Archief - Na Scans blijven pop-ups

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
S

Sergeant_bob

Legacy Member
ik krijg dus massas pop-ups als een browser open(en verder surf of d browser gewoon open staat ik gebruik altijd FF), ik heb gescand met Adware, Spysweeper en AVG antivirus veel gevonden maar de pop ups blijven
het is volgens mij door het process Explorer.exe maar ik kan het niet afsluiten

Logfile of HijackThis v1.99.1
Scan saved at 10:08:35, on 12/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Synergy\synergys.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.141\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sergeant-bob.spaces.live.com//PhotoUpload/MsnPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0002239 (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Synergy Server - Unknown owner - C:\Program Files\Synergy\synergys.exe

alvast bedankt !:)
J

Jurgenv1

Legacy Member
vDownload combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een Y in om het cleaningsprocess te starten.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt) Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.
S

Sergeant_bob

Legacy Member
COMBOFIX

"Administrator" - 2007-05-12 13:08:23 Service Pack 2
ComboFix 07-05.09.V - Running from: "C:\Documents and Settings\Administrator\Bureaublad\"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\{34EDE~1\Bar888.dll.lzma
C:\Program Files\Common Files\{34EDE~1
C:\Program Files\Common Files\{D4EDE~1
C:\WINDOWS\system32\drivers\core.sys
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\DOCUME~1
C:\qoobox\purity\C\DOCUME~1\ADMINI~1
C:\qoobox\purity\C\DOCUME~1\ADMINI~1\APPLIC~1
C:\qoobox\purity\C\DOCUME~1\ADMINI~1\MIJNDO~1
C:\qoobox\purity\C\DOCUME~1\ADMINI~1\APPLIC~1\STEM32~1
C:\qoobox\purity\C\DOCUME~1\ADMINI~1\MIJNDO~1\FNTS~1
C:\qoobox\purity\C\Program Files\Common Files\FNTS~1
C:\qoobox\purity\C\WINDOWS\SCURIT~1


((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_CLIENT_IP-IPX
-------\LEGACY_CORE
-------\Client IP-IPX
-------\core


((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-12 ))))))))))))))))))))))))))))))))))


