antivirus.startpagina.nl

Spyware/virus?

  • Anonymous avatar

    Bram

    Hallo,

    Ik heb sinds een paar dagen problemen met mijn PC.

    Alles functioneert prima de eerste minuut maar daarna is er geen internetverbinding meer. Ik zie dat op c:\ de volgende files gecreerd worden:

    tb.exe

    xe.exe

    low.exe

    Ik heb een virusscan gedaan en ook adware, spybots en cwshredder gedraaid maar telkens na opnieuw opstarten gaat het weer fout.

    Misschien dat mijn windows nog ge-update kan worden maar dit kan niet omdat ik geen internetverbinding heb. (zit nu achter een andere pc)

    Ik heb een logje gemaakt hopelijk kan iemand mij helpen?:

    Logfile of HijackThis v1.99.1

    Scan saved at 15:43:40, on 20-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

    C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

    C:\Program Files\CA\eTrust Antivirus\InoRT.exe

    C:\Program Files\CA\eTrust Antivirus\InoTask.exe

    C:\WINDOWS\lsass.exe

    C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\AGRSMMSG.exe

    C:\WINDOWS\Dit.exe

    C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\Program Files\Home Cinema\PowerCinema\PCMService.exe

    C:\PROGRA~1\CA\ETRUST~1\realmon.exe

    C:\Program Files\D-Tools\daemon.exe

    C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

    C:\Program Files\MessengerPlus! 3\MsgPlus.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    C:\bram\Shareaza\Shareaza.exe

    C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\WinZip\WZQKPICK.EXE

    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe

    C:\Documents and Settings\Purk9\Bureaublad\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: (no name) - {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} - (no file)

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O4 - HKLM\..\Run: AGRSMMSG.exe

    O4 - HKLM\..\Run: Dit.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe

    O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: “C:\Program Files\Home Cinema\PowerCinema\PCMService.exe”

    O4 - HKLM\..\Run: C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s

    O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

    O4 - HKLM\..\Run: “C:\Program Files\D-Tools\daemon.exe” -lang 1033

    O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -k

    O4 - HKLM\..\Run: “C:\Program Files\MessengerPlus! 3\MsgPlus.exe”

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    O4 - HKLM\..\Run: “C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe”

    O4 - HKCU\..\Run: “C:\bram\Shareaza\Shareaza.exe” -tray

    O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe

    O4 - Global Startup: BlueSoleil.lnk = ?

    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/

    O15 - Trusted Zone: *.musicmatch.com

    O15 - Trusted Zone: *.musicmatch.com (HKLM)

    O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106838455765

    O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab

    O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp.cab

    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

    O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/ie/bridge-c6.cab

    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab

    O20 - Winlogon Notify: mllml - mllml.dll (file missing)

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe

    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe

    O23 - Service: Local Security Authority Subsystem Service (lsass) - Unknown owner - C:\WINDOWS\lsass.exe

    O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

    Alvast bedankt!

  • Anonymous avatar

    Erik

    Deze hoort daar niet te staan maar in de system32 map C:\WINDOWS\lsass.exe

    Je hebt twee virusscanners draaien en die gaan in 9 van de 10 gevallen elkaar in de weg zitten, zet er iig 1 uit.

    Ga naar de volgende site en laat eerst dit bestand scannen http://virusscan.jotti.org

    C:\WINDOWS\lsass.exe

    via bladeren zoek je het op en vervolgens klik je op submit, post de uitkomst hier svp.

    Daarna:

    Doe een online scan bij Panda: http://www.pandasoftware.com/products/activescan

    Bewaar het logje van panda en post dat hier samen met een nieuw HJT logje.

  • Anonymous avatar

    Bram

    Tot zover bedankt Erik!

    Logje van panda en HJT:

    Incident Status Location

    Adware:adware/wupd No disinfected C:\WINDOWS\SYSTEM32\ide21201.vxd

    Spyware:spyware/media-motor No disinfected Windows Registry

    Adware:Adware/WUpd No disinfected C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OXMF0L6V\MediaGateway.exe

    Virus:Trj/Hooker.M No disinfected C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OXMF0L6V\yes.x

    Adware:Adware/IST.ISTBar No disinfected C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OXMF0L6V\yes.x

    Virus:Trj/Hooker.M No disinfected C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\W163SLQB\bt.x

    Adware:Adware/IST.ISTBar No disinfected C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\W163SLQB\bt.x

    Virus:Trj/Hooker.M Disinfected C:\is.exe

    Virus:W32/Sdbot.FKE.worm Disinfected C:\WINDOWS\lsass.exe

    Virus:Trj/Hooker.M No disinfected C:\zxvcc73x.exe

    Adware:Adware/IST.ISTBar No disinfected C:\zxvcc73x.exe

    Logfile of HijackThis v1.99.1

    Scan saved at 16:28:09, on 21-10-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

    C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

    C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

    C:\Program Files\CA\eTrust Antivirus\InoRT.exe

    C:\Program Files\CA\eTrust Antivirus\InoTask.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

    C:\WINDOWS\AGRSMMSG.exe

    C:\WINDOWS\Dit.exe

    C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\Program Files\Home Cinema\PowerCinema\PCMService.exe

    C:\PROGRA~1\CA\ETRUST~1\realmon.exe

    C:\Program Files\D-Tools\daemon.exe

    C:\Program Files\MessengerPlus! 3\MsgPlus.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    C:\bram\Shareaza\Shareaza.exe

    C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

    C:\Program Files\WinZip\WZQKPICK.EXE

    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe

    C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Documents and Settings\Purk9\Bureaublad\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: (no name) - {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} - (no file)

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O4 - HKLM\..\Run: AGRSMMSG.exe

    O4 - HKLM\..\Run: Dit.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe

    O4 - HKLM\..\Run: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: “C:\Program Files\Home Cinema\PowerCinema\PCMService.exe”

    O4 - HKLM\..\Run: C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s

    O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

    O4 - HKLM\..\Run: “C:\Program Files\D-Tools\daemon.exe” -lang 1033

    O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -k

    O4 - HKLM\..\Run: “C:\Program Files\MessengerPlus! 3\MsgPlus.exe”

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    O4 - HKLM\..\Run: “C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe”

    O4 - HKCU\..\Run: “C:\bram\Shareaza\Shareaza.exe” -tray

    O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe

    O4 - Global Startup: BlueSoleil.lnk = ?

    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/

    O15 - Trusted Zone: *.musicmatch.com

    O15 - Trusted Zone: *.musicmatch.com (HKLM)

    O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106838455765

    O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab

    O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp.cab

    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

    O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/ie/bridge-c6.cab

    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab

    O20 - Winlogon Notify: mllml - mllml.dll (file missing)

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

    O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

    O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe

    O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe

    O23 - Service: Local Security Authority Subsystem Service (lsass) - Unknown owner - C:\WINDOWS\lsass.exe (file missing)

    O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe