Archief - Check pls

Win xp hijackthis ( ni verschiete )

Logfile of HijackThis v1.99.1
Scan saved at 21:44:44, on 28-5-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\rundll32.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\D-Tools\daemon.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\WINDOWS\System32\wuauclt.exe
D:\WINDOWS\System32\wuauclt.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Documents and Settings\Windows XP\Bureaublad\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts: 63.223.73.138 hsbc.co.uk
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MSConfig] D:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\Xfire.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WindowsUpdate - D:\WINDOWS\system32\kt6ul7j91.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe

* open hijckthis en vink volgende regels aan:

O1 - Hosts: 63.223.73.138 hsbc.co.uk
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Download Look2Me-Destroyer.exe naar je bureaublad.

• Sluit alle open venster.
• Dubbelklik Look2Me-Destroyer.exe om het te starten.
• Zet een vinkje naast Run this program as a task.
• Je zal een melding krijgen met: 'Look2Me-Destroyer will close and re-open in approximately 10 seconds'. Klik OK
• Wanneer Look2Me-Remover opnieuw opent, Klik de Scan for L2M knop.
• Je bureaublad icoontjes en taakbalk zullen verdwijnen, dit is normaal.
• Eénmaal gedaan met scannen, klik de Remove L2M knop.
• Je zal de boodschap Done Scanning krijgen, klik OK.
• Nadien zal je volgende melding krijgen: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klik OK.
• Je computer zal dan afsluiten.
• Start je computer opnieuw op.
• Post de inhoud van C:\Look2Me-Destroyer.txt samen met een nieuw hijackthislogje.

Indien je een alert krijgt van je firewall dat dit programma probeert toegang te krijgen met het internet, sta het toe en blokkeer het niet!

Indien je een runtime error '339' krijgt, download MSWINSCK.OCX via onderstaande link en plaats het in je C:\Windows\System32 map.
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 22:34:43, on 28-5-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\D-Tools\daemon.exe
D:\WINDOWS\System32\RUNDLL32.EXE
D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\WINDOWS\System32\wuauclt.exe
D:\WINDOWS\System32\wuauclt.exe
D:\WINDOWS\system32\NOTEPAD.EXE
D:\Documents and Settings\Windows XP\Bureaublad\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\nl-be\msntb.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MSConfig] D:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\Xfire.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe

L2M:


Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 28-5-2006 22:29:01

Infected! D:\WINDOWS\system32\kt6ul7j91.dll
Infected! D:\WINDOWS\system32\dlskcopy.dll
Infected! D:\WINDOWS\system32\kt6ul7j91.dll
Infected! D:\WINDOWS\system32\hrn6055se.dll
Infected! D:\WINDOWS\system32\ktrul7991.dll
Infected! D:\WINDOWS\system32\hrl6053se.dll
Infected! D:\WINDOWS\system32\lvpo0973e.dll
Infected! D:\WINDOWS\system32\n8r20i9oe8.dll
Infected! D:\WINDOWS\system32\p0p6la7s1d.dll
Infected! D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010209.dll
Infected! D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010299.dll
Infected! D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010448.dll
Infected! D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010452.dll
Infected! D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010455.dll
Infected! D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010459.dll

Attempting to delete infected files...

Attempting to delete: D:\WINDOWS\system32\kt6ul7j91.dll
D:\WINDOWS\system32\kt6ul7j91.dll Deleted successfully!

Attempting to delete: D:\WINDOWS\system32\dlskcopy.dll
D:\WINDOWS\system32\dlskcopy.dll Deleted successfully!

Attempting to delete: D:\WINDOWS\system32\kt6ul7j91.dll
D:\WINDOWS\system32\kt6ul7j91.dll Deleted successfully!

Attempting to delete: D:\WINDOWS\system32\hrn6055se.dll
D:\WINDOWS\system32\hrn6055se.dll Deleted successfully!

Attempting to delete: D:\WINDOWS\system32\ktrul7991.dll
D:\WINDOWS\system32\ktrul7991.dll Deleted successfully!

Attempting to delete: D:\WINDOWS\system32\hrl6053se.dll
D:\WINDOWS\system32\hrl6053se.dll Deleted successfully!

Attempting to delete: D:\WINDOWS\system32\lvpo0973e.dll
D:\WINDOWS\system32\lvpo0973e.dll Deleted successfully!

Attempting to delete: D:\WINDOWS\system32\n8r20i9oe8.dll
D:\WINDOWS\system32\n8r20i9oe8.dll Deleted successfully!

Attempting to delete: D:\WINDOWS\system32\p0p6la7s1d.dll
D:\WINDOWS\system32\p0p6la7s1d.dll Deleted successfully!

Attempting to delete: D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010209.dll
D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010209.dll Deleted successfully!

Attempting to delete: D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010299.dll
D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010299.dll Deleted successfully!

Attempting to delete: D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010448.dll
D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010448.dll Deleted successfully!

Attempting to delete: D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010452.dll
D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010452.dll Deleted successfully!

Attempting to delete: D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010455.dll
D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010455.dll Deleted successfully!

Attempting to delete: D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010459.dll
D:\System Volume Information\_restore{91B18909-1E3C-4ABE-8449-2E658E8BC2E7}\RP82\A0010459.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsUpdate

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{B29CC433-0BF0-4C27-861B-4CE5137F513A}"
HKCR\Clsid\{B29CC433-0BF0-4C27-861B-4CE5137F513A}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{797AFA5F-4D8C-4826-BFC4-4B58A700D030}"
HKCR\Clsid\{797AFA5F-4D8C-4826-BFC4-4B58A700D030}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{C127CEDF-93E5-48B5-AA0E-86B0212FB6CB}"
HKCR\Clsid\{C127CEDF-93E5-48B5-AA0E-86B0212FB6CB}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded

Ziet er goed uit, hoe werkt alles verder?

werkt zeer vlot, heel hard bedankt :applause:

Ga naar http://windowsupdate.microsoft.com/ en installeer alle beschikbare updates, ook na een herstart blijven updates installeren tot je geen meer vindt

* post dan een nieuw hijackthis logje hier