logfile

alles uit lees eerst dit gedaan. weleen virus verwijderd. probleem, na een aantal keer in te loggen op internet wordt de inlognaam en wachtwoord veranderd. er wordt dan ingelogd op een betaalsite? je hoort dit kost 0.8 eurocent per minuut.

zit er iets in het logfile?

vast bedankt karien

Logfile of HijackThis v1.99.1

Scan saved at 16:09:19, on 6-11-2005

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\COMPAQ\ACLIENT\ACLIENT.exe

C:\WINNT\System32\cpqalert.exe

C:\WINNT\Cpqdiag\Cpqdfwag.exe

C:\Program Files\COMPAQ\CpqWebDMI\webdmi.EXE

C:\WINNT\System32\svchost.exe

C:\Program Files\Compaq\LCRMS\LCRMS.EXE

C:\WINNT\System32\NMSSvc.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

c:\dmi\win32\bin\Win32sl.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\System32\cpqdmi.exe

C:\WINNT\Explorer.EXE

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\WINNT\system32\Smtray.exe

C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe

C:\WINNT\system32\Promon.exe

C:\WINNT\system32\CHKADMIN.EXE

C:\progra~1\scansoft\paperp~1\pptd40nt.exe

C:\Program Files\MSN Apps\Updater\01.02.0000.2693\nl\msnappau.exe

C:\Program Files\HP\HP Software Update\HPWuSchd.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe

C:\Program Files\Information Update\iu.exe

C:\WINNT\system32\internat.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINNT\system32\HPZipm12.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Administrator\Mijn documenten\hijackthis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rabobank.nl/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.nl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.0000.2693\en-xu\stmain.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0000.2693\nl\msntb.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.0000.2693\nl\msntb.dll

O4 - HKLM\..\Run: mobsync.exe /logon

O4 - HKLM\..\Run: Smtray.exe

O4 - HKLM\..\Run: C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe

O4 - HKLM\..\Run: Promon.exe

O4 - HKLM\..\Run: CHKADMIN.EXE

O4 - HKLM\..\Run: c:\progra~1\scansoft\paperp~1\pptd40nt.exe

O4 - HKLM\..\Run: “C:\Program Files\MSN Apps\Updater\01.02.0000.2693\nl\msnappau.exe”

O4 - HKLM\..\Run: “C:\Program Files\HP\HP Software Update\HPWuSchd.exe”

O4 - HKLM\..\Run: “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”

O4 - HKLM\..\Run: “C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe”

O4 - HKLM\..\Run: C:\Program Files\Information Update\iu.exe

O4 - HKLM\..\RunServices: C:\WINNT\Cpqdiag\CpqDfwAg.exe

O4 - HKCU\..\Run: internat.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1128251412156

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{CFD1C3AE-5395-479C-B4CB-E782A778E01D}: NameServer = 62.58.50.5 62.58.50.6

O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\COMPAQ\ACLIENT\ACLIENT.exe

O23 - Service: Compaq Local Alerter (CPQALERT) - Compaq Computer Corporation - C:\WINNT\System32\cpqalert.exe

O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINNT\Cpqdiag\Cpqdfwag.exe

O23 - Service: CPQDMI - Compaq Computer Corporation - C:\WINNT\System32\cpqdmi.exe

O23 - Service: Compaq DMI Web Agent (CpqWebDmi) - Compaq Computer Corporation - C:\Program Files\COMPAQ\CpqWebDMI\webdmi.EXE

O23 - Service: Logical Disk Manager Administrative-service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: Insight Manager LC Remote Management (LCRMS) - Compaq Computer Corporation - C:\Program Files\Compaq\LCRMS\LCRMS.EXE

O23 - Service: NMS Service (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

O23 - Service: Win32sl - Intel - c:\dmi\win32\bin\Win32sl.exe

hoi karien,

start hijack,klik op scan en vink alleen de onderstaande regels aan:

O4 - HKLM\..\Run: C:\Program Files\Information Update\iu.exe

sluit alle vensters behalve hijack en klik op “fix checked”

verwijder de volgende map:

C:\Program Files\Information Update

deze service hoeft volgens mij niet mee op te starten :

O23 - Service: Win32sl - Intel - c:\dmi\win32\bin\Win32sl.exe

http://www.liutilities.com/products/wintaskspro/processlibrary/win32sl/

ik denk niet dat dell wat op de pc te zoeken heeft zonder dat jij het vraagt

ga naar start uitvoeren en type : services.msc en klik ok

zoek in de lijst naar Win32sl ,dubbelklik hem en klik op stoppen en kies als opstarttype “uitgeschakeld” ,klik op toepassen en ok.

als je dan hulp van dell nodig hebt kan je hem altijd weer aan zetten

paul

karien

Avondsmurf

karien

Avondsmurf

karien

pablo

karien

pablo

karien

pablo