Archief - Check log plz

hi,
kheb ff een thread geopend:
https://www.beyondgaming.be/archive/software.22/pc-gaat-enorm-traag-nog-wat-probs.318772
daarin zeide ze dat ik een hijack this moest posten, hier is ie dus:


Logfile of HijackThis v1.99.1
Scan saved at 17:17:26, on 26/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hwclock.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\SCardClnt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\WINDOWS\System32\scvhost.exe
C:\WINDOWS\System32\explored.exe
C:\WINDOWS\System32\nvscv32.exe
E:\programms\Spy Sweeper\SpySweeper.exe
E:\programms\Whatpulse\WhatPulse.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\programms\Winrar\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.110\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [Microsoft Windows Updata] scvhost.exe
O4 - HKLM\..\Run: [explorered] explored.exe
O4 - HKLM\..\Run: [FireWire Service] nvscv32.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Updata] scvhost.exe
O4 - HKLM\..\RunServices: [explorered] explored.exe
O4 - HKLM\..\RunServices: [FireWire Service] nvscv32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "E:\programms\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Microsoft Windows Updata] scvhost.exe
O4 - HKCU\..\Run: [WhatPulse] E:\programms\Whatpulse\WhatPulse.exe
O4 - HKCU\..\Run: [explorered] explored.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Xfire.lnk = E:\programms\Xfire\Xfire.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Smart Card Client (SCardClnt) - Unknown owner - C:\WINDOWS\System32\SCardClnt.exe


Zijn er bestanden die weg mogen ?


alvast bedankt

ge ziet met een virus, waarschijnlijk ligt het daaraan.

opstarten in veligemodus, en volgende verwijderen.

C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\System32\SCardClnt.exe
C:\WINDOWS\System32\scvhost.exe = virus
C:\WINDOWS\System32\explored.exe = virus
C:\WINDOWS\System32\nvscv32.exe = virus

daarna deze verwijderen

O4 - HKLM\..\Run: [Microsoft Windows Updata] scvhost.exe
O4 - HKLM\..\Run: [explorered] explored.exe
O4 - HKLM\..\Run: [FireWire Service] nvscv32.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Updata] scvhost.exe
O4 - HKLM\..\RunServices: [explorered] explored.exe
O4 - HKLM\..\RunServices: [FireWire Service] nvscv32.exe
O4 - HKCU\..\Run: [Microsoft Windows Updata] scvhost.exe
O4 - HKCU\..\Run: [explorered] explored.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe
O23 - Service: Smart Card Client (SCardClnt) - Unknown owner - C:\WINDOWS\System32\SCardClnt.exe

Rebooten, en nieuw log posten

kheb het geprobeert maar eeuhm...
da eerste kan ik niet verwijderen, is in gebruik zegt em
en de rest vind ik gwn niet
met zoekfunctie enzo vinnek nx

in veilige mode opgestart?

ja

dat is net het rare

Verwijder dan eerst de opstartinstructies, en laat die bestanden voorlopig staan.
Post dan een nieuw log (de bestanden zijn veilig als er geen opstartinstructies meer zijn). Komen er verdachte instructies terug, moeten we dieper graven.

kheb hwclock.exe & nvscv32.exe eraf gekrege (denk ik )

kheb dan zoals j. vroeg die opstartinstructies weggedaan:

new log:

Logfile of HijackThis v1.99.1
Scan saved at 20:58:26, on 26/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\SCardClnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Program Files\Messenger\msmsgs.exe
E:\programms\Whatpulse\WhatPulse.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\programms\Winrar\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.328\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "E:\programms\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [WhatPulse] E:\programms\Whatpulse\WhatPulse.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Xfire.lnk = E:\programms\Xfire\Xfire.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)
O23 - Service: Smart Card Client (SCardClnt) - Unknown owner - C:\WINDOWS\System32\SCardClnt.exe

C:\WINDOWS\System32\SCardClnt.exe

O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)
O23 - Service: Smart Card Client (SCardClnt) - Unknown owner - C:\WINDOWS\System32\SCardClnt.exe

is het nadien nog niet weg, zou ik eens enkele online virusscanners proberen, aangezien het bij een virus behoort

die scardclnt vind ik niet maar weel scardsvr...

scardsvr is in orde: het is een windows-bestand. Scan, zoals preske zei, eens on line in veilige modus met netwerkondersteuning op virussen, b.v. op housecall.

Als dat niet werkt, manueel verwijderen: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_RANDEX.BN&VSect=Sn

k...kheb gedaan wa preske vroeg alleen die sCard... kan ik niet vinden

ik heb die 3 files zo geselecteert en dan fix gedaan, reboot en dan terug een logske laten maken:

Logfile of HijackThis v1.99.1
Scan saved at 22:08:59, on 26/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\SCardClnt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\WINDOWS\System32\explored.exe
C:\Program Files\Messenger\msmsgs.exe
E:\programms\Whatpulse\WhatPulse.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
E:\programms\Winrar\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.578\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [explorered] explored.exe
O4 - HKLM\..\RunServices: [explorered] explored.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "E:\programms\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [WhatPulse] E:\programms\Whatpulse\WhatPulse.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [explorered] explored.exe
O4 - Startup: Xfire.lnk = E:\programms\Xfire\Xfire.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)
O23 - Service: Smart Card Client (SCardClnt) - Unknown owner - C:\WINDOWS\System32\SCardClnt.exe


die 3 bestanden blijven er staan

kzal on line zo is moeten laten scannen denk ik, is housecall zo'n site waar ik dat kan laten doen ?

edit:
kheb die housecall is gedaan, maar hij vraagt om een plug in van netscape te d'loaden...en ik gebruik firefox !

IE gebruiken

ge hebt het trouwens terug zitten.
ik zie er weer enkele oude bestanden zitten.

en Hijackthis zou in een apart mapje moeten ipv temp.

Maak ook uw tempfiles eens leeg e.d.

me hates virusses

kheb dit nu gedaan:
1. housecall laten scannen in de normale modus ( kon in veilige modus maar niet op internet geraken ). Die heeft vanalles gevonden, heb het laten wegdoen maar iexplorer.exe & explored ging maar niet weg omdat het in gebruik was.
2.Kheb hijackthis weggedaan van die temp files. Daarna in veilige modus laten draaien, hier de log:
Logfile of HijackThis v1.99.1
Scan saved at 13:28:48, on 27/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator\Bureaublad\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [explorered] explored.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [Registries] IEXPL0RER.exe
O4 - HKLM\..\RunServices: [explorered] explored.exe
O4 - HKLM\..\RunServices: [Registries] IEXPL0RER.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "E:\programms\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [WhatPulse] E:\programms\Whatpulse\WhatPulse.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [explorered] explored.exe
O4 - Startup: Xfire.lnk = E:\programms\Xfire\Xfire.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)

het zit er nog altijd in

download wholockme
http://www.dr-hoiby.com/WhoLockMe/index.php

daarmee kunt ge kijken wat die bestanden in gebruik houd. en hopelijk kunt ge het dan wegkrijgen


O4 - HKLM\..\Run: [explorered] explored.exe
O4 - HKLM\..\Run: [Registries] IEXPL0RER.exe
O4 - HKLM\..\RunServices: [explorered] explored.exe
O4 - HKLM\..\RunServices: [Registries] IEXPL0RER.exe
O4 - HKCU\..\Run: [explorered] explored.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\System32\nvsvc32.exe (file missing)

in velige modus weer verwijderen, enz enz

*zucht*
kwas het kotsbeu, kheb m'n pc maar geformateert...MAar die hwclock.exe is daar terug !
kan dat zijn omdat ik somige bestanden op mijn pc gehouden heb ?

ik heb norton 2004 geinstalleert, hij ziet het virus: w32wallz ofzoiets in bestand hwclock.exe maar hij kan het niet verwijderen. de toegang tot het bestand is altijd geweigerd.
Ik krijg nu als ik niet op i'net zit altijd maar vragen om te verbinden met:
Symantec.loves. ...
OWSjap.game2max.net
LAB2.lab.41hosting
test0r.server.us
....



kga ff nog maar ens een hijackthis logske maken

ge zit soms niet in netwerk ofzo?

ik zou verder posten in uwe software-post.
het is redelijk duidelijk dat dit verder gaat dan een hjt log, mss kunnen ze daar meer helpen

nee ik zit niet in netwerk

kheb ff nog wat ligge doen:
1. in veilige modus hjt gedaan:
Logfile of HijackThis v1.99.1
Scan saved at 21:30:31, on 27/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\fre\Bureaublad\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\programms\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\programms\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] E:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "E:\programms\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "E:\programms\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [MICROSOFT UNPACK SYSTEM] winrarx.exe
O4 - HKLM\..\Run: [Windows System Utilities] lssass.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
O4 - HKLM\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKLM\..\RunServices: [MICROSOFT UNPACK SYSTEM] winrarx.exe
O4 - HKLM\..\RunServices: [Windows System Utilities] lssass.exe
O4 - HKLM\..\RunServices: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MICROSOFT UNPACK SYSTEM] winrarx.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - E:\programms\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\programms\Norton Antivirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - E:\programms\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

2. virusscan, heeft die hwclock.exe gevonden en hij zei dat het verwijdert werd.
3. terug hjt logske:
Logfile of HijackThis v1.99.1
Scan saved at 21:59:32, on 27/04/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\fre\Bureaublad\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\programms\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\programms\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] E:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "E:\programms\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "E:\programms\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [MICROSOFT UNPACK SYSTEM] winrarx.exe
O4 - HKLM\..\Run: [Windows System Utilities] lssass.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
O4 - HKLM\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKLM\..\RunServices: [MICROSOFT UNPACK SYSTEM] winrarx.exe
O4 - HKLM\..\RunServices: [Windows System Utilities] lssass.exe
O4 - HKLM\..\RunServices: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MICROSOFT UNPACK SYSTEM] winrarx.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - E:\programms\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - E:\programms\Norton Antivirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - E:\programms\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

ik moet u teleurstellen

O4 - HKLM\..\Run: [MICROSOFT UNPACK SYSTEM] winrarx.exe
O4 - HKLM\..\Run: [Windows System Utilities] lssass.exe
O4 - HKLM\..\Run: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKLM\..\RunServices: [MICROSOFT UNPACK SYSTEM] winrarx.exe
O4 - HKLM\..\RunServices: [Windows System Utilities] lssass.exe
O4 - HKLM\..\RunServices: [Microsoft AOL Instant Messenger] MSAOL32.exe
O4 - HKCU\..\Run: [MICROSOFT UNPACK SYSTEM] winrarx.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)

edit volgt:
ik stel voor dat we zware geschut inzetten.
download escan van http://www.mwti.net/antivirus/mwav.asp

vervolgens, zet de settings zoals http://www.trojaner-info.de/hijacker/escan.shtml (sorry, maar ik vind geen anderstalige uitleg)

Dit is een gratis versie. het kan alleen scannen en detecten. niet verwijderen. maar dat kan je manueel ook.

Je kan het log bekijken, en naar alle errors en gevonden virussen/spyware zoeken.

Post die mss dan ook even hier.

Wel even zeggen, dit is zeer intensief. het kan een tijdje duren eer alles gescanned is. (maak daarom je tempfiles leeg, scheelt wat tijd)

merci voor de hulp al.
Kheb gister men pc helemaal geformateert, partities enzo ook.
Maar kheb het nu weeral
kheb uit windows/system32 als die nvsc32.exe weggedaan. Kheb norton 2004 erop gezet en geupdate, hij vind vanalle bestande en hij zegt dat hij ze verwijdert heeft maar als ik dan in die map kijk ( system32) dan staan ze er nog in.
Kga dan maar zoals ge het verwoorde: het groot geschut inschakele

goe, kheb gescanned met die éscan.
kga die log hier niet zetten, is véél te lang. Kga de virus log wel zette:
File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{47F32D85-85D8-4A83-ADB9-06184C3C1818}\RP1\A0000134.exe tagged as not-a-virus:RiskWare.Tool.ExitWin.b. No Action Taken.

File C:\System Volume Information\_restore{47F32D85-85D8-4A83-ADB9-06184C3C1818}\RP4\A0000178.exe infected by "Backdoor.Win32.Wootbot.gen" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{47F32D85-85D8-4A83-ADB9-06184C3C1818}\RP4\A0000179.exe infected by "Backdoor.Win32.Codbot.z" Virus. Action Taken: No Action Taken.

File C:\WINDOWS\system32\sscs.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\WINDOWS\system32\winrarx.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File C:\WINDOWS\Temp\sen.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\00A71AA0 infected by "Trojan-Downloader.BAT.Ftp.z" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\01886BA8.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\03B34D45.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\05D430ED.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\08CA3DAB.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\0A34721C.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\6BDF6F7E.exe infected by "Backdoor.Win32.Wootbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\6C3A0719.exe infected by "Backdoor.Win32.Codbot.z" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\721978A4.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\72A25C0D.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\732B3F76 infected by "Backdoor.Win32.PoeBot.b" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\78CE3D42.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\79687299.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\79E42E10.exe infected by "Backdoor.Win32.Small.eo" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\7ABB0123.exe infected by "Backdoor.Win32.Codbot.z" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\7ACC5311.exe infected by "Backdoor.Win32.Codbot.z" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\7C0C65B1.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\7D3F505F.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\7E104F79 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

File E:\programms\Norton Antivirus\Quarantine\7E2D4959.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.


dan norton:
in die messages van norton die ik krijg heb ik enorm veel files. oa: bbb.exe, ccc.exe, .exe, linux, ... De virusse zijn: w32wasex, w32.spybot.worm, download.trojan en van die dingen.
hij zegt altijd: bestand automatisch verwijdert.
kga nu die quarantaind files wegdoen...