antivirus.startpagina.nl

logfile

  • Anonymous avatar

    Simon

    ik heb het hele stappenplan doorlopen, en Spyware Doctor en Registry Mechanic laten draaien.

    zou iemand hier naar willen kijken?

    alvast bedankt!

    gr. Simon

    Logfile of HijackThis v1.98.2

    Scan saved at 11:46:09, on 17-11-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Unable to get Internet Explorer version!

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\csrss.exe

    C:\WINDOWS\SYSTEM32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\LEXPPS.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe

    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\AVENGINE.EXE

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe

    C:\WINDOWS\system32\wdfmgr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\apvxdwin.exe

    C:\WINDOWS\System32\alg.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\SRVLOAD.EXE

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\WebProxy.exe

    C:\Program Files\Conexant\CnxDslTb.exe

    C:\WINDOWS\system32\RunDll32.exe

    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\Program Files\Winamp\winampa.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\WINDOWS\explorer.exe

    C:\WINDOWS\system32\msiexec.exe

    C:\WINDOWS\system32\ntvdm.exe

    C:\Program Files\Spyware Doctor\swdoctor.exe

    C:\Documents and Settings\Simon\Bureaublad\hijackthis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    R3 - Default URLSearchHook is missing

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\Plugins\RazaWebHook.dll (file missing)

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O4 - HKLM\..\Run: C:\Program Files\Conexant\CnxDslTb.exe

    O4 - HKLM\..\Run: nse.exe

    O4 - HKLM\..\Run: sysconf.exe

    O4 - HKLM\..\Run: enbiei.exe

    O4 - HKLM\..\Run: RunDll32 cmicnfg.cpl,CMICtrlWnd

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

    O4 - HKLM\..\Run: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE” /s

    O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    O4 - HKLM\..\Run: “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”

    O4 - HKLM\..\Run: C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: C:\Program Files\Winamp\winampa.exe

    O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

    O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

    O4 - HKLM\..\RunServices: nse.exe

    O4 - HKLM\..\RunServices: sysconf.exe

    O4 - HKLM\..\RunServices: wmmon32.exe

    O4 - HKLM\..\RunServices: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe”

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: navmgrd.exe

    O4 - HKCU\..\Run: “C:\Program Files\Spyware Doctor\swdoctor.exe” /Q

    O4 - HKCU\..\RunServices: winsystem32xp.exe

    O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe

    O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\MICROS~1\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll

  • Anonymous avatar

    hatolex

    Maar ja, wat is nu het probleem???????????

    hatolex

  • Anonymous avatar

    Simon

    o sorry, vergeten te vermelden.

    Probleem is een trage computer en internetverbinding.

  • Anonymous avatar

    pablo

    je hebt een oude versie van hijack :?

    Logfile of HijackThis v1.98.2

    download eerst de nieuwste versie ( zie het stappenplan ) en plaats daarmee even een nieuw logje :)

    paul :)

  • Anonymous avatar

    Simon

    bij deze!

    Logfile of HijackThis v1.99.1

    Scan saved at 12:52:07, on 17-11-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Unable to get Internet Explorer version!

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\csrss.exe

    C:\WINDOWS\SYSTEM32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\LEXPPS.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe

    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\AVENGINE.EXE

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe

    C:\WINDOWS\system32\wdfmgr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\apvxdwin.exe

    C:\WINDOWS\System32\alg.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\SRVLOAD.EXE

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\WebProxy.exe

    C:\Program Files\Conexant\CnxDslTb.exe

    C:\WINDOWS\system32\RunDll32.exe

    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\Program Files\Winamp\winampa.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\WINDOWS\explorer.exe

    C:\WINDOWS\system32\ntvdm.exe

    C:\Program Files\Spyware Doctor\swdoctor.exe

    C:\MICROS~1\OFFICE11\OUTLOOK.EXE

    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

    C:\Documents and Settings\Simon\Bureaublad\hijackthis-1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    R3 - Default URLSearchHook is missing

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\Plugins\RazaWebHook.dll (file missing)

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O4 - HKLM\..\Run: C:\Program Files\Conexant\CnxDslTb.exe

    O4 - HKLM\..\Run: nse.exe

    O4 - HKLM\..\Run: sysconf.exe

    O4 - HKLM\..\Run: enbiei.exe

    O4 - HKLM\..\Run: RunDll32 cmicnfg.cpl,CMICtrlWnd

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

    O4 - HKLM\..\Run: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE” /s

    O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    O4 - HKLM\..\Run: “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”

    O4 - HKLM\..\Run: C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: C:\Program Files\Winamp\winampa.exe

    O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

    O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

    O4 - HKLM\..\RunServices: nse.exe

    O4 - HKLM\..\RunServices: sysconf.exe

    O4 - HKLM\..\RunServices: wmmon32.exe

    O4 - HKLM\..\RunServices: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe”

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: navmgrd.exe

    O4 - HKCU\..\Run: “C:\Program Files\Spyware Doctor\swdoctor.exe” /Q

    O4 - HKCU\..\RunServices: winsystem32xp.exe

    O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe

    O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\MICROS~1\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

    O23 - Service: Panda Antispam Server Service (PASSRV) - Unknown owner - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe

    O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe

    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe

    O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe

    O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe

    O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe

  • Anonymous avatar

    lucas

    Moment ik kijk even voor je ;)

  • Anonymous avatar

    lucas

    Simon,

    Doe deze onlinescan eens ;)

    http://housecall.trendmicro.com/housecall/start_corp.asp

    En plaats het housecall logje + een nieuw Hijack logje even hier.

    Lucas :)

  • Anonymous avatar

    Simon

    Hallo Lucas,

    Zag geen mogelijkheid een logje te produceren…

    Het resultaat:

    5 keer het virus Joke_beer A in de temp. internet files. Er is door Housecall geen actie ondernomen.

    Hierbij een nieuw logje van Hijack.

    Logfile of HijackThis v1.99.1

    Scan saved at 12:00:10, on 18-11-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Unable to get Internet Explorer version!

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\csrss.exe

    C:\WINDOWS\SYSTEM32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\LEXPPS.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe

    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\AVENGINE.EXE

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe

    C:\WINDOWS\system32\wdfmgr.exe

    C:\WINDOWS\System32\alg.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\apvxdwin.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\SRVLOAD.EXE

    C:\Program Files\Conexant\CnxDslTb.exe

    C:\WINDOWS\system32\RunDll32.exe

    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\Program Files\Winamp\winampa.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Spyware Doctor\swdoctor.exe

    C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\WebProxy.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\MICROS~1\OFFICE11\OUTLOOK.EXE

    C:\WINDOWS\system32\ntvdm.exe

    C:\WINDOWS\system32\cmd.exe

    C:\WINDOWS\system32\ntvdm.exe

    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\IFACE.EXE

    C:\Documents and Settings\Simon\Bureaublad\hijackthis-1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    R3 - Default URLSearchHook is missing

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\Plugins\RazaWebHook.dll (file missing)

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O4 - HKLM\..\Run: C:\Program Files\Conexant\CnxDslTb.exe

    O4 - HKLM\..\Run: RunDll32 cmicnfg.cpl,CMICtrlWnd

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

    O4 - HKLM\..\Run: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE” /s

    O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    O4 - HKLM\..\Run: “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”

    O4 - HKLM\..\Run: C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: C:\Program Files\Winamp\winampa.exe

    O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

    O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

    O4 - HKLM\..\RunServices: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe”

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: navmgrd.exe

    O4 - HKCU\..\Run: “C:\Program Files\Spyware Doctor\swdoctor.exe” /Q

    O4 - HKCU\..\RunServices: winsystem32xp.exe

    O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe

    O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\MICROS~1\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

    O23 - Service: Panda Antispam Server Service (PASSRV) - Unknown owner - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe

    O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe

    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe

    O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe

    O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe

    O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe

  • Anonymous avatar

    lucas

    Hij heeft wel degelijk iets gedaan hoor ;)

    Doe eens een scan met Ewido voor de infectie in de temp files ;)

    Download de trial versie van Ewido: www.ewido.com installeer en update het doe daarmee een volledige systeem scan in de veilige modus uitleg

    Bewaar het logje van Ewido en post dat samen met een nieuw

    HJT logje even hier.

    Lucas :)

  • Anonymous avatar

    Simon

    hallo Lucas,

    Hierbij de 2 logjes

    Bedankt voor je hulp!

    gr. simon

    ———————————————————

    ewido security suite - Scan rapport

    ———————————————————

    + Gemaakt op: 14:47:37, 18-11-2005

    + Rapport samenvatting: 51EC9D68

    + Scan resultaten:

    HKLM\SOFTWARE\Classes\Interface\{700DC0DD-F409-42E0-9DE5-21EE1A2BA9FD} -> Spyware.TOPicks : Schoongemaakt met een backup

    HKLM\SOFTWARE\Classes\Interface\{700DC0DD-F409-42E0-9DE5-21EE1A2BA9FD}\ProxyStubClsid32\\ -> Spyware.P2PNetworking : Schoongemaakt met een backup

    HKLM\SOFTWARE\Classes\Interface\{CE9B37EC-D243-47A2-83DB-3A8350175193}\ProxyStubClsid32\\ -> Spyware.P2PNetworking : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ISTbarISTbar -> Spyware.HotBar : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/bridge.dll\\.Owner -> Spyware.WinFavorites : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/bridge.dll\\{9C691A33-7DDA-4C2F-BE4C-C176083F35CF} -> Spyware.WinFavorites : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/jao.dll\\.Owner -> Spyware.WinFavorites : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/jao.dll\\{9C691A33-7DDA-4C2F-BE4C-C176083F35CF} -> Spyware.WinFavorites : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/SyncroAdX.dll\\.Owner -> Spyware.WinFavorites : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/SyncroAdX.dll\\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -> Spyware.WinFavorites : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/WinAdToolsX.dll\\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -> Spyware.WinFavorites : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/mfc42.dll\\{9EB320CE-BE1D-4304-A081-4B4665414BEF} -> Spyware.PurityScan : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/msvcrt.dll\\{9EB320CE-BE1D-4304-A081-4B4665414BEF} -> Spyware.PurityScan : Schoongemaakt met een backup

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/System32/olepro32.dll\\{9EB320CE-BE1D-4304-A081-4B4665414BEF} -> Spyware.PurityScan : Schoongemaakt met een backup

    ::Einde rapport

    Logfile of HijackThis v1.99.1

    Scan saved at 15:06:16, on 18-11-2005

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Unable to get Internet Explorer version!

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\csrss.exe

    C:\WINDOWS\SYSTEM32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\LEXPPS.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\ewido\security suite\ewidoctrl.exe

    C:\Program Files\ewido\security suite\ewidoguard.exe

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe

    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\AVENGINE.EXE

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe

    C:\WINDOWS\system32\wdfmgr.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\apvxdwin.exe

    C:\WINDOWS\System32\alg.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\SRVLOAD.EXE

    C:\Program Files\Conexant\CnxDslTb.exe

    C:\WINDOWS\system32\RunDll32.exe

    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    C:\Program Files\Winamp\winampa.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Spyware Doctor\swdoctor.exe

    C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\WebProxy.exe

    C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

    C:\WINDOWS\system32\NOTEPAD.EXE

    C:\Documents and Settings\Simon\Bureaublad\hijackthis-1.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    R3 - Default URLSearchHook is missing

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\Plugins\RazaWebHook.dll (file missing)

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O4 - HKLM\..\Run: C:\Program Files\Conexant\CnxDslTb.exe

    O4 - HKLM\..\Run: RunDll32 cmicnfg.cpl,CMICtrlWnd

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

    O4 - HKLM\..\Run: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE” /s

    O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    O4 - HKLM\..\Run: “C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”

    O4 - HKLM\..\Run: C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: C:\Program Files\Winamp\winampa.exe

    O4 - HKLM\..\Run: “C:\Program Files\iTunes\iTunesHelper.exe”

    O4 - HKLM\..\Run: “C:\Program Files\QuickTime\qttask.exe” -atboottime

    O4 - HKLM\..\RunServices: “C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe”

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: navmgrd.exe

    O4 - HKCU\..\Run: “C:\Program Files\Spyware Doctor\swdoctor.exe” /Q

    O4 - HKCU\..\RunServices: winsystem32xp.exe

    O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Corel Registration.lnk = C:\Program Files\Corel\WordPerfect Office 2000\Register\Remind32.exe

    O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\MICROS~1\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab

    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

    O23 - Service: Panda Antispam Server Service (PASSRV) - Unknown owner - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe

    O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe

    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe

    O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe

    O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe

    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe

    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe

    O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe

    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe