Archief - Check plz

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
J

JohnDodger

Legacy Member
Veel dingen van rapidshare die zomaar dingen in mijn PC veranderen, bv da'k taakbeheer niet meer kan openen
Klik om te vergroten...

Logfile of HijackThis v1.99.1
Scan saved at 14:22:52, on 1/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\dxwizard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\netmsg.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\USB Storage RW\shwicon.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\LIUtilities\WinTasks\wintasks.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Eigenaar\LOCALS~1\Temp\Rar$EX00.281\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: Shell=Explorer.exe rapidshare.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iPod\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [win32] C:\WINDOWS\system32\winpack32.exe
O4 - HKLM\..\Run: [werters] C:\WINDOWS\system32\winIogon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MSN Messenger\MsgPlus.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [Windows Update] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [msconfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [Windows Update] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [msconfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [] C:\WINDOWS\rapidshare.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [win32] C:\WINDOWS\system32\winpack32.exe
O4 - HKCU\..\Run: [werters] C:\WINDOWS\system32\winIogon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1156186885217
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1156187273998
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DAD8FD3-4781-49D0-A73F-5B30422A1DAA}: NameServer = 195.238.2.22 195.238.2.21
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: DirectX common - Unknown owner - C:\WINDOWS\system32\dxwizard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Net message Service - Unknown owner - C:\WINDOWS\system32\netmsg.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
J

Jurgenv1

Legacy Member
Download combofix.exe: http://download.bleepingcomputer.com/sUBs/combofix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
J

JohnDodger

Legacy Member
Eigenaar - 06-11-01 15:21:59,37 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Eigenaar\Bureaublad"

((((((((((((((((((((((((((((((( Files Created from 2006-10-01 to 2006-11-01 ))))))))))))))))))))))))))))))))))


