Archief - veel spyware, antivirus xp enz.

Hallo,

Mijn broer heeft zijn pc redelijk gemold. Zou je dit logje eens willen controlleren.

thx

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:23:46, on 18/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\sprof\sprof.exe
C:\Program Files\Microsoft Security Adviser\msctrl.exe
C:\Program Files\Microsoft Security Adviser\msavsc.exe
C:\Program Files\Microsoft Security Adviser\msscan.exe
C:\Program Files\Microsoft Security Adviser\msiemon.exe
C:\Program Files\Microsoft Security Adviser\msfw.exe
C:\WINDOWS\system32\lphcla2j0ecdp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\pphcla2j0ecdp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Security Adviser\mssadv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forum.bugland.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: 473083 helper - {7DC3E763-855E-4B27-BD7F-6E67B533EB4C} - C:\WINDOWS\system32\473083\473083.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: iSecurity - {A8311E8F-E459-4D22-89B4-CB9DCF10A425} - iSecurity.cpl (file missing)
O2 - BHO: cj helper - {B552B8A4-76AC-4e8c-A469-C1585B111116} - C:\Program Files\IE Extensions\cj.v5.dll
O2 - BHO: (no name) - {BD8ADE14-5580-4CB8-83C7-E23C5C859D08} - C:\WINDOWS\system32\avmete.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iSecurity applet] rundll32.exe iSecurity.cpl,SecurityMonitor
O4 - HKLM\..\Run: [sprof] C:\Program Files\sprof\sprof.exe
O4 - HKLM\..\Run: [Windows defend] C:\Program Files\iSecurity\{9DA536DD-32B1-4944-B34F-98A8E18CF2BA}\install.exe
O4 - HKLM\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe
O4 - HKLM\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe
O4 - HKLM\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe
O4 - HKLM\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe
O4 - HKLM\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe
O4 - HKLM\..\Run: [lphcla2j0ecdp] C:\WINDOWS\system32\lphcla2j0ecdp.exe
O4 - HKLM\..\Run: [SMrhcga2j0ecdp] C:\Program Files\rhcga2j0ecdp\rhcga2j0ecdp.exe
O4 - HKLM\..\Run: [lphcg4qj0e5kt] C:\WINDOWS\system32\lphcg4qj0e5kt.exe
O4 - HKCU\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe
O4 - HKCU\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe
O4 - HKCU\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe
O4 - HKCU\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe
O4 - HKCU\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1217886301288
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100
O20 - AppInit_DLLs: iSecurity.cpl
O21 - SSODL: iSecurity - {A8311E8F-E459-4D22-89B4-CB9DCF10A425} - iSecurity.cpl (file missing)
O21 - SSODL: PreBootCheck - {21139550-a3d4-4e47-b4a6-0a44008caee7} - C:\WINDOWS\Resources\KbdStd.dll

--
End of file - 5614 bytes

Download combofix.exe: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Plaats het op je bureaublad.
Dubbelklik er op om het programma te starten.
In het scherm dat verschijnt tik je een 1 in om het cleaning- en analysesproces te laten uitvoeren.
Volg de instructies op het scherm.
Als het tooltje klaar is, opent er een logfile (combofix.txt).
Post de inhoud van dit bestandje samen met een nieuwe hijackthislog.

ComboFix 08-08-18.04 - joeri 2008-08-19 13:11:07.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.144 [GMT 2:00]
Gestart vanuit: C:\Documents and Settings\joeri\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\joeri\Application Data\rhcga2j0ecdp
C:\Documents and Settings\joeri\Bureaublad\Antivirus 2009.lnk
C:\Documents and Settings\joeri\Bureaublad\Antivirus XP 2008.lnk
C:\Documents and Settings\joeri\Bureaublad\SystemDefender.lnk
C:\Documents and Settings\joeri\Cookies\[email protected][2].txt
C:\Documents and Settings\joeri\Cookies\joeri@live[2].txt
C:\Documents and Settings\joeri\UserData
C:\Documents and Settings\joeri\UserData\12W55WMY\IsOnIE6tbPromo[1].xml
C:\Documents and Settings\joeri\UserData\DVB2W3W6\Tdy58[1].xml
C:\Documents and Settings\joeri\UserData\index.dat
C:\Documents and Settings\joeri\UserData\YKRVHU2V\oWindowsUpdate[1].xml
C:\Program Files\IE Extensions
C:\Program Files\IE Extensions\cj.v5.dll
C:\Program Files\iSecurity
C:\Program Files\iSecurity\{829DAC63-1F27-41a9-846B-30536AD47135}\install.exe
C:\Program Files\iSecurity\antivirusxp.bmp
C:\Program Files\iSecurity\antivirusxp.ico
C:\Program Files\iSecurity\antivirusxpi.bmp
C:\Program Files\iSecurity\av2009.bmp
C:\Program Files\iSecurity\av2009.ico
C:\Program Files\iSecurity\av2009i.bmp
C:\Program Files\iSecurity\iSecurity.dat
C:\Program Files\iSecurity\iSecurity.html
C:\Program Files\iSecurity\systemdefender.bmp
C:\Program Files\iSecurity\systemdefender.ico
C:\Program Files\iSecurity\SystemDefender\install.exe
C:\Program Files\iSecurity\systemdefenderi.bmp
C:\Program Files\iSecurity\Thumbs.db
C:\Program Files\iSecurity\v20\iSecurity.cpl
C:\Program Files\Microsoft Security Adviser
C:\Program Files\Microsoft Security Adviser\msavsc.exe
C:\Program Files\Microsoft Security Adviser\msctrl.exe
C:\Program Files\Microsoft Security Adviser\msctrl.log
C:\Program Files\Microsoft Security Adviser\msfw.exe
C:\Program Files\Microsoft Security Adviser\msiemon.exe
C:\Program Files\Microsoft Security Adviser\mssadv.exe
C:\Program Files\Microsoft Security Adviser\mssadv.log
C:\Program Files\Microsoft Security Adviser\mssadv_sp.log
C:\Program Files\Microsoft Security Adviser\msscan.exe
C:\Program Files\rhcga2j0ecdp
C:\Program Files\sprof
C:\Program Files\sprof\sprof.exe
C:\Program Files\SystemDefender
C:\syst.exe
C:\WINDOWS\resources\KbdStd.dll
C:\WINDOWS\system32\1.tmp
C:\WINDOWS\system32\2.tmp
C:\WINDOWS\system32\3.tmp
C:\WINDOWS\system32\4.tmp
C:\WINDOWS\system32\473083
C:\WINDOWS\system32\473083\473083.dll
C:\WINDOWS\system32\5.tmp
C:\WINDOWS\system32\6.tmp
C:\WINDOWS\system32\7.tmp
C:\WINDOWS\system32\8.tmp
C:\WINDOWS\system32\9.tmp
C:\WINDOWS\system32\A.tmp
C:\WINDOWS\system32\avmete.dll
C:\WINDOWS\system32\B.tmp
C:\WINDOWS\system32\blphcg4qj0e5kt.scr
C:\WINDOWS\system32\blphcla2j0ecdp.scr
C:\WINDOWS\system32\C.tmp
C:\WINDOWS\system32\D.tmp
C:\WINDOWS\system32\E.tmp
C:\WINDOWS\system32\F.tmp
C:\WINDOWS\system32\ISECUR~1.CPL
C:\WINDOWS\system32\iSecurity.cpl
C:\WINDOWS\system32\lphcg4qj0e5kt.exe
C:\WINDOWS\system32\lphcla2j0ecdp.exe
C:\WINDOWS\system32\phcg4qj0e5kt.bmp
C:\WINDOWS\system32\phcla2j0ecdp.bmp
C:\WINDOWS\system32\pphcla2j0ecdp.exe

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-07-19 to 2008-08-19 ))))))))))))))))))))))))))))))
.

2008-08-18 14:23 . 2008-08-18 14:23 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-18 14:12 . 2008-08-18 14:12 0 --a------ C:\WINDOWS\system32\272.tmp
2008-08-08 15:32 . 2008-08-08 15:32 0 --a------ C:\WINDOWS\system32\FF.tmp
2008-08-08 15:20 . 2008-08-08 15:25 94,208 --a------ C:\WINDOWS\system32\34.tmp
2008-08-08 12:50 . 2008-08-08 13:51 94,208 --a------ C:\WINDOWS\system32\24.tmp
2008-08-08 00:18 . 2008-08-08 00:18 1 --a------ C:\WINDOWS\fmark2.dat
2008-08-07 23:13 . 2008-08-07 23:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-08-07 11:29 . 2008-08-07 11:29 <DIR> d-------- C:\Program Files\Messenger Plus! Live
2008-08-05 19:05 . 2008-08-05 19:06 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-08-05 19:01 . 2008-08-06 10:59 <DIR> d-------- C:\Program Files\NOS
2008-08-05 19:01 . 2008-08-06 10:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS
2008-08-05 13:50 . 2008-08-05 13:50 <DIR> d-------- C:\Documents and Settings\joerike\Mijn documenten
2008-08-05 13:50 . 2008-08-05 13:50 <DIR> d-------- C:\Documents and Settings\joerike
2008-08-05 13:43 . 2008-08-06 14:57 <DIR> d-------- C:\Documents and Settings\joeri\Application Data\LimeWire
2008-08-05 13:40 . 2008-08-05 13:40 <DIR> d-------- C:\WINDOWS\Sun
2008-08-05 13:38 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-05 13:37 . 2008-08-05 13:38 <DIR> d-------- C:\Program Files\Java
2008-08-05 13:37 . 2008-08-05 13:37 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-05 13:34 . 2008-08-05 13:35 <DIR> d-------- C:\Program Files\LimeWire
2008-08-05 13:27 . 2001-09-06 21:26 89,088 --a------ C:\WINDOWS\system32\hpgt33.dll
2008-08-05 13:27 . 2001-09-06 21:26 89,088 --a--c--- C:\WINDOWS\system32\dllcache\hpgt33.dll
2008-08-05 13:27 . 2001-09-06 21:27 87,040 --a------ C:\WINDOWS\system32\wiafbdrv.dll
2008-08-05 13:27 . 2001-09-06 21:27 87,040 --a--c--- C:\WINDOWS\system32\dllcache\wiafbdrv.dll
2008-08-05 13:27 . 2001-09-06 21:26 48,128 --a------ C:\WINDOWS\system32\hpgt33tk.dll
2008-08-05 13:27 . 2001-09-06 21:26 48,128 --a--c--- C:\WINDOWS\system32\dllcache\hpgt33tk.dll
2008-08-05 13:27 . 2001-09-06 21:26 32,768 --a------ C:\WINDOWS\system32\hpgtmcro.dll
2008-08-05 13:27 . 2001-09-06 21:26 32,768 --a--c--- C:\WINDOWS\system32\dllcache\hpgtmcro.dll
2008-08-05 13:27 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-08-05 13:27 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-08-05 12:49 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-08-05 00:08 . 2008-08-05 11:43 <DIR> d-------- C:\Documents and Settings\joeri\Contacts
2008-08-05 00:06 . 2008-08-05 00:06 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-08-05 00:01 . 2008-08-05 00:05 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-08-05 00:00 . 2008-08-05 00:06 <DIR> d-------- C:\Program Files\Windows Live
2008-08-05 00:00 . 2008-08-05 00:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-08-04 23:52 . 2008-08-04 23:52 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-08-04 23:52 . 2005-02-25 05:35 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-08-04 23:46 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-08-04 23:46 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-08-04 23:46 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-08-04 23:46 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-08-04 23:46 . 2007-07-30 19:18 20,824 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-08-04 22:41 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-08-04 22:41 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-13 17:58 94,208 ----a-w C:\WINDOWS\system32\168.tmp
2008-08-13 17:58 94,208 ----a-w C:\WINDOWS\system32\167.tmp
2008-08-13 17:58 94,208 ----a-w C:\WINDOWS\system32\166.tmp
2008-08-13 17:58 94,208 ----a-w C:\WINDOWS\system32\165.tmp
2008-08-13 17:58 94,208 ----a-w C:\WINDOWS\system32\164.tmp
2008-08-13 17:58 94,208 ----a-w C:\WINDOWS\system32\163.tmp
2008-08-13 17:57 94,208 ----a-w C:\WINDOWS\system32\162.tmp
2008-08-13 17:57 94,208 ----a-w C:\WINDOWS\system32\161.tmp
2008-08-13 17:56 94,208 ----a-w C:\WINDOWS\system32\160.tmp
2008-08-13 17:56 94,208 ----a-w C:\WINDOWS\system32\15F.tmp
2008-08-13 17:56 94,208 ----a-w C:\WINDOWS\system32\15E.tmp
2008-08-13 17:55 94,208 ----a-w C:\WINDOWS\system32\15D.tmp
2008-08-13 17:55 94,208 ----a-w C:\WINDOWS\system32\15C.tmp
2008-08-11 10:39 94,208 ----a-w C:\WINDOWS\system32\15B.tmp
2008-08-11 10:39 94,208 ----a-w C:\WINDOWS\system32\15A.tmp
2008-08-11 10:38 94,208 ----a-w C:\WINDOWS\system32\159.tmp
2008-08-11 10:38 94,208 ----a-w C:\WINDOWS\system32\158.tmp
2008-08-11 10:38 94,208 ----a-w C:\WINDOWS\system32\157.tmp
2008-08-11 10:38 94,208 ----a-w C:\WINDOWS\system32\156.tmp
2008-08-11 10:37 94,208 ----a-w C:\WINDOWS\system32\155.tmp
2008-08-11 10:37 94,208 ----a-w C:\WINDOWS\system32\154.tmp
2008-08-11 10:37 94,208 ----a-w C:\WINDOWS\system32\153.tmp
2008-08-11 10:36 94,208 ----a-w C:\WINDOWS\system32\152.tmp
2008-08-11 10:36 94,208 ----a-w C:\WINDOWS\system32\151.tmp
2008-08-11 10:36 94,208 ----a-w C:\WINDOWS\system32\150.tmp
2008-08-11 10:35 94,208 ----a-w C:\WINDOWS\system32\14F.tmp
2008-08-11 10:35 94,208 ----a-w C:\WINDOWS\system32\14E.tmp
2008-08-11 10:34 94,208 ----a-w C:\WINDOWS\system32\14D.tmp
2008-08-08 13:24 94,208 ----a-w C:\WINDOWS\system32\33.tmp
2008-08-08 13:24 94,208 ----a-w C:\WINDOWS\system32\32.tmp
2008-08-08 13:24 94,208 ----a-w C:\WINDOWS\system32\31.tmp
2008-08-08 13:24 94,208 ----a-w C:\WINDOWS\system32\30.tmp
2008-08-08 13:23 94,208 ----a-w C:\WINDOWS\system32\2F.tmp
2008-08-08 13:23 94,208 ----a-w C:\WINDOWS\system32\2E.tmp
2008-08-08 13:23 94,208 ----a-w C:\WINDOWS\system32\2D.tmp
2008-08-08 13:22 94,208 ----a-w C:\WINDOWS\system32\2C.tmp
2008-08-08 13:22 94,208 ----a-w C:\WINDOWS\system32\2B.tmp
2008-08-08 13:22 94,208 ----a-w C:\WINDOWS\system32\2A.tmp
2008-08-08 13:21 94,208 ----a-w C:\WINDOWS\system32\29.tmp
2008-08-08 13:21 94,208 ----a-w C:\WINDOWS\system32\28.tmp
2008-08-08 13:21 94,208 ----a-w C:\WINDOWS\system32\27.tmp
2008-08-08 13:21 94,208 ----a-w C:\WINDOWS\system32\26.tmp
2008-08-08 13:20 94,208 ----a-w C:\WINDOWS\system32\25.tmp
2008-08-08 11:51 94,208 ----a-w C:\WINDOWS\system32\23.tmp
2008-08-08 11:50 94,208 ----a-w C:\WINDOWS\system32\22.tmp
2008-08-08 11:50 94,208 ----a-w C:\WINDOWS\system32\21.tmp
2008-08-08 11:50 94,208 ----a-w C:\WINDOWS\system32\20.tmp
2008-08-08 11:49 94,208 ----a-w C:\WINDOWS\system32\1F.tmp
2008-08-08 11:49 94,208 ----a-w C:\WINDOWS\system32\1E.tmp
2008-08-08 11:48 94,208 ----a-w C:\WINDOWS\system32\1D.tmp
2008-08-08 11:48 94,208 ----a-w C:\WINDOWS\system32\1C.tmp
2008-08-08 11:47 94,208 ----a-w C:\WINDOWS\system32\1B.tmp
2008-08-08 11:47 94,208 ----a-w C:\WINDOWS\system32\1A.tmp
2008-08-08 11:47 94,208 ----a-w C:\WINDOWS\system32\19.tmp
2008-08-08 11:47 94,208 ----a-w C:\WINDOWS\system32\18.tmp
2008-08-08 11:10 94,208 ----a-w C:\WINDOWS\system32\17.tmp
2008-08-08 11:10 94,208 ----a-w C:\WINDOWS\system32\16.tmp
2008-08-08 11:09 94,208 ----a-w C:\WINDOWS\system32\15.tmp
2008-08-08 11:09 94,208 ----a-w C:\WINDOWS\system32\14.tmp
2008-08-08 11:09 94,208 ----a-w C:\WINDOWS\system32\13.tmp
2008-08-08 11:08 94,208 ----a-w C:\WINDOWS\system32\12.tmp
2008-08-08 11:08 94,208 ----a-w C:\WINDOWS\system32\11.tmp
2008-08-08 11:08 94,208 ----a-w C:\WINDOWS\system32\10.tmp
2008-08-04 15:45 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-sprof - C:\Program Files\sprof\sprof.exe
HKLM-Run-Windows defend - C:\Program Files\iSecurity\{9DA536DD-32B1-4944-B34F-98A8E18CF2BA}\install.exe
HKLM-Run-lphcla2j0ecdp - C:\WINDOWS\system32\lphcla2j0ecdp.exe
HKLM-Run-SMrhcga2j0ecdp - C:\Program Files\rhcga2j0ecdp\rhcga2j0ecdp.exe
HKLM-Run-lphcg4qj0e5kt - C:\WINDOWS\system32\lphcg4qj0e5kt.exe


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.forum.bugland.be/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 13:18:04
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2008-08-19 13:21:21 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-19 11:21:14

Pre-Run: 76,859,949,056 bytes beschikbaar
Post-Run: 77,281,681,408 bytes beschikbaar

240


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:28:20, on 19/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forum.bugland.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1217886301288
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100

--
End of file - 3376 bytes

* Download Malwarebytes' Anti-Malware via hier of hier.

Dubbelklik mbam-setup.exe om het programma te installeren.

• Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Launch Malwarebytes' Anti-Malware, Klik daarna op "finish".
• Indien een update gevonden werd, zal het die downloaden en de laatste versie installeren.
• Wanneer het programma volledig up to date is, selecteer "Perform Quick Scan", daarna klik Scan.
• Het scannen kan een tijdje duren, dus wees geduldig.
• Wanneer de scan voltooid is, klik OK, daarna "Show Results" om de resultaten te zien.
• Zorg ervoor dat daar alles aangevinkt is, daarna klik: Remove Selected.
• Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie extra nota onderaan)
• De log wordt automatisch bewaard door MBAM die je kan zien door de "Logs" tab te klikken in MBAM.
• Kopieer en plak de resultaten van de log in je volgend antwoord, samen met een nieuw HijackThislog.

Extra Nota:
Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de Computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Op die computer werkt geen internet meer, dus die updates zijn niet gebeurd.

Malwarebytes' Anti-Malware 1.25
Database versie: 1062
Windows 5.1.2600 Service Pack 2

23:44:21 21/08/2008
mbam-log-08-21-2008 (23-44-21).txt

Scan type: Snelle Scan
Objecten gescand: 36000
Verstreken tijd: 3 minute(s), 35 second(s)

Geheugenprocessen geïnfecteerd: 0
Geheugenmodulen geïnfecteerd: 0
Registersleutels geïnfecteerd: 6
Registerwaarden geïnfecteerd: 2
Registerdata bestanden geïnfecteerd: 0
Mappen geïnfecteerd: 0
Bestanden geïnfecteerd: 1

Geheugenprocessen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Geheugenmodulen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Registersleutels geïnfecteerd:
HKEY_CLASSES_ROOT\Interface\{a3b4ff8a-d3e7-4692-a9b6-971f62802310} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{2b7763c3-642b-4934-902c-72a63a95127a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcga2j0ecdp (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcga2j0ecdp (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\x123.x123mgr (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\x123.x123mgr.1 (Adware.BHO) -> Quarantined and deleted successfully.

Registerwaarden geïnfecteerd:
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registerdata bestanden geïnfecteerd:
(Geen kwaadaardige items gevonden)

Mappen geïnfecteerd:
(Geen kwaadaardige items gevonden)

Bestanden geïnfecteerd:
C:\Documents and Settings\joeri\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

Klik om te vergroten...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:44:44, on 21/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forum.bugland.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1217886301288
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100

--
End of file - 3560 bytes

Klik om te vergroten...

Hoezo 'er werkt geen internet meer?'

nee, de pc krijgt alleen beperkte verbinding. Ik heb modem enzo al proberen uit te trekken maar dat helpt niet. De andere pc's hier in huis hun internet werkt perfect.

Fout paswoord?

het is geen draadloos internet gewoon via kabel, dus geen pw nodig

• Download en installeer AVG Anti-Spyware.
• Na de installatie open je AVG Anti-Spyware.
• Onder 'Status' klik je naast 'Resident shield' op Change state. (deze moet op 'Inactive' komen te staan)
  Wil je het Resident shield gebruiken in de toekomst, dan laat je dit op "Active" staan.
• Onder 'Status' klik je bij Last Update op Update now.
  Lukt dit niet, dan ga je in het menu naar 'Update' en klik je bij 'Manual update' op de knop Start update.
  
• Onder 'Scanner' ga je naar de tab 'Settings' en zorg je voor de volgende instellingen:
  • onder 'How to act?', klik je op 'Recommended actions' en selecteer je Quarantine.
  • onder 'How to scan?', zorg je dat alle opties geselecteerd zijn.
  • onder 'Possibly unwanted software:', zorg je dat alle opties geselecteerd zijn.
  • onder 'Reports:', selecteer je Automatically generate report after every scan.
  • onder 'Reports:', verwijder je het vinkje bij Only if threats were found.
  • onder 'What to scan?', selecteer je Scan every file.
• Sluit AVG Anti-Spyware. Laat het nog niet scannen.
• Start de computer op in veilige modus. Hoe je dit doet kan je hier lezen.
• Start AVG Anti-Spyware.
• Klik in het menu op 'Scanner'
• Kies Complete system scan.
• AVG Anti-Spyware gaat nu je volledige computer scannen.
• Als de scan be&#65533;indigd is, klik je onderaan op de knop Apply all Actions.
• Wacht to je de melding krijgt 'All actions have been applied'.
• Ga in het menu naar 'Reports', en klik op de knop 'Save report as' en sla het rapport van de scan op op je bureaublad.
• Sluit AVG Anti-Spyware af.
• Herstart de computer in normale modus en post het rapport van AVG Anti-Spyware.

Indien je het rapport niet kan vinden start dan AVG Anti-Spyware opnieuw.
Kies het menu Reports.
In het linkse venster krijg je een overzicht van de gemaakte rapporten.
Selecteer de meest recente (opbouw is datum - uur), en in het rechtse venster zie je nu de inhoud van het scanrapport verschijnen.
Kopieer de inhoud van dit venster en plak het in je volgende post.