antivirus.startpagina.nl

Kan iemand mijn hijackthis nakijken

  • Anonymous avatar

    Guusje

    Avond,

    Pc opgeruimd en alle scans gedaan. Zou iemand mijn hijackthis kunnen nakijken. Bij F3 zie ik hele rare tekens, misschien dat iemand weet wat het is.

    Alvast bedankt,

    Guusje

    Logfile of HijackThis v1.99.0

    Scan saved at 23:42:09, on 11-11-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Sygate\SPF\smc.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    C:\WINDOWS\System32\CTsvcCDA.exe

    C:\WINDOWS\System32\nvsvc32.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\MsPMSPSv.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\windows\system\hpsysdrv.exe

    C:\Program Files\USB Storage RW\shwicon.exe

    C:\HP\KBD\KBD.EXE

    C:\WINDOWS\system32\CTHELPER.EXE

    C:\Program Files\ASUS\Remote Control\Remote Master.exe

    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    C:\WINDOWS\system32\gsicon.exe

    C:\WINDOWS\system32\dslagent.exe

    C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

    C:\Program Files\MSN Messenger\MsnMsgr.Exe

    C:\WINDOWS\system32\rundll32.exe

    C:\Program Files\Skype\Phone\Skype.exe

    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Documents and Settings\Eigenaar\Bureaublad\spyware\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tele2.nl/redirect/startpage/dial_up/dut/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tele2.nl/redirect/startpage/dial_up/dut/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tele2.nl/redirect/startpage/dial_up/dut/

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    F3 - REG:win.ini: load=???

    ?, ? ?????

    ?????????????????

    F3 - REG:win.ini: run=???

    ?, ? ?????

    ?????????????????

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\igfxtray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\hkcmd.exe

    O4 - HKLM\..\Run: “C:\Program Files\USB Storage RW\shwicon.exe” -t“KYE\USB Storage RW”

    O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

    O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

    O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: nwiz.exe /installquiet /keeploaded

    O4 - HKLM\..\Run: CTHELPER.EXE

    O4 - HKLM\..\Run: c:\Program Files\ASUS\Remote Control\Remote Master.exe

    O4 - HKLM\..\Run: C:\WINDOWS\UpdReg.EXE

    O4 - HKLM\..\Run: C:\WINDOWS\system32\ps2.exe

    O4 - HKLM\..\Run: C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    O4 - HKLM\..\Run: gsicon.exe

    O4 - HKLM\..\Run: dslagent.exe USB

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

    O4 - HKLM\..\Run: C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

    O4 - HKLM\..\Run: “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”

    O4 - HKCU\..\Run: rundll32.exe nview.dll,nViewLoadHook

    O4 - HKCU\..\Run: “C:\Program Files\MSN Messenger\MsnMsgr.Exe” /background

    O4 - HKCU\..\Run: “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://www.tele2.nl/redirect/startpage/dial_up/dut/

    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game19.zylom.lycos.nl/activex/zylomgamesplayer.cab

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

    O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    O23 - Service: AVG E-mail Scanner - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    O23 - Service: Sygate Personal Firewall - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

  • Anonymous avatar

    pablo

    hoi guusje,

    zo te zien is je win.ini beschadigd ;)

    start hijack,klik op scan en vink alleen de onderstaande regels aan:

    F3 - REG:win.ini: load=???

    ?, ? ?????

    ?????????????????

    F3 - REG:win.ini: run=???

    ?, ? ?????

    ?????????????????

    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe

    sluit alle vensters behalve hijack en klik op “fix checked”

    verder een mooi schoon logje :)

    paul :)

  • Anonymous avatar

    Guusje

    Avond Pablo,

    Doe ik meteen enalvast bedankt.

    Guusje.

  • Anonymous avatar

    Guusje

    Probleem is eloof ik opgelost.

    Logfile of HijackThis v1.99.1

    Scan saved at 0:13:50, on 12-11-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Sygate\SPF\smc.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    C:\WINDOWS\System32\CTsvcCDA.exe

    C:\WINDOWS\System32\nvsvc32.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\System32\MsPMSPSv.exe

    C:\windows\system\hpsysdrv.exe

    C:\Program Files\USB Storage RW\shwicon.exe

    C:\HP\KBD\KBD.EXE

    C:\WINDOWS\system32\CTHELPER.EXE

    C:\Program Files\ASUS\Remote Control\Remote Master.exe

    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    C:\WINDOWS\system32\gsicon.exe

    C:\WINDOWS\system32\dslagent.exe

    C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE

    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

    C:\Program Files\MSN Messenger\MsnMsgr.Exe

    C:\Program Files\Skype\Phone\Skype.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Documents and Settings\Eigenaar\Bureaublad\spyware\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tele2.nl/redirect/startpage/dial_up/dut/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tele2.nl/redirect/startpage/dial_up/dut/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.nl/0SENLNL/SAOS01

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tele2.nl/redirect/startpage/dial_up/dut/

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O4 - HKLM\..\Run: c:\windows\system\hpsysdrv.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\igfxtray.exe

    O4 - HKLM\..\Run: C:\WINDOWS\System32\hkcmd.exe

    O4 - HKLM\..\Run: “C:\Program Files\USB Storage RW\shwicon.exe” -t“KYE\USB Storage RW”

    O4 - HKLM\..\Run: C:\HP\KBD\KBD.EXE

    O4 - HKLM\..\Run: C:\WINDOWS\SMINST\RECGUARD.EXE

    O4 - HKLM\..\Run: RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: nwiz.exe /installquiet /keeploaded

    O4 - HKLM\..\Run: CTHELPER.EXE

    O4 - HKLM\..\Run: c:\Program Files\ASUS\Remote Control\Remote Master.exe

    O4 - HKLM\..\Run: C:\WINDOWS\UpdReg.EXE

    O4 - HKLM\..\Run: C:\WINDOWS\system32\ps2.exe

    O4 - HKLM\..\Run: C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    O4 - HKLM\..\Run: gsicon.exe

    O4 - HKLM\..\Run: dslagent.exe USB

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

    O4 - HKLM\..\Run: C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE

    O4 - HKLM\..\Run: C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

    O4 - HKLM\..\Run: “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”

    O4 - HKCU\..\Run: rundll32.exe nview.dll,nViewLoadHook

    O4 - HKCU\..\Run: “C:\Program Files\MSN Messenger\MsnMsgr.Exe” /background

    O4 - HKCU\..\Run: “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://www.tele2.nl/redirect/startpage/dial_up/dut/

    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game19.zylom.lycos.nl/activex/zylomgamesplayer.cab

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)

    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

  • Anonymous avatar

    pablo

    yep,mooi schoon logje weer ;)

    paul :)