2006-11-01 14:02 1,109,491 ---hs---- C:\WINDOWS\rapidshare.exe
2006-10-31 15:44 2,314,332 --a------ C:\WINDOWS\system32\LIBMMD.DLL
2006-10-31 15:28 15,360 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-10-31 14:41 1,191,621 --a------ C:\WINDOWS\system32\winIogon.exe
2006-10-30 11:19 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe
2006-10-30 11:18 577,536 --a------ C:\WINDOWS\soundman.exe
2006-10-30 11:18 315,392 --a------ C:\WINDOWS\alcupd.exe
2006-10-30 11:18 217,088 --a------ C:\WINDOWS\Alcrmv.exe
2006-10-30 11:18 143,360 --a------ C:\WINDOWS\system32\RtlCPAPI.dll
2006-10-30 11:18 10,528,768 --a------ C:\WINDOWS\system32\RTLCPL.exe
2006-10-30 10:04 39,599 --a------ C:\WINDOWS\system32\winpack32.exe
2006-10-30 09:49 163,924 --a------ C:\WINDOWS\themeui.exe
2006-10-30 09:32 135,168 --a------ C:\WINDOWS\system32\netmsg.exe
2006-10-30 09:27 135,168 --a------ C:\WINDOWS\system32\dxwizard.exe
2006-10-26 19:48 52,736 --a------ C:\WINDOWS\passview.dll
2006-10-14 16:05 1,170,223 --a------ C:\WINDOWS\steam.exe
2006-10-14 13:11 1,592,559 ---hs---- C:\WINDOWS\scvhost.exe
2006-10-14 13:06 33,952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2006-10-14 13:06 1,559,819 ---hs---- C:\WINDOWS\svchost.exe
2006-10-12 19:30 1,592,603 ---hs---- C:\WINDOWS\svhost.exe
2006-10-02 20:04 806,912 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-10-02 20:04 806,912 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-10-02 20:04 790,528 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-10-02 20:04 635,486 --a------ C:\WINDOWS\system32\DivX.dll
2006-10-01 12:56 129,784 --------- C:\WINDOWS\system32\pxafs.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-01 15:20 -------- d-------- C:\Program Files\Mozilla Firefox
2006-11-01 15:20 -------- d-------- C:\Program Files\Call of Duty
2006-11-01 14:13 -------- d-------- C:\Documents and Settings\Eigenaar\Application Data\uTorrent
2006-11-01 13:26 -------- d-------- C:\Documents and Settings\Eigenaar\Application Data\Xfire
2006-10-31 15:51 -------- d-------- C:\Program Files\VirtualDJ
2006-10-31 14:34 -------- d-------- C:\Program Files\uTorrent
2006-10-31 13:19 -------- d-------- C:\Program Files\Adobe
2006-10-31 13:19 -------- d-------- C:\Documents and Settings\Eigenaar\Application Data\Adobe
2006-10-30 11:24 -------- d-------- C:\Program Files\Common Files
2006-10-30 11:18 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-10-30 11:18 -------- d-------- C:\Program Files\Common Files\Realtek AC97
2006-10-30 11:15 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2006-10-29 13:09 -------- d-------- C:\Documents and Settings\Eigenaar\Application Data\Lavasoft
2006-10-29 13:08 -------- d-------- C:\Program Files\Lavasoft
2006-10-29 13:05 -------- d-------- C:\Program Files\Java
2006-10-29 09:09 -------- dr------- C:\Program Files\Xfire
2006-10-24 18:02 -------- d-------- C:\Program Files\Windows Media Player
2006-10-24 17:55 -------- d--h----- C:\Program Files\Outlook Express
2006-10-24 17:55 -------- d--h----- C:\Program Files\netmeeting
2006-10-20 19:21 1568 --a------ C:\Documents and Settings\Eigenaar\Application Data\mpauth.dat
2006-10-14 13:18 -------- d-------- C:\Program Files\Google
2006-10-13 17:07 -------- d-------- C:\Program Files\World of Warcraft
2006-10-09 17:29 -------- d-------- C:\Program Files\MSN Messenger
2006-10-04 17:49 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-10-04 15:31 -------- d-------- C:\Documents and Settings\Eigenaar\Application Data\Lionhead Studios
2006-10-04 15:24 -------- d-------- C:\Program Files\Lionhead Studios Ltd
2006-10-03 21:28 -------- d-------- C:\Documents and Settings\Eigenaar\Application Data\DivX
2006-10-03 20:09 -------- d-------- C:\Program Files\DivX
2006-10-01 14:18 -------- d-------- C:\Program Files\iPod
2006-10-01 14:17 -------- d-------- C:\Program Files\QuickTime
2006-10-01 12:57 -------- d-------- C:\Program Files\Winamp
2006-09-26 18:00 611064 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2006-09-24 08:58 8464 --a------ C:\WINDOWS\system32\sporder.dll
2006-09-24 08:58 50688 --a-s---- C:\WINDOWS\NDNuninstall6_38.exe
2006-09-23 14:10 -------- d-------- C:\Program Files\TGTSoft
2006-09-22 16:03 -------- d-------- C:\Program Files\RecordNow
2006-09-20 15:01 4019072 -ra------ C:\WINDOWS\system32\drivers\alcxwdm.sys
2006-09-15 16:34 -------- d-------- C:\Program Files\LimeWire
2006-09-13 06:07 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-12 16:51 1245184 --a------ C:\WINDOWS\system32\msxml4.dll
2006-09-10 09:44 -------- d---s---- C:\Documents and Settings\Eigenaar\Application Data\Microsoft
2006-09-10 09:28 286720 --------- C:\WINDOWS\Setup1.exe
2006-09-10 07:48 -------- d-------- C:\Program Files\WinRAR
2006-09-05 17:42 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-09-03 18:20 -------- d-------- C:\Documents and Settings\Eigenaar\Application Data\System Requirements Lab
2006-08-25 16:51 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-25 04:47 115880 --------- C:\WINDOWS\system32\pxinsi64.exe
2006-08-22 12:48 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-08-21 13:28 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 10:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-16 12:59 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-08-11 20:45 888832 --a------ C:\WINDOWS\system32\nvmobls.dll
2006-08-11 20:45 581632 --a------ C:\WINDOWS\system32\nvhwvid.dll
2006-08-11 20:45 5611520 --a------ C:\WINDOWS\system32\nvdisps.dll
2006-08-11 20:45 5251072 --a------ C:\WINDOWS\system32\nvdispsr.dll
2006-08-11 20:45 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll
2006-08-11 20:45 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll
2006-08-11 20:45 3039232 --a------ C:\WINDOWS\system32\nvgames.dll
2006-08-11 20:45 2953216 --a------ C:\WINDOWS\system32\nvvitvsr.dll
2006-08-11 20:45 2928640 --a------ C:\WINDOWS\system32\nvgamesr.dll
2006-08-11 20:45 2904064 --a------ C:\WINDOWS\system32\nvvitvs.dll
2006-08-11 20:45 2859008 --a------ C:\WINDOWS\system32\nvmoblsr.dll
2006-08-11 20:45 229376 --a------ C:\WINDOWS\system32\nvmccs.dll
2006-08-11 20:45 188416 --a------ C:\WINDOWS\system32\nvmccss.dll
2006-08-11 20:45 1732608 --a------ C:\WINDOWS\system32\nvwssr.dll
2006-08-11 20:45 1236992 --a------ C:\WINDOWS\system32\nvwss.dll
2006-08-11 20:44 147456 --a------ C:\WINDOWS\system32\nvcolor.exe
2006-08-11 20:43 86016 --a------ C:\WINDOWS\system32\nvmctray.dll
2006-08-11 20:43 81920 --a------ C:\WINDOWS\system32\nvwddi.dll
2006-08-11 20:43 794624 --a------ C:\WINDOWS\system32\nvcplui.exe
2006-08-11 20:43 7630848 --a------ C:\WINDOWS\system32\nvcpl.dll
2006-08-11 20:43 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2006-08-11 20:43 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2006-08-11 20:43 425984 --a------ C:\WINDOWS\system32\keystone.exe
2006-08-11 20:43 311296 --a------ C:\WINDOWS\system32\nvexpbar.dll
2006-08-11 20:43 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2006-08-11 20:43 196608 --a------ C:\WINDOWS\system32\nvapi.dll
2006-08-11 20:43 1662976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2006-08-11 20:43 1519616 --a------ C:\WINDOWS\system32\nwiz.exe
2006-08-11 20:43 1470464 --a------ C:\WINDOWS\system32\nview.dll
2006-08-11 20:43 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2006-08-11 20:43 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2006-08-11 20:43 1011712 --a------ C:\WINDOWS\system32\nvcpluir.dll
2006-08-11 20:42 5636096 --a------ C:\WINDOWS\system32\nvoglnt.dll
2006-08-11 20:42 4496128 --a------ C:\WINDOWS\system32\nv4_disp.dll
2006-08-11 20:42 35840 --a------ C:\WINDOWS\system32\nvcodins.dll
2006-08-11 20:42 35840 --a------ C:\WINDOWS\system32\nvcod.dll
2006-08-11 20:42 155715 --a------ C:\WINDOWS\system32\nvsvc32.exe
2006-08-11 00:03 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2006-08-11 00:03 196608 --a------ C:\WINDOWS\system32\dtu100.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"STYLEXP"="C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe -Hide"
"win32"="C:\\WINDOWS\\system32\\winpack32.exe"
"werters"="C:\\WINDOWS\\system32\\winIogon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe"
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"KYE_Showicon"="\"C:\\Program Files\\USB Storage RW\\shwicon.exe\" -t\"KYE\\USB Storage RW\""
"Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"nwiz"="nwiz.exe /install"
"AdslTaskBar"="rundll32.exe stmctrl.dll,TaskBar"
"PS2"="C:\\WINDOWS\\system32\\ps2.exe"
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Alcatel\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iPod\\iTunesHelper.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"win32"="C:\\WINDOWS\\system32\\winpack32.exe"
"werters"="C:\\WINDOWS\\system32\\winIogon.exe"
"SoundMan"="SOUNDMAN.EXE"
"MessengerPlus3"="\"C:\\Program Files\\MSN Messenger\\MsgPlus.exe\""
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Windows Update"="C:\\WINDOWS\\rapidshare.exe"
"msconfig"="C:\\WINDOWS\\rapidshare.exe"
"icq lite"="C:\\WINDOWS\\rapidshare.exe"
"Update Checker"="C:\\WINDOWS\\rapidshare.exe"
"AntiVir"="C:\\WINDOWS\\rapidshare.exe"
@="C:\\WINDOWS\\rapidshare.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"Windows Update"="C:\\WINDOWS\\rapidshare.exe"
"msconfig"="C:\\WINDOWS\\rapidshare.exe"
"icq lite"="C:\\WINDOWS\\rapidshare.exe"
"Update Checker"="C:\\WINDOWS\\rapidshare.exe"
"AntiVir"="C:\\WINDOWS\\rapidshare.exe"
@="C:\\WINDOWS\\rapidshare.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Windows Update"="C:\\WINDOWS\\rapidshare.exe"
"msconfig"="C:\\WINDOWS\\rapidshare.exe"
"icq lite"="C:\\WINDOWS\\rapidshare.exe"
"Update Checker"="C:\\WINDOWS\\rapidshare.exe"
"AntiVir"="C:\\WINDOWS\\rapidshare.exe"
@="C:\\WINDOWS\\rapidshare.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e8,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000000
"NoLowDiskSpaceChecks"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableTaskMgr"=dword:00000001
"DisableRegistryTools"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
@=""
"NoDriveTypeAutoRun"=hex:5b,00,00,00
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^InterVideo WinCinema Manager.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\InterVideo WinCinema Manager.lnk"
"backup"="C:\\WINDOWS\\pss\\InterVideo WinCinema Manager.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\INTERV~1\\Common\\Bin\\WINCIN~1.EXE "
"item"="InterVideo WinCinema Manager"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rapidshare"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\rapidshare.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntiVir]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rapidshare"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\rapidshare.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icq lite]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rapidshare"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\rapidshare.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
"key"="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
"item"="themeui"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\themeui.exe"
"inimapping"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msconfig]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rapidshare"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\rapidshare.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PWRISOVM"
"hkey"="HKLM"
"command"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
"key"="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
"item"="rapidshare"
"hkey"="HKCU"
"command"="C:\\WINDOWS\\rapidshare.exe"
"inimapping"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="sgtray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\VERITAS Software\\Update Manager\\sgtray.exe\" /r"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysMetrix]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SysMetrix"
"hkey"="HKLM"
"command"="C:\\Program Files\\SysMetrix\\SysMetrix.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Update Checker]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rapidshare"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\rapidshare.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="rapidshare"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\rapidshare.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=dword:00000003

