antivirus.startpagina.nl

Adaware-Onestep

  • Anonymous avatar

    Brigges

    Mijn McAfee geeft, na de uitgebreide scan, aan dat mijn pc is besmet met dit “mogelijke” schadelijke programma: Adware-onestep

    Het staat in C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Temporary Internet Files\Content.IE5\P7PXJNLP\upgrade.cab

    Ik heb een McAfee scan gedaan onder normaal, in de veilige modus ( volledig ge-up-date ), abonnement tot 2011, Spybot, Adware,Anti Malware en Hijacthis, alle instructies opgevolgd, maar weet nu niet of alles weg is.

    Dit is mijn Hijackthis log:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 20:53:01, on 9-11-2009

    Platform: Windows Vista SP2 (WinNT 6.00.1906)

    MSIE: Internet Explorer v8.00 (8.00.6001.18828)

    Boot mode: Normal

    Running processes:

    c:\PROGRA~1\mcafee.com\agent\mcagent.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Windows\system32\taskeng.exe

    C:\Program Files\Windows Defender\MSASCui.exe

    C:\Windows\System32\igfxtray.exe

    C:\Windows\System32\hkcmd.exe

    C:\Windows\System32\igfxpers.exe

    C:\Windows\RtHDVCpl.exe

    C:\Windows\PLFSetI.exe

    C:\Program Files\Launch Manager\LManager.exe

    C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

    C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Program Files\Java\jre6\bin\jusched.exe

    C:\Windows\ehome\ehtray.exe

    C:\Program Files\Windows Media Player\wmpnscfg.exe

    C:\Windows\system32\igfxsrvc.exe

    C:\Windows\ehome\ehmsas.exe

    C:\Windows\system32\wbem\unsecapp.exe

    C:\Windows\system32\igfxext.exe

    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

    C:\Users\MARCEL~1.NL\AppData\Local\Temp\RtkBtMnt.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=2&o=vp32&d=1208&m=aspire_5735

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    O1 - Hosts: ::1 localhost

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

    O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll

    O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O4 - HKLM\..\Run: %ProgramFiles%\Windows Defender\MSASCui.exe -hide

    O4 - HKLM\..\Run: “C:\Program Files\McAfee.com\Agent\mcagent.exe” /runkey

    O4 - HKLM\..\Run: C:\Windows\system32\igfxtray.exe

    O4 - HKLM\..\Run: C:\Windows\system32\hkcmd.exe

    O4 - HKLM\..\Run: C:\Windows\system32\igfxpers.exe

    O4 - HKLM\..\Run: RtHDVCpl.exe

    O4 - HKLM\..\Run: C:\Windows\PLFSetI.exe

    O4 - HKLM\..\Run: C:\PROGRA~1\LAUNCH~1\LManager.exe

    O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

    O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe

    O4 - HKLM\..\Run: C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe

    O4 - HKLM\..\Run: “D:\QTTask.exe” -atboottime

    O4 - HKLM\..\Run: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    O4 - HKLM\..\Run: “C:\Program Files\Java\jre6\bin\jusched.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

    O4 - HKLM\..\Run: “C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe” /runcleanupscript

    O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

    O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

    O4 - HKCU\..\RunOnce: C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103472 -“Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; eSobiSubscriber 2.0.4.16; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; OfficeLiveConnector.1.4; OfficeLivePatch.1.3)” -“http://games.spele.nl/spelehost2/2/rally_point.dcr”

    O4 - HKUS\S-1-5-19\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

    O4 - HKUS\S-1-5-19\..\Run: rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

    O4 - HKUS\S-1-5-20\..\Run: %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

    O4 - HKUS\S-1-5-18\..\Run: c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\MARCEL~1.NL\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\L22P095O\MESSEN~2.SH! (User ‘SYSTEEM’)

    O4 - HKUS\.DEFAULT\..\Run: c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\MARCEL~1.NL\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\L22P095O\MESSEN~2.SH! (User ‘Default user’)

    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

    O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra ‘Tools’ menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)

    O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

    O13 - Gopher Prefix:

    O15 - Trusted Zone: http://*.mcafee.com

    O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx

    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

    O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\BTNtService.exe

    O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe

    O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

    O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

    O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

    O23 - Service: Google Updateservice (gupdate1ca02003cc07a7e) (gupdate1ca02003cc07a7e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe

    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

    O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

    O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - D:\Spybot - Search & Destroy\SDWinSec.exe

    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    O23 - Service: Start BT in service - Unknown owner - D:\StartSkysolSvc.exe

    O23 - Service: TomTomHOMEService - TomTom - D:\TomTom HOME 2\TomTomHOMEService.exe

    O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

    –

    End of file - 11029 bytes

    en dit is mijn Anti Malware log:

    Malwarebytes' Anti-Malware 1.41

    Database versie: 3134

    Windows 6.0.6002 Service Pack 2

    9-11-2009 20:42:07

    mbam-log-2009-11-09 (20-42-07).txt

    Scan type: Snelle Scan

    Objecten gescand: 94957

    Verstreken tijd: 7 minute(s), 39 second(s)

    Geheugenprocessen geïnfecteerd: 0

    Geheugenmodulen geïnfecteerd: 0

    Registersleutels geïnfecteerd: 5

    Registerwaarden geïnfecteerd: 0

    Registerdata bestanden geïnfecteerd: 0

    Mappen geïnfecteerd: 2

    Bestanden geïnfecteerd: 2

    Geheugenprocessen geïnfecteerd:

    (Geen kwaadaardige items gevonden)

    Geheugenmodulen geïnfecteerd:

    (Geen kwaadaardige items gevonden)

    Registersleutels geïnfecteerd:

    HKEY_CLASSES_ROOT\AppID\{418d86be-7386-4f1a-83e0-53604adbda74} (Trojan.BHO) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{eb692fe4-6873-09e0-c127-95e8ba2f94ff} (Adware.EvenMoreMegaSwellAdsForYou) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eb692fe4-6873-09e0-c127-95e8ba2f94ff} (Adware.EvenMoreMegaSwellAdsForYou) -> Quarantined and deleted successfully.

    HKEY_CLASSES_ROOT\AppID\EvenMoreMegaSwellAdsForYou.DLL (Adware.EvenMoreMegaSwellAdsForYou) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\EvenMoreMegaSwellAdsForYou (Adware.EvenMoreMegaSwellAdsForYou) -> Quarantined and deleted successfully.

    Registerwaarden geïnfecteerd:

    (Geen kwaadaardige items gevonden)

    Registerdata bestanden geïnfecteerd:

    (Geen kwaadaardige items gevonden)

    Mappen geïnfecteerd:

    C:\Users\Marcel J.nl\AppData\Roaming\DealAssistant (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\Program Files\Kwanzy (Adware.Kwanzy) -> Quarantined and deleted successfully.

    Bestanden geïnfecteerd:

    C:\Users\Marcel J.nl\AppData\Roaming\DealAssistant\config.cfg (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\Program Files\Kwanzy\kwanzy.exe (Adware.Kwanzy) -> Quarantined and deleted successfully.

    Wie oh wie kan mij helpen?

    Marcel.

  • Anonymous avatar

    fazantje

    Hoi Brigges,

    Start HijackThis en Klik op Do a Systemscan only en vink de volgende regels aan:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

    Sluit alle vensters, behalve HijackThis en klik op fix checked.

    Zo te zien heeft MBAM zijn werk gedaan, maar doe voor de zekerheid eens een scan met:superantispyware

    http://www.superantispyware.com/download.html

    Laat de uitslag hier even weten;)

    Succes,

    Huib:)

  • Anonymous avatar

    Brigges

    Huib,

    Zover alvast bedankt,

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

    heb ik verwijder met Hijackthis, de scan met http://www.superantispyware.com/download.html ga ik nu doen en laat hem even lopen. Ik meld me later.

    Marcel.

  • Anonymous avatar

    Brigges

    Huib,

    Ik heb http://www.superantispyware.com/download.html laten scannen en hij detecteerde 11 bestanden van Adware. Ik ben een gelukkig mens, iedereen van dit prikbord bedankt voor de tips.

    Marcel.

  • Anonymous avatar

    fazantje

    Graag gedaan Brigges;)

    Huib:)