Archief - Q: Virussen

Logfile of HijackThis v1.99.1
Scan saved at 4:08:59, on 10/03/2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Winamp\Winamp.exe
C:\Documents and Settings\Scampi_ml\Bureaublad\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://www.yahoo.com/[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] wins.exe
O4 - HKLM\..\RunServices: [NTSF MICROSOFT SYSTEM] winreg.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - [url]http://housecall-beta.trendmicro.com/housecall/xscan60.cab[/url]
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - [url]http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab[/url]
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[5/10] Command line: ""... 
[5/10] Detected CPU: Vendor: "AMD" Name: "Athlon XP (Barton)" Family: 6 Model: 10 Stepping: 0 
[5/10] CPU: Enhanced 3dNow! support activated! 
[1/10] LeakerBot (0.3.1) "Release" on "Win32" starting up... 
[2/10] Debugging with debuglevel of 10... 
[5/10] Assigning base subsystems... 
[5/10] Initializing base subsystems... 
[5/10] Starting service thread... 
[2/10] CThread::Start(cthread.cpp): Starting CService thread using CreateThread(). 
[5/10] Installing bot... 
[5/10] Checking for multiple copies... 
[5/10] Command line: ""... 
[5/10] Detected CPU: Vendor: "AMD" Name: "Athlon XP (Barton)" Family: 6 Model: 10 Stepping: 0 
[5/10] CPU: Enhanced 3dNow! support activated! 
[1/10] LeakerBot (0.3.1) "Release" on "Win32" starting up... 
[2/10] Debugging with debuglevel of 10... 
[5/10] Assigning base subsystems... 
[5/10] Initializing base subsystems... 
[5/10] Starting service thread... 
[2/10] CThread::Start(cthread.cpp): Starting CService thread using CreateThread(). 
[5/10] Installing bot... 
[5/10] Checking for multiple copies... 
[5/10] CService::CService(utility.cpp): Starting service... 
[5/10] CService::CService(utility.cpp): Starting service control dispatcher... 
[5/10] First copy running... 
[5/10] Trying to copy to system directory... 
[5/10] Finished copying to system directory... 
[5/10] Starting new process... 
[5/10] Command line: "-meltserver "c:\ahefmztb.exe""... 
[5/10] Detected CPU: Vendor: "AMD" Name: "Athlon XP (Barton)" Family: 6 Model: 10 Stepping: 0 
[5/10] CPU: Enhanced 3dNow! support activated! 
[1/10] LeakerBot (0.3.1) "Release" on "Win32" starting up... 
[2/10] Debugging with debuglevel of 10... 
[5/10] Assigning base subsystems... 
[5/10] Initializing base subsystems... 
[5/10] Starting service thread... 
[2/10] CThread::Start(cthread.cpp): Starting CService thread using CreateThread(). 
[5/10] Installing bot... 
[5/10] Checking for multiple copies... 
[5/10] CService::CService(utility.cpp): Starting service... 
[5/10] CService::CService(utility.cpp): Starting service control dispatcher... 
[5/10] First copy running... 
[5/10] Adding registry autostart... 
[5/10] Adding service... 
[5/10] Starting service... 
[5/10] Command line: "-service"... 
[5/10] Detected CPU: Vendor: "AMD" Name: "Athlon XP (Barton)" Family: 6 Model: 10 Stepping: 0 
[5/10] CPU: Enhanced 3dNow! support activated! 
[1/10] LeakerBot (0.3.1) "Release" on "Win32" starting up... 
[2/10] Debugging with debuglevel of 10... 
[5/10] Assigning base subsystems... 
[5/10] Initializing base subsystems... 
[5/10] Starting service thread... 
[2/10] CThread::Start(cthread.cpp): Starting CService thread using CreateThread(). 
[5/10] Installing bot... 
[5/10] Checking for multiple copies... 
[5/10] First copy running... 
[5/10] Adding registry autostart... 
[7/10] Initializing RNG... 
[7/10] Starting the startup thread... 
[2/10] CThread::Start(cthread.cpp): Starting CStartupThread thread using CreateThread(). 
[5/10] Initializing subsystems... 
[5/10] Starting threads... 
[2/10] CThread::Start(cthread.cpp): Starting CIRC thread using CreateThread(). 
[2/10] CThread::Start(cthread.cpp): Starting CThread thread using CreateThread(). 
[2/10] CThread::Start(cthread.cpp): Starting CThread thread using CreateThread(). 
[7/10] Starting the main loop... 
[5/10] CService::CService(utility.cpp): Starting service... 
[5/10] CService::CService(utility.cpp): Starting service control dispatcher... 
[5/10] ServiceStart(utility.cpp): Starting up service... 
[5/10] ServiceStart(utility.cpp): Registering service handler... 
[5/10] ServiceStart(utility.cpp): Setting service to running... 
[5/10] ServiceStart(utility.cpp): Finished Initialization. 
[5/10] CStartupThread::Run(): Checking if host can spam AOL. 
[5/10] CStartupThread::Run(): Checking the hosts speed. 
[5/10] CStartupThread::Run(): Executing ONSTARTUPFIN script. 
[2/10] CThread::RunWrapper(cthread.cpp): CStartupThread thread exiting (5 threads). 
[4/10] CIRC(0x007C0048h): Trying to connect to "leak.eliteirc.co.uk:8080"... 
[5/10] CSocketServer(0x0081DF14h): Binding SendFile to port 25817. 
[5/10] CSocketServer(0x0081DF14h): SendFile listening on port 25817 (listening socket: 240). 
[5/10] CSocketServer(0x0081DF14h): Creating new socket. 
[5/10] CSocketServer(0x0081DF14h): Waiting for connection. 
[5/10] CSocketServer(0x0081E870h): Binding FTP to port 14943. 
[5/10] CSocketServer(0x0081E870h): FTP listening on port 14943 (listening socket: 256). 
[5/10] CSocketServer(0x0081E870h): Creating new socket. 
[5/10] CSocketServer(0x0081E870h): Waiting for connection. 
[4/10] CIRC(0x007C0048h): Connection to "leak.eliteirc.co.uk:8080" failed!