foto virus msn

• 

  Maud

  11-03-2010 12:12

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 11:59:54, on 11-3-2010

  Platform: Windows XP SP2 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\Program Files\AVG\AVG9\avgchsvx.exe

  C:\Program Files\AVG\AVG9\avgrsx.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\AVG\AVG9\avgwdsvc.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\system32\oodag.exe

  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

  C:\Program Files\UPHClean\uphclean.exe

  C:\Program Files\AVG\AVG9\avgnsx.exe

  C:\Program Files\AVG\AVG9\avgemc.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\WINDOWS\RTHDCPL.EXE

  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Electronic Arts\EADM\Core.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe

  C:\Program Files\NETGEAR\WPN111\wpn111.exe

  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

  C:\Program Files\AVG\AVG9\avgtray.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Windows Live\Toolbar\wltuser.exe

  C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hyves.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.nod32.com/dredirect.php?did=0&eval=2

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll

  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll

  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: RTHDCPL.EXE

  O4 - HKLM\..\Run: ALCMTR.EXE

  O4 - HKLM\..\Run: “C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe”

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG9\avgtray.exe

  O4 - HKLM\..\RunOnce: C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: “C:\Program Files\Electronic Arts\EADM\Core.exe” -silent

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\RunOnce: C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150596.exe -Update -1150596 -“Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)” -“http://www.comoquierascolacao.com/secciones/juegobmx/juego_game.aspx”

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe

  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

  O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?

  O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra ‘Tools’ menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/nl/uno1/GAME_UNO1.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

  O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe

  O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

  O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

  O24 - Desktop Component 0: (no name) - http://nienke.ismijnpaard.eu/wallpapers/horse12w1024x768.jpg

  –

  End of file - 7179 bytes

  Rapporteren
• 

  Maud

  11-03-2010 12:16

  Op advies van de buren ivm virus, post ik hier de logs, hopelijk worden jullie er iets wijzer van.

  Groet, Maud

  Rapporteren
• 

  Maud

  11-03-2010 12:20

  En hier de log van mbam

  Malwarebytes' Anti-Malware 1.44

  Database versie: 3851

  Windows 5.1.2600 Service Pack 2

  Internet Explorer 8.0.6001.18702

  11-3-2010 11:56:30

  mbam-log-2010-03-11 (11-56-30).txt

  Scan type: Snelle Scan

  Objecten gescand: 112839

  Verstreken tijd: 5 minute(s), 52 second(s)

  Geheugenprocessen geïnfecteerd: 0

  Geheugenmodulen geïnfecteerd: 0

  Registersleutels geïnfecteerd: 0

  Registerwaarden geïnfecteerd: 1

  Registerdata bestanden geïnfecteerd: 0

  Mappen geïnfecteerd: 0

  Bestanden geïnfecteerd: 0

  Geheugenprocessen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Geheugenmodulen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Registersleutels geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Registerwaarden geïnfecteerd:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\firewall administrating (Backdoor.IRCBot) -> Quarantined and deleted successfully.

  Registerdata bestanden geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Mappen geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Bestanden geïnfecteerd:

  (Geen kwaadaardige items gevonden)

  Rapporteren
• 

  Teaser

  11-03-2010 14:38

  Zo nu eerst maar eens windows updaten kom dan terug met een vers HJT log (tu)

  Rapporteren
• 

  Maud

  11-03-2010 15:54

  Logfile of Trend Micro HijackThis v2.0.2

  Scan saved at 15:52:45, on 11-3-2010

  Platform: Windows XP SP2 (WinNT 5.01.2600)

  MSIE: Internet Explorer v8.00 (8.00.6001.18702)

  Boot mode: Normal

  Running processes:

  C:\WINDOWS\System32\smss.exe

  C:\WINDOWS\system32\winlogon.exe

  C:\WINDOWS\system32\services.exe

  C:\WINDOWS\system32\lsass.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\WINDOWS\system32\svchost.exe

  C:\WINDOWS\System32\svchost.exe

  C:\WINDOWS\system32\Ati2evxx.exe

  C:\Program Files\AVG\AVG9\avgchsvx.exe

  C:\Program Files\AVG\AVG9\avgrsx.exe

  C:\WINDOWS\system32\spoolsv.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  C:\Program Files\AVG\AVG9\avgwdsvc.exe

  C:\WINDOWS\Explorer.EXE

  C:\WINDOWS\system32\oodag.exe

  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

  C:\Program Files\UPHClean\uphclean.exe

  C:\Program Files\AVG\AVG9\avgemc.exe

  C:\Program Files\AVG\AVG9\avgnsx.exe

  C:\WINDOWS\system32\wuauclt.exe

  C:\Program Files\AVG\AVG9\avgcsrvx.exe

  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

  C:\WINDOWS\RTHDCPL.EXE

  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

  C:\PROGRA~1\AVG\AVG9\avgtray.exe

  C:\Program Files\Windows Live\Messenger\msnmsgr.exe

  C:\Program Files\Electronic Arts\EADM\Core.exe

  C:\WINDOWS\system32\ctfmon.exe

  C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe

  C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  C:\Program Files\NETGEAR\WPN111\wpn111.exe

  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

  C:\Program Files\Windows Live\Toolbar\wltuser.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hyves.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.nod32.com/dredirect.php?did=0&eval=2

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

  O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll

  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll

  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

  O4 - HKLM\..\Run: C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

  O4 - HKLM\..\Run: “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”

  O4 - HKLM\..\Run: RTHDCPL.EXE

  O4 - HKLM\..\Run: ALCMTR.EXE

  O4 - HKLM\..\Run: “C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe”

  O4 - HKLM\..\Run: C:\PROGRA~1\AVG\AVG9\avgtray.exe

  O4 - HKCU\..\Run: “C:\Program Files\Windows Live\Messenger\msnmsgr.exe” /background

  O4 - HKCU\..\Run: “C:\Program Files\Electronic Arts\EADM\Core.exe” -silent

  O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe

  O4 - HKCU\..\Run: “C:\WINDOWS\system32\browserchoice.exe” /run

  O4 - HKCU\..\RunOnce: C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150596.exe -Update -1150596 -“Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.3; OfficeLivePatch.0.0)” -“http://www.comoquierascolacao.com/secciones/juegobmx/juego_game.aspx”

  O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Lokale service’)

  O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Netwerkservice’)

  O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)

  O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)

  O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe

  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

  O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

  O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?

  O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra ‘Tools’ menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

  O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/nl/uno1/GAME_UNO1.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

  O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe

  O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

  O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

  O24 - Desktop Component 0: (no name) - http://nienke.ismijnpaard.eu/wallpapers/horse12w1024x768.jpg

  –

  End of file - 7168 bytes

  Rapporteren
• 

  Teaser

  11-03-2010 16:31

  SP3 van windows mis ik hoor

  Rapporteren
• 

  Maud

  11-03-2010 18:49

  Ja klopt, dat lukt steeds niet. Hij geeft steeds aan dat dat is mislukt

  Rapporteren
• 

  Teaser

  11-03-2010 18:53

  http://safety.live.com/site/nl-NL/default.htm

  Kies wel voor de full scan

  Probeer het dan nogmaals

  Rapporteren
• 

  fazantje

  11-03-2010 22:40

  Hoi Maud,

  Je schreef o.a.:

  >>>Punt 5 en 6 had ik niet gedaan.

  Dat ben ik nu aan het doen op de comp van m'n dochter.<<<

  Is dit een andere computer:S

  Of een ander account op jou computer:S:S

  Die stappen moeten wel per account uitgevoerd worden.

  Groet Huib:)

  

  Rapporteren
• 

  Maud

  12-03-2010 12:25

  Hoi Huib,

  De pc van m'n dochter is geinfecteerd dus die ben ik aan het repareren. Ondertussen zit ik op m'n eigen laptop;)

  Groet, Maud

  Rapporteren