antivirus.startpagina.nl

Na drie jaar

  • Anonymous avatar

    Richard

    Deze Pc heeft een tijdje geen onderhoud gehad.

    Wil iemand de goedheid hebben om naar het logje te kijken ?

    Lees dit eerst is uitgevoerd.

    Ewido ook.

    Alvast erg bedankt !

    Logfile of HijackThis v1.99.1

    Scan saved at 14:49:59, on 16-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\csrss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    C:\WINDOWS\System32\nvsvc32.exe

    C:\WINDOWS\system32\wdfmgr.exe

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    C:\HP\KBD\KBD.EXE

    C:\windows\system\hpsysdrv.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    C:\WINDOWS\System32\alg.exe

    C:\WINDOWS\System32\wbem\wmiprvse.exe

    C:\Program Files\Sygate\SPF\smc.exe

    C:\Utils\ewido\security suite\ewidoctrl.exe

    C:\WINDOWS\explorer.exe

    C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe

    C:\WINDOWS\explorer.exe

    C:\Documents and Settings\Eigenaar\Bureaublad\hijackthis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ne5.hpwis.com/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    R3 - Default URLSearchHook is missing

    O2 - BHO: (no name) - SOFTWARE - (no file)

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

    O2 - BHO: (no name) - {1FDA7154-A0F1-4F57-AC58-64D6BAA2E889} - (no file)

    O2 - BHO: (no name) - {20B75EBF-D811-4093-B1FD-6AD21F479B58} - (no file)

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: (no name) - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - (no file)

    O2 - BHO: (no name) - {5AC5E0EF-999E-4C37-9549-AB2F22ECB460} - (no file)

    O2 - BHO: (no name) - {6501C514-5C19-40ED-9660-BAAD4A41EDB7} - (no file)

    O2 - BHO: (no name) - {75D9E9A8-6393-497D-8A56-CF44821F2202} - (no file)

    O2 - BHO: (no name) - {7627BFD6-E8FF-4153-B0B3-BF9633B574E1} - (no file)

    O2 - BHO: (no name) - {817C9848-A8D6-401F-8EF7-88D37A227B08} - (no file)

    O2 - BHO: (no name) - {9E865C25-3501-4EF1-AF45-F693E237185E} - (no file)

    O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

    O2 - BHO: (no name) - {ADC34469-1E10-4D19-BBE9-AF771A09C59E} - (no file)

    O2 - BHO: (no name) - {AF35653F-118A-4946-B1EF-54DEE4B4DC1F} - (no file)

    O2 - BHO: (no name) - {B8E69F8B-D483-4C91-8872-005F1424B033} - (no file)

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

    O2 - BHO: (no name) - {DE4363F9-E52A-4687-8548-BD17A445278C} - (no file)

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

    O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

    O4 - HKLM\..\Run: C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\igfxtray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\hkcmd.exe

    O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

    O4 - HKLM\..\Run: C:\WINDOWS\system32\ps2.exe

    O4 - HKLM\..\Run: “C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe” /icon

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

    O4 - HKLM\..\Run: rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s

    O4 - HKLM\..\Run: nwiz.exe /install

    O4 - HKLM\..\Run: C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

    O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Agnitum\TAUSCA~1.7\taumon.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

    O4 - HKLM\..\RunOnce: C:\Program Files\Washer\washidx.exe “Eigenaar”

    O4 - HKCU\..\Run: “C:\Program Files\MSN Messenger\MsnMsgr.Exe” /background

    O4 - HKCU\..\Run: C:\Program Files\Washer\washer.exe /0

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

    O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN

    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O10 - Hijacked Internet access by New.Net

    O10 - Hijacked Internet access by New.Net

    O10 - Hijacked Internet access by New.Net

    O10 - Hijacked Internet access by New.Net

    O10 - Hijacked Internet access by New.Net

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab

    O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)

    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    O23 - Service: ewido security suite control - ewido networks - C:\Utils\ewido\security suite\ewidoctrl.exe

    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    O23 - Service: SNDSrvc - Sygate Technologies, Inc. - (no file)

    O23 - Service: SPBBCSvc - Sygate Technologies, Inc. - (no file)

  • Anonymous avatar

    Erik

    verwijder eerst newdotnet even op een van de manieren van de link:

    www.newdotnet.com/removal.html

    Start daarna alleen Hijackthis en vink alleen de volgende regels aan:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ne5.hpwis.com/

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

    O2 - BHO: (no name) - SOFTWARE - (no file)

    O2 - BHO: (no name) - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - (no file)

    O2 - BHO: (no name) - {5AC5E0EF-999E-4C37-9549-AB2F22ECB460} - (no file)

    O2 - BHO: (no name) - {6501C514-5C19-40ED-9660-BAAD4A41EDB7} - (no file)

    O2 - BHO: (no name) - {75D9E9A8-6393-497D-8A56-CF44821F2202} - (no file)

    O2 - BHO: (no name) - {7627BFD6-E8FF-4153-B0B3-BF9633B574E1} - (no file)

    O2 - BHO: (no name) - {817C9848-A8D6-401F-8EF7-88D37A227B08} - (no file)

    O2 - BHO: (no name) - {9E865C25-3501-4EF1-AF45-F693E237185E} - (no file)

    O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)

    O2 - BHO: (no name) - {ADC34469-1E10-4D19-BBE9-AF771A09C59E} - (no file)

    O2 - BHO: (no name) - {AF35653F-118A-4946-B1EF-54DEE4B4DC1F} - (no file)

    O2 - BHO: (no name) - {B8E69F8B-D483-4C91-8872-005F1424B033} - (no file)

    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

    O2 - BHO: (no name) - {DE4363F9-E52A-4687-8548-BD17A445278C} - (no file)

    Klik op fix checked.

    Herstart je PC en post daarna nog even een vers HJT logje svp :-)

  • Anonymous avatar

    Richard

    Hier is het nieuwe logje.

    Ben benieuwd :)

    Logfile of HijackThis v1.99.1

    Scan saved at 16:11:58, on 16-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Sygate\SPF\smc.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    C:\Utils\ewido\security suite\ewidoctrl.exe

    C:\WINDOWS\System32\nvsvc32.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    C:\HP\KBD\KBD.EXE

    C:\windows\system\hpsysdrv.exe

    C:\PROGRA~1\Agnitum\TAUSCA~1.7\taumon.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

    C:\Program Files\Washer\washer.exe

    C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Documents and Settings\Eigenaar\Bureaublad\hijackthis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    R3 - Default URLSearchHook is missing

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

    O2 - BHO: (no name) - {1FDA7154-A0F1-4F57-AC58-64D6BAA2E889} - (no file)

    O2 - BHO: (no name) - {20B75EBF-D811-4093-B1FD-6AD21F479B58} - (no file)

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

    O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

    O4 - HKLM\..\Run: C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\igfxtray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\hkcmd.exe

    O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

    O4 - HKLM\..\Run: C:\WINDOWS\system32\ps2.exe

    O4 - HKLM\..\Run: “C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe” /icon

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

    O4 - HKLM\..\Run: nwiz.exe /install

    O4 - HKLM\..\Run: C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

    O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Agnitum\TAUSCA~1.7\taumon.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

    O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

    O4 - HKCU\..\Run: “C:\Program Files\MSN Messenger\MsnMsgr.Exe” /background

    O4 - HKCU\..\Run: C:\Program Files\Washer\washer.exe /0

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

    O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN

    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab

    O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)

    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    O23 - Service: ewido security suite control - ewido networks - C:\Utils\ewido\security suite\ewidoctrl.exe

    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    O23 - Service: SNDSrvc - Sygate Technologies, Inc. - (no file)

    O23 - Service: SPBBCSvc - Sygate Technologies, Inc. - (no file)

  • Anonymous avatar

    Erik

    Deze regels mag je nog fixen met HJT:

    R3 - Default URLSearchHook is missing

    O2 - BHO: (no name) - {1FDA7154-A0F1-4F57-AC58-64D6BAA2E889} - (no file)

    O2 - BHO: (no name) - {20B75EBF-D811-4093-B1FD-6AD21F479B58} - (no file)

    Bezoek ook deze pagina eens want je java is niet up-to-date: http://www.java.com/en/download/installed.jsp

    Verder ziet het er goed uit, mischien de laatste versie van sygate downloaden en installeren :?

  • Anonymous avatar

    Richard

    Alles gefixed en de updates van java had ik intussen al

    opgehaald.

    We zullen de laatste Sygate installeren en dan is tie

    weer top.

    Hartelijk bedankt voor je moeite !!

  • Anonymous avatar

    Erik

    Mischien dat je hier nog nieuwe inspiratie op kan doen: http://www.jawwi.nl/tips/beveiligen.html spywareblaster kan al een hoop voorkomen b.v.v

  • Anonymous avatar

    Richard

    Dankjewel :)