Archief - kan in taakbeheer niets afsluiten van systeem + popups explorer en firefox

kan iemand mij helpen ?
heb gisteren op een verkeerde site crackje gedownlowd en boem patat
vroeger kreeg ik ze er altijd goed van maar nu lukt het niet
met ad aware komen ze altijd terug en met spyware doctor heb ik er ook elke keer teug over de 100..

aub

ogfile of HijackThis v1.99.1
Scan saved at 17:59:14, on 14-11-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\drivers\CDAC11BA.EXE
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Program Files\NetLimiter 2 Pro\nlsvc.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Spyware Doctor\sdhelp.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\NetLimiter 2 Pro\NLClient.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\MessengerPlus! 3\MsgPlus.exe
D:\Program Files\ASUS\Probe\AsusProb.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\Globe Software\StatBar\StatBar.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Program Files\Spyware Doctor\swdoctor.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Winamp\winamp.exe
D:\Documents and Settings\- TheOx -\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ASUS Probe] d:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] D:\Program Files\Corel\Corel Graphics 12\Languages\NL\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=100909 serial=dr12wex-1504397-kty lang=NL
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVMixerTray] "D:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [StatBar] D:\Program Files\Globe Software\StatBar\StatBar.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: MrBpoker Poker - {0932285F-432B-42b0-B960-7946B1950802} - D:\Program Files\MrBookmakerMPP\MPPoker.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - D:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - D:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: ShellScrap - D:\WINDOWS\system32\jt6207joe.dll
O21 - SSODL: SysTray.Exys - {7368D5FC-6F5C-4f5b-B964-E67214F67852} - D:\WINDOWS\system32\olpkodgc.dll
O21 - SSODL: SysTray.Excn2 - {1722ECFF-4356-4f5b-B534-E67294FE75E9} - (no file)
O21 - SSODL: SysTray.Exsn - {2368D1FC-2F5C-4f1b-B124-E67214FC78E2} - D:\WINDOWS\system32\eknjbcpc.dll
O21 - SSODL: SysTray.Exgl - {636821FC-6F5C-2f1b-B164-E67214F678E2} - D:\WINDOWS\system32\gahkfkim.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - D:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - D:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - D:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcSandraSrv.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - D:\Program Files\Spyware Doctor\sdhelp.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O9 - Extra button: MrBpoker Poker - {0932285F-432B-42b0-B960-7946B1950802} - D:\Program Files\MrBookmakerMPP\MPPoker.exe
O20 - Winlogon Notify: ShellScrap - D:\WINDOWS\system32\jt6207joe.dll
O21 - SSODL: SysTray.Exys - {7368D5FC-6F5C-4f5b-B964-E67214F67852} - D:\WINDOWS\system32\olpkodgc.dll
O21 - SSODL: SysTray.Excn2 - {1722ECFF-4356-4f5b-B534-E67294FE75E9} - (no file)
O21 - SSODL: SysTray.Exsn - {2368D1FC-2F5C-4f1b-B124-E67214FC78E2} - D:\WINDOWS\system32\eknjbcpc.dll
O21 - SSODL: SysTray.Exgl - {636821FC-6F5C-2f1b-B164-E67214F678E2} - D:\WINDOWS\system32\gahkfkim.dll
O23 - Service: Adobe Version Cue CS2 - Unknown owner - D:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)


gekend?
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - D:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - D:\PROGRA~1\BT2Net\BT2PLU~1.DLL

gekend?
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - D:\PROGRA~1\BT2Net\BT2PLU~1.DLL
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - D:\PROGRA~1\BT2Net\BT2PLU~1.DLL

ja is programa voor te downlowden dat ik al 6 maanden heb ofzo

ik gaa direct die lijnen verwijderen ty

ik heb nog steeds die popups

van explorer

maar in taakbalk staat het niet aleen op scherm zelf ( ook raar )

Logfile of HijackThis v1.99.1
Scan saved at 22:20:26, on 14-11-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Program Files\NetLimiter 2 Pro\nlsvc.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Spyware Doctor\sdhelp.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\NetLimiter 2 Pro\NLClient.exe
D:\Program Files\MessengerPlus! 3\MsgPlus.exe
D:\Program Files\ASUS\Probe\AsusProb.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Spyware Doctor\swdoctor.exe
D:\Program Files\Globe Software\StatBar\StatBar.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\- TheOx -\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ASUS Probe] d:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] D:\Program Files\Corel\Corel Graphics 12\Languages\NL\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=100909 serial=dr12wex-1504397-kty lang=NL
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVMixerTray] "D:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [StatBar] D:\Program Files\Globe Software\StatBar\StatBar.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: Nls - D:\WINDOWS\system32\r0r60a9sed.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - D:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcSandraSrv.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - D:\Program Files\Spyware Doctor\sdhelp.exe

* ga naar start==>configuratiescherm==>softwre en de-installeer:
StatBar

* open hijackthis en vink volgende regels aan indien aanwezig:

O4 - HKCU\..\Run: [StatBar] D:\Program Files\Globe Software\StatBar\StatBar.exe

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* verwijder volgende map indien anwezig:

D:\Program Files\Globe Software

* Download de trial versie van Spy Sweeper Hier

en installeer het via de 'standaard installatie'. (er word gevraagd om je e-mail adres, je kan deze gerust geven )

er zal u gevraagd worden om de nieuwste defenitie's van spysweeper te installeren, doe dit ook
(dit kan enkele minuten duren)

klik dan op Options > Sweep Options en vink aan: Sweep all Folders on Selected drives. en Local Disc C. onder What to Sweep, vink je alles aan

klik op Sweep en laat het je systeem volledig scannen

wanneer het scannen gedaan is, klik dan op Remove. en daarna op Select All en daarna Next

bij 'Results', ga naar Session Log tabblad. klik dan op Save to File en bewaar de log waar je het gemakkelijk terugvind
Exit Spy Sweeper.

kopieer en plak dan de log hier als je volgend antwoord met een nieuw hijackthis log

merci tot nu toe al geen popups meer

ik had bij spy sweaper 6 files die critical zijn

nu doet hij The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com dit niet meer dat was het probleem


********
17:43: | Start of Session, dinsdag 15 november 2005 |
17:43: Spy Sweeper started
17:43: Sweep initiated using definitions version 573
17:43: Starting Memory Sweep
17:43: Found Adware: icannnews
17:43: Detected running threat: D:\WINDOWS\system32\dFdim.dll (ID = 83)
17:43: Found Trojan Horse: trojan-backdoor-superbgirlz
17:43: Detected running threat: D:\WINDOWS\system32\child.dll (ID = 183971)
17:43: Detected running threat: D:\WINDOWS\system32\dnro0193e.dll (ID = 83)
17:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:44: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:44: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:44: Memory Sweep Complete, Elapsed Time: 00:01:37
17:44: Starting Registry Sweep
17:45: Found Trojan Horse: trojan-backdoor-zubox
17:45: HKCR\*\shellex\contextmenuhandlers\sysacpildap\ (1 subtraces) (ID = 484093)
17:45: HKLM\software\classes\*\shellex\contextmenuhandlers\sysacpildap\ (1 subtraces) (ID = 484152)
17:45: HKU\S-1-5-21-1275210071-1454471165-839522115-1003\software\classes\clsid\{4f141cba-1457-6cca-03a7-7aa21b61ea0f}\ (3 subtraces) (ID = 954563)
17:45: Registry Sweep Complete, Elapsed Time:00:00:10
17:45: Starting Cookie Sweep
17:45: Found Spy Cookie: yieldmanager cookie
17:45: - theox [email protected][2].txt (ID = 3751)
17:45: Found Spy Cookie: adultfriendfinder cookie
17:45: - theox -@adultfriendfinder[1].txt (ID = 2165)
17:45: Found Spy Cookie: fe.lea.lycos.com cookie
17:45: - theox [email protected][2].txt (ID = 2660)
17:45: Found Spy Cookie: screensavers.com cookie
17:45: - theox [email protected][1].txt (ID = 3298)
17:45: - theox [email protected][1].txt (ID = 3298)
17:45: Cookie Sweep Complete, Elapsed Time: 00:00:00
17:45: Starting File Sweep
17:45: Found Adware: spysheriff
17:45: secure32.html (ID = 184319)
17:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:45: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:45: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:46: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:46: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:47: Found Trojan Horse: trojan-backdoor-us15info
17:47: toolbar[1].txt (ID = 183857)
17:47: toolbar.exe (ID = 183857)
17:47: tool1[1].txt (ID = 149671)
17:47: secure32.html (ID = 184319)
17:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:47: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:47: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:48: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:48: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:48: Found Trojan Horse: spamrelayer_alpiok
17:48: deebnnli.exe (ID = 183253)
17:48: edaepiji.exe (ID = 184296)
17:48: ms1[1].txt (ID = 183512)
17:48: ms1.exe (ID = 183512)
17:48: inst_cn2x[1].exe (ID = 183253)
17:48: blink[1].exe (ID = 184296)
17:48: child[1].exe (ID = 183963)
17:48: Found Adware: command
17:48: mte3ndi6odoxng[1].exe (ID = 185985)
17:49: mte3ndi6odoxng[1].exe (ID = 185985)
17:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:49: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:49: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:50: eknjbcpc.dll (ID = 183982)
17:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:50: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:50: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:50: eopcmcpg.dll (ID = 182718)
17:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:51: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:51: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:52: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:52: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:52: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:52: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:52: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:52: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:52: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:52: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:53: 24.tmp (ID = 183963)
17:53: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:53: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:53: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:53: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:54: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:54: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:55: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:55: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:55: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:55: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:56: child.dll (ID = 183971)
17:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:56: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:56: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:57: Found Adware: webhancer
17:57: wh.exe (ID = 156803)
17:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:57: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:57: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:58: installer[1].exe (ID = 185986)
17:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:58: Found Adware: tibs dialer
17:58: xxx.lnk (ID = 79520)
17:58: Found Adware: instant access
17:58: prohome[1].htm (ID = 63853)
17:58: p315na0.vbs (ID = 185675)
17:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:58: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:58: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:59: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:59: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:00: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:00: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:01: File Sweep Complete, Elapsed Time: 00:16:46
18:01: Full Sweep has completed. Elapsed time 00:18:37
18:01: Traces Found: 39
18:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:02: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:02: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:02: Removal process initiated
18:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:04: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
18:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:04: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
18:04: Quarantining All Traces: icannnews
18:04: icannnews is in use. It will be removed on reboot.
18:04: D:\WINDOWS\system32\dFdim.dll is in use. It will be removed on reboot.
18:04: D:\WINDOWS\system32\dnro0193e.dll is in use. It will be removed on reboot.
18:04: Quarantining All Traces: spamrelayer_alpiok
18:04: Quarantining All Traces: spysheriff
18:04: Quarantining All Traces: trojan-backdoor-us15info
18:04: Quarantining All Traces: trojan-backdoor-zubox
18:04: Quarantining All Traces: tibs dialer
18:04: Quarantining All Traces: trojan-backdoor-superbgirlz
18:04: trojan-backdoor-superbgirlz is in use. It will be removed on reboot.
18:04: child.dll is in use. It will be removed on reboot.
18:04: Quarantining All Traces: command
18:04: Quarantining All Traces: instant access
18:04: Quarantining All Traces: webhancer
18:04: Quarantining All Traces: adultfriendfinder cookie
18:04: Quarantining All Traces: fe.lea.lycos.com cookie
18:04: Quarantining All Traces: screensavers.com cookie
18:04: Quarantining All Traces: yieldmanager cookie
18:04: Warning: Launched explorer.exe
18:04: Warning: Quarantine process could not restart Explorer.
18:05: Preparing to restart your computer. Please wait...
18:05: Removal process completed. Elapsed time 00:02:24
********
17:42: | Start of Session, dinsdag 15 november 2005 |
17:42: Spy Sweeper started
17:42: Sweep initiated using definitions version 573
17:42: Starting Memory Sweep
17:42: Sweep Canceled
17:42: Memory Sweep Complete, Elapsed Time: 00:00:04
17:42: Traces Found: 0
17:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:42: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:42: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:43: | End of Session, dinsdag 15 november 2005 |
********
17:41: | Start of Session, dinsdag 15 november 2005 |
17:41: Spy Sweeper started
17:41: Your spyware definitions have been updated.
17:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:41: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
17:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:41: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
17:41: Updating spyware definitions
17:41: Your definitions are up to date.
17:42: | End of Session, dinsdag 15 november 2005 |


Logfile of HijackThis v1.99.1
Scan saved at 18:14:47, on 15-11-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Program Files\NetLimiter 2 Pro\nlsvc.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Spyware Doctor\sdhelp.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
D:\Program Files\MessengerPlus! 3\MsgPlus.exe
D:\Program Files\ASUS\Probe\AsusProb.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\NetLimiter 2 Pro\NLClient.exe
D:\Program Files\Globe Software\StatBar\StatBar.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\- TheOx -\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ASUS Probe] d:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] D:\Program Files\Corel\Corel Graphics 12\Languages\NL\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=100909 serial=dr12wex-1504397-kty lang=NL
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVMixerTray] "D:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [StatBar] D:\Program Files\Globe Software\StatBar\StatBar.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - D:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcSandraSrv.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - D:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

de-installeer volgende prog via start==>configuratiescherm==>softwrae:
statbar

* open hijackthis en vink volgende regel aan indien aanwezig:

O4 - HKCU\..\Run: [StatBar] D:\Program Files\Globe Software\StatBar\StatBar.exe

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* verwijder volgende map indien aanwezig:

D:\Program Files\Globe Software

* herstart je pc en post eenn nieuw hijackthis logje hier