hacker

• 

  roy.l

  03-11-2005 21:29

  beste lezers nadat mijn zoon een e-mail heeft geopend ,die aan mij gericht was met mijn eigen adres en deze geopend heeft. heeft mijn pc deze bestanden geinstaleerd. antiav_exe en hloader_exe. het had mijn internet en mijn outlook geblokeerd .want als ik op een koppeling vinkte dan gaf mijn pc aan dat internet in gebruik was.

  dat probleem heb ik al verholpen door de processen uit te schakelen.maar bij msconfig staan ze er nog wel in(heb de vinkies wel weggehaald).

  kan iemand deze log even bekijken en heeft misschien een oplossing voor mij,alvast bedankt Roy.

  Logfile of HijackThis v1.98.2

  Scan saved at 21:18:28, on 3-11-2005

  Platform: Windows XP SP1 (WinNT 5.01.2600)

  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\System32\LckFldService.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

  C:\Compaq\eakdrv\STARTDRV.exe

  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

  C:\Program Files\Messenger Plus! 3\MsgPlus.exe

  C:\Compaq\eakdrv\EAKDRV.exe

  C:\Program Files\Messenger\msmsgs.exe

  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

  C:\Program Files\MSN Messenger\msnmsgr.exe

  C:\Program Files\@Home veiligheid\AntiVirus\AVRealTime.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Documents and Settings\FRITS LUDWIG\Mijn documenten\Mijn ontvangen bestanden\HijackThis19802.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: PopThis BHO - {0549E6CB-9985-42F6-8FD6-4EC017E6AAE1} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

  O4 - HKLM\..\Run: C:\Compaq\eakdrv\STARTDRV.exe

  O4 - HKLM\..\Run: mmrtkrnl.exe

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Messenger Plus! 3\MsgPlus.exe”

  O4 - HKLM\..\Run: C:\Program Files\@Home veiligheid\AntiVirus\AVRealTime.exe

  O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -k

  O4 - HKLM\..\RunOnce: C:\Program Files\Webroot\Washer\WashIdx.exe “FRITS LUDWIG”

  O4 - HKCU\..\Run: “C:\Program Files\Messenger\msmsgs.exe” /background

  O4 - HKCU\..\RunOnce: C:\Program Files\Webroot\Washer\WashIdx.exe “FRITS LUDWIG”

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

  O9 - Extra button: (no name) - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O9 - Extra ‘Tools’ menuitem: PopThis! Options… - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

  O14 - IERESET.INF: START_PAGE_URL=http://www/

  O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab

  O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab

  O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab

  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

  O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab

  O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/packages/GSManager.cab

  O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB

  O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab

  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab

  O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021126/qtinstall.info.apple.com/sikes/nl/win/QuickTimeInstaller.exe

  O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab

  O16 - DPF: {6211AC26-A1B4-422A-AC52-1E70B7D24465} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/nl/filesharingctrl.cab

  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126337729281

  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

  O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab

  O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab

  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.bitdefender.com/scan/Msie/bitdefender.cab

  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab

  O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab

  O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.enschede.nl:48250/activex/AxisCamControl.cab

  O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.com/oas/ActiveX/FileXfer.cab

  O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab

  O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game16.zylomgames.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.communities.msn.com/controls/PhotoUC/MsnPUpld.cab

  O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/6c5b0a1ae398e3/player.virtools.com/downloads/player/Install2.5/Installer.exe

  O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -

  O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game16.zylomgames.com/activex/zylomloader.cab

  O16 - DPF: {DA28C54E-D95C-11D3-9A01-005004677EF4} (McAfee.com Component Download Manager Class) - http://download.mcafee.com/molbin/clinic/CDM/McCDM.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?319

  O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4566/mcfscan.cab

  O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cab

  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

  O16 - DPF: {F7E7FE39-7298-442F-97CE-B7A5E9AFE12D} (Info Class) - http://www.spelpunt.nl/idtool.cab

  O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

  Rapporteren
• 

  killerbee

  03-11-2005 21:44

  Rode link boven aan de pagina….

  Je gebruikt een oude versie HJT

  Rapporteren
• 

  roy.l

  03-11-2005 23:44

  hier een logfile van de nieuwe hijack.

  ik draai onder xp home edition.

  Logfile of HijackThis v1.99.1

  Scan saved at 23:42:58, on 3-11-2005

  Platform: Windows XP SP1 (WinNT 5.01.2600)

  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\Explorer.EXE

  C:\Compaq\eakdrv\STARTDRV.exe

  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

  C:\Program Files\Messenger Plus! 3\MsgPlus.exe

  C:\Compaq\eakdrv\EAKDRV.exe

  C:\Program Files\@Home veiligheid\AntiVirus\AVRealTime.exe

  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

  C:\Program Files\Messenger\msmsgs.exe

  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

  C:\WINDOWS\System32\LckFldService.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

  C:\WINDOWS\system32\sessmgr.exe

  C:\Program Files\Outlook Express\MSIMN.EXE

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Documents and Settings\FRITS LUDWIG\Mijn documenten\Mijn ontvangen bestanden\hijackthis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: PopThis BHO - {0549E6CB-9985-42F6-8FD6-4EC017E6AAE1} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

  O4 - HKLM\..\Run: C:\Compaq\eakdrv\STARTDRV.exe

  O4 - HKLM\..\Run: mmrtkrnl.exe

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Messenger Plus! 3\MsgPlus.exe”

  O4 - HKLM\..\Run: C:\Program Files\@Home veiligheid\AntiVirus\AVRealTime.exe

  O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -k

  O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

  O4 - HKCU\..\Run: “C:\Program Files\Messenger\msmsgs.exe” /background

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

  O9 - Extra button: (no name) - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O9 - Extra ‘Tools’ menuitem: PopThis! Options… - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

  O14 - IERESET.INF: START_PAGE_URL=http://www/

  O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab

  O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab

  O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab

  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

  O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab

  O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/packages/GSManager.cab

  O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB

  O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab

  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab

  O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021126/qtinstall.info.apple.com/sikes/nl/win/QuickTimeInstaller.exe

  O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab

  O16 - DPF: {6211AC26-A1B4-422A-AC52-1E70B7D24465} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/nl/filesharingctrl.cab

  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126337729281

  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

  O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab

  O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab

  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.bitdefender.com/scan/Msie/bitdefender.cab

  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab

  O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab

  O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.enschede.nl:48250/activex/AxisCamControl.cab

  O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.com/oas/ActiveX/FileXfer.cab

  O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab

  O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game16.zylomgames.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.communities.msn.com/controls/PhotoUC/MsnPUpld.cab

  O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/6c5b0a1ae398e3/player.virtools.com/downloads/player/Install2.5/Installer.exe

  O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -

  O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game16.zylomgames.com/activex/zylomloader.cab

  O16 - DPF: {DA28C54E-D95C-11D3-9A01-005004677EF4} (McAfee.com Component Download Manager Class) - http://download.mcafee.com/molbin/clinic/CDM/McCDM.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?319

  O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4566/mcfscan.cab

  O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cab

  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

  O16 - DPF: {F7E7FE39-7298-442F-97CE-B7A5E9AFE12D} (Info Class) - http://www.spelpunt.nl/idtool.cab

  O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

  O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\System32\LckFldService.exe

  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

  Rapporteren
• 

  Killerbee

  04-11-2005 12:35

  De problemen die jij noemde zie ik niet meer in je log …………..

  Rapporteren
• 

  Erik

  04-11-2005 13:20

  Uitschakelen in MSConfig betekent niet dat het weg is :-)

  Download KillBox van OptionExplicit

  -Unzip Killbox het naar je buroblad.

  -Dubbelklik het icoontje.

  -Zet een vinkje bij “delete on reboot”

  -Kopieer de volgende vette text:

  C:\WINDOWS\system32\antiav_exe.exe

  C:\WINDOWS\system32\hloader_exe.exe

  C:\WINDOWS\system32\HLEADER_DLL.DLL

  C:\WINDOWS\system32\HLOADER_DLL.DLL

  C:\WINDOWS\system32\antiav_dll.dll

  In killbox ga naar File>>paste from clipboard.

  Killbox geeft alleen de files weer die ook daadwerkelijk bestaan.

  Klik op het Rode rondje met wit kruis

  Antwoord JA JA, als je een melding krijgt svp handmatig rebooten

  Doe een onlinescan bij Panda en bewaar het logje: http://www.pandasoftware.com/products/activescan.htm

  Plaats daarna een nieuw HJT logje en het logje van Panda svp

  Rapporteren
• 

  Erik

  04-11-2005 13:22

  Ik wordt niet goed van dat prikbord, ik type gewoon en het maakt er zelf weer van

  Hier de text die je in Killbox moet pasten:

  C:\WINDOWS\system32\antiav_exe.exe

  C:\WINDOWS\system32\hloader_exe.exe

  C:\WINDOWS\system32\HLEADER_DLL.DLL

  C:\WINDOWS\system32\HLOADER_DLL.DLL

  C:\WINDOWS\system32\antiav_dll.dll

  Rapporteren
• 

  roy.l

  04-11-2005 15:24

  zaols gevraagd hier een logfile van hijack en panda scan online.

  en dat verwijderen met killbox heb ik ook uitgevoerd.

  Logfile of HijackThis v1.99.1

  Scan saved at 15:19:29, on 4-11-2005

  Platform: Windows XP SP1 (WinNT 5.01.2600)

  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\csrss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\WINDOWS\Explorer.EXE

  C:\Compaq\eakdrv\STARTDRV.exe

  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

  C:\Program Files\Messenger Plus! 3\MsgPlus.exe

  C:\Compaq\eakdrv\EAKDRV.exe

  C:\Program Files\@Home veiligheid\AntiVirus\AVRealTime.exe

  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

  C:\Program Files\Messenger\msmsgs.exe

  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

  C:\WINDOWS\System32\alg.exe

  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

  C:\WINDOWS\System32\LckFldService.exe

  C:\WINDOWS\System32\svchost.exe

  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

  C:\WINDOWS\System32\wdfmgr.exe

  C:\Program Files\MSN Messenger\msnmsgr.exe

  C:\Program Files\MSN Messenger\msnmsgr.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Documents and Settings\FRITS LUDWIG\Mijn documenten\Mijn ontvangen bestanden\hijackthis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: PopThis BHO - {0549E6CB-9985-42F6-8FD6-4EC017E6AAE1} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

  O4 - HKLM\..\Run: C:\Compaq\eakdrv\STARTDRV.exe

  O4 - HKLM\..\Run: mmrtkrnl.exe

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Messenger Plus! 3\MsgPlus.exe”

  O4 - HKLM\..\Run: C:\Program Files\@Home veiligheid\AntiVirus\AVRealTime.exe

  O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -k

  O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

  O4 - HKLM\..\Run: “C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe” /startintray

  O4 - HKCU\..\Run: “C:\Program Files\Messenger\msmsgs.exe” /background

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

  O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

  O9 - Extra button: (no name) - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O9 - Extra ‘Tools’ menuitem: PopThis! Options… - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

  O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

  O14 - IERESET.INF: START_PAGE_URL=http://www/

  O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab

  O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab

  O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab

  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

  O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab

  O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/packages/GSManager.cab

  O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB

  O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab

  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab

  O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021126/qtinstall.info.apple.com/sikes/nl/win/QuickTimeInstaller.exe

  O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab

  O16 - DPF: {6211AC26-A1B4-422A-AC52-1E70B7D24465} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/nl/filesharingctrl.cab

  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126337729281

  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

  O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab

  O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab

  O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.bitdefender.com/scan/Msie/bitdefender.cab

  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab

  O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab

  O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcam.enschede.nl:48250/activex/AxisCamControl.cab

  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

  O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.com/oas/ActiveX/FileXfer.cab

  O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab

  O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

  O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game16.zylomgames.com/activex/zylomgamesplayer.cab

  O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab

  O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.communities.msn.com/controls/PhotoUC/MsnPUpld.cab

  O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/6c5b0a1ae398e3/player.virtools.com/downloads/player/Install2.5/Installer.exe

  O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -

  O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game16.zylomgames.com/activex/zylomloader.cab

  O16 - DPF: {DA28C54E-D95C-11D3-9A01-005004677EF4} (McAfee.com Component Download Manager Class) - http://download.mcafee.com/molbin/clinic/CDM/McCDM.cab

  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?319

  O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4566/mcfscan.cab

  O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cab

  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab

  O16 - DPF: {F7E7FE39-7298-442F-97CE-B7A5E9AFE12D} (Info Class) - http://www.spelpunt.nl/idtool.cab

  O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

  O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\System32\LckFldService.exe

  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

  hier de logfile van pande scan online.

  Incident Status Location

  Adware:adware/ncase No disinfected C:\TEMP\salm_kyf.dat

  Dialer:dialer.su No disinfected C:\WINDOWS\run.cxq

  Adware:adware/ist.istbar No disinfected C:\PROGRAM FILES\COMMON FILES\Totem Shared

  Spyware:spyware/shopnav No disinfected Windows Registry

  Spyware:Spyware/Bridge No disinfected C:\Program Files\CEDP Stealer\CEDP.Stealer.exe

  Adware:Adware/WUpd No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\0279670A-80A2-45E1-8907-CB3538\0B61D6CC-117A-4A04-A42F-7E942A

  Adware:Adware/WinTools No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\6B86C507-70B5-4C07-9990-0AE4AF\4ADFB4D7-B2B4-4AD1-AC91-64D89B

  Adware:Adware/WUpd No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\DC9FBB54-629F-4277-882B-A36913\A5B76F82-FA27-4BA3-8868-20EB34

  Virus:Trj/Zapchast.AA Disinfected C:\WINDOWS\intelii32.exe.tcf

  Spyware:Spyware/Bridge No disinfected C:\WINDOWS\tmpdata.reg

  Adware:Adware/WUpd No disinfected C:\WINDOWS\tqp.exe

  en de virus die avg heeft verwijderd was I-Worm/bagle.

  Erik schreef:

  >

  > Ik wordt niet goed van dat prikbord, ik type gewoon

  > en het maakt er zelf weer van

  >

  > Hier de text die je in Killbox moet pasten:

  >

  > C:\WINDOWS\system32\antiav_exe.exe

  > C:\WINDOWS\system32\hloader_exe.exe

  > C:\WINDOWS\system32\HLEADER_DLL.DLL

  > C:\WINDOWS\system32\HLOADER_DLL.DLL

  > C:\WINDOWS\system32\antiav_dll.dll

  Rapporteren
• 

  Erik

  04-11-2005 15:38

  Hoi Roy,

  Ziet er al beter uit zo, hoe is het met MS-Config

  Vink alleen de volgende regels aan in Hijackthis:

  O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - a532.g.akamai.net/7/532/6712/6c5b0a1ae398e3/player.virtools.com/downloads/player /Install2.5/Installer.exe

  O9 - Extra button: (no name) - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  O9 - Extra ‘Tools’ menuitem: PopThis! Options… - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll

  Sluit alle andere vensters behalve HJT. Klik op fix checked

  Leeg de Quarantaine van MS-Antispy

  Ken je dit programma

  C:\Program Files\CEDP Stealer <==

  -Dubbelklik het icoontje van killbox

  -Zet een vinkje bij “delete on reboot”

  -Kopieer de volgende vette text:

  C:\TEMP\salm_kyf.dat

  C:\WINDOWS\run.cxq

  C:\PROGRAM FILES\COMMON FILES\Totem Shared

  C:\WINDOWS\intelii32.exe.tcf

  C:\WINDOWS\tmpdata.reg

  C:\WINDOWS\tqp.exe

  In killbox ga naar File>>paste from clipboard.

  Killbox geeft alleen de files weer die ook daadwerkelijk bestaan.

  Klik op het Rode rondje met wit kruis

  Antwoord JA JA, als je een melding krijgt svp handmatig rebooten.

  Rapporteren
• 

  roy.l

  04-11-2005 15:51

  alles gedaan wat je gezegd hebt het werkt allemaal weer toppie, nog vele malen dank.

  en het prgramma CEDP stealer dat is een programma om bij iemand anders de emoticons en foto's uit msn te halen.

  Rapporteren
• 

  Erik

  04-11-2005 15:53

  Delete nog even deze map C:\!submit

  Verder graag gedaan :-)

  Rapporteren