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-01 15:23:06.75
C:\ComboFix.txt ... 06-11-01 15:23

Logfile of HijackThis v1.99.1
Scan saved at 15:24:30, on 1/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\dxwizard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\netmsg.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\USB Storage RW\shwicon.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\LIUtilities\WinTasks\wintasks.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Eigenaar\LOCALS~1\Temp\Rar$EX00.688\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: Shell=Explorer.exe rapidshare.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iPod\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [win32] C:\WINDOWS\system32\winpack32.exe
O4 - HKLM\..\Run: [werters] C:\WINDOWS\system32\winIogon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MSN Messenger\MsgPlus.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [Windows Update] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [msconfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [Windows Update] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [msconfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [] C:\WINDOWS\rapidshare.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [win32] C:\WINDOWS\system32\winpack32.exe
O4 - HKCU\..\Run: [werters] C:\WINDOWS\system32\winIogon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1156186885217
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1156187273998
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DAD8FD3-4781-49D0-A73F-5B30422A1DAA}: NameServer = 195.238.2.22 195.238.2.21
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: DirectX common - Unknown owner - C:\WINDOWS\system32\dxwizard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Net message Service - Unknown owner - C:\WINDOWS\system32\netmsg.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
J

Jurgenv1

Legacy Member
* Download en installeer AVG Anti-Spyware.

