antivirus.startpagina.nl

virus - log nakijken

  • Anonymous avatar

    Coccolina

    Lieve ..

    Ben Coccolina uit Italy!! Heb gisteravond iets ‘'fouts’' gedownload , daarna besmet met virus en/of worm. Heb alles kunnen verwijderen (denk ik) heb alle scans gehad, online en in veilige modus. Maar toch zijn er nog problemen, zoals dat er steeds een nieuw scherm in internet explorer opent, met reclame, of een klein pop-up dat zich voordoet als een kleine scan en aangeeft dat de pc is besmet en dat ik daar op moet klikken. Wat ik ook doe het gaat niet weg.

    Gisteren was ook de taakbeheer uitgeschakeld maar dat heb ik kunnen terugzetten.

    Ik heb dus alles gedaan om mijn pc weer schoon te krijgen maar da is wrs niet zo, daarom hier een log van hijackthis

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 14.53.37, on 10/01/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16762)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\System32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe

    C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

    C:\Programmi\Alwil Software\Avast4\ashServ.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe

    C:\Programmi\Analog Devices\SoundMAX\SMTray.exe

    C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe

    C:\Programmi\HP\HP Software Update\HPWuSchd2.exe

    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe

    C:\Programmi\Java\jre6\bin\jusched.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Programmi\Windows Media Player\WMPNSCFG.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Programmi\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe

    C:\Programmi\Java\jre6\bin\jqs.exe

    C:\Programmi\McAfee\SiteAdvisor\McSACore.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\WINDOWS\System32\tcpsvcs.exe

    C:\WINDOWS\System32\snmp.exe

    C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

    C:\Programmi\Spyware Terminator\sp_rsser.exe

    C:\WINDOWS\System32\PAStiSvc.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

    C:\Programmi\Internet Explorer\iexplore.exe

    C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe

    C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar.dll

    O4 - HKLM\..\Run: Ati2mdxx.exe

    O4 - HKLM\..\Run: C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

    O4 - HKLM\..\Run: “C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe”

    O4 - HKLM\..\Run: C:\Programmi\Analog Devices\SoundMAX\SMTray.exe

    O4 - HKLM\..\Run: C:\Programmi\HP\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKLM\..\Run: “C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe”

    O4 - HKLM\..\Run: “C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe”

    O4 - HKLM\..\Run: “C:\Programmi\Java\jre6\bin\jusched.exe”

    O4 - HKLM\..\Run: rundll32.exe “C:\WINDOWS\system32\bhbygpcv.dll”,b

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: C:\Programmi\Windows Media Player\WMPNSCFG.exe

    O4 - HKCU\..\Run: C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SERVIZIO LOCALE’)

    O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SERVIZIO DI RETE’)

    O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

    O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

    O4 - Global Startup: ZDWLan Utility.lnk = C:\Programmi\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe

    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

    O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

    O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O14 - IERESET.INF: START_PAGE_URL=http://www.libero.it

    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab

    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab

    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Programmi\Yahoo!\Common\Yinsthelper.dll

    O16 - DPF: {426784E5-24B2-4708-820D-117342FAD009} (Cimporter Object) - http://www.hyves.nl/cab/outlookaddressbook.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://famdings.spaces.msn.com//PhotoUpload/MsnPUpld.cab

    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126610148593

    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game14.zylom.com/activex/zylomgamesplayer.cab

    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL

    O20 - AppInit_DLLs: lgbsxj.dll

    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

    O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe

    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Programmi\McAfee\SiteAdvisor\McSACore.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmi\Spyware Terminator\sp_rsser.exe

    O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

    –

    End of file - 8570 bytes

    Heel hartelijk dank voor diegene die hiervoor tijd wil vrijmaken!

    Coccolina

  • Anonymous avatar

    Coccolina

    Dit is dus zo'n link waar explorer heengaat. Avast blokkeerd hem dan waardoor google zegt: oops deze site bestaat niet !!

    professional-virus-scanner.com/2009/1/freescan.php?nu=770522174812

    Groet,

    Coco

  • Anonymous avatar

    huib

    Hoi Coccolina,

    Je schreef o.a.:

    >>>Heb alles kunnen verwijderen (denk ik) heb alle scans gehad<<<

    Welke scans:?:?

    Als je de scans van ons stappenplan bedoeld, heb je niet alles gedaan.

    Zie hier ons stappenplan:

    http://antivirus.prikpagina.nl/read.php?f=123&i=186977&t=186977

    Verder schreef je:

    >>>of een klein pop-up dat zich voordoet als een kleine scan en aangeeft dat de pc is besmet en dat ik daar op moet klikken. Wat ik ook doe het gaat niet weg.<<<

    Toch wel zo verstandig geweest om dus juist niet op die kleine pop up's te klikken:?:?

    Voer ons plan uit en we kunnen je verder helpen;)

    Let op: je moet 2 logjes plaatsen.

    Succes,

    Huib:)

  • Anonymous avatar

    coccolina

    Ik heb mijn eigen scanners; Avast en Spywareterminator gedraaid in zowel normale als in veilige modus. Daarnaast heb ik hitmanpro gedraaid en daar zijn ook die proggie's (dacht ik) de jullie opnoemen. Dan nog ad-ware 2008 laten draaien. Toen nog een online scan bij bitdefender. Maar ik doe alles dan nog wel een keer zoals jullie beschrijven, en plaats dan een nieuwe log. (2 logjes??)

    Ik heb zèker niet op die popups geklikt, soms blokkeerd ook avast deze site.

    Ik meld me weer later als ik de hele procedure heb gehad!!

    Ciao!!

  • Anonymous avatar

    Ben

    Stap 7 ! (het logje van mbam)

    Ben

  • Anonymous avatar

    Coccolina

    Okay, ik had het al gevonden.Ben nu bezig om de updates van MS te halen , maar dat lukt niet, ook niet na de instructies die ze geven. Dus deze sla ik maar over, maar normaal gesproken worden steeds de updates hier automatisch gehaald.

    Tot laterzzz

  • Anonymous avatar

    Coccolina

    Ben schreef:

    >

    > Stap 7 ! (het logje van mbam)

    >

    > Ben

    Ik krijg dit niet gedownload , er komt vanuit beide sites een vreemde onproffesionle site met wat linken en alles doorelkaar. Daar kom je niet wijs uit wat je moetaanklikken. Wat doe ik nu?

  • Anonymous avatar

    Ben

    http://www.jawwi.nl/anti-malware/mbam1.html

    Ben

  • Anonymous avatar

    Coccolina

    Zo!! Hoop dat ik het goed heb gedaan ;)

    Intussen kon ik na de herstart ook een windows update doen en zoals ik al verwachte is ie uptodate.

    Nou er was wel hier en daar wat te verwijderen, nu maar hopen dat het wegblijft,,,opfff…

    Groetjes, ciaociao

    Coco

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 17.25.30, on 10/01/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16762)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\System32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe

    C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

    C:\Programmi\Alwil Software\Avast4\ashServ.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Programmi\Java\jre6\bin\jqs.exe

    C:\Programmi\McAfee\SiteAdvisor\McSACore.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\WINDOWS\System32\tcpsvcs.exe

    C:\WINDOWS\System32\snmp.exe

    C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

    C:\Programmi\Spyware Terminator\sp_rsser.exe

    C:\WINDOWS\System32\PAStiSvc.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

    C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

    C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe

    C:\Programmi\Analog Devices\SoundMAX\SMTray.exe

    C:\Programmi\HP\HP Software Update\HPWuSchd2.exe

    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe

    C:\Programmi\Java\jre6\bin\jusched.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Programmi\Windows Media Player\WMPNSCFG.exe

    C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Programmi\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Programmi\Internet Explorer\iexplore.exe

    C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe

    C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll

    O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmi\Google\Google Toolbar\GoogleToolbar.dll

    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programmi\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

    O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll

    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmi\Google\Google Toolbar\GoogleToolbar.dll

    O4 - HKLM\..\Run: Ati2mdxx.exe

    O4 - HKLM\..\Run: C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

    O4 - HKLM\..\Run: “C:\Programmi\digicomt\Michelangelo USB ADSL\CnxDslTb.exe”

    O4 - HKLM\..\Run: C:\Programmi\Analog Devices\SoundMAX\SMTray.exe

    O4 - HKLM\..\Run: C:\Programmi\HP\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKLM\..\Run: “C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe”

    O4 - HKLM\..\Run: “C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe”

    O4 - HKLM\..\Run: “C:\Programmi\Java\jre6\bin\jusched.exe”

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: C:\Programmi\Windows Media Player\WMPNSCFG.exe

    O4 - HKCU\..\Run: C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SERVIZIO LOCALE’)

    O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SERVIZIO DI RETE’)

    O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

    O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

    O4 - Global Startup: ZDWLan Utility.lnk = C:\Programmi\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe

    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

    O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

    O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll

    O9 - Extra ‘Tools’ menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O14 - IERESET.INF: START_PAGE_URL=http://www.libero.it

    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab

    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab

    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Programmi\Yahoo!\Common\Yinsthelper.dll

    O16 - DPF: {426784E5-24B2-4708-820D-117342FAD009} (Cimporter Object) - http://www.hyves.nl/cab/outlookaddressbook.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://famdings.spaces.msn.com//PhotoUpload/MsnPUpld.cab

    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126610148593

    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game14.zylom.com/activex/zylomgamesplayer.cab

    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL

    O20 - AppInit_DLLs: lgbsxj.dll

    O20 - Winlogon Notify: qoMdDUmj - qoMdDUmj.dll (file missing)

    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe

    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe

    O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe

    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Programmi\McAfee\SiteAdvisor\McSACore.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmi\Spyware Terminator\sp_rsser.exe

    O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

    –

    End of file - 9897 bytes

    <<<<<<<<<<<<<<<<<<<<<<

    Malwarebytes' Anti-Malware 1.32

    Database versie: 1638

    Windows 5.1.2600 Service Pack 3

    10/01/2009 17.08.17

    mbam-log-2009-01-10 (17-08-17).txt

    Scan type: Snelle Scan

    Objecten gescand: 56961

    Verstreken tijd: 7 minute(s), 41 second(s)

    Geheugenprocessen geïnfecteerd: 0

    Geheugenmodulen geïnfecteerd: 2

    Registersleutels geïnfecteerd: 13

    Registerwaarden geïnfecteerd: 4

    Registerdata bestanden geïnfecteerd: 6

    Mappen geïnfecteerd: 0

    Bestanden geïnfecteerd: 18

    Geheugenprocessen geïnfecteerd:

    (Geen kwaadaardige items gevonden)

    Geheugenmodulen geïnfecteerd:

    C:\WINDOWS\system32\xxyaxWOg.dll (Trojan.Vundo.H) -> Delete on reboot.

    C:\WINDOWS\system32\lgbsxj.dll (Trojan.Vundo.H) -> Delete on reboot.

    Registersleutels geïnfecteerd:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2583a567-9bd3-48e3-bbe9-3b8dc3b162ad} (Trojan.Vundo.H) -> Delete on reboot.

    HKEY_CLASSES_ROOT\CLSID\{2583a567-9bd3-48e3-bbe9-3b8dc3b162ad} (Trojan.Vundo.H) -> Delete on reboot.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bf4c5a6b-3961-472f-a96b-930bbba3c135} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_CLASSES_ROOT\CLSID\{bf4c5a6b-3961-472f-a96b-930bbba3c135} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bf4c5a6b-3961-472f-a96b-930bbba3c135} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2583a567-9bd3-48e3-bbe9-3b8dc3b162ad} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_CLASSES_ROOT\CLSID\{b03e39ed-48b7-402e-9e7e-f981b1c0778b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b03e39ed-48b7-402e-9e7e-f981b1c0778b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Delete on reboot.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registerwaarden geïnfecteerd:

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb7263 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd454 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga1958 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc9267 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    Registerdata bestanden geïnfecteerd:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\xxyaxwog -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\xxyaxwog -> Delete on reboot.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Mappen geïnfecteerd:

    (Geen kwaadaardige items gevonden)

    Bestanden geïnfecteerd:

    C:\WINDOWS\system32\xxyaxWOg.dll (Trojan.Vundo.H) -> Delete on reboot.

    C:\WINDOWS\system32\gOWxayxx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\gOWxayxx.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\lgbsxj.dll (Trojan.Vundo.H) -> Delete on reboot.

    C:\WINDOWS\system32\bhbygpcv.dll_old (Trojan.Vundo.H) -> Delete on reboot.

    C:\WINDOWS\system32\vcpgybhb.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\pctooosp.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\cdfkbk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\cprvvlrv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\fopnwkwj.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\wgblji.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\dhthhubr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\zuipyi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\wvgrakmj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\edewqf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

    C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    C:\WINDOWS\system32\ahtn.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.

  • Anonymous avatar

    huib

    Hoiu Coccolina,

    Ik heb vNf 15 uur een feestje gehad, dus nu niet helder.

    Ik zal morgen verder kijken;)

    Gr HUIb