HiJackThis=Guido2442

[Anoniem2]

Hallo ik ben een niet erg goed met het verwijderen van virussen,malware ed, maar heb nu last van een serieus probleem, namelijk dat zo nu en dan ik mailtjes verstuur aan mijn gehele contactenlijst waar ik geen weet van heb! Deze mailtjes bestaat uit een tekst als deze: \r\n\r\n[I]Hi,\r\n\r\nHow are you doing these days? \r\nA few days ago, I came across a good shopping website. \r\nIt is amazing that the products have competitive price and high-quality. \r\nI have bought some items from this site, and i am very satisfied with their items and services. \r\nIf you have any question please contact with the online servicers you will have a good reply.\r\nSo do have a look at this web page : cheapele.com \r\nI hope it will give you some help.\r\n\r\nYours,[/I]\r\n\r\nErg vervelend, dus en mensen die er eventueel op klikken zullen wel hetzelfde krijgen. \r\nWeet iemand hoe ik hier vanaf kom en of het uberhaubt in mijn laptop zit of ergens anders? Daarom heb voor de zekerheid een logfile van HiJackThis erbij gedaan.\r\nAlvast bedankt voor het (in)lezen en reageren!\r\n\r\nLogfile:\r\n\r\nLogfile of Trend Micro HijackThis v2.0.3 (BETA)\r\nScan saved at 9:08:53, on 9-3-2010\r\nPlatform: Windows Vista SP2 (WinNT 6.00.1906)\r\nMSIE: Internet Explorer v8.00 (8.00.6001.18882)\r\nBoot mode: Normal\r\n\r\nRunning processes:\r\nC:\\Windows\\system32\\taskeng.exe\r\nC:\\Windows\\Explorer.EXE\r\nC:\\Program Files\\Windows Defender\\MSASCui.exe\r\nC:\\Windows\\System32\\igfxtray.exe\r\nC:\\Windows\\System32\\hkcmd.exe\r\nC:\\Windows\\System32\\igfxpers.exe\r\nC:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe\r\nC:\\Windows\\system32\\igfxsrvc.exe\r\nC:\\Program Files\\Hewlett-Packard\\HP Wireless Assistant\\HPWAMain.exe\r\nC:\\Program Files\\Hewlett-Packard\\HP Wireless Assistant\\WiFiMsg.exe\r\nC:\\Program Files\\Eset\\nod32kui.exe\r\nC:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\r\nC:\\Program Files\\Hp\\HP Software Update\\hpwuSchd2.exe\r\nC:\\Program Files\\Lavasoft\\Ad-Aware\\AAWTray.exe\r\nC:\\Program Files\\UsbBoost\\TurboHddUsb.exe\r\nC:\\Windows\\WindowsMobile\\wmdc.exe\r\nC:\\Program Files\\Java\\jre6\\bin\\jusched.exe\r\nC:\\Program Files\\iTunes\\iTunesHelper.exe\r\nC:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\r\nC:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe\r\nC:\\Program Files\\Windows Media Player\\wmpnscfg.exe\r\nC:\\Program Files\\Taskbar Shuffle\\taskbarshuffle.exe\r\nC:\\Program Files\\Samsung\\Samsung New PC Studio\\NPSAgent.exe\r\nC:\\Program Files\\Steam\\Steam.exe\r\nC:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe\r\nC:\\Program Files\\Hewlett-Packard\\Shared\\HpqToaster.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Program Files\\Synaptics\\SynTP\\SynTPHelper.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Update\\1.2.183.17\\GoogleCrashHandler.exe\r\nC:\\Program Files\\HP\\Digital Imaging\\bin\\hpqSTE08.exe\r\nC:\\Program Files\\HP\\Digital Imaging\\bin\\hpqbam08.exe\r\nC:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Program Files\\iTunes\\iTunes.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Users\\Guido\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\r\nC:\\Program Files\\TrendMicro\\HiJackThis\\HiJackThis.exe\r\n\r\nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = [url]http://www.plusnetwork.com[/url]\r\nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = [url]http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_NL&c=74&bd=smb&pf=laptop[/url]\r\nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]\r\nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]\r\nR0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = [url]http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=NL_NL&c=74&bd=smb&pf=laptop[/url]\r\nR0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Search,SearchAssistant = \r\nR0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Search,CustomizeSearch = \r\nR1 - HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,ProxyOverride = *.local\r\nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = \r\nO1 - Hosts: ::1 localhost\r\nO3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\\Program Files\\AOL\\AOL Toolbar 5.0\\aoltb.dll (file missing)\r\nO4 - HKLM\\..\\Run: [Windows Defender] %ProgramFiles%\\Windows Defender\\MSASCui.exe -hide\r\nO4 - HKLM\\..\\Run: [IgfxTray] C:\\Windows\\system32\\igfxtray.exe\r\nO4 - HKLM\\..\\Run: [HotKeysCmds] C:\\Windows\\system32\\hkcmd.exe\r\nO4 - HKLM\\..\\Run: [Persistence] C:\\Windows\\system32\\igfxpers.exe\r\nO4 - HKLM\\..\\Run: [SynTPEnh] C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe\r\nO4 - HKLM\\..\\Run: [hpWirelessAssistant] %ProgramFiles%\\Hewlett-Packard\\HP Wireless Assistant\\HPWAMain.exe\r\nO4 - HKLM\\..\\Run: [WAWifiMessage] %ProgramFiles%\\Hewlett-Packard\\HP Wireless Assistant\\WiFiMsg.exe\r\nO4 - HKLM\\..\\Run: [HP Health Check Scheduler] c:\\Program Files\\Hewlett-Packard\\HP Health Check\\HPHC_Scheduler.exe\r\nO4 - HKLM\\..\\Run: [nod32kui] \"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE\r\nO4 - HKLM\\..\\Run: [GrooveMonitor] \"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\"\r\nO4 - HKLM\\..\\Run: [HP Software Update] C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe\r\nO4 - HKLM\\..\\Run: [Ad-Watch] C:\\Program Files\\Lavasoft\\Ad-Aware\\AAWTray.exe\r\nO4 - HKLM\\..\\Run: [UsbBoost] C:\\Program Files\\UsbBoost\\TurboHddUsb.exe\r\nO4 - HKLM\\..\\Run: [Windows Mobile Device Center] %windir%\\WindowsMobile\\wmdc.exe\r\nO4 - HKLM\\..\\Run: [Windows Mobile-based device management] %windir%\\WindowsMobile\\wmdSync.exe\r\nO4 - HKLM\\..\\Run: [QuickTime Task] \"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime\r\nO4 - HKLM\\..\\Run: [SunJavaUpdateSched] \"C:\\Program Files\\Java\\jre6\\bin\\jusched.exe\"\r\nO4 - HKLM\\..\\Run: [Adobe Reader Speed Launcher] \"C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\"\r\nO4 - HKLM\\..\\Run: [Adobe ARM] \"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\"\r\nO4 - HKLM\\..\\Run: [hpqSRMon] C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqSRMon.exe\r\nO4 - HKLM\\..\\Run: [iTunesHelper] \"C:\\Program Files\\iTunes\\iTunesHelper.exe\"\r\nO4 - HKLM\\..\\Run: [RemoteControl] \"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"\r\nO4 - HKLM\\..\\Run: [LanguageShortcut] \"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\"\r\nO4 - HKCU\\..\\Run: [MsnMsgr] \"C:\\Program Files\\Windows Live\\Messenger\\MsnMsgr.Exe\" /background\r\nO4 - HKCU\\..\\Run: [Taskbar Shuffle] C:\\Program Files\\Taskbar Shuffle\\taskbarshuffle.exe\r\nO4 - HKCU\\..\\Run: [Google Update] \"C:\\Users\\Guido\\AppData\\Local\\Google\\Update\\GoogleUpdate.exe\" /c\r\nO4 - HKCU\\..\\Run: [AutoStartNPSAgent] C:\\Program Files\\Samsung\\Samsung New PC Studio\\NPSAgent.exe\r\nO4 - HKCU\\..\\Run: [Steam] \"C:\\Program Files\\Steam\\Steam.exe\" -silent\r\nO4 - HKUS\\S-1-5-19\\..\\Run: [Sidebar] %ProgramFiles%\\Windows Sidebar\\Sidebar.exe /detectMem (User \'LOCAL SERVICE\')\r\nO4 - HKUS\\S-1-5-19\\..\\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User \'LOCAL SERVICE\')\r\nO4 - HKUS\\S-1-5-20\\..\\Run: [Sidebar] %ProgramFiles%\\Windows Sidebar\\Sidebar.exe /detectMem (User \'NETWORK SERVICE\')\r\nO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe\r\nO8 - Extra context menu item: &AOL-werkbalk Search - c:\\program files\\aol\\aol toolbar 5.0\\resources\\nl-NL\\local\\search.html\r\nO8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\\Windows\\system32\\GPhotos.scr/200\r\nO8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\\PROGRA~1\\MICROS~2\\Office12\\EXCEL.EXE/3000\r\nO9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\\PROGRA~1\\MICROS~2\\Office12\\ONBttnIE.dll\r\nO9 - Extra \'Tools\' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\\PROGRA~1\\MICROS~2\\Office12\\ONBttnIE.dll\r\nO9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)\r\nO9 - Extra button: @C:\\Windows\\WindowsMobile\\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\\Windows\\WindowsMobile\\INetRepl.dll\r\nO9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\\Windows\\WindowsMobile\\INetRepl.dll\r\nO9 - Extra \'Tools\' menuitem: @C:\\Windows\\WindowsMobile\\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\\Windows\\WindowsMobile\\INetRepl.dll\r\nO9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\\Program Files\\AOL\\AOL Toolbar 5.0\\aoltb.dll (file missing)\r\nO9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\\Program Files\\PokerStars\\PokerStarsUpdate.exe\r\nO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\\PROGRA~1\\MICROS~2\\Office12\\REFIEBAR.DLL\r\nO9 - Extra button: HP Slim selecteren - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\hpswp_BHO.dll (file missing)\r\nO13 - Gopher Prefix: \r\nO15 - Trusted Zone: login.live.com\r\nO15 - Trusted Zone: live.xbox.com\r\nO16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Youda%20Marina/Images/stg_drm.ocx\r\nO16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Youda%20Marina/Images/armhelper.ocx\r\nO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\\Program Files\\Microsoft Office\\Office12\\GrooveSystemServices.dll\r\nO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\\PROGRA~1\\COMMON~1\\Skype\\SKYPE4~1.DLL\r\nO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\\Windows\\system32\\browseui.dll\r\nO23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe\r\nO23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\\Program Files\\Bonjour\\mDNSResponder.exe\r\nO23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\\Program Files\\Hewlett-Packard\\HP Quick Launch Buttons\\Com4Qlb.exe\r\nO23 - Service: FsUsbExService - Teruten - C:\\Windows\\system32\\FsUsbExService.Exe\r\nO23 - Service: Google Update Service (gupdate1c994db16524990) (gupdate1c994db16524990) - Google Inc. - C:\\Program Files\\Google\\Update\\GoogleUpdate.exe\r\nO23 - Service: Google Updater Service (gusvc) - Google - C:\\Program Files\\Google\\Common\\Google Updater\\GoogleUpdaterService.exe\r\nO23 - Service: HP Health Check Service - Hewlett-Packard - c:\\Program Files\\Hewlett-Packard\\HP Health Check\\hphc_service.exe\r\nO23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\\Program Files\\Hewlett-Packard\\Shared\\hpqWmiEx.exe\r\nO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\\Program Files\\Common Files\\InstallShield\\Driver\\1050\\Intel 32\\IDriverT.exe\r\nO23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\\Program Files\\iPod\\bin\\iPodService.exe\r\nO23 - Service: IviRegMgr - InterVideo - C:\\Program Files\\Common Files\\InterVideo\\RegMgr\\iviRegMgr.exe\r\nO23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\\Program Files\\Lavasoft\\Ad-Aware\\AAWService.exe\r\nO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\\Program Files\\Eset\\nod32krn.exe\r\nO23 - Service: PnkBstrA - Unknown owner - C:\\Windows\\system32\\PnkBstrA.exe\r\nO23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\\Program Files\\CyberLink\\Shared files\\RichVideo.exe\r\nO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\\Program Files\\Spyware Doctor\\pctsAuxs.exe\r\nO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\\Program Files\\Spyware Doctor\\pctsSvc.exe\r\nO23 - Service: ServiceLayer - Nokia. - C:\\Program Files\\PC Connectivity Solution\\ServiceLayer.exe\r\nO23 - Service: Steam Client Service - Valve Corporation - C:\\Program Files\\Common Files\\Steam\\SteamService.exe\r\nO23 - Service: stllssvr - MicroVision Development, Inc. - c:\\Program Files\\Common Files\\SureThing Shared\\stllssvr.exe\r\nO23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeper.exe\r\nO23 - Service: XAudioService - Conexant Systems, Inc. - C:\\Windows\\system32\\DRIVERS\\xaudio.exe\r\n\r\n--\r\nEnd of file - 11733 bytes

[Anoniem2]

[b]Schakel tijdelijk Windows Defender uit[/b]\r\nWant deze kan voor stoorzender spelen bij het fixen met HJT (de fix terug ongedaan maken)\r\n* Open Windows Defender > Klik [b]Tools[/b]\r\n* Klik [b]\"General Settings\"[/b] of [b]Options[/b]\r\n* Scroll naar [b]\"Real Time Protection Options\"[/b]\r\n* Haal het vinkje weg bij [b]\"Turn on Real Time Protection (recommended)\"[/b] > Klik [b]\"Save\"[/b]\r\n* Sluit Windows Defender\r\n(als de problemen over zijn, logje weer schoon verklaard is, kan je \'m weer aanzetten)\r\n\r\n\r\nKlik met de rechtermuis op het programma Hijackthis en kies voor \"Uitvoeren als Administrator\"\r\nKies voor \'Do a system scan only\'\r\nSelecteer alleen de items die hieronder zijn genoemd:\r\n[b]\r\nR0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Search,SearchAssistant =\r\nR0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Search,CustomizeSearch =\r\nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName =\r\nO9 - Extra button: HP Slim selecteren - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\\Program Files\\HP\\Digital Imaging\\Smart Web Printing\\hpswp_BHO.dll (file missing)\r\n[/b]\r\nKlik op \'Fix checked\' om de items te verwijderen.\r\n\r\n\r\nDownload [url=http://www.besttechie.net/tools/mbam-setup.exe][b][color=red]MalwareBytes\' Anti-Malware[/color][/b][/url] en sla het op je bureaublad op.\r\nDubbelklik op [b]mbam-setup.exe[/b] om het programma te installeren.\r\n\r\nZorg dat er na de installatie een vinkje is geplaatst bij:[list]\r\n[*]Update MalwareBytes\' Anti-Malware\r\n[*]Start MalwareBytes\' Anti-Malware\r\n[/list]Klik daarna op \"[b]Voltooien[/b]\".\r\nIndien een update gevonden wordt, zal die gedownload en geïnstalleerd worden.[list]\r\n[*]Zodra het programma gestart is, ga dan naar het tabblad \"[b]Instellingen[/b]\".\r\n[*]Vink hier aan: \"[b]Sluit Internet Explorer tijdens verwijdering van malware[/b]\".\r\n[*]Ga daarna naar het tabblad \"[b]Scanner[/b]\", kies hier voor \"[b]Snelle Scan[/b]\".\r\n[*]Druk vervolgens op \"[b]Scannen[/b]\" om de scan te starten.\r\n[*]Het scannen kan een tijdje duren, dus wees geduldig.\r\n\r\n[*]Wanneer de scan voltooid is, klik op [b]OK[/b], daarna \"[b]Bekijk Resultaten[/b]\" om de resultaten te zien.\r\n[*]Zorg ervoor dat daar alles aangevinkt is, daarna klik op: \"[b]Verwijder geselecteerde[/b]\".\r\n[*]Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten.\r\n[/list]Het log wordt automatisch bewaard door MalwareBytes\' Anti-Malware en kan je terugvinden door op de \"[b]Logs[/b]\" tab te klikken in het programma.\r\n\r\nPlaats dit logje samen met een nieuw logje van HijackThis.\r\n\r\nStart hijackthis opnieuw en maak een nieuw HijackThis logje, let wel op want\r\nje moet HijackThis als [b]Administrator[/b] uitvoeren en dan de nieuwe log posten.\r\nIndien je het niet als administrator uitvoert, wordt de oude log niet overschreven.