  • Na de installatie, open AVG Anti-Spyware:
    * onder "Status", klik op Change state naast "Resident shield". (wijzig van active naar inactive!)
    * onder "Update", klik op de Start update knop.
    * onder "Scanner", tab "Settings":
    • - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine. (ZEER BELANGRIJK!)
      * onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
    Sluit AVG Anti-Spyware. Laat het nog niet scannen.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm
Download link van Ad-aware: http://www.lavasoftusa.com/products/ad-aware_se_personal.php

* Start je computer op in VEILIGE MODUS

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

* Start AVG Anti-Spyware.
  • * Klik op Scan en kies Complete System Scan.
    Na de scan; volg onderstaande instructies :
    BELANGRIJK : Klik niet op de "Save Scan Report" knop vooraleer je de "Apply all Actions" knop hebt aangeklikt !
    * Draag er zorg voor dat Set all elements to: op Quarantine staat (1),
    zoniet klik op de link en kies Quarantine in de popup menu. (2)
    (Dit geldt niet voor cookies, deze worden onveranderlijk gedelete !)
    * Onderaan het venster klik op de Apply all Actions knop. (3)
    ewidoscan.jpg

    * Wanneer je de melding krijgt 'All actions have been applied', klik je onderaan op de knop Save Report.

* Herstart je computer in normale modus.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Post dan een nieuw hijackthis logje hier met het rapport van AVG antispyware.
J

JohnDodger

Legacy Member
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 23:22:58 1/11/2006

+ Scan result:



C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP152\A0019507.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP153\A0019524.EXE -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP153\A0019528.dll -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\WINDOWS\NDNuninstall6_38.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
HKU\S-1-5-21-2134728094-947456382-995365557-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E} -> Adware.NewDotNet : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP153\A0019535.exe -> Adware.Relevant : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP153\A0019510.dll -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP153\A0019511.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP153\A0019514.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP153\A0019525.exe -> Adware.SaveNow : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP145\A0018969.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\WINDOWS\system32\winpack32.exe -> Backdoor.Bifrose.aap : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP142\A0018542.dll -> Hijacker.Agent.ac : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{6EF46B21-7B8F-4B6C-9812-6B74765F8EAA}\RP143\A0018666.dll -> Hijacker.Agent.ac : Cleaned with backup (quarantined).
:mozilla.18:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.107:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.92:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.93:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.97:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.98:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.99:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Eigenaar\Cookies\eigenaar@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.55:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.56:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.48:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.82:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.83:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.84:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.85:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.86:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.87:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.35:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.36:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.16:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.61:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.65:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.66:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.38:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.39:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.40:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.47:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.41:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.42:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.43:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.78:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.79:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.80:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.81:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.50:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.58:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.71:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.72:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.73:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.74:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.75:C:\Documents and Settings\Eigenaar\Application Data\Mozilla\Firefox\Profiles\14kkqgm8.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\WINDOWS\system32\dxwizard.exe -> Trojan.Agent.ye : Cleaned with backup (quarantined).
C:\WINDOWS\system32\netmsg.exe -> Trojan.Agent.ye : Cleaned with backup (quarantined).
C:\WINDOWS\passview.dll -> Trojan.IcqSmiley.e : Cleaned with backup (quarantined).
C:\WINDOWS\system32\winIogon.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\WINDOWS\system32\drivers\etc\hosts -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\WINDOWS\system32\drivers\etc\hosts.msn -> Trojan.Qhosts : Cleaned with backup (quarantined).
C:\WINDOWS\steam.exe -> Trojan.Steam.f : Cleaned with backup (quarantined).


::Report end


Logfile of HijackThis v1.99.1
Scan saved at 23:30:25, on 1/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\rapidshare.exe
C:\WINDOWS\scvhost.exe
C:\WINDOWS\svhost.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\USB Storage RW\shwicon.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iPod\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Eigenaar\LOCALS~1\Temp\Rar$EX00.187\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REG:system.ini: Shell=Explorer.exe rapidshare.exe
F3 - REG:win.ini: run=C:\WINDOWS\rapidshare.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iPod\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MSN Messenger\MsgPlus.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\Run: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\Run: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\Run: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\Run: [] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\RunServices: [msconfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\RunOnce: [msconfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [] C:\WINDOWS\rapidshare.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1156186885217
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1156187273998
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DAD8FD3-4781-49D0-A73F-5B30422A1DAA}: NameServer = 195.238.2.22 195.238.2.21
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: DirectX common - Unknown owner - C:\WINDOWS\system32\dxwizard.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Net message Service - Unknown owner - C:\WINDOWS\system32\netmsg.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
J

JohnDodger

Legacy Member
Ik zou er eventjes willen bijzeggen dat na deze scan de expand/minimalise van dit forum niet meer werken, de knopjes [-] reageren niet.
Ook als ik wat dingen in het spelletjes gedeelte van de frontpage wil veranderen (zoals verschuiven) reageren niet :s

Is dit normaal :s
K

KO

Legacy Member
JohnDodger123 zei:
Ik zou er eventjes willen bijzeggen dat na deze scan de expand/minimalise van dit forum niet meer werken, de knopjes [-] reageren niet.
Ook als ik wat dingen in het spelletjes gedeelte van de frontpage wil veranderen (zoals verschuiven) reageren niet :s

Is dit normaal :s
Klik om te vergroten...

Lijkt eropt dat uw javascript niet meer wordt uitgevoerd. Kijk in je instellingen van de browser(s) die je gebruikt of javascipt ingeschakeld is.
J

Jurgenv1

Legacy Member
* Open hijackthis en vink volgende regels aan:

F2 - REGystem.ini: Shell=Explorer.exe rapidshare.exe
F3 - REG:win.ini: run=C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\Run: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\Run: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\Run: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\Run: [] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\RunServices: [msconfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunServices: [] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\RunOnce: [msconfig] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [icq lite] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [Update Checker] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [AntiVir] C:\WINDOWS\rapidshare.exe
O4 - HKLM\..\RunOnce: [] C:\WINDOWS\rapidshare.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

Ik zie dat je geen antivirus hebt geïnstalleerd, dit is pure zelfmoord om zonder bescherming op het internet te surfen met de dag van vandaag, dus installeer een gratis en goeie antivirus dat je pc niet zo erg vertraagd: AVG Free antivirus, antivir en Avast! Home edition zijn er een paar van. :) Voor Avast moet je wel nog eens gratis registreren voor je de antivirus kan gebruiken, zie hier voor meer info.

Daarna is het zeer belangrijk dat je de definitie's van je antivirus update, zodat je beschermd bent tegen de nieuwste bedreigingen.


* Scan dan eens met je AV in veilige modus en verwijder alles wat er gevonden wordt.

* Post dan een nieuw hijackthis logje hier.
J

JohnDodger

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 13:06:00, on 2/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\scvhost.exe
C:\WINDOWS\scvhost.exe
C:\WINDOWS\svhost.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\USB Storage RW\shwicon.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iPod\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\scvhost.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Eigenaar\Mijn documenten\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iPod\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\RunOnce: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1156186885217
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1156187273998
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DAD8FD3-4781-49D0-A73F-5B30422A1DAA}: NameServer = 195.238.2.22 195.238.2.21
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
J

Jurgenv1

Legacy Member
* Fix de volgende regels in hijackthis:

O4 - HKLM\..\RunServices: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\RunOnce: [Windows Update] C:\WINDOWS\scvhost.exe

* Download en unzip Killbox naar je bureaublad.
Klik op killbox.exe.
Selecteer de optie "Delete on reboot".
In het veld "Full Path of File to Delete" kopieer en plak je het volgende:

C:\WINDOWS\scvhost.exe

Klik op de knop: single file (!Belangrijk!)

Daarna, Klik op de rode cirkel met het wit kruisje erin.
Killbox zal zeggen dat deze file zal verwijderd worden on reboot.. vraagt om nu te rebooten. Klik YES.

Je pc moet nu rebooten.

* Post dan een nieuw hijackthis logje hier.
J

JohnDodger

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 13:21:27, on 2/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\svhost.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\USB Storage RW\shwicon.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iPod\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Eigenaar\LOCALS~1\Temp\Rar$EX02.375\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iPod\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [Windows Update] C:\WINDOWS\scvhost.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1156186885217
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1156187273998
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DAD8FD3-4781-49D0-A73F-5B30422A1DAA}: NameServer = 195.238.2.22 195.238.2.21
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
K

KO

Legacy Member
En als ge nu "C:\WINDOWS\svhost.exe" gewoon in da kaderetje plakt ?
J

Jurgenv1

Legacy Member
Probeer ook eens met verborgen mappen en bestanden zichtbaar. :)
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan