alcra b

• 

  hans

  18-10-2005 15:48

  Hallo,

  ik heb last van een hardnekkig virus. Ik heb alles geprobeerd, maar hij komt steeds terug. Wie kan mij helpen?

  Hier is mijn logfile

  Logfile of HijackThis v1.99.1

  Scan saved at 15:44:56, on 18-10-2005

  Platform: Windows XP SP2 (WinNT 5.01.2600)

  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\csrss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Internet Explorer\iexplore.exe

  D:\hijackthishj\hijackthis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vjviqhcqydzkhynxjivwpqts.com/CQSlQYwB13TZ0ytMbvr0eCOE/05D_ecAzrQZ7JLQ3WPHrfc4IKlllVRM89xkq3/O.html

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.nl

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  R3 - URLSearchHook: (no name) - - (no file)

  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

  O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

  O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

  O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: C:\Program Files\Norton Internet Security\UrlLstCk.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Ahead\InCD\InCD.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\CASEMA~2\SMARTB~1\MotiveSB.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\LXSUPMON.EXE RUN

  O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

  O4 - HKLM\..\Run: nwiz.exe /install

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\Program Files\MSI\Live Update 3\LMonitor.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\CTFMON.EXE

  O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE

  O4 - Global Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe

  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409

  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab

  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

  O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab

  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1110379210359

  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129634605750

  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab

  O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp09.photoprintit.de/microsite/1543/defaults/activex/IPSUploader.cab

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

  O23 - Service: Deepsight Extractor (DeepsightExtractor) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe (file missing)

  O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe

  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

  O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

  O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  Groetjes

  Hans

  Rapporteren
• 

  hans

  18-10-2005 15:54

  Ik was vergeten erbij te zetten dat ik in safe mode de virusscanner heb gedraaid, maar daarna was hij weer terug. Daarna in safe mode hitmanpro gedraaid en daarna hijackthis. Ik hoor het wel.

  Groetjes

  Hans

  Rapporteren
• 

  lucas

  18-10-2005 18:19

  Hitmanpro is niet de procedure die bij dit prikbord hoort.

  Zie je die rode letters boven in je scherm ook (LEES DIT EERST!)

  Plaats aan het eind van de rit een nieuw logje

  We zien met belangstelling je logje tegemoet.

  Lucas

  Rapporteren
• 

  hans

  18-10-2005 21:35

  Hier ben ik weer, van norton blijft er steeds een melding terugkomen dat hij is verwijderd, maar lijkt wel een boomerang.

  Logfile of HijackThis v1.99.1

  Scan saved at 21:31:53, on 18-10-2005

  Platform: Windows XP SP2 (WinNT 5.01.2600)

  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

  C:\WINDOWS\system32\LEXBCES.EXE

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\system32\LEXPPS.EXE

  C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

  C:\Program Files\Ahead\InCD\InCDsrv.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

  C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

  C:\WINDOWS\system32\nvsvc32.exe

  C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

  C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

  C:\Program Files\Common Files\Symantec Shared\ccApp.exe

  C:\Program Files\Ahead\InCD\InCD.exe

  C:\PROGRA~1\CASEMA~2\SMARTB~1\MotiveSB.exe

  C:\WINDOWS\system32\LXSUPMON.EXE

  C:\WINDOWS\SOUNDMAN.EXE

  C:\Program Files\MSI\Live Update 3\LMonitor.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\MSN Messenger\msnmsgr.exe

  C:\Program Files\Casema SnelHelp\bin\mpbtn.exe

  C:\Program Files\Internet Explorer\IEXPLORE.EXE

  C:\Program Files\Messenger\msmsgs.exe

  D:\hijackthishj\hijackthis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vjviqhcqydzkhynxjivwpqts.com/CQSlQYwB13TZ0ytMbvr0eCOE/05D_ecAzrQZ7JLQ3WPHrfc4IKlllVRM89xkq3/O.html

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.nl

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vjviqhcqydzkhynxjivwpqts.com/CQSlQYwB13TZ0ytMbvr0eCOE/05D_ecAzrQZ7JLQ3WPHrfc4IKlllVRM89xkq3/O.html

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.nl

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

  O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

  O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

  O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: C:\Program Files\Norton Internet Security\UrlLstCk.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Ahead\InCD\InCD.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\CASEMA~2\SMARTB~1\MotiveSB.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\LXSUPMON.EXE RUN

  O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

  O4 - HKLM\..\Run: nwiz.exe /install

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\Program Files\MSI\Live Update 3\LMonitor.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “\” /WinStart

  O4 - HKCU\..\Run: “C:\Program Files\MSN Messenger\msnmsgr.exe” /background

  O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE

  O4 - Global Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe

  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab

  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

  O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab

  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1110379210359

  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129634605750

  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab

  O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp09.photoprintit.de/microsite/1543/defaults/activex/IPSUploader.cab

  O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4603/mcfscan.cab

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

  O23 - Service: Deepsight Extractor (DeepsightExtractor) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe (file missing)

  O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe

  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

  O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

  O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  groetjes

  Hans

  Rapporteren
• 

  pablo

  18-10-2005 21:56

  hoi hans,

  download Brute Force Uninstaller.

  http://www.merijn.org/files/bfu.zip

  pak het uit naar zijn eigen map op je C:\ (c:\BFU).

  Start the Brute Force Uninstaller door te dubbelklikken op BFU.exe

  Naast ‘scriptfile to execute’-venster zal je een klein icoontje zien

  Klik op dat icoontje en een nieuw venster zal openen.

  Bovenaan zie je staan: ‘Please enter the full URL to the sript you want to execute’

  In het venster kopieer en plak je volgende url:

  http://metallica.geekstogo.com/p2pnetwork.bfu

  Klik OK

  Daarna klik je execute in Brute Force Uninstaller.

  Wacht tot je de boodschap complete script execution te zien krijgt en klik daarna op OK.

  Klik exit om het programma te beeïndigen.

  herstart,plaats een nieuw hijacklogje en vertel of je die meldingen nog steeds krijgt

  paul

  Rapporteren
• 

  hans

  19-10-2005 19:20

  Hallo Pablo,

  bedankt voor je reactie.Hier is mijn nieuwe logfile

  Logfile of HijackThis v1.99.1

  Scan saved at 19:16:51, on 19-10-2005

  Platform: Windows XP SP2 (WinNT 5.01.2600)

  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

  C:\WINDOWS\system32\LEXBCES.EXE

  C:\WINDOWS\system32\LEXPPS.EXE

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\Explorer.EXE

  C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

  C:\Program Files\Ahead\InCD\InCDsrv.exe

  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

  C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

  C:\Program Files\Common Files\Symantec Shared\ccApp.exe

  C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

  C:\Program Files\Ahead\InCD\InCD.exe

  C:\PROGRA~1\CASEMA~2\SMARTB~1\MotiveSB.exe

  C:\WINDOWS\system32\LXSUPMON.EXE

  C:\WINDOWS\system32\nvsvc32.exe

  C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

  C:\WINDOWS\SOUNDMAN.EXE

  C:\Program Files\MSI\Live Update 3\LMonitor.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  C:\Program Files\Messenger\msmsgs.exe

  C:\Program Files\MSN Messenger\msnmsgr.exe

  C:\Program Files\Casema SnelHelp\bin\mpbtn.exe

  C:\WINDOWS\system32\wuauclt.exe

  D:\hijackthishj\hijackthis.exe

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vjviqhcqydzkhynxjivwpqts.com/CQSlQYwB13TZ0ytMbvr0eCOE/05D_ecAzrQZ7JLQ3WPHrfc4IKlllVRM89xkq3/O.html

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vjviqhcqydzkhynxjivwpqts.com/CQSlQYwB13TZ0ytMbvr0eCOE/05D_ecAzrQZ7JLQ3WPHrfc4IKlllVRM89xkq3/O.html

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.nl

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

  O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

  O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll

  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

  O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”

  O4 - HKLM\..\Run: C:\Program Files\Norton Internet Security\UrlLstCk.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

  O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Ahead\InCD\InCD.exe

  O4 - HKLM\..\Run: C:\PROGRA~1\CASEMA~2\SMARTB~1\MotiveSB.exe

  O4 - HKLM\..\Run: C:\WINDOWS\system32\LXSUPMON.EXE RUN

  O4 - HKLM\..\Run: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

  O4 - HKLM\..\Run: nwiz.exe /install

  O4 - HKLM\..\Run: SOUNDMAN.EXE

  O4 - HKLM\..\Run: C:\Program Files\MSI\Live Update 3\LMonitor.exe

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “\” /WinStart

  O4 - HKCU\..\Run: “C:\Program Files\MSN Messenger\msnmsgr.exe” /background

  O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE

  O4 - Global Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe

  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab

  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

  O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab

  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1110379210359

  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129634605750

  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab

  O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp09.photoprintit.de/microsite/1543/defaults/activex/IPSUploader.cab

  O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4603/mcfscan.cab

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

  O23 - Service: Deepsight Extractor (DeepsightExtractor) - Unknown owner - C:\Program Files\Symantec\DeepSight Extractor\ExtractorService.exe (file missing)

  O23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe

  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

  O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

  O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  Hij komt niet meer terug en de pc is weer sneller

  Alvast bedankt

  Hans

  Rapporteren
• 

  pablo

  19-10-2005 19:31

  hoi hans,

  dat is goed nieuws

  nu nog even je logje opruimen

  start hijack,klik op scan en vink alleen de onderstaande regels aan:

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.vjviqhcqydzkhynxjivwpqts.com/CQSlQYwB13TZ0ytMbvr0eCOE/05D_ecAzrQZ7JLQ3WPHrfc4IKlllVRM89xkq3/O.html

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = www.vjviqhcqydzkhynxjivwpqts.com/CQSlQYwB13TZ0ytMbvr0eCOE/05D_ecAzrQZ7JLQ3WPHrfc4IKlllVRM89xkq3/O.html

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)

  O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

  sluit alle vensters behalve hijack en klik op “fix checked”

  je acrobat reader is blijkbaar beschadigd,ik zou hem deinstalleren en opnieuw installeren

  paul

  Rapporteren
• 

  hans

  25-10-2005 13:24

  Paul,

  heel erg bedankt, het is gelukt.

  Groetjes

  Hans

  Rapporteren
• 

  pablo

  26-10-2005 21:07

  mooi zo en graag gedaan

  paul

  Rapporteren