Archief - virus heeft zich zonet geïnstalleerd

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
F

Farnsworth

Legacy Member
Mijn zus heeft zonet een virus geïnstalleerd door op een link in een msn messenger gesprek te klikken. Het bestand dat ze gedownload heeft, noemde D90037.JPG_Photobucket.com. Van zodra ze het bestand gedownload had, begon het automatisch dezelfde link te verspreiden naar haar msn-contactpersonen. Dus het is wel degelijk geïnstalleerd.
Ik heb al gescand met NOD32. De trojan win32/Agent.OBH werd daarbij gedetecteerd in een van de systeemherstelbetanden en dat bestand is ondertussen verwijderd.


EDIT: net de sticky over .com-msn-virussen gevonden. Ik zal het stappenplan morgen eens doorlopen.


* oorspronkelijk hijackthis log-file verwijderd *
F

Farnsworth

Legacy Member
Ik heb de procedure, beschreven in de stickies, gevolgd. Hier zijn de log-files. Zou iemand ze eens willen controleren?


AVG log

AVG 8.0 Anti-Virus command line scanner
Copyright (c) 1992 - 2008 AVG Technologies
Program version 8.0.145, engine 8.0.0
Virus Database: Version 270.6.21/1671 2008-09-14

C:\Documents and Settings\Elien\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\Elien\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\Elien\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\Elien\NTUSER.dat.LOG Locked file. Not tested.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\NetworkService\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Locked file. Not tested.
C:\pagefile.sys Locked file. Not tested.
C:\System Volume Information\ Locked file. Not tested.
C:\WINDOWS\system32\config\default Locked file. Not tested.
C:\WINDOWS\system32\config\default.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SAM Locked file. Not tested.
C:\WINDOWS\system32\config\SAM.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\software Locked file. Not tested.
C:\WINDOWS\system32\config\software.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\system Locked file. Not tested.
C:\WINDOWS\system32\config\system.LOG Locked file. Not tested.
D:\samen\System Volume Information\ Locked file. Not tested.
D:\System Volume Information\ Locked file. Not tested.

------------------------------------------------------------
Objects scanned : 518290
Found infections : 0
Found PUPs : 0
Healed infections : 0
Healed PUPs : 0
Warnings : 0


------------------------------------------------------------


COMBOFIX LOG

ComboFix 08-09-13.05 - Elien 2008-09-14 18:11:57.1 - NTFSx86
Gestart vanuit: C:\Documents and Settings\Elien\Bureaublad\VIRUS\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt

WAARSCHUWING - DE RECOVERY CONSOLE IS NIET OP DIT SYSTEEM GEINSTALLEERD !!
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\ehSched.exe

.
(((((((((((((((((((( Bestanden Gemaakt van 2008-08-14 to 2008-09-14 ))))))))))))))))))))))))))))))
.

2008-09-14 15:28 . 2008-09-14 15:28 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-09-14 14:33 . 2008-09-14 14:33 <DIR> d--h----- C:\$AVG8.VAULT$
2008-09-14 12:21 . 2008-09-14 12:49 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-09-14 12:21 . 2008-09-14 12:21 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-09-14 12:21 . 2008-09-14 12:21 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-09-14 12:21 . 2008-09-14 12:21 12,936 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-09-14 12:21 . 2008-09-14 12:21 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-09-14 12:19 . 2008-09-14 12:19 <DIR> d-------- C:\Program Files\AVG
2008-09-14 12:19 . 2008-09-14 12:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-09-14 12:19 . 2008-09-14 12:19 45,568 --a------ C:\WINDOWS\system32\avgfwdx.dll
2008-09-14 12:19 . 2008-09-14 12:19 23,296 --a------ C:\WINDOWS\system32\drivers\avgfwdx.sys
2008-09-14 10:47 . 2008-09-14 10:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-14 00:25 . 2008-09-14 00:25 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-09-13 23:01 . 2008-09-13 23:01 <DIR> d-------- C:\Program Files\Panda Security
2008-09-13 23:01 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-09-07 19:17 . 2008-09-07 19:36 <DIR> d-------- C:\Documents and Settings\Bert\Application Data\DeepBurner
2008-09-07 12:28 . 2008-09-07 12:28 <DIR> d-------- C:\WINDOWS\system32\nl
2008-09-07 12:28 . 2008-09-07 12:28 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-07 12:28 . 2008-09-07 12:28 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-07 12:21 . 2008-09-10 13:05 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-09-06 11:55 . 2008-04-14 19:02 1,306,624 --------- C:\WINDOWS\system32\msxml6.dll
2008-09-06 11:54 . 2008-04-14 19:02 233,472 --------- C:\WINDOWS\system32\azroles.dll
2008-09-06 11:54 . 2008-04-14 19:02 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-09-06 11:54 . 2008-04-14 19:02 48,640 --------- C:\WINDOWS\system32\dhcpqec.dll
2008-09-06 11:54 . 2008-04-14 19:02 39,936 --------- C:\WINDOWS\system32\dimsroam.dll
2008-09-06 11:54 . 2008-04-14 19:02 19,456 --------- C:\WINDOWS\system32\dimsntfy.dll
2008-09-06 11:54 . 2008-04-14 19:02 12,800 --------- C:\WINDOWS\system32\credssp.dll
2008-09-06 11:54 . 2008-04-14 19:02 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll
2008-09-04 16:12 . 2008-09-14 18:01 <DIR> dr-h----- C:\Documents and Settings\Elien\Onlangs geopend
2008-09-04 15:56 . 2008-09-11 20:35 <DIR> dr-h----- C:\Documents and Settings\Mama\Onlangs geopend
2008-09-04 15:50 . 2008-09-07 19:11 <DIR> dr-h----- C:\Documents and Settings\Bert\Onlangs geopend
2008-08-28 16:58 . 2008-08-28 16:58 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-28 16:58 . 2008-08-28 16:58 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-15 14:52 . 2008-08-15 14:52 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-08-15 14:29 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-15 11:32 . 2008-05-01 16:37 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-14 08:46 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-09-13 22:41 --------- d-----w C:\Documents and Settings\Bert\Application Data\Lavasoft
2008-09-13 22:40 --------- d-----w C:\Program Files\Windows Live
2008-09-01 19:00 --------- d-----w C:\Program Files\Hema Album Software be-nl Advanced
2008-09-01 19:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hema Album Software be-nl Advanced
2008-08-05 19:48 68 ----a-w C:\scandata.dat
2008-08-05 19:48 --------- d-----w C:\Program Files\ExtraFilm PhotoAssistant
2008-07-22 22:15 --------- d-----w C:\Documents and Settings\Bert\Application Data\mIRC
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-17 21:08 --------- d-----w C:\Documents and Settings\Bert\Application Data\TeamViewer
2008-07-07 20:30 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 16:43 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:49 247,296 ----a-w C:\WINDOWS\system32\mswsock.dll
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"DrvMon.exe"="C:\WINDOWS\system32\DrvMon.exe" [2004-06-15 53248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 90112]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-18 188416]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="C:\Programs\ScanSoft OmniPage\OpwareSE4.exe" [2006-10-11 75304]
"CloneCDElbyCDFL"="C:\Programs\CloneCD\ElbyCheck.exe" [2002-11-02 45056]
"AVG8_TRAY"="C:\Programs\AVG\AVG8\avgtray.exe" [2008-09-14 1235736]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]
SANTIS USB and PC Card Utility.lnk - C:\Program Files\Siemens\SANTIS WLAN\WlanMonitor.exe [2003-04-02 491520]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^ WinCinema Manager.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\ WinCinema Manager.lnk
backup=C:\WINDOWS\pss\ WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Adobe Reader Snelle start.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Snelle start.lnk
backup=C:\WINDOWS\pss\Adobe Reader Snelle start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Bert^Menu Start^Programma's^Opstarten^Adobe Gamma.lnk]
path=C:\Documents and Settings\Bert\Menu Start\Programma's\Opstarten\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExtraFilmHemmaAgent]
--a------ 2007-11-05 17:59 323584 C:\Program Files\ExtraFilm PhotoAssistant\Agent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
--a------ 2007-02-12 17:21 734624 c:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Programs\\uTorrent\\utorrent.exe"=
"C:\\Programs\\Cerberus FTP Server\\Cerberus.exe"=
"C:\\Programs\\AVG\\AVG8\\avgemc.exe"=
"C:\\Programs\\AVG\\AVG8\\avgupd.exe"=
"C:\\Programs\\AVG\\AVG8\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-09-14 12936]
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-09-14 97928]
R1 nltdi;nltdi;C:\WINDOWS\system32\drivers\nltdi.sys [2006-06-14 93824]
R2 avg8emc;AVG8 E-mail Scanner;C:\Programs\AVG\AVG8\avgemc.exe [2008-09-14 875288]
R2 avg8wd;AVG8 WatchDog;C:\Programs\AVG\AVG8\avgwdsvc.exe [2008-09-14 231704]
R2 avgfws8;AVG8 Firewall;C:\Programs\AVG\AVG8\avgfws8.exe [2008-09-14 1220888]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-09-14 76040]
R3 ATMEL FVNETusbASKEY (AR)(R);ATMEL FVNETusbASKEY (AR)(R) Service for SANTIS WLAN USB Adapter;C:\WINDOWS\system32\DRIVERS\vnetusbk.sys [2003-02-20 93184]
R3 Avgfwdx;Avgfwdx;C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2008-09-14 23296]
R3 camvid20;Philips ToUcam Camera; Video;C:\WINDOWS\system32\DRIVERS\camdrv21.sys [ ]
S3 ATMEL WinXP PCMCIAFVNETR (2ARC)(R);ATMEL WinXP PCMCIAFVNETR (2ARC)(R) Service for SANTIS WLAN PC Card;C:\WINDOWS\system32\DRIVERS\fvnetr51.sys [2003-01-14 91648]
S3 Avgfwfd;AVG network filter service;C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2008-09-14 23296]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{286d99ea-762e-11db-a3ad-0090964c3bb7}]
\Shell\AutoRun\command - G:\loader.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{823f8cb7-bc19-11db-a578-0090964c3bb7}]
\Shell\AutoRun\command - G:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9437a624-50a5-11db-a2cf-806d6172696f}]
\Shell\AutoRun\command - G:\autorun.exe

*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-HotKey - C:\WINDOWS\Twain_32\FlatBed\HotKey.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Elien\Application Data\Mozilla\Firefox\Profiles\ik9j3c1c.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.be
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava11.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava12.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava13.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava14.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava32.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF -: plugin - C:\Programs\Codec\Real Alternative\browser\plugins\nppl3260.dll
FF -: plugin - C:\Programs\Codec\Real Alternative\browser\plugins\nprpjplug.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\np32dsw.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\npnul32.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\nppdf32.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\nppl3260.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\npqtplugin.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\npqtplugin2.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\npqtplugin3.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\npqtplugin4.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\npqtplugin5.dll
FF -: plugin - C:\Programs\Mozilla Firefox\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-14 18:15:10
Windows 5.1.2600 Service Pack 3 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2008-09-14 18:19:18
ComboFix-quarantined-files.txt 2008-09-14 16:19:13

Pre-Run: 21,431,869,440 bytes beschikbaar
Post-Run: 21,439,176,704 bytes beschikbaar

191 --- E O F --- 2008-09-10 16:22:21


-------------------------------------------------------------------------


HIJACKTHIS LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:22:20, on 14/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programs\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programs\AVG\AVG8\avgwdsvc.exe
C:\Programs\AVG\AVG8\avgfws8.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Programs\NetLimiter 2 Pro\nlsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programs\AVG\AVG8\avgam.exe
C:\Programs\AVG\AVG8\avgrsx.exe
C:\Programs\AVG\AVG8\avgnsx.exe
C:\Programs\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Programs\ScanSoft OmniPage\OpwareSE4.exe
C:\Programs\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siemens\SANTIS WLAN\WlanMonitor.exe
C:\Programs\AVG\AVG8\avgscanx.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Elien\Bureaublad\HiJackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programs\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Programs\ScanSoft OmniPage\OpwareSE4.exe"
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Programs\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Programs\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DrvMon.exe] C:\WINDOWS\system32\DrvMon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Lokale service')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Netwerkservice')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SANTIS USB and PC Card Utility.lnk = C:\Program Files\Siemens\SANTIS WLAN\WlanMonitor.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Programs\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Programs\FlashGet\jc_link.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.pandasoftware.com
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://frambooosje.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://frambooosje.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9FB71686-068D-46E5-9625-1AB2B57CDBEB}: NameServer = 195.238.2.21,195.238.2.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7F10542-8877-435F-BF10-E3D22F5052E0}: NameServer = 195.238.2.21,195.238.2.22
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programs\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programs\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Programs\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Programs\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\Programs\AVG\AVG8\avgfws8.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programs\NetLimiter 2 Pro\nlsvc.exe
J

Jurgenv1

Legacy Member
* Download Malwarebytes' Anti-Malware via hier of hier.

Dubbelklik mbam-setup.exe om het programma te installeren.
  • Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Launch Malwarebytes' Anti-Malware, Klik daarna op "finish".
  • Indien een update gevonden werd, zal het die downloaden en de laatste versie installeren.
  • Wanneer het programma volledig up to date is, selecteer "Perform Quick Scan", daarna klik Scan.
  • Het scannen kan een tijdje duren, dus wees geduldig.
  • Wanneer de scan voltooid is, klik OK, daarna "Show Results" om de resultaten te zien.
  • Zorg ervoor dat daar alles aangevinkt is, daarna klik: Remove Selected.
  • Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie extra nota onderaan)
  • De log wordt automatisch bewaard door MBAM die je kan zien door de "Logs" tab te klikken in MBAM.
  • Kopieer en plak de resultaten van de log in je volgend antwoord, samen met een nieuw HijackThislog.
Extra Nota:
Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de Computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.
F

Farnsworth

Legacy Member
Malwarebytes' Anti-Malware 1.28
Database version: 1157
Windows 5.1.2600 Service Pack 3

15/09/2008 22:18:13
mbam-log-2008-09-15 (22-18-13).txt

Scan type: Quick Scan
Objects scanned: 47575
Time elapsed: 4 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
M

MetalG

Legacy Member
try superantispyware die vind echt veel, de naam lijkt verdacht mr da prog is goed ze ^^
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan