antivirus.startpagina.nl

log file schonen aub

  • Anonymous avatar

    marcel

    Beste,

    Wie wil aub zo vriendelijk zijn mijn log file te bekijken en te schonen. Volgens mij staat er rommel van “platte media” op. Iemand heeft dat geïnstallerd. Ik heb ook al met Malwarebytes' Anti-Malware gescaned.

    Hierbij de log file. Alvast bedankt!

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 20:20:59, on 11-7-2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v8.00 (8.00.6001.18702)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

    C:\WINDOWS\Explorer.EXE

    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    C:\Program Files\Alwil Software\Avast4\ashServ.exe

    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\Program Files\Java\jre6\bin\jusched.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

    C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

    C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe

    C:\PROGRA~1\MICROS~2\rapimgr.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\Program Files\Common Files\LightScribe\LSSrvc.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

    C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    O4 - HKLM\..\Run: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

    O4 - HKLM\..\Run: C:\Program Files\Unlocker\UnlockerAssistant.exe

    O4 - HKLM\..\Run: C:\WINDOWS\system32\umonit.exe

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot

    O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -u

    O4 - HKLM\..\Run: %systemroot%\system32\dumprep 0 -k

    O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

    O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

    O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

    O4 - HKCU\..\Run: “C:\Program Files\Microsoft ActiveSync\Wcescomm.exe”

    O4 - HKCU\..\Run: “C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe” -onlytray

    O4 - HKCU\..\RunOnce: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

    O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

    O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

    O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

    O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

    O9 - Extra ‘Tools’ menuitem: Mobiele favorieten maken… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1150207990994

    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://sizo4sales.cu4xs.com/Pages/msrdp.cab

    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    –

    End of file - 7340 bytes

    Thx

  • Anonymous avatar

    Jos H

    http://antivirus.startpagina.nl/prikbord/9044707/9045783/re-wie-kan-mij-helpen-mijn-logfile#msg-9045783

  • Anonymous avatar

    marcel

    Sorry vergeten1 Hierbij de 2e logMalwarebytes' Anti-Malware 1.38

    Database versie: 2410

    Windows 5.1.2600 Service Pack 3

    11-7-2009 20:09:40

    mbam-log-2009-07-11 (20-09-40).txt

    Scan type: Snelle Scan

    Objecten gescand: 93703

    Verstreken tijd: 10 minute(s), 58 second(s)

    Geheugenprocessen geïnfecteerd: 2

    Geheugenmodulen geïnfecteerd: 0

    Registersleutels geïnfecteerd: 2

    Registerwaarden geïnfecteerd: 1

    Registerdata bestanden geïnfecteerd: 0

    Mappen geïnfecteerd: 4

    Bestanden geïnfecteerd: 14

    Geheugenprocessen geïnfecteerd:

    C:\WINDOWS\system32\pm_proc1.exe (Trojan.Agent) -> Unloaded process successfully.

    c:\WINDOWS\system32\pm_proc2.exe (Trojan.Agent) -> Unloaded process successfully.

    Geheugenmodulen geïnfecteerd:

    (Geen kwaadaardige items gevonden)

    Registersleutels geïnfecteerd:

    HKEY_CLASSES_ROOT\CLSID\{d810b78a-d010-44df-8445-ac58086b600e} (Trojan.BHO) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d810b78a-d010-44df-8445-ac58086b600e} (Trojan.BHO) -> Quarantined and deleted successfully.

    Registerwaarden geïnfecteerd:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\plsi (Trojan.Agent) -> Quarantined and deleted successfully.

    Registerdata bestanden geïnfecteerd:

    (Geen kwaadaardige items gevonden)

    Mappen geïnfecteerd:

    C:\WINDOWS\system32\win32GI (Backdoor.Bifrose) -> Quarantined and deleted successfully.

    C:\Program Files\Platte (Adware.Platte) -> Quarantined and deleted successfully.

    c:\program files\Platte\invoice (Adware.Platte) -> Quarantined and deleted successfully.

    c:\program files\Platte\invoice\images (Adware.Platte) -> Quarantined and deleted successfully.

    Bestanden geïnfecteerd:

    c:\windows\help\SERVER.EXE (Backdoor.Bifrose) -> Quarantined and deleted successfully.

    c:\WINDOWS\system32\win32GI\klog.dat (Backdoor.Bifrose) -> Quarantined and deleted successfully.

    c:\WINDOWS\system32\win32GI\svchost.exe (Backdoor.Bifrose) -> Quarantined and deleted successfully.

    c:\program files\Platte\DVDshaker.htm (Adware.Platte) -> Quarantined and deleted successfully.

    c:\program files\Platte\Platte utility.lnk (Adware.Platte) -> Quarantined and deleted successfully.

    c:\program files\Platte\invoice\252000720068868126697110709192408.htm (Adware.Platte) -> Quarantined and deleted successfully.

    c:\program files\Platte\invoice\style1.css (Adware.Platte) -> Quarantined and deleted successfully.

    c:\program files\Platte\invoice\images\bg.png (Adware.Platte) -> Quarantined and deleted successfully.

    c:\program files\Platte\invoice\images\bg2.png (Adware.Platte) -> Quarantined and deleted successfully.

    c:\program files\Platte\invoice\images\divider.png (Adware.Platte) -> Quarantined and deleted successfully.

    c:\program files\Platte\invoice\images\platteint.png (Adware.Platte) -> Quarantined and deleted successfully.

    c:\WINDOWS\system32\pm_proc1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

    c:\WINDOWS\system32\pm_proc2.exe (Trojan.Agent) -> Quarantined and deleted successfully.

    c:\documents and settings\Marcel\Application Data\addon.dat (Malware.Trace) -> Quarantined and deleted successfully.

  • Anonymous avatar

    Jos H

    Wacht op de loglezers.

    Als de naam overeenkomt met je mailadres zou ik het wijzigen.(uit veiligheidsoverweging)

  • Anonymous avatar

    Luca

    Mbam heeft voor zover ik het kan bekijken alle troep wel opgeruimd, want je log ziet er netjes uit.

    Hoe staat het met je probleem?

  • Anonymous avatar

    marcel

    Ik zie geen troep meer van pm enz. Wel irritant dat er zoiets wordt geinstalleerd.

    Nog maar weer adaware en spybot er op loslaten.

    In ieder geval hartelijk bedankt voor het kijken ! !

    Groet Marcel