Archief - controle van systeem :)

yo jurgen dude

ja na daje mij keer geholpen ebt met een gigantische virus infectie shit toestand gaak nog ke een controleke doen of da men systeem wel nog in orden is

ier eb je al de info dak denk daje zult nodig ebbn en keb de meeste programmatjes nog staan dus moet ma kez eggn welke dak best nog ke laat doen

PANDA SCAN:


Incident Status Location

Adware:adware/gator Not disinfected g:\windows\GatorUninstaller_cme.log
Adware:adware/deskwizz Not disinfected Windows Registry
Adware:adware/winactive Not disinfected Windows Registry
Potentially unwanted tool:application/funweb Not disinfected hkey_local_machine\software\FunWebProducts
Adware:adware/yazzlesudoku Not disinfected Windows Registry
Potentially unwanted tool:application/mywebsearch Not disinfected hkey_classes_root\clsid\{A4730EBE-43A6-443e-9776-36915D323AD3}
Potentially unwanted tool:application/altnet Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\AltnetDM
Adware:adware/commad Not disinfected Windows Registry
Spywarepyware/media-motor Not disinfected Windows Registry
Spywarepyware/apropos Not disinfected Windows Registry
Spyware:Cookie/Statcounter Not disinfected D:\Documents and Settings\Willy\Cookies\willy@statcounter[1].txt
Spyware:Cookie/Tradedoubler Not disinfected D:\Documents and Settings\Willy\Cookies\willy@tradedoubler[1].txt
Spyware:Cookie/Tradedoubler Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Application Data\Mozilla\Firefox\Profiles\h8pt0m1l.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Statcounter Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Application Data\Mozilla\Firefox\Profiles\h8pt0m1l.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Tribalfusion Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Application Data\Mozilla\Firefox\Profiles\h8pt0m1l.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Atlas DMT Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Application Data\Mozilla\Firefox\Profiles\h8pt0m1l.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Hitbox Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Application Data\Mozilla\Firefox\Profiles\h8pt0m1l.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/Doubleclick Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Application Data\Mozilla\Firefox\Profiles\h8pt0m1l.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/YieldManager Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Application Data\Mozilla\Firefox\Profiles\h8pt0m1l.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Advertising Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Application Data\Mozilla\Firefox\Profiles\h8pt0m1l.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Hbmediapro Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\[email protected][2].txt
Spyware:Cookie/Atlas DMT Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@atdmt[2].txt
Spyware:Cookie/Belnk Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@belnk[1].txt
Spyware:Cookie/Casalemedia Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@casalemedia[1].txt
Spyware:Cookie/Com.com Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@com[1].txt
Spyware:Cookie/Belnk Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\[email protected][2].txt
Spyware:Cookie/Doubleclick Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@doubleclick[1].txt
Spyware:Cookie/Itrack Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\[email protected][2].txt
Spyware:Cookie/Mediaplex Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@mediaplex[1].txt
Spyware:Cookie/MetriWeb Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@metriweb[1].txt
Spyware:Cookie/QuestionMarket Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@questionmarket[2].txt
Spyware:Cookie/Rn11 Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@rn11[2].txt
Spyware:Cookie/Statcounter Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@statcounter[2].txt
Spyware:Cookie/Mammamediasolutions Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@targetnet[2].txt
Spyware:Cookie/Tradedoubler Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@tradedoubler[1].txt
Spyware:Cookie/Xiti Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\anika@xiti[1].txt
Spyware:Cookie/Adserver Not disinfected G:\Documents and Settings\Anika.WDABRECHT\Cookies\[email protected][1].txt




HIJACKTHIS LOG:

Logfile of HijackThis v1.99.1
Scan saved at 15:29:49, on 16/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\ewido anti-malware\ewidoctrl.exe
G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
G:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
G:\WINDOWS\system32\wscntfy.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Analog Devices\SoundMAX\Smtray.exe
G:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
G:\Program Files\Common Files\Real\Update_OB\realsched.exe
G:\Program Files\QuickTime\qttask.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Winamp\winamp.exe
G:\Program Files\MSN Messenger\msnmsgr.exe
G:\WINDOWS\system32\svchost.exe
G:\PROGRA~1\MOZILL~1\FIREFOX.EXE
G:\Documents and Settings\brecht\Mijn documenten\oplossing\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.flabber.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Smapp] G:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [DrvListnr] G:\Program Files\Analog Devices\SoundMAX\DrvListnr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] G:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "G:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AceGain LiveUpdate] G:\Program Files\AceGain\LiveUpdate\LiveUpdate.exe
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://g:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://g:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://g:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://g:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://g:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://g:\program files\google\GoogleToolbar2.dll/cmtrans.html
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1094151048578
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144001280281
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/player.virtools.com/downloads/player/Install3.0/Installer.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "G:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "G:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WBSrv - G:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - Service: Adobe LM Service - Adobe Systems - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido security suite control - ewido networks - G:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - G:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - G:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

* je moet Java updaten:

• Ga naar Start > Configuratiescherm dubbelklik op het Software icoontje. Je zal een lijst te zien krijgen van de geïnstalleerde programma's op je systeem.
• Zoek in de lijst naar alle voorgaande versies van Java. (J2SE Runtime Environment.... )
  Het heeft volgend icoontje:
  
  
  Selecteer het en kies voor verwijderen.
• Daarna, download en installeer de nieuwste versie van hier:

http://www.java.com/en/download/manual.jsp


* Start je computer op in VEILIGE MODUS

* verwijder volgend bestand:

g:\windows\GatorUninstaller_cme.log

Open Kladblok.
Kopieer de onderstaande vetgedrukte tekst en plak deze in een nieuw document.


Kies Bestand -> Opslaan
Selecteer bij "Opslaan in": Bureaublad
Vul bij "Bestandsnaam" in: fix.reg
Selecteer bij "Opslaan als type": Alle bestanden
Klik op "Opslaan".

Dubbelklik op fix.reg, dat nu op je bureaublad staat.
Ga ermee akkoord dat deze gegevens aan het register worden toegevoegd.

* start je pc weer normaal

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* doe dan opnieuw een scan met panda en post het resultaat terug hier met een nieuw hijackthis logje.