Mijn PC is "plots" traag geworden en ik wordt er gek van……Ik heb hieronder mijn HJT Logje gepost. Ik hoop dat iemand kan helpen.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:47:26, on 20-7-2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
F:\Security\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
F:\Security\Avira\AntiVir Desktop\avgnt.exe
F:\Security\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
F:\Security\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
F:\Security\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Remco Peters\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Remco Peters\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Remco Peters\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
F:\Security\HijackThis\Trend Micro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Remco Peters\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SSOIEAddonBHO - {DA5BCE70-D057-4D63-943D-5F3927EC59F1} - F:\Programma's\FastAccess (webcam C510)\FAIESSO.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avgnt] "F:\Security\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Security\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - F:\Games\Pokerstars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Performer Optimum - http://img.livejasmin.com/performeroptimum/new/performer_optimum.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1291748457338
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: FastAccess - F:\Programma's\FastAccess (webcam C510)\FALogNot.dll
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - F:\Security\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - F:\Security\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 6866 bytes

Hoi remco, laten we eerst controleren of Windows "gezond" is.

[u:c2140fdb73][b:c2140fdb73]Rapport Microsoft Safety Scan[/b:c2140fdb73][/u:c2140fdb73]

Deze heeft niets opgeleverd met snelle scan. Er werden geen virussen, spy-ware of ongewenste software gevonden.

[u:c2140fdb73][b:c2140fdb73]Malwarebytes MBAM[/b:c2140fdb73][/u:c2140fdb73]

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Databaseversie: 7213

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

20-7-2011 20:57:44
mbam-log-2011-07-20 (20-57-44).txt

Scantype: Snelle scan
Objecten gescand: 163415
Verstreken tijd: 3 minuut/minuten, 25 seconde(n)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 0
Registerwaarden geïnfecteerd: 0
Registerdata geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 0

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registersleutels geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Registerdata geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Mappen geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Bestanden geïnfecteerd:
(Geen kwaadaardige objecten gedetecteerd)

Oké, een laatste test:

[b:bedf048460]Doe de ESET online scan (Klik).[/b:bedf048460]
[list:bedf048460]
[*:bedf048460]Klik op de knop [b:bedf048460]ESET Online Scanner[/b:bedf048460]
[*:bedf048460]Zet een vinkje bij [b:bedf048460]YES, I accept the Terms of Use[/b:bedf048460]
[*:bedf048460]Klik op [b:bedf048460]Start[/b:bedf048460]
[*:bedf048460]Sta het ActiveX control toe om te installeren.
[*:bedf048460]Klik op [b:bedf048460]"Advanced settings"[/b:bedf048460]
[*:bedf048460]Zet een vinkje bij de volgende opties:
[list:bedf048460][*:bedf048460][b:bedf048460]Remove found threats[/b:bedf048460]
[*:bedf048460][b:bedf048460]Scan archives[/b:bedf048460]
[*:bedf048460][b:bedf048460]Scan for potentially unwanted applications[/b:bedf048460]
[*:bedf048460][b:bedf048460]Scan for potentially unsafe applications[/b:bedf048460]
[*:bedf048460][b:bedf048460]Enable Anti-Stealth technology [/b:bedf048460][/list:u:bedf048460]
[*:bedf048460]Klik op [b:bedf048460]Start[/b:bedf048460]
[*:bedf048460]De computer wordt nu gescand. Dit kan best lang duren, heb dus geduld.
[*:bedf048460]Je mag het venster sluiten wanneer de scan klaar is.
[*:bedf048460]Gebruik [b:bedf048460]Kladblok[/b:bedf048460] om het logje te openen. Dit logje vind je in de lokatie C:\Program Files\EsetOnlineScanner\[b:bedf048460]log.txt[/b:bedf048460]
[*:bedf048460]Kopieer en plak de inhoud van dit logje in je volgende bericht.[/list:u:bedf048460]
N.B.: deaktiveer tijdelijk je eigen antivirus tijdens de scan, dan is de onlinescan sneller!

[b:9d6538b515][u:9d6538b515]ESET online scanner logje:[/u:9d6538b515][/b:9d6538b515]

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=6354f539262e394ca1c78cd4474fc1ab
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-07-21 07:48:37
# local_time=2011-07-21 09:48:37 (+0100, West-Europa (zomertijd))
# country="Netherlands"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1797 16775141 100 93 136378 47763363 165503 0
# compatibility_mode=8192 67108863 100 0 115 115 0 0
# compatibility_mode=9217 16777214 75 70 3930451 10827687 0 0
# scanned=239563
# found=2
# cleaned=2
# scan_time=7744
F:\Mijn documenten\Downloads\GrabIt\pinnacle studio 12[1]\Pinnacle.Studio.Ultimate.12.Multi-Bambino\Pinnacle.Studio.Ultimate.12.Multi-Bambino.iso multiple threats (deleted - quarantined) 00000000000000000000000000000000 C
F:\Programma's\Finale 2011\patch_finale_2011.r2.exe probably a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Hoi Remco, weet dat makers van keygens, patches, fixes en ga zo maar door betaald krijgen voor het verspreiden van malware met hun tools!

Je bent dus gewaarschuwd.


Hoe gaat het ondertussen met jouw Windows?