Archief - virus

telkens als 'k pc opstart krijg 'k van antivir een waarschuwing:


C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPLICATION DATA\MICROSOFT\CRYPTNETURLCACHE\CONTENT\F482C95F83F1B59228F1B1E720F2EDF1

The Trojan horse TR/Click.Verzil.A.3

als ik dan op delete klik staat em de volgende reboot al terug...

HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 9:35:34, on 20/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
H:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
H:\Program Files\AVPersonal\AVGUARD.EXE
H:\Program Files\AVPersonal\AVWUPSRV.EXE
H:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
H:\Program Files\AVPersonal\GUARDGUI.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hercules\Audio\Hercules DJ Console\DJConsoleMixer.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
H:\Program Files\AVPersonal\AVGNT.EXE
C:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Belkin\Bluetooth Software\BTTray.exe
H:\Program Files\Nokia\PC Suite for N-Gage QD\connmngmntbox.exe
H:\Program Files\Nokia\PC Suite for N-Gage QD\ectaskscheduler.exe
H:\Program Files\mIRC\mirc.exe
H:\PROGRA~1\Nokia\PCSUIT~1\Elogerr.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
H:\PROGRA~1\Belkin\BLUETO~1\BTSTAC~1.EXE
H:\PROGRA~1\Nokia\PCSUIT~1\BROADC~1.EXE
H:\PROGRA~1\Nokia\PCSUIT~1\SCRFS.exe
H:\Program Files\Firefox\firefox.exe
C:\PROGRA~1\Intuwave\Shared\MROUTE~1\MRE513~1.EXE
C:\Documents and Settings\...\Bureaublad\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = HLN home
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - H:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: (no name) - {E5A1691B-D188-4419-AD02-90002030B8EE} - H:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - H:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.EXE -off
O4 - HKLM\..\Run: [DJ Console] C:\Program Files\Hercules\Audio\Hercules DJ Console\DJConsoleMixer.exe -hide
O4 - HKLM\..\Run: [SmcService] H:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] "H:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: NoNameScript.lnk = H:\Program Files\mIRC\mirc.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: PCSuiteForNokiaN-Gage QD Detect.lnk = ?
O4 - Global Startup: PCSuiteForNokiaN-Gage QD TS.lnk = ?
O8 - Extra context menu item: Download All by FlashGet - H:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - H:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://H:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - H:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Onderzoek (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: @btrez.dll,-4015 (HKLM)
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 (HKLM)
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.00.0036/OCI/setup.exe
O16 - DPF: {6211AC26-A1B4-422A-AC52-1E70B7D24465} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/nl/filesharingctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1093036284296
O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortvrml.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38102.3853703704
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab30149.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futuremark.com/global/msc34.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} (CTAdjust Class) - http://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab30149.cab

iemand die weet hoe 'k da weg krijg?
zo te zien geen removal tool van norton enzo

Hoi, heb die virus ook gehad een paar dagen geleden. Bij het opstarten zei Antivir niets, maar ik heb toen een volledige systeemscan laten doen en dan kwam er die waarschuwing. Heb toen op delete gedrukt en is weg denk ik... Ik krijg toch geen melding bij opstarten of zo...

Misschien kun je een scan laten doen in veilige modus... Of manueel gaan zoeken naar die file en die verwijderen ?

Vladimir