Sorry, ik had niet gescand bij panda.
Ben ik nu aan het doen.
hallo,
Ik heb gescand bij panda, 7 virussen ontdekt en verwijderd.
Hierna waren de bestanden cmd32.exe en scagent.exe niet meer op deze computer aanwezig.
Ook nog gescand met housecall, niets gevonden.
Daarna met bitdefender en deze vond er wel weer 2.
Als ik HJT probeer te starten vanaf de harde schijf dan krijg ik de melding: ongeldige bewerking uitgevoerd, prog. zal worden afgesloten.
Meteen openen na downloaden gaat wel.
De logjes:
Logfile of HijackThis v1.99.1
Scan saved at 15:48:45, on 20-10-2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Apacer USB Device\shwicon.exe
C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\Eric\Local Settings\Temporary Internet Files\Content.IE5\ATSHWFAL\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.startpagina.nl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.planet.nl:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: anvshell.exe
O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: nwiz.exe /install
O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: CTHELPER.EXE
O4 - HKLM\..\Run: C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: “C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe”
O4 - HKLM\..\Run: “C:\Program Files\Apacer USB Device\shwicon.exe” -t“Apacer Technology Inc.\Apacer USB Device v1.16e012”
O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime
O4 - HKLM\..\Run: “C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe”
O4 - HKCU\..\Run: “C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE”
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra ‘Tools’ menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - file://K:\setup\RiffLick.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123774304154
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://mozart.amadeus-hotel.com:82/activex/AMC.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B00B6026-696A-4D78-A867-62BED7C5CA2A}: NameServer = 195.121.1.34 195.121.1.66
O21 - SSODL: ASUS Probe V2.19.00 - {315C1991-1C8C-2CB8-9B02-79588D64D624} - c:\program files\asus\probe\oxiov32.dll (file missing)
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Security Agent (scagent) - Unknown owner - C:\WINDOWS\system32\scagent.exe" start (file missing)
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
————————————————————————————————————————————–
BitDefender Online Scanner
Scan report generated at: Thu, Oct 20, 2005 - 15:41:14
Scan path: A:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;
Statistics
Time
00:26:47
Files
129484
Folders
4071
Boot Sectors
6
Archives
1275
Packed Files
15108
Results
Identified Viruses
2
Infected Files
2
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
2
Engines Info
Virus Definitions
224177
Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)
Scan plugins
13
Archive plugins
39
Unpack plugins
4
E-mail plugins
6
System plugins
1
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
D:\Diversen\kl200nb2.exe=>(Instyler o)=>(Instyler Module 11)
Infected with: Trojan.Downloader.Small.AGQ
D:\Diversen\kl200nb2.exe=>(Instyler o)=>(Instyler Module 11)
Disinfection failed
D:\Diversen\kl200nb2.exe=>(Instyler o)=>(Instyler Module 11)
Deleted
D:\Diversen\kl200nb2.exe=>(Instyler o)
Update failed
D:\System Volume Information\_restore{210B4010-A7D5-45DD-A1A9-DB86C50BDDE7}\RP551\A0136512.exe=>(ZIP Sfx s)=>connect.exe
Detected with: Application.Dialer.UQ
D:\System Volume Information\_restore{210B4010-A7D5-45DD-A1A9-DB86C50BDDE7}\RP551\A0136512.exe=>(ZIP Sfx s)=>connect.exe
Disinfection failed
D:\System Volume Information\_restore{210B4010-A7D5-45DD-A1A9-DB86C50BDDE7}\RP551\A0136512.exe=>(ZIP Sfx s)=>connect.exe
Deleted
D:\System Volume Information\_restore{210B4010-A7D5-45DD-A1A9-DB86C50BDDE7}\RP551\A0136512.exe=>(ZIP Sfx s)
Updated
D:\System Volume Information\_restore{210B4010-A7D5-45DD-A1A9-DB86C50BDDE7}\RP551\A0136512.exe
Update failed
Weet je zeker dat je deze post als spam wil rapporteren aan de beheerder?
Deze post wordt als spam gerapporteerd aan de beheerder van het forum. Bedankt!
Weet u zeker dat u dit topic wil verwijderen?