Archief - Adware.MaxSearch

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
P

Pr0gaM3r

Legacy Member
Ik heb heir al een thread van gelezen, maar alles wat erin stond (Wat ik allemaal geprobeert heb) werkte dus niet.
Ik heb Norton Antivirus 2006 laten scannen op deze adware, spybot search and destroy gebruikt... Niets helpt, m'n homepage verandert voortduren, ik heb geen toolbar (Wat mensen op verschillende sites zeggen), ik raak het regedit op normal mode niet in, dus moet ik safe mode, niets te vinden van die adware, en elke keer meld Norton Antivirus dit : Adware.MaxSearch has been detected :
- Remove
- Exclude this risk
- Ignore this risk for 30 minutes

Kan iemand me alstublieft helpen? BTW : Ctrl + Alt + Delete werkt ook al niet.
P

Pr0gaM3r

Legacy Member
Hier is trouwens m'n hijacklog:
Logfile of HijackThis v1.99.1
Scan saved at 16:17:06, on 11/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Dit.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\calcheck.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\DitExp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Yannick\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/First2Enter/Portal/portal.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.telenet.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [tapiexec] C:\WINDOWS\system32\tapiexec.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [p2p networking] p2pnetworking.exe
O4 - HKLM\..\Run: [sconfig] C:\WINDOWS\mshosts.exe
O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [sconfig] C:\WINDOWS\mshosts.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Herinneringen van Microsoft Works Agenda.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: msconfig.exe
O4 - Global Startup: taskmgr.exe
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\calcheck.exe
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\Trust\Compact Scan\WATCH.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/bestfriends/miniclipGameLoader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135970539458
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: tapiexec - tapiexec.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Moest j't nodig hebben ;D
P

Pr0gaM3r

Legacy Member
Komaan mensen:s
Niemand die me kan helpen? Ik heb ook Killbox. Ik ben al 4 uurs aan dit *** bezig en ik wil buiten gaan zwemmen :p
E

Exit

Legacy Member
dit is spyware dus dt hoort op software - hijackthis forum!!!!
MOVED
RTFS
E

Exit

Legacy Member
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/First2Enter/Portal/portal.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
O4 - HKLM\..\Run: [tapiexec] C:\WINDOWS\system32\tapiexec.exe ** virus/trojan **
O4 - HKLM\..\Run: [sconfig] C:\WINDOWS\mshosts.exe * trojan **
O4 - HKCU\..\Run: [sconfig] C:\WINDOWS\mshosts.exe
O4 - Global Startup: msconfig.exe
O4 - Global Startup: taskmgr.exe
O20 - Winlogon Notify: tapiexec - tapiexec.dll (file missing)


desftige full scan met virusscanner die up to date is en spyware sanner als adaware SE + ewido

zie sticky's
P

Pr0gaM3r

Legacy Member
Exit zei:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/First2Enter/Portal/portal.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
O4 - HKLM\..\Run: [tapiexec] C:\WINDOWS\system32\tapiexec.exe ** virus/trojan **
O4 - HKLM\..\Run: [sconfig] C:\WINDOWS\mshosts.exe * trojan **
O4 - HKCU\..\Run: [sconfig] C:\WINDOWS\mshosts.exe
O4 - Global Startup: msconfig.exe
O4 - Global Startup: taskmgr.exe
O20 - Winlogon Notify: tapiexec - tapiexec.dll (file missing)


desftige full scan met virusscanner die up to date is en spyware sanner als adaware SE + ewido

zie sticky's
Klik om te vergroten...
Moet ik de vermelde nummers verwijderen?
J

Jurgenv1

Legacy Member
* Download Alcanshorty, en plaats het op je bureaublad.

Dubbelklik op alcanshorty_nl om het te installeren.

Open daarna de map alcanshorty_nl , en dubbelklik op run.bat

De ikoontjes op je bureaublad zullen verdwijen en daarna terug verschijnen. Dit is normaal.

Wacht op de "Completed script execution"-boodschap en klik op "OK"

Sluit BFU af door op "EXIT" te klikken.

* * Download Dr.Web CureIt naar je bureaublad:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
  • Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
  • Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
  • Eenmaal de korte scan is beeïndigd, kan je de drives selecteren die je wilt laten scannen.
  • Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
  • Klik daarna de groene pijl rechts om de scan te starten.
  • Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
  • Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
    check.gif
  • Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
    move.gif

    Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
  • Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
  • Sluit daarna Dr.Web Cureit.
  • Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
  • Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post.
J

Jurgenv1

Legacy Member
Hou ook rekening dat sommige mensen examens hebben en niet 24/24 kunnen aanwezig zijn, dus beeje respect is op zijn plaats. :)
P

Pr0gaM3r

Legacy Member
Dit gebeurt er als ik klik op run.bat:
-Foutmelding: Dit bestand wordt momenteel door een ander programma gebruikt.
E

Exit

Legacy Member
Pr0gaM3r zei:
Ik heb al gescand :s wtf is je probleem man? Ik weet wel hoe ik met een pc moet omgaan hoor... Ik heb de scans al gedaan. Uhuh!
Klik om te vergroten...

ge meld u ff snel aan, doet post (verkeerd forum dus hebt ge nog geeneens de sticky's bekeken ...)
dan maakt ge 2de post op volgend forum (bijna juist) en zit ge te zagen om niet te closen maar snel te antwoorden omdat ge iets anders wilt gaan doen.

zoals Jurgen zegt, is niet iedreen altijd online en kennis/wil om te helpen, zeker niet als ge dan zo begint ...
Dus ....
P

Pr0gaM3r

Legacy Member
Oke, echt sorry hiervoor dat ik wat opdringerig ben, maar ik heb ook examen, en als ik dan de dingen niet in orde krijg kan ik niet fatsoenlijk leren. Ik zal nu het resultaat van die DrWeb posten :
WinRar 4.1 Pro (with CRACK).exe;D:\software;IRC.Randon;Incurable.Moved.;
A0011260.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011261.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011262.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011263.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011264.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011265.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011266.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011267.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011268.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011269.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011270.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011271.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011272.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011273.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011274.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011275.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011276.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011277.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011278.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011279.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011280.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011281.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011282.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0011283.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP10;Win32.HLLW.PMX;Deleted.;
A0008780.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0008815.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0008817.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0008834.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0008835.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0008944.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0008970.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0008981.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009001.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009039.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009049.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009102.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009103.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009106.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009142.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009143.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009205.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009220.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009246.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009316.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0009328.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP6;Win32.HLLW.PMX;Deleted.;
A0010119.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP9;Win32.HLLW.PMX;Deleted.;
A0010120.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP9;Win32.HLLW.PMX;Deleted.;
A0010121.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP9;Win32.HLLW.PMX;Deleted.;
A0010122.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP9;Win32.HLLW.PMX;Deleted.;
A0010123.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP9;Win32.HLLW.PMX;Deleted.;
A0010124.exe;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP9;Win32.HLLW.PMX;Deleted.;
A0010126.EXE;D:\System Volume Information\_restore{0A16E989-4782-44D8-912A-E770B12408B4}\RP9;Win32.HLLW.PMX;Deleted.;
A0239282.exe;D:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;IRC.Randon;Incurable.Moved.;
Setup.exe;C:\;BackDoor.IRC.Ranm;Deleted.;
ver.exe;C:\;BackDoor.IRC.Ranm;Deleted.;
rar.exe;C:\Documents and Settings\Chloë;BackDoor.IRC.Ranm;Deleted.;
uninstall.exe;C:\Documents and Settings\Chloë\Local Settings\Temp;Adware.Xbarre;Incurable.Moved.;
mc-110-12-0000140.exe;C:\Documents and Settings\Yannick;Trojan.DownLoader.10320;Incurable.Moved.;
A0239282.exe;C:\Documents and Settings\Yannick\DoctorWeb\Quarantine;IRC.Randon;Incurable.Moved.;
mc-110-12-0000140.exe;C:\Documents and Settings\Yannick\DoctorWeb\Quarantine;Trojan.DownLoader.10320;Incurable.Moved.;
WinRar 4.1 Pro (with CRACK).exe;C:\Documents and Settings\Yannick\DoctorWeb\Quarantine;IRC.Randon;Incurable.Moved.;
Norton Internet Security 2006 - Crack.exe;C:\My Shared Folder;HLLP.Setart.19919;Cured.;
Norton Internet Security 2006 - Crack.exe;C:\My Shared Folder;Trojan.MulDrop.3222;Incurable.Moved.;
A0177435.dll;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP220;Adware.Minibug;Incurable.Moved.;
A0188717.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP233;Trojan.MulDrop.3222;Incurable.Moved.;
A0190016.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP239;Trojan.SCKeyLog.20;Deleted.;
A0190017.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP239;Adware.Gator;Incurable.Moved.;
A0190018.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP239;Adware.Gator;Incurable.Moved.;
A0190020.dll;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP239;Trojan.SCKeyLog.20;Deleted.;
A0192050.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP239;Trojan.MulDrop.3222;Incurable.Moved.;
A0210194.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0210195.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0210196.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0210197.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0210198.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0210199.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0210200.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0210201.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0210202.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0210203.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP252;HLLP.Setart.19919;Cured.;
A0217789.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP254;HLLP.Setart.19919;Cured.;
A0217790.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP254;HLLP.Setart.19919;Cured.;
A0217791.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP254;HLLP.Setart.19919;Cured.;
A0217792.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP254;HLLP.Setart.19919;Cured.;
A0217793.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP254;HLLP.Setart.19919;Cured.;
A0217794.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP254;HLLP.Setart.19919;Cured.;
A0217795.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP254;HLLP.Setart.19919;Cured.;
A0217796.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP254;HLLP.Setart.19919;Cured.;
A0217797.EXE;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP254;HLLP.Setart.19919;Cured.;
A0231191.dll;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP269;Trojan.Fakealert;Deleted.;
A0234795.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP279;Adware.WebHancer;Incurable.Moved.;
A0234800.dll;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP279;Adware.NewDotNet;Incurable.Moved.;
A0234801.dll;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP279;Adware.WebHancer;Incurable.Moved.;
A0234802.dll;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP279;Adware.WebHancer;Incurable.Moved.;
A0238283.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP282;BackDoor.IRC.Ranm;Deleted.;
A0238284.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP282;BackDoor.IRC.Ranm;Deleted.;
A0238285.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP282;BackDoor.IRC.Ranm;Deleted.;
A0238295.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP282;BackDoor.IRC.Ranm;Deleted.;
A0238296.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP282;BackDoor.IRC.Ranm;Deleted.;
A0238297.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP282;BackDoor.IRC.Ranm;Deleted.;
A0238346.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP282;Trojan.DownLoader.10320;Incurable.Moved.;
A0238749.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;BackDoor.IRC.Ranm;Deleted.;
A0239279.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;BackDoor.IRC.Ranm;Deleted.;
A0239280.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;BackDoor.IRC.Ranm;Deleted.;
A0239281.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;BackDoor.IRC.Ranm;Deleted.;
A0239283.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;BackDoor.IRC.Ranm;Deleted.;
A0239284.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;BackDoor.IRC.Ranm;Deleted.;
A0239285.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;BackDoor.IRC.Ranm;Deleted.;
A0239286.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;Trojan.DownLoader.10320;Incurable.Moved.;
A0239287.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;HLLP.Setart.19919;Cured.;
A0239287.exe;C:\System Volume Information\_restore{539258F2-A458-49B9-B09E-89864049890E}\RP284;Trojan.MulDrop.3222;Incurable.Moved.;
Setup.exe;C:\WINDOWS;BackDoor.IRC.Ranm;Deleted.;
miniclipGameLoader.dll;C:\WINDOWS\Downloaded Program Files;Trojan.DownLoader.3069;Deleted.;
rar.exe;C:\WINDOWS\system32;BackDoor.IRC.Ranm;Deleted.;
P

Pr0gaM3r

Legacy Member
Ik moet trouwens nog iets melden m'n startpagina blijft veranderen naar : http://securityresponse.symantec.com/avcenter/fix_homepage/, voor mij is dit heel storend... Dit allemaal heb ik door 1 file te downloaden via Limewire :s, zo is het allemaal begonnen, dus ik heb m'n les geleerd " download niets van limewire "
J

Jurgenv1

Legacy Member
Post eens een nieuw hijackthis logje hier. :)
Je startpagina zou je gewoon weer kunnen instellen via de opties.
P

Pr0gaM3r

Legacy Member
Jurgenv1 zei:
Post eens een nieuw hijackthis logje hier. :)
Je startpagina zou je gewoon weer kunnen instellen via de opties.
Klik om te vergroten...
Logfile of HijackThis v1.99.1
Scan saved at 21:15:11, on 11/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Dit.exe
C:\Program Files\Browser MOUSE\mouse32a.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\calcheck.exe
C:\WINDOWS\twain_32\Trust\Compact Scan\WATCH.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Yannick\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/First2Enter/Portal/portal.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.telenet.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [tapiexec] C:\WINDOWS\system32\tapiexec.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [p2p networking] p2pnetworking.exe
O4 - HKLM\..\Run: [sconfig] C:\WINDOWS\mshosts.exe
O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [sconfig] C:\WINDOWS\mshosts.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Herinneringen van Microsoft Works Agenda.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\calcheck.exe
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\Trust\Compact Scan\WATCH.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/bestfriends/miniclipGameLoader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135970539458
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: tapiexec - tapiexec.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
J

Jurgenv1

Legacy Member
* je moet Java updaten:


  • Ga naar Start > Configuratiescherm dubbelklik op het Software icoontje. Je zal een lijst te zien krijgen van de geïnstalleerde programma's op je systeem.
  • Zoek in de lijst naar alle voorgaande versies van Java. (J2SE Runtime Environment.... )
    Het heeft volgend icoontje:
    javaicon.jpg

    Selecteer het en kies voor verwijderen.
  • Daarna, download en installeer de nieuwste versie van hier:

http://www.java.com/en/download/manual.jsp

* Ga naar start==>configuratiescherm==>software en de-installeer indien aanwezig:
switch

* open hijackthis en vink volgende regels aan:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = file:///C:/Program%20Files/First2Enter/Portal/portal.html
O4 - HKLM\..\Run: [tapiexec] C:\WINDOWS\system32\tapiexec.exe
O4 - HKLM\..\Run: [tapiexec] C:\WINDOWS\system32\tapiexec.exe
O4 - HKLM\..\Run: [p2p networking] p2pnetworking.exe
O4 - HKLM\..\Run: [sconfig] C:\WINDOWS\mshosts.exe
O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe
O4 - HKCU\..\Run: [sconfig] C:\WINDOWS\mshosts.exe
O20 - Winlogon Notify: tapiexec - tapiexec.dll (file missing)

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* verwijder volgende map indien aanwezig:

C:/Program Files/First2Enter

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* post dan een nieuw hijackthis logje hier
P

Pr0gaM3r

Legacy Member
Logfile of HijackThis v1.99.1
Scan saved at 21:33:35, on 11/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Dit.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\calcheck.exe
C:\WINDOWS\twain_32\Trust\Compact Scan\WATCH.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Documents and Settings\Yannick\Bureaublad\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.altavista.be/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.telenet.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Herinneringen van Microsoft Works Agenda.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\calcheck.exe
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\Trust\Compact Scan\WATCH.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/bestfriends/miniclipGameLoader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135970539458
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan