Archief - freaky xp

na het herinstallen van win xp op mijn pc begin ik tal van foutmeldingen te krijgen van onderandere beird.exe,enotax2.exe,explorx.exe,ger.exe,cult.exe,
repcale.exe en nog vele meer. deze bestanden zijn op mijn pc te vinden in c:/windows/system32/bntrth.

nu ik deze map verwijder komt deze na reboot er toch doodleuk terug op.

weet er iemand of dit schadelijke bestanden zijn/welk nut ze hebben, en vooral hoe je ze van je pc kan halen.

Met vriendelijke groeten,

Peter

Waarschijnlijk spy/adware.

Scan eens met HiJackThis en post uw logfile. Dan zullen wij zeggen wat je mag fixen.

Steven

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Dit.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Medion Home CinemaXL\PowerCinema\PCMService.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\WINDOWS\System32\svdll32.exe
C:\WINDOWS\System32\enotax2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\peter\Application Data\nwlm.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\System32\taskmrg.exe
C:\dasssa.exe
C:\WINDOWS\System32\bntrth\beird.exe
c:\windows\system32\bntrth\wshield.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\peter\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABBHO.DLL
O2 - BHO: (no name) - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [PCMService] C:\Program Files\Medion Home CinemaXL\PowerCinema\PCMService.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [CloseDNF] C:\WINDOWS\System32\Utility.exe \1008
O4 - HKLM\..\Run: [Go And Start] svdll32.exe
O4 - HKLM\..\Run: [Start The Roll] enotax2.exe
O4 - HKLM\..\Run: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKLM\..\Run: [Start Upping] taskmrg.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Sys29] c:\windows\system32\winuwg32.exe
O4 - HKLM\..\RunServices: [Go And Start] svdll32.exe
O4 - HKLM\..\RunServices: [Start The Roll] enotax2.exe
O4 - HKLM\..\RunServices: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKLM\..\RunServices: [Start Upping] taskmrg.exe
O4 - HKCU\..\Run: [Start The Roll] enotax2.exe
O4 - HKCU\..\Run: [Go And Start] svdll32.exe
O4 - HKCU\..\Run: [Start Upping] taskmrg.exe
O4 - HKCU\..\Run: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Trdc] C:\Documents and Settings\peter\Application Data\nwlm.exe
O4 - HKCU\..\Run: [SuperAdBlocker] C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
O4 - HKCU\..\RunServices: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...a92af5471717:0cbfdcb4486c77ad0a879ed076144f12
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37671.2196180556
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6008E81C-5821-4222-8B2F-1D36F0DFA833}: NameServer = 195.238.2.21 195.238.2.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{6008E81C-5821-4222-8B2F-1D36F0DFA833}: NameServer = 195.238.2.21 195.238.2.22

Malware processen:
C:\WINDOWS\System32\svdll32.exe
C:\WINDOWS\System32\enotax2.exe
C:\Documents and Settings\peter\Application Data\nwlm.exe
C:\WINDOWS\System32\taskmrg.exe
C:\dasssa.exe
C:\WINDOWS\System32\bntrth\beird.exe
c:\windows\system32\bntrth\wshield.exe

Te fixen:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/
O2 - BHO: (no name) - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 53.dll
O4 - HKLM\..\Run: [CloseDNF] C:\WINDOWS\System32\Utility.exe \1008
O4 - HKLM\..\Run: [Go And Start] svdll32.exe
O4 - HKLM\..\Run: [Start The Roll] enotax2.exe
O4 - HKLM\..\Run: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKLM\..\Run: [Start Upping] taskmrg.exe
O4 - HKLM\..\Run: [Sys29] c:\windows\system32\winuwg32.exe
O4 - HKLM\..\RunServices: [Go And Start] svdll32.exe
O4 - HKLM\..\RunServices: [Start The Roll] enotax2.exe
O4 - HKLM\..\RunServices: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKLM\..\RunServices: [Start Upping] taskmrg.exe
O4 - HKCU\..\Run: [Start The Roll] enotax2.exe
O4 - HKCU\..\Run: [Go And Start] svdll32.exe
O4 - HKCU\..\Run: [Start Upping] taskmrg.exe
O4 - HKCU\..\Run: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O4 - HKCU\..\Run: [Trdc] C:\Documents and Settings\peter\Application Data\nwlm.exe
O4 - HKCU\..\RunServices: [NBT System alias] c:\windows\system32\bntrth\repcale.exe c:\windows\system32\bntrth\beird.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...a879ed076144f12

Die 'te fixen'-items aanvinken in HiJackThis en op 'Fix Checked' drukken. Herstart daarna de pc.

Steven

is hijackthis zoiets als ad-aware ???
is dit beter of slechter???

Het verschil is dat HiJackThis *NIET* automatisch opkuist en dat je zelf moet kunnen onderscheiden welke zaken slecht zijn en welke niet. Bovendien zal HiJackThis nooit echt bestanden verwijderen, enkel de verwijzingen naar die bestanden. Het gevolg is dat je met een hoop inactieve rommelbestanden blijft zitten (die weliswaar nauwelijks plaats innemen).

Een voordeel van HiJackThis is wel dat die echt grondig is (tenzij je zelf iets vergeet aan te vinken).

Steven