2007-05-12 09:58 <DIR> d-------- C:\temp\tn3
2007-05-12 00:05 <DIR> d-------- C:\Program Files\MP4Converter
2007-05-11 23:49 384,512 --a------ C:\WINDOWS\system32\mp4sdmod.dll
2007-05-11 23:49 360,448 --a------ C:\WINDOWS\system32\NCTWMAFile.dll
2007-05-11 23:49 316,008 --a------ C:\WINDOWS\system32\mp43dmod.dll
2007-05-11 23:49 248,424 --a------ C:\WINDOWS\system32\mpg4dmod.dll
2007-05-11 23:49 233,472 --a------ C:\WINDOWS\system32\lame_enc.dll
2007-05-11 23:49 1,703,936 --a------ C:\WINDOWS\system32\NCTAudioFile.dll
2007-05-11 23:49 <DIR> d-------- C:\Program Files\ACE-HIGH MP3 WAV WMA OGG Converter
2007-05-11 23:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2007-05-11 23:40 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2007-05-11 23:40 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-05-11 23:40 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-05-11 23:40 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2007-05-11 23:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
2007-05-11 23:32 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Creative
2007-05-11 13:45 <DIR> d-------- C:\Program Files\Save
2007-05-11 13:44 <DIR> d-------- C:\Program Files\BearShare
2007-05-11 13:44 <DIR> d-------- C:\My Downloads
2007-05-11 13:35 41,984 --------- C:\WINDOWS\Ctregrun.exe
2007-05-11 13:33 <DIR> d-------- C:\Program Files\Creative
2007-05-09 00:00 <DIR> d-------- C:\Program Files\16bags
2007-05-07 12:38 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-05-06 01:21 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Lavasoft
2007-05-06 01:20 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-05-06 00:53 <DIR> d-------- C:\Program Files\DrehoekSW
2007-05-02 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
2007-05-02 20:01 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-05-02 20:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
2007-05-01 21:40 684,032 --a------ C:\WINDOWS\system32\libeay32.dll
2007-05-01 21:40 155,648 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-04-30 11:37 <DIR> d-------- C:\Program Files\Lavasoft
2007-04-26 23:07 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\campsupporttitlethe
2007-04-26 23:07 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\16bags
2007-04-26 20:55 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Mp3tag
2007-04-26 20:54 <DIR> d-------- C:\Program Files\Mp3tag
2007-04-26 05:16 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-04-25 08:19 98,304 -ra------ C:\WINDOWS\system32\hpzjsn01.dll
2007-04-25 08:19 86,016 -ra------ C:\WINDOWS\system32\ZSPOOL.DLL
2007-04-25 08:19 86,016 -ra------ C:\WINDOWS\system32\zlhp2600.dll
2007-04-25 08:19 749,568 -ra------ C:\WINDOWS\system32\agissi.dll
2007-04-25 08:19 73,728 -ra------ C:\WINDOWS\system32\hptcpmib.dll
2007-04-25 08:19 286,720 -ra------ C:\WINDOWS\system32\zshp2600.exe
2007-04-25 08:19 28,672 -ra------ C:\WINDOWS\system32\zlm.dll
2007-04-25 08:19 28,672 -ra------ C:\WINDOWS\system32\IMF32.DLL
2007-04-25 08:19 28,672 -ra------ C:\WINDOWS\system32\hpzjfw01.dll
2007-04-25 08:19 241,664 -ra------ C:\WINDOWS\system32\zhhp2600.exe
2007-04-25 08:19 24,576 -ra------ C:\WINDOWS\system32\ZTAG32.DLL
2007-04-25 08:19 212,992 -ra------ C:\WINDOWS\system32\hptcpmui.dll
2007-04-25 08:19 155,648 -ra------ C:\WINDOWS\system32\HP2600IR.dll
2007-04-25 08:19 126,976 -ra------ C:\WINDOWS\system32\hptcpmon.dll
2007-04-25 08:19 114,688 -ra------ C:\WINDOWS\system32\vshp2600.dll
2007-04-25 08:19 11,202,560 -ra------ C:\WINDOWS\system32\zhhp_res.dll
2007-04-25 08:19 102,400 -ra------ C:\WINDOWS\system32\hpzjrd01.dll
2007-04-25 08:19 <DIR> d--h----- C:\Program Files\Zenographics
2007-04-25 08:19 <DIR> d-------- C:\Program Files\Hewlett-Packard
2007-04-24 18:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
2007-04-23 17:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TrackMania United
2007-04-23 11:03 <DIR> d-------- C:\Program Files\uTorrent
2007-04-23 11:03 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\uTorrent
2007-04-22 21:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Screenshot Sender
2007-04-12 13:13 <DIR> d-------- C:\Program Files\KBC-Online


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-05-12 11:07:19 -------- d-----w C:\Program Files\Mozilla Thunderbird
2007-05-11 11:35:22 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-07 13:48:47 -------- d-----w C:\Program Files\DAEMON Tools
2007-04-25 20:44:30 504,832 ----a-w C:\WINDOWS\system32\winlogon.exe
2007-04-22 19:34:25 -------- d-----w C:\Program Files\MSN Messenger
2007-04-22 19:34:25 -------- d-----w C:\Program Files\Messenger Plus! Live
2007-04-12 11:11:44 3,738 ----a-w C:\WINDOWS\mozver.dat
2007-04-11 09:01:33 554 ----a-w C:\WINDOWS\eReg.dat
2007-04-09 18:56:37 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2007-04-09 18:42:59 -------- d-----w C:\Program Files\Microsoft Works
2007-04-09 18:42:33 -------- d-----w C:\Program Files\Microsoft.NET
2007-04-09 18:03:40 -------- d-----w C:\Program Files\Ahead
2007-04-09 18:03:39 -------- d-----w C:\Program Files\Common Files\Ahead
2007-04-09 16:16:12 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Talkback
2007-04-09 16:16:09 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Thunderbird
2007-04-09 16:05:52 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Visicom Media
2007-04-09 16:05:50 -------- d-----w C:\Program Files\Visicom Media
2007-04-08 20:54:59 -------- d-----w C:\Program Files\Realtek Sound Manager
2007-04-08 20:52:37 -------- d-----w C:\Program Files\AvRack
2007-04-08 20:52:29 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-04-08 20:09:12 -------- d-----w C:\Program Files\Common Files\ODBC
2007-04-08 20:09:10 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-04-08 20:01:13 76,582 ----a-w C:\WINDOWS\system32\perfc013.dat
2007-04-08 20:01:13 455,614 ----a-w C:\WINDOWS\system32\perfh013.dat
2007-04-08 19:53:50 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\InstallShield
2007-04-08 19:41:33 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-04-08 19:34:00 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\vlc
2007-04-08 19:33:46 -------- d-----w C:\Program Files\VideoLAN
2007-04-08 19:32:27 98,304 ----a-w C:\WINDOWS\system32\qttask.exe
2007-04-08 19:31:46 -------- d-----w C:\Program Files\ACE Mega CoDecS Pack
2007-04-08 19:05:55 -------- d-----w C:\Program Files\Winamp
2007-04-08 18:48:17 -------- d-----w C:\Program Files\Guitar Pro 5
2007-04-08 18:42:50 0 ----a-w C:\WINDOWS\nsreg.dat
2007-04-08 18:37:17 -------- d-----w C:\Program Files\Stardock
2007-04-08 18:33:09 -------- d-----w C:\Program Files\Synergy
2007-04-08 18:18:41 -------- d-----w C:\Program Files\microsoft frontpage
2007-04-08 18:18:16 0 --sha-r C:\MSDOS.SYS
2007-04-08 18:18:16 0 --sha-r C:\IO.SYS
2007-04-08 18:18:16 0 ----a-w C:\CONFIG.SYS
2007-04-08 18:18:16 0 ----a-w C:\AUTOEXEC.BAT
2007-04-08 18:17:20 -------- d--h--w C:\Program Files\WindowsUpdate
2007-04-08 18:17:16 -------- d-----w C:\Program Files\Online Services
2007-04-08 18:16:38 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-04-08 18:16:33 -------- d-----w C:\Program Files\Movie Maker
2007-04-08 18:15:46 21,748 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-04-08 18:15:21 -------- d-----w C:\Program Files\Messenger
2007-04-08 18:15:16 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-04-08 18:15:07 -------- d-----w C:\Program Files\Windows NT


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"="C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll"
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"="C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"hidesafe"="C:\\DOCUME~1\\ADMINI~1\\APPLIC~1\\16bags\\pollinfocash.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_3"=hex(2):72,75,6e,64,6c,6c,33,32,20,61,64,76,70,61,63,6b,2e,64,6c,6c,\
2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,45,78,20,6e,4c,69,74,65,\
2e,69,6e,66,2c,43,2c,2c,34,2c,4e,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll"


HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="wbsys.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages msv1_0\0\0
Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages scecli\0\0

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^administrator^menu start^programma's^opstarten^adobe gamma.lnk
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^all users^menu start^programma's^opstarten^adobe reader snelle start.lnk
C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!avg anti-spyware
"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bearshare
"C:\Program Files\BearShare\BearShare.exe" /pause

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hidesafe
C:\DOCUME~1\ADMINI~1\APPLIC~1\16bags\pollinfocash.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ipwins
"C:\Program Files\Ipwindows\ipwins.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jkv
"C:\Documents and Settings\Administrator\Application Data\??stem32\??ool32.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr
"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nerofiltercheck
C:\WINDOWS\system32\NeroCheck.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvcpldaemon
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvmediacenter
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz
"nwiz.exe" /install

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\para
"C:\PROGRA~1\COMMON~1\FNTS~1\mmc.exe" -vt ndrv

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\quicktime task
"C:\WINDOWS\system32\qttask.exe" -atboottime

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\soundman
SOUNDMAN.EXE

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spysweeper
"C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sunjavaupdatesched
"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\title the log hide
C:\Documents and Settings\All Users\Application Data\campsupporttitlethe\build surf.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uuji
C:\WINDOWS\s?curity\w?nspool.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vvsn
C:\Program Files\VVSN\VVSN.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\whenusave
"C:\Program Files\Save\Save.exe"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter HTTPFilter\0\0
LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService DnsCache\0\0
DcomLaunch DcomLaunch\0TermService\0\0
rpcss RpcSs\0\0
imgsvc StiSvc\0\0
termsvcs TermService\0\0
Usnsvc usnsvc\0\0

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost



Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AA13925290A0088E.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-12 13:10:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


********************************************************************

Completion time: 2007-05-12 13:10:52 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-05-12 13:10

HIJACK THIS

Logfile of HijackThis v1.99.1
Scan saved at 13:12:18, on 12/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Synergy\synergys.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Winamp\winamp.exe
G:\Software\Hijak This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [hidesafe] C:\DOCUME~1\ADMINI~1\APPLIC~1\16bags\pollinfocash.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sergeant-bob.spaces.live.com//PhotoUpload/MsnPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Synergy Server - Unknown owner - C:\Program Files\Synergy\synergys.exe

alvast bedankt ik heb er geen meer :D
J

Jurgenv1

Legacy Member
* open hijackthis en vink volgende regels aan indien aanwezig:

O4 - HKCU\..\Run: [hidesafe] C:\DOCUME~1\ADMINI~1\APPLIC~1\16bags\pollinfocash. exe

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Start je computer op in VEILIGE MODUS

* Ga naar Start en klik op Deze computer.
In de menubalk selecteer je Extra en dan Mapopties.
Selecteer de tab Weergave.
Bij Verborgen bestanden en mappen selecteer je Verborgen bestanden en mappen weergeven.
Bij Bestanden en mappen haal je het vinkje weg bij: Beveiligde besturingssysteembestanden verbergen (aanbevolen).
Klik op Ja om dit te bevestigen.
Klik op OK.

* verwijder volgende mappen indien aanwezig:

C:\Documents and Settings\ADMINI~1\Application Data\16bags

* start je pc weer normaal

* Download dit bestand: Deljob.exe (mirror)
Plaats het op je bureaublad.
Indien je virusscanner de download van deljob.exe blokkeert,
schakel dan tijdelijk je virusscanner uit of download de zip-versie
deljob.zip en pak deze uit naar je Bureaublad.
Dubbelklik Deljob.exe.
Een logje(logit.txt) zal openen, het bestandje kan je ook terugvinden op je bureaublad.
Post de inhoud van logit.txt in je volgende bericht met een nieuw logje van combofix.
S

Sergeant_bob

Legacy Member
DELJOB

--------------------------------------------------------
BACKUPS CREATED in C:\DELJOB

AA13925290A0088E.job
--------------------------------------------------------
FILES IN TASKS FOLDER

--------------------------------------------------------
EXPORT APP DATA FOLDERS

Het volume in station C heeft geen naam.
Het volumenummer is D4ED-E282

Map van C:\Documents and Settings\Administrator\Application Data

14/05/2007 00:36 <DIR> .
14/05/2007 00:36 <DIR> ..
06/05/2007 01:04 <DIR> Adobe
02/05/2007 20:04 <DIR> AdobeUM
11/05/2007 23:32 <DIR> Creative
08/04/2007 20:21 <DIR> IDENTI~1 Identities
08/04/2007 21:53 <DIR> INSTAL~1 InstallShield
12/05/2007 23:04 <DIR> Joost
06/05/2007 01:21 <DIR> Lavasoft
08/04/2007 21:43 <DIR> MACROM~1 Macromedia
02/05/2007 20:08 <DIR> MICROS~1 Microsoft
09/04/2007 18:16 <DIR> Mozilla
26/04/2007 20:55 <DIR> Mp3tag
27/04/2007 23:37 <DIR> SCREEN~1 Screenshot Sender
12/04/2007 13:11 <DIR> Sun
09/04/2007 18:16 <DIR> Talkback
09/04/2007 18:16 <DIR> THUNDE~1 Thunderbird
05/05/2007 10:53 <DIR> uTorrent
09/04/2007 18:05 <DIR> VISICO~1 Visicom Media
08/04/2007 21:34 <DIR> vlc
0 bestand(en) 0 bytes
20 map(pen) 8.294.776.832 bytes beschikbaar
Het volume in station C heeft geen naam.
Het volumenummer is D4ED-E282

Map van C:\Documents and Settings\All Users\Application Data

11/05/2007 23:40 <DIR> .
11/05/2007 23:40 <DIR> ..
02/05/2007 20:03 <DIR> Adobe
02/05/2007 20:01 <DIR> ADOBES~1 Adobe Systems
11/05/2007 23:40 <DIR> AVS4YOU
09/05/2007 00:01 <DIR> CAMPSU~1 campsupporttitlethe
08/04/2007 22:08 <DIR> MEDIAC~1 Media Center Programs
24/04/2007 18:51 <DIR> MESSEN~1 Messenger Plus!
27/04/2007 23:48 <DIR> MICROS~1 Microsoft
09/04/2007 20:43 <DIR> MICROS~2 Microsoft Help
08/04/2007 22:14 <DIR> NVIEW_~1 nView_Profiles
23/04/2007 17:49 <DIR> TRACKM~1 TrackMania United
0 bestand(en) 0 bytes
12 map(pen) 8.294.776.832 bytes beschikbaar
--------------------------------------------------------


Hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 0:42:43, on 14/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Synergy\synergys.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
G:\Software\Hijak This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sergeant-bob.spaces.live.com//PhotoUpload/MsnPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Synergy Server - Unknown owner - C:\Program Files\Synergy\synergys.exe

sorry voor de laate reply, alvast bedaankt ik heb er nu totaal geen meer :)
J

Jurgenv1

Legacy Member
Nog een paar tips om problemen te voorkomen in de toekomst:

Installeer alvast volgende GRATIS programmatjes indien je ze nog niet hebt:

Spywareblaster
Adaware se
Spybot s&d


Tijdens het surfen, klik niet overal klakkeloos op ja als je dit gevraagd wordt... doe dit enkel wanneer je het volledig vertrouwt.

En kies eventueel een alternatieve browser zoals Opera of Firefox.

En ik raad je ook aan om af en toe een online virusscan uit te voeren. housecall en/of Bitdefender. Want, wat de ene scanner niet kan vinden, kan een andere misschien wel.
Zorg er ook voor dat je virusscanner die op je systeem geïnstalleerd is altijd up to date is!!

En... geregeld eens een bezoekje brengen aan: http://windowsupdate.microsoft.com/

Bekijk ook eens deze 2 filmpjes.. Heel interessant:
http://www2.trosradar.nl/mediaplayer/player.php?videoID=524&mode=dossier#
http://www.benedelman.org/spyware/security-111804.wmv


Meer preventietips zijn ook op volgende sites te vinden:

http://www.bluemedicine.be
http://users.telenet.be/marcvn/spyware
How did I get infected in the first place (article by TonyKlein)
Het voorkomen van spyware-infecties en browserhijacking
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan