logje check aub

[pitbull.spikey]

Hey hallo kan iemand even dit logje chekken want nadat ik de windows live messenger heb geinstald zijn de problemen met popups begonnen kan ook toeval zijn natuurlijk alvast bedankt
Logfile of HijackThis v1.99.1
Scan saved at 0:25:48, on 26/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\cidaemon.exe
C:\Program Files\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\RunServices: [ScanReg] C:\WINDOWS\WSCRIPT.EXE C:\WINDOWS\system32\SCANREG.VBS
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe"
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
O8 - Extra context menu item: &MyToolBar Search - res://C:\Program Files\ToolBar888\MyToolBar.dll/MENUSEARCH.HTM
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Start EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\Program Files\My Screen Cam\easywebcam.exe (file missing)
O9 - Extra 'Tools' menuitem: &EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\Program Files\My Screen Cam\easywebcam.exe (file missing)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1145386761734
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europ...vex/hcImpl.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemp...ogin-devel.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/1/sux.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\o6840glqe6qe0.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Unknown owner - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe (file missing)

[jurgenv]

Download Look2Me-Destroyer.exe naar je bureaublad.

• Sluit alle open venster.
• Dubbelklik Look2Me-Destroyer.exe om het te starten.
• Zet een vinkje naast Run this program as a task.
• Je zal een melding krijgen met: 'Look2Me-Destroyer will close and re-open in approximately 10 seconds'. Klik OK
• Wanneer Look2Me-Remover opnieuw opent, Klik de Scan for L2M knop.
• Je bureaublad icoontjes en taakbalk zullen verdwijnen, dit is normaal.
• Eénmaal gedaan met scannen, klik de Remove L2M knop.
• Je zal de boodschap Done Scanning krijgen, klik OK.
• Nadien zal je volgende melding krijgen: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klik OK.
• Je computer zal dan afsluiten.
• Start je computer opnieuw op.
• Post de inhoud van C:\Look2Me-Destroyer.txt samen met een nieuw hijackthislogje.

Indien je een alert krijgt van je firewall dat dit programma probeert toegang te krijgen met het internet, sta het toe en blokkeer het niet!

Indien je een runtime error '339' krijgt, download MSWINSCK.OCX via onderstaande link en plaats het in je C:\Windows\System32 map.
http://www.ascentive.com/support/new...b/MSWINSCK.OCX

[pitbull.spikey]

Logfile of HijackThis v1.99.1
Scan saved at 13:20:28, on 26/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Telemeter 3.0\telemeter3.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\SYSTEM32\cidaemon.exe
C:\Program Files\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Telemeter 3.0] "C:\Program Files\Telemeter 3.0\telemeter3.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [ScanReg] C:\WINDOWS\WSCRIPT.EXE C:\WINDOWS\system32\SCANREG.VBS
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~3\Ad-Watch.exe"
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
O8 - Extra context menu item: &MyToolBar Search - res://C:\Program Files\ToolBar888\MyToolBar.dll/MENUSEARCH.HTM
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Start EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\Program Files\My Screen Cam\easywebcam.exe (file missing)
O9 - Extra 'Tools' menuitem: &EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\Program Files\My Screen Cam\easywebcam.exe (file missing)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1145386761734
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemp...ogin-devel.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/1/sux.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Unknown owner - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe (file missing)




Look2Me-Destroyer V1.0.12
Scanning for infected files.....
Scan started at 26/06/2006 12:39:25
Infected! C:\WINDOWS\system32\ktj2l71o1.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP199\A0089294.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP199\A0089297.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP200\A0089311.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP201\A0089426.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP203\A0090559.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP203\A0090593.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP207\A0090650.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP208\A0090709.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP208\A0090714.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091781.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091782.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091786.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091787.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091865.dll
Infected! C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091889.dll
Infected! C:\WINDOWS\system32\c2000cdmef0a0.dll
Infected! C:\WINDOWS\system32\gwtuname.dll
Infected! C:\WINDOWS\system32\j24o0ch3ef4.dll
Infected! C:\WINDOWS\system32\ktj2l71o1.dll
Infected! C:\WINDOWS\system32\lv0009dme.dll
Infected! C:\WINDOWS\system32\o6840glqe6qe0.dll
Infected! C:\WINDOWS\system32\oW840glqe6qe0.dll
Attempting to delete infected files...
Attempting to delete: C:\WINDOWS\system32\ktj2l71o1.dll
C:\WINDOWS\system32\ktj2l71o1.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP199\A0089294.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP199\A0089294.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP199\A0089297.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP199\A0089297.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP200\A0089311.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP200\A0089311.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP201\A0089426.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP201\A0089426.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP203\A0090559.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP203\A0090559.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP203\A0090593.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP203\A0090593.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP207\A0090650.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP207\A0090650.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP208\A0090709.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP208\A0090709.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP208\A0090714.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP208\A0090714.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091781.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091781.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091782.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091782.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091786.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091786.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091787.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091787.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091865.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091865.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091889.dll
C:\System Volume Information\_restore{D3942838-562C-4851-9FF1-DA082EF670B6}\RP210\A0091889.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\c2000cdmef0a0.dll
C:\WINDOWS\system32\c2000cdmef0a0.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\gwtuname.dll
C:\WINDOWS\system32\gwtuname.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\j24o0ch3ef4.dll
C:\WINDOWS\system32\j24o0ch3ef4.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\ktj2l71o1.dll
C:\WINDOWS\system32\ktj2l71o1.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\lv0009dme.dll
C:\WINDOWS\system32\lv0009dme.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\o6840glqe6qe0.dll
C:\WINDOWS\system32\o6840glqe6qe0.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\oW840glqe6qe0.dll
C:\WINDOWS\system32\oW840glqe6qe0.dll Deleted successfully!
Making registry repairs.
Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\URL
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved "{A68BE54C-12F4-4DC8-9C64-0085E7245607}"
HKCR\Clsid\{A68BE54C-12F4-4DC8-9C64-0085E7245607}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved "{86247692-8954-4BEF-B682-612B78F44211}"
HKCR\Clsid\{86247692-8954-4BEF-B682-612B78F44211}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved "{3FC4C6E2-B990-49E0-8203-1E97AF81B30B}"
HKCR\Clsid\{3FC4C6E2-B990-49E0-8203-1E97AF81B30B}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved "{F2DF2101-F7ED-4ED9-9CF1-AF2B38383B60}"
HKCR\Clsid\{F2DF2101-F7ED-4ED9-9CF1-AF2B38383B60}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved "{94023494-0C43-4CB8-87A8-2140F9B77C68}"
HKCR\Clsid\{94023494-0C43-4CB8-87A8-2140F9B77C68}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved "{AC0A8EB5-A43C-40E0-B2BF-8A41AAB5EE29}"
HKCR\Clsid\{AC0A8EB5-A43C-40E0-B2BF-8A41AAB5EE29}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved "{A83F16F4-A9A0-4426-AAC5-6001FB4079BE}"
HKCR\Clsid\{A83F16F4-A9A0-4426-AAC5-6001FB4079BE}
Restoring Windows certificates.
Replaced hosts file with default windows hosts file

Restoring SeDebugPrivilege for Administrators - Succeeded

[jurgenv]

Ziet er goed uit, hoe werkt alles verder?

[pitbull.spikey]

Ziet er goed uit, hoe werkt alles verder?

Wel als ik de problemen had heb ik dan even de anti spyware van zonealarm geinstaleerd en deze deed wat moeilijk maar na een uninstall doet voorlopig alles het terug ok vriendelijk bedankt voor je hulp jurgen

[jurgenv]

Graag gedaan.

Dit gaat dan op slot.