Archief - Kan de wallpaper niet veranderen - VIRUS

thomasovaere · 1 jan 2007

Hallo
ik heb een probleempje met mijn bureablad
plots was deze helemaal wit geworden
bij bureablad kan ik geen andere achtergrond kiezen omdat alles grijs is en ik kan dus nergens op klikken
ik heb alle rechten op mijn pc en windows herstellen helpt niet :oink:

Exit · 1 jan 2007

wrs spyware ... post eens hjt logje

thomasovaere · 1 jan 2007

Logfile of HijackThis v1.98.2
Scan saved at 19:43:25, on 1-1-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Windows\xpupdate.exe
C:\Documents and Settings\Thomas\Menu Start\Programma's\Opstarten\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Xfire\Xfire.exe
D:\Program Files\Steam\Steam.exe
C:\Documents and Settings\Thomas\Mijn documenten\Maxthon\Maxthon.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Thomas\LOCALS~1\Temp\Rar$EX00.797\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.playrstation.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: iexplore.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Zoeken - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{D49A7082-4849-4AFB-8A75-3509BED1ECC8}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS3\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS4\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL

Exit · 1 jan 2007

C:\Windows\xpupdate.exe = VIRUS
tja uw prob wrs ... al dees moven naar hjt forum voor verdere ontleding en oplossing.
http://www.sophos.com/virusinfo/analyses/w32rbotqe.html

en blijkbaar hebt ge geen virusscanner op uw pc ...

Jurgenv1 · 1 jan 2007

Je kan beter deze instructies opslaan omdat je pc zal moeten herstarten.
Download Wareoutfix van één van deze twee site's:

http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

Sla het op op je bureaublad en laat het runnen. Klik dan op Next, dan op Install, wees zeker dat "Run fixit" is aangevinkt en klik op Finish. De fix zal beginnen; volg de instructies die je krijgt. Er zal gevraagd worden of je je pc wilt herstarten; doe dit ook. Je computer zal nu wat trager opstarten, dit is normaal

Wanneer het bureaublad verschenen is, zal je een tekstbestandje zien te voorschijn komen (report.txt), post daarvan de inhoud hier met een nieuw hijackthis logje.

thomasovaere · 2 jan 2007

Fixwareout
Last edited 12/06/2006
Post this report in the forums please
...
Prerun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"="csmic.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dmjtw.exe"="C:\\WINDOWS\\system32\\dmjtw.exe"

...
...
Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DB68A5991AAB-0EE8-9C74-D2DD-813DEA63{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}649733019653-121B-1D84-3130-AC8FBE2E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}01750F7FCC90-0408-2194-0ADB-9085441B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\wtjmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\0mdm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\1mdm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\yqdm
...

Random Runs removed from HKLM
"dmjtw.exe"=-
...
...

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names...

»»»»»
Search five digit cs, dm kd and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSMIC.EXE 51.805 2006-12-21

Other suspects.
C:\WINDOWS\System32\{B1445809-BDA0-4912-8040-09CCF7F05710}.exe

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.
...
Postrun check
[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""

...

en hijack

Logfile of HijackThis v1.98.2
Scan saved at 11:11:14, on 2-1-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Thomas\Mijn documenten\Maxthon\Maxthon.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Thomas\LOCALS~1\Temp\Rar$EX00.593\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O8 - Extra context menu item: &Google Zoeken - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{D49A7082-4849-4AFB-8A75-3509BED1ECC8}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS3\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS4\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL

Jurgenv1 · 2 jan 2007

* Download Killbox.
Klik op killbox.exe.
Kies de optie: "Delete on reboot".

Kopieer het volgende vetgedrukt deel:

C:\WINDOWS\SYSTEM32\CSMIC.EXE
C:\WINDOWS\system32\dmjtw.exe
C:\WINDOWS\System32\{B1445809-BDA0-4912-8040-09CCF7F05710}.exe

Open 'file' in het killboxmenu bovenaan en kies: Paste from clipboard

Je zal zien, het bovenstaande vetgedrukte zal staan in het "Full Path of File to Delete"-veld.
Er is een klein pijltje naast dat veld. Als je daarop klikt zal je al die bovenstaande lijntjes (indien bestanden aanwezig) die je gekopieerd hebt zien staan (dit is alvast de bedoeling)

Klik op de knop: All files (!Belangrijk!)

Daarna, Klik op de rode cirkel met het wit kruisje erin.
Killbox zal zeggen dat deze file zal verwijderd worden on reboot.. vraagt om nu te rebooten. Klik YES.

Je pc moet nu rebooten.

* Download de nieuwere versie van hijackthis hier:
http://castlecops.com/zx/Merijn/hijackthis.zip

Pak het uit naar een vaste map bv C:/hijackthis en post dan een nieuw hijackthis logje hier.

thomasovaere · 2 jan 2007

gedaan

Logfile of HijackThis v1.99.1
Scan saved at 16:40:44, on 2-1-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Thomas\Mijn documenten\Maxthon\Maxthon.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O8 - Extra context menu item: &Google Zoeken - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{D49A7082-4849-4AFB-8A75-3509BED1ECC8}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS3\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS4\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe

Voorlopig zie ik nog geen verschil op mijn computer

Jurgenv1 · 2 jan 2007

Je Java software is verouderd.
Oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.
Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

Download Java Runtime Environment (JRE) 6.0.

Scroll omlaag naar : "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Klik op de "Download" knop aan de rechterkant.
Vink aan: "Accept License Agreement".
De pagina zal herladen.
Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen, en bewaar het naar je Bureaublad.
Sluit alle programma's die eventueel open zijn - Zeker je web browser!
Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java uit de Softwarelijst.
Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
Klik dan op Verwijderen of op de Wijzig/Verwijder knop.
Herhaal dit tot alle oudere versies verdwenen zijn.
Na het verwijderen van alle oudere versies, herstart je pc.
Dubbelklik vervolgens op jre-6-windows-i586.exe op je Bureaublad om de nieuwste versie van Java te installeren.

* Download en installeer AVG Anti-Spyware.

Na de installatie, open AVG Anti-Spyware:
* onder "Status", klik op Change state naast "Resident shield". (wijzig van active naar inactive!)
* onder "Update", klik op de Start update knop.
* onder "Scanner", tab "Settings":
- - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine. (ZEER BELANGRIJK!)
  * onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
Sluit AVG Anti-Spyware. Laat het nog niet scannen.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm
Download link van Ad-aware: http://www.lavasoftusa.com/products/ad-aware_se_personal.php

* Start je computer op in VEILIGE MODUS

* open hijackthis en vink volgende regels aan:

O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\..\{D49A7082-4849-4AFB-8A75-3509BED1ECC8}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS3\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111
O17 - HKLM\System\CS4\Services\Tcpip\..\{01257DE6-1F6A-453F-BF1C-FA07C6809133}: NameServer = 85.255.115.106,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.106 85.255.112.111

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Verwijder volgend bestand indien aanwezig:

C:\Windows\xpupdate.exe

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

* Start AVG Anti-Spyware.

* Klik op Scan en kies Complete System Scan.
Na de scan; volg onderstaande instructies :
BELANGRIJK : Klik niet op de "Save Scan Report" knop vooraleer je de "Apply all Actions" knop hebt aangeklikt !
* Draag er zorg voor dat Set all elements to: op Quarantine staat (1),
zoniet klik op de link en kies Quarantine in de popup menu. (2)
(Dit geldt niet voor cookies, deze worden onveranderlijk gedelete !)
* Onderaan het venster klik op de Apply all Actions knop. (3)

* Wanneer je de melding krijgt 'All actions have been applied', klik je onderaan op de knop Save Report.

* Herstart je computer in normale modus.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Post dan een nieuw hijackthis logje hier met het rapport van AVG antispyware.

thomasovaere · 3 jan 2007

Ja srry vergeten op quarantaine te zetten want ik kon deze topic nergens meer vinden

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 20:43:48 2-1-2007

+ Scan result:

C:\Documents and Settings\Bart\Menu Start\Programma's\Power Scan -> Adware.PowerScan : Cleaned.
C:\Program Files\SpyMarshal -> Adware.SpyMarshal : Cleaned.
C:\Program Files\SpyMarshal\SpyMarshal.exe -> Adware.SpyMarshal : Cleaned.
C:\Program Files\SpyMarshal\SpyMarshal.lic -> Adware.SpyMarshal : Cleaned.
C:\Program Files\SpyMarshal\Uninstall.exe -> Adware.SpyMarshal : Cleaned.
C:\Documents and Settings\Thomas\Mijn documenten\UplinkSetup-dm.exe -> Adware.Trymedia : Cleaned.
C:\Documents and Settings\Bart\rebates.exe/rebates.exe -> Adware.WinAD : Cleaned.
C:\Documents and Settings\Ma\rebates.exe/rebates.exe -> Adware.WinAD : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\2exml32.2.exe -> Backdoor.Agent.afj : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\67exml32.2.exe -> Backdoor.Agent.afj : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\42exed32_2.exe -> Backdoor.Xbot : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\31exed32_2.exe -> Backdoor.Xbot : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\39exed32_2.exe -> Backdoor.Xbot : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\12exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\23exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\48exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\49exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\68exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\69exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\74exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\80exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\83exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\87exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\58exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\91exhdd.1.exe -> Downloader.Horst.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\20ex6.modul32.exe -> Logger.Agent.nr : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\44ex6.modul32.exe -> Logger.Agent.nr : Cleaned.
C:\Documents and Settings\Thomas\Bureaublad\MORESMELLYTNTANUSFARTS-FIFA07NODVDCRACKPATCHER.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned.
C:\Documents and Settings\Thomas\Mijn documenten\Mijn ontvangen bestanden\fifa07rwaaah.rar/MORESMELLYTNTANUSFARTS-FIFA07NODVDCRACKPATCHER.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned.
C:\Documents and Settings\Thomas\Mijn documenten\photoshopcsparadoxnagandserial.zip/PHOTOSHOP CS - PARADOX NAG AND SERIAL EXPIRE REMOVE FIX.RAR/test.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned.
D:\Program Files\EA SPORTS\FIFA 07\MORESMELLYTNTANUSFARTS-FIFA07NODVDCRACKPATCHER.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\12exmodul32d.4.exe -> Proxy.Horst.ad : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\39exmodul32d.4.exe -> Proxy.Horst.ad : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\49exmodul32d.4.exe -> Proxy.Horst.ad : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\63exmodul32d.4.exe -> Proxy.Horst.ad : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\0exinjs31.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\10exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\15exinjs31.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\16exinjs31.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\19exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\20exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\23exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\25ex7.modul32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\25exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\26exinjs32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\26exinjs5.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\27exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\28exinjs32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\29exinjs5.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\2exinjs32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\36exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\38exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\39ex7.modul32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\3exinjs31.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\40exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\40exinjs5.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\42exinjs31.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\58ex7.modul32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\58exinjs31.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\59exinjs32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\64ex7.modul32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\70exinjs32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\71exinjs31.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\76ex7.modul32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\7exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\80exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\83exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\86ex7.modul32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\88exinjs31.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\89ex7.modul32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\92exinjs32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\99exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\17exinjs32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\21exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\22exinjs32.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\26exinjs31.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\75exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\92exinjs.3.exe -> Proxy.Horst.av : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\29ex1.modul32.exe -> Proxy.Horst.be : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\3ex1.modul32.exe -> Proxy.Horst.be : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\88ex1.modul32.exe -> Proxy.Horst.be : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\27ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\39ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\46ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\48ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\62ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\87ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\93ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\9ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\1ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\23ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\92ex4.modul32.exe -> Proxy.Horst.cg : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\12ex5.modul32.exe -> Proxy.Horst.cm : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\17ex5.modul32.exe -> Proxy.Horst.cm : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\18ex5.modul32.exe -> Proxy.Horst.cm : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\23ex5.modul32.exe -> Proxy.Horst.cm : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\31ex5.modul32.exe -> Proxy.Horst.cm : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\4ex5.modul32.exe -> Proxy.Horst.cm : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\28ex5.modul32.exe -> Proxy.Horst.cm : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\2ex5.modul32.exe -> Proxy.Horst.cm : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\91ex5.modul32.exe -> Proxy.Horst.cm : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\16exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\26exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\29exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\29exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\32exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\36exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\42exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\49exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\50exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\57exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\59exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\67exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\67exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\68exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\6exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\73exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\78exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\89exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\90exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\91exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\95exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\99exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\33exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\38exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\40exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\45exhdd.f.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\48exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\6exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\75exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\86exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\98exhdd.e.exe -> Proxy.Horst.dt : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\28ex9.modul32.exe -> Proxy.Horst.dz : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\0ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\12ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\14ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\19ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\20ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\21ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\28ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\31ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\63ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\75ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\86ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\95ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\96ex4.mhdd.exe -> Proxy.Horst.ev : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\16exinjs.a.exe -> Proxy.Horst.hs : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\24exinjs.6.exe -> Proxy.Horst.hs : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\25exinjs.a.exe -> Proxy.Horst.hs : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\50exinjs.a.exe -> Proxy.Horst.hs : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\88exinjs.a.exe -> Proxy.Horst.hs : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\96exinjs.a.exe -> Proxy.Horst.hs : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\23exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\28exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\30exinjs.b.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\43exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\47exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\72exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\11exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\22exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\35exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\44exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\64exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\81exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\91exinjs.8.exe -> Proxy.Horst.ig : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\39exmodul32d.1.exe -> Proxy.Horst.jk : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\25exinjs.d.exe -> Proxy.Horst.jr : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\2exinjs.d.exe -> Proxy.Horst.jr : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\36exinjs.d.exe -> Proxy.Horst.jr : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\8exinjs.d.exe -> Proxy.Horst.jr : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\33exinjs.d.exe -> Proxy.Horst.jr : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\63exinjs.d.exe -> Proxy.Horst.jr : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\72exinjs.c.exe -> Proxy.Horst.js : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\43exmodul32d.5.exe -> Proxy.Horst.jx : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\73exmodul32d.5.exe -> Proxy.Horst.jx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\32exmodul32d.a.exe -> Proxy.Horst.ka : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\57exmodul32d.a.exe -> Proxy.Horst.ka : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\69exmodul32d.a.exe -> Proxy.Horst.ka : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\95exmodul32d.a.exe -> Proxy.Horst.ka : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\20exhdd.b.exe -> Proxy.Horst.kc : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\21exhdd.b.exe -> Proxy.Horst.kc : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\23exhdd.b.exe -> Proxy.Horst.kc : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\5exhdd.b.exe -> Proxy.Horst.kc : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\47exhdd.b.exe -> Proxy.Horst.kc : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\0exmodul32d.c.exe -> Proxy.Horst.ki : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\9exmodul32d.c.exe -> Proxy.Horst.ki : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\85exmodul32d.c.exe -> Proxy.Horst.ki : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\11exinjs.n.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\19exinjs.n.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\1exinjs.f.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\20exhdd.d.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\39exinjs.n.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\43exhdd.d.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\53exinjs.n.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\59exhdd.d.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\62exinjs.f.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\63exinjs.n.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\7exinjs.f.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\82exhdd.d.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\89exinjs.n.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\8exinjs.n.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\97exhdd.d.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\20exinjs.f.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\64exinjs.f.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\7exinjs.n.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\95exhdd.d.exe -> Proxy.Horst.kq : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\23exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\25exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\27exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\29exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\37exinjs.i.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\45exinjs.g.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\45exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\49exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\51exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\53exinjs.i.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\56exinjs.i.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\58exinjs.i.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\63exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\67exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\85exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\92exinjs.i.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\92exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\93exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\9exinjs.i.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\46exinjs.l.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\75exmodul32e.c.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\90exinjs.i.exe -> Proxy.Horst.kx : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\18exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\21exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\24exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\30exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\34exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\40exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\50exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\69exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\82exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\85exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\88exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\90exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\97exhdd.g.exe -> Proxy.Horst.lh : Cleaned.
C:\Documents and Settings\Bart\Cookies\bart@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Thomas\Cookies\thomas@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Thomas\Cookies\thomas@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Thomas\Cookies\[email protected][1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Thomas\Cookies\[email protected][2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Thomas\Cookies\[email protected][2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Documents and Settings\Thomas\Cookies\thomas@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Thomas\Cookies\thomas@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Ma\Cookies\ma@ivwbox[2].txt -> TrackingCookie.Ivwbox : Cleaned.
C:\Documents and Settings\Thomas\Cookies\[email protected][1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\Documents and Settings\Thomas\Cookies\[email protected][2].txt -> TrackingCookie.Planetactive : Cleaned.
C:\Documents and Settings\Thomas\Cookies\[email protected][1].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Thomas\Cookies\thomas@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Thomas\Cookies\thomas@yadro[1].txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\Thomas\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\24exmodul32.exe -> Trojan.Spambot : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\31ex3.modul32.exe -> Trojan.Spambot : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\32ex3.modul32.exe -> Trojan.Spambot : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\38ex3.modul32.exe -> Trojan.Spambot : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\69ex3.modul32.exe -> Trojan.Spambot : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\92ex3.modul32.exe -> Trojan.Spambot : Cleaned.
C:\Documents and Settings\Bart\Local Settings\Temp\98ex3.modul32.exe -> Trojan.Spambot : Cleaned.
C:\Documents and Settings\Ma\Local Settings\Temp\82ex3.modul32.exe -> Trojan.Spambot : Cleaned.

::Report end

thomasovaere · 3 jan 2007

Logfile of HijackThis v1.99.1
Scan saved at 9:04:35, on 3-1-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O8 - Extra context menu item: &Google Zoeken - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe

Jurgenv1 · 3 jan 2007

Deze vergeten te fixen?

O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe

Voer ook het volgende uit:

Download roguescanfix_setup.

Dubbelklik op roguescanfix_setup om het te installeren.

Na de installatie krijg je de vraag om het programma te laten opstarten. Kies dan JA/YES.

Nota: Deze tool heeft internet connectie nodig zodat het een extra bestand kan downloaden om deze tool te laten werken.
Indien je Firewall een alert geeft, sta het toe en blokkeer het niet
Indien je daarna nog steeds de melding krijgt dat BFU.exe niet aanwezig is, download BFU.exe van hier.
Unzip het en plaats BFU.exe in de c:\PROGRAM FILES\Roguescanfix-map. Dubbelklik daarna opnieuw op Roguescanfix.bat

Er zal een dosvenster openen met een keuzemenu.
Kies hier optie #1: Run roguescanfix

Deze tool zal sommige ongewenste programma's deïnstalleren en gerelateerde bestanden en registersleutels verwijderen.
Indien sommige bestanden niet kunnen verwijderd worden, zal deze tool vragen of je je pc opnieuw wilt opstarten.
Zorg er wel eerst voor dat het deïnstalleren van de ongewenste programma's voltooid is vooraleer je op 'Yes' klikt om je pc opnieuw te laten opstarten.

Er zal een kladblokbestandje openen. Plaats de inhoud van dat bestandje in je volgende antwoord, samen met een nieuw logje van Hijackthis.
(Het bestandje vind je ook in c:\program files\roguescanfix\task.txt)

thomasovaere · 4 jan 2007

Export SharedTaskScheduler key
------------------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

en dat van BFU ofzoiets

BFU v1.00.9
Windows XP SP2 (WinNT 5.01.2600 SP2)
Script started at 13:01:58, on 4-1-2007

Option pause between commands: 100 ms
Failed: FileDelete C:\Documents and Settings\Thomas\Application Data\Microsoft\Internet Explorer\QuickLaunch\SpyFalcon*.* (operation failed)
Failed: FileDelete C:\Documents and Settings\Thomas\Application Data\Microsoft\Internet Explorer\QuickLaunch\SpywareQuake*.* (operation failed)
Failed: FileDelete C:\Documents and Settings\Thomas\Application Data\Microsoft\Internet Explorer\QuickLaunch\Spyware Sherif*.* (operation failed)
Failed: FolderDelete C:\Program Files\eMedia Codec (folder not found)
Failed: FolderDelete C:\Program Files\Media-Codec (folder not found)
Failed: FolderDelete C:\Program Files\spyfalcon (folder not found)
Failed: FolderDelete C:\Documents and Settings\Thomas\Menu Start\Programma's\SpyFalcon (folder not found)
Failed: FolderDelete C:\Documents and Settings\Thomas\Menu Start\Programma's\SpywareQuake (folder not found)
Failed: FolderDelete C:\Program Files\SpywareQuake (folder not found)
Failed: FolderDelete C:\WINDOWS\system32\1024 (folder not found)
Failed: FolderDelete C:\Program Files\Trust Cleaner (folder not found)
Failed: FolderDelete C:\Program Files\TrustIn Contextual (folder not found)
Failed: FolderDelete C:\Program Files\TrustIn Bar (folder not found)
Failed: FolderDelete C:\Program Files\TrustIn Popups (folder not found)
Failed: FolderDelete C:\Program Files\TrustIn Search (folder not found)
Failed: FolderDelete C:\Program Files\SpywareQuake.com (folder not found)
Failed: FolderDelete C:\Program Files\SpywareStrike (folder not found)
Failed: FolderDelete C:\Program Files\SpyQuake2.com (folder not found)
Failed: FolderDelete C:\Documents and Settings\Thomas\Menu Start\Programma's\SpyQuake2.com (folder not found)
Failed: FolderDelete C:\Program Files\IntCodec (folder not found)
Failed: FolderDelete C:\Program Files\virusburst (folder not found)
Failed: FolderDelete C:\Program Files\virus-burst (folder not found)
Failed: FolderDelete C:\Program Files\strCodec (folder not found)
Failed: FolderDelete C:\Program Files\vb (folder not found)
Failed: FolderDelete C:\Program Files\virusburster (folder not found)
Failed: FolderDelete C:\Program Files\virusbursters (folder not found)
Script completed.

Logfile of HijackThis v1.99.1
Scan saved at 13:05:27, on 4-1-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\Roguescanfix\BFU.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Thomas\Mijn documenten\Maxthon\Maxthon.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O8 - Extra context menu item: &Google Zoeken - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe

Wanneer dat programma open was veranderde mijn wallpaper naar dat scherm van: de actieve dekstop herstellen

Jurgenv1 · 4 jan 2007

Kan je inmiddels al je wallpaper veranderen?

thomasovaere · 4 jan 2007

Nee
maar nadat ik dat programma BTU execute gedaan heb zie ik zo'n wit scherm met letters op mijn wallpaper waarop staat: de actieve desktop herstellen enzo
als ik dan eigenschappen van bureablad kies dan staat bij bureablad een wallpaper ingesteld die ik vroeger had, ik kan nog steeds nergens klikken behalve kan ik nu kiezen tussen centreel, naast elkaar enzo
Als ik dan op toepassen klik zie ik mijn oude wallpaper dus terug
Als ik nu gewoon ergens een foto open en ik kies: als bureabladachtergrond gebruiken dan zie ik als wallpaper nu een witte achtergrond terug.
Dus ben ik nu weer vanaf af.
Het goede nieuws is dat ik nu dus mijn oude wallpaper kan gebruiken maar het slechte nieuws is dat ik die niet meer kan veranderen.

Jurgenv1 · 4 jan 2007

* Download SmitfraudFix (by S!Ri)
Unzip het naar je bureaublad.
Lees hier hoe je op de juiste wijze moet unzippen/uitpakken.
Dit zal een nieuwe map op je bureaublad aanmaken met de naam Smitfraudfix
Verder nog niet gebruiken.

* Start nu je pc op in VEILIGE MODE. ( zonder netwerkondersteuning! )
Hoe start ik in veilige mode op.

* Clean de Cache and Cookies in IE:

Sluit Internet Explorer.
Ga naar Configuratiescherm > Internet Opties > tab Algemeen
Klik de "Cookies verwijderen" knop
Klik op de "Bestanden verwijderen" knop ernaast
Vink aan: "Ook alle off line items verwijderen", klik OK

* Clean de Cache and Cookies in Firefox (In geval Firefox geïnstalleerd is):

Go to Extra > Opties.
Klik Privacy in het menu.
Klik op de knop wissen (Geschiedenis, Cookies, Cache).
Klik OK om het venster opnieuw te sluiten.

* Clean andere Temporary files + Prullenbak

Ga naar start > uitvoeren en typ: cleanmgr en klik ok.
Laat het je systeem scannen op bestanden die moeten verwijderd worden
Zorg er wel voor dat je daar enkel maar 'tijdelijke bestanden', 'tijdelijke internetbestanden' en 'prullenbak' staan aangevinkt.
Klik daarna op ok.

* Open de SmitfraudFix map en dubbelklik smitfraudfix.cmd
Kies optie #2 - Clean door 2 te typen en op "Enter" te klikken.

Er zal gevraagd worden : "Registry cleaning - Do you want to clean the registry ?"; antwoord "Yes/ja" door Y te typen en daarna op "Enter" te klikken. Dit zal je bureaublad terug herstellen en registersleutels die deze infectie heeft gemaakt terug verwijderen.

Daarna zal de tool nagaan als wininet.dll is geïnfecteerd. Indien dit het geval is, zal er gevraagd worden om de geïnfecteerde wininet.dll te herplaatsen met een niet geïnfecteerde kopie van wininet.dll aanwezig op je computer (indien gevonden); antwoord "Yes/ja" door Y te typen en daarna op Enter te klikken.

De tool zal daarna je computer opnieuw laten opstarten om de restanten te verwijderen;
Indien het niet automatisch opstart, start je pc zelf opnieuw op naar normale mode terug (dus geen veilige mode)
Een log zal openen na het opnieuw opstarten. Deze bevindt zich ook hier: C:\rapport.txt
Ik heb die log later nodig als checkup.

Opgelet : Optie #2 gebruiken op een niet geïnfecteerde computer zal uw bureaublad verwijderen. Je kan dez elater weer terug instellen.

* Voer een onlinescan uit met Panda: http://www.pandasoftware.com/products/activescan.htm
Vink aan: All my computer
Zorg ervoor dat alles aangevinkt is in de scanopties.

Na de scan kan je een log laten maken. Bewaar die log naar je bureaublad en kopieer en plak die in je volgend bericht,
samen met een nieuwe HijackThis Log en de log van smitfraudfix ( C:\rapport.txt )

thomasovaere · 5 jan 2007

Oja ik was het goede nieuws bijna vergeten: MIJN WALLPAPER WERKT TERUG
Dat was nadat ik de SmitfraudFix gedaan heb
Probleem opgelost dus
Bedankt voor de heel goede en gedetailleerde uitleg

Logfile of HijackThis v1.99.1
Scan saved at 10:49:28, on 5-1-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Xfire\Xfire.exe
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O8 - Extra context menu item: &Google Zoeken - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Woord vertalen in het Nederlands - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe

SmitFraudFix v2.132

Scan done at 9:48:09,78, vr 05-01-2007
Run from C:\Documents and Settings\Thomas\Bureaublad\SmitfraudFix
OS: Microsoft Windows XP [versie 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Documents and Settings\Thomas\Application Data\Install.dat Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"system"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Incident Status Location

Adware:Adware/SpyMarshal Not disinfected C:\!KillBox\{B1445809-BDA0-4912-8040-09CCF7F05710}.exe
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Bart\Cookies\bart@atdmt[1].txt
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Bart\Cookies\bart@metriweb[1].txt
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Ma\Cookies\ma@metriweb[1].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Thomas\Bureaublad\SmitfraudFix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Thomas\Bureaublad\SmitfraudFix.zip[SmitfraudFix/Process.exe]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@atdmt[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@doubleclick[1].txt
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@metriweb[1].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@statcounter[1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@zedo[2].txt
Virus:Trj/Clicker.MW Disinfected C:\Documents and Settings\Thomas\Mijn documenten\Adobe.InDesign.CS2.Tryout.to.Full.Activation.zip[crack-inf.exe]
Virus:Trj/Clicker.MW Disinfected C:\Documents and Settings\Thomas\Mijn documenten\ADOBE.INDESIGN.CS2.V4.0.GERMAN.INCL.KEYGEN-DWP.ZIP[crack-inf.exe]
Virus:Trj/Clicker.MW Disinfected C:\Documents and Settings\Thomas\Mijn documenten\Adobe.InDesign.CS2.v4.0.Incl.Keygen-SSG.ZIP[crack-inf.exe]
Virus:Trj/Clicker.SX Disinfected C:\Documents and Settings\Thomas\Mijn documenten\Ashlar[1].Vellum.Cobalt.v7.4.zip.rar[patch_.exe]
Spyware

pyware/AdClicker Not disinfected C:\Documents and Settings\Thomas\Mijn documenten\Atomix.Virtual.DJ.v2.1-BEAT.ZIP[crack-inf.exe][Adobe Gamma Loader.exe]
Virus:Trj/Clicker.MW Disinfected C:\Documents and Settings\Thomas\Mijn documenten\crack-inf.exe
Virus:Trj/Clicker.LU Not disinfected C:\Documents and Settings\Thomas\Mijn documenten\fear\F.E.A.R.NODVD.CRACK-iND.ZIP[crack-inf.exe][adobemgr.exe]
Virus:Trj/Clicker.LU Not disinfected C:\Documents and Settings\Thomas\Mijn documenten\Window.Blinds.v5.0.Enhanced.WinALL.CRACKED-CRD.ZIP[crack-inf.exe][adobemgr.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Program Files\Roguescanfix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe

Jurgenv1 · 5 jan 2007

Nog een paar tips om problemen te voorkomen in de toekomst:

Installeer alvast volgende GRATIS programmatjes indien je ze nog niet hebt:

Spywareblaster
Adaware se
Spybot s&d

Tijdens het surfen, klik niet overal klakkeloos op ja als je dit gevraagd wordt... doe dit enkel wanneer je het volledig vertrouwt.

En kies eventueel een alternatieve browser zoals Opera of Firefox.

En ik raad je ook aan om af en toe een online virusscan uit te voeren. housecall en/of Bitdefender. Want, wat de ene scanner niet kan vinden, kan een andere misschien wel.
Zorg er ook voor dat je virusscanner die op je systeem geïnstalleerd is altijd up to date is!!

En... geregeld eens een bezoekje brengen aan: http://windowsupdate.microsoft.com/

Bekijk ook eens deze 2 filmpjes.. Heel interessant:
http://www2.trosradar.nl/mediaplayer/player.php?videoID=524&mode=dossier#
http://www.benedelman.org/spyware/security-111804.wmv

Meer preventietips zijn ook op volgende sites te vinden:

http://www.bluemedicine.be
http://users.telenet.be/marcvn/spyware
How did I get infected in the first place (article by TonyKlein)
Het voorkomen van spyware-infecties en browserhijacking

Archief - Kan de wallpaper niet veranderen - VIRUS

thomasovaere

Legacy Member

Exit

Legacy Member

thomasovaere

Legacy Member

Exit

Legacy Member

Jurgenv1

Legacy Member

thomasovaere

Legacy Member

Jurgenv1

Legacy Member

thomasovaere

Legacy Member

Jurgenv1

Legacy Member

thomasovaere

Legacy Member

thomasovaere

Legacy Member

Jurgenv1

Legacy Member

thomasovaere

Legacy Member

Jurgenv1

Legacy Member

thomasovaere

Legacy Member

Jurgenv1

Legacy Member

thomasovaere

Legacy Member

Jurgenv1

Legacy Member