Archief - HiJackThis Log'ske

Ik zit nu al een week opgescheept met een zeer ambetant ''virus''. Als ik aan het surfen ben gaat mijn browser naar stomme reclamesites (geen pop-ups, de site gaat gewoon naar een andere pagina) zonder dat ik de pc ook maar aanraak. Ik heb al met tientallen virus/antispyware/... programma's (Symantec, Spyware Doctor, Xoftspy, CCleaner, Ewido) gescand en de rotzooi gedelete maar het probleem blijft zich voordoen. Mss kunnen jullie iets afleiden uit de HJT-log want ik zie niet direct een oplossing . Thanks bij voorbaat

Logfile of HijackThis v1.99.1
Scan saved at 22:14:55, on 16/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
D:\WINDOWS\system32\dslagent.exe
D:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\iTunes\iTunesHelper.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Microsoft Office\Office\FINDFAST.EXE
D:\Program Files\Microsoft Office\Office\OSA.EXE
D:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Filip\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] D:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office Snelzoeken.lnk = D:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Opstarten.lnk = D:\Program Files\Microsoft Office\Office\OSA.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0ED14DF-1A9B-4861-8FDB-7BEA60AF9999}: NameServer = 195.238.2.22 195.238.2.21
O20 - Winlogon Notify: Shell Extensions - D:\WINDOWS\system32\p08qlal51dq.dll
O23 - Service: DefWatch - Symantec Corporation - D:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

* eerst en vooral, de-installeer die xoftspy maar want deze heeft valse meldingen, zie hier voor meer info:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Download de trial versie van Spy Sweeper Hier

en installeer het via de 'standaard installatie'. (er word gevraagd om je e-mail adres, je kan deze gerust geven )

er zal u gevraagd worden om de nieuwste defenitie's van spysweeper te installeren, doe dit ook
(dit kan enkele minuten duren)

klik dan op Options > Sweep Options en vink aan: Sweep all Folders on Selected drives. en Local Disc C. onder What to Sweep, vink je alles aan

klik op Sweep en laat het je systeem volledig scannen

wanneer het scannen gedaan is, klik dan op Remove. en daarna op Select All en daarna Next

bij 'Results', ga naar Session Log tabblad. klik dan op Save to File en bewaar de log waar je het gemakkelijk terugvind
Exit Spy Sweeper.

kopieer en plak dan de log hier als je volgend antwoord met een nieuw hijackthis log

////SpySweeper Log:

********
19:00: | Start of Session, donderdag 17 november 2005 |
19:00: Spy Sweeper started
19:00: Sweep initiated using definitions version 573
19:00: Starting Memory Sweep
19:01: Found Adware: icannnews
19:01: Detected running threat: D:\WINDOWS\system32\wwnsrv.dll (ID = 83)
19:01: Detected running threat: D:\WINDOWS\system32\lv0409dqe.dll (ID = 83)
19:01: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:01: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:02: Memory Sweep Complete, Elapsed Time: 00:02:02
19:02: Starting Registry Sweep
19:02: Found Adware: cws_secure32.html hijack
19:02: HKLM\software\microsoft\internet explorer\main\ || default_page_url (ID = 946027)
19:02: Found Adware: websearch toolbar
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1005\software\microsoft\internet explorer\extensions\cmdmapping\ || {686c970f-1d7d-4469-85d1-4b35763b56cc} (ID = 146456)
19:02: Found Adware: directrevenue-abetterinternet
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1005\software\aurora\ (28 subtraces) (ID = 360174)
19:02: Found Adware: ebates money maker
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\extensions\cmdmapping\ || {6685509e-b47b-4f47-8e16-9a5f3a62f683} (ID = 125587)
19:02: Found Adware: webrebates
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\extensions\{6685509e-b47b-4f47-8e16-9a5f3a62f683}\ (6 subtraces) (ID = 125589)
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\extensions\{6685509e-b47b-4f47-8e16-9a5f3a62f683}\ (6 subtraces) (ID = 125589)
19:02: Found Adware: hotbar
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\hotbar\ (181 subtraces) (ID = 127565)
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\explorer bars\{becafc17-baf9-11d4-b492-00d0b77f0a6d}\ (2 subtraces) (ID = 127573)
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\explorer bars\{ff6b2fd5-093c-4d4f-bb98-5641130a9de6}\ (1 subtraces) (ID = 127574)
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\toolbar\shellbrowser\ || {b195b3b3-8a05-11d3-97a4-0004aca6948e} (ID = 127585)
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\toolbar\webbrowser\ || {b195b3b3-8a05-11d3-97a4-0004aca6948e} (ID = 127587)
19:02: Found Adware: 180search assistant/zango
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\msbb\ (22 subtraces) (ID = 135781)
19:02: Found Adware: ist sidefind
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\extensions\cmdmapping\ || {10e42047-deb9-4535-a118-b3f6ec39b807} (ID = 141778)
19:02: Found Adware: switchdialer
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\main\ || startpagina (ID = 143489)
19:02: HKU\WRSS_Profile_S-1-5-21-1417001333-688789844-1343024091-1004\software\microsoft\internet explorer\extensions\cmdmapping\ || {686c970f-1d7d-4469-85d1-4b35763b56cc} (ID = 146456)
19:02: HKU\S-1-5-21-1417001333-688789844-1343024091-1003\software\microsoft\internet explorer\extensions\cmdmapping\ || {686c970f-1d7d-4469-85d1-4b35763b56cc} (ID = 146456)
19:02: Registry Sweep Complete, Elapsed Time:00:00:23
19:03: Starting Cookie Sweep
19:03: Found Spy Cookie: atlas dmt cookie
19:03: pa@atdmt[2].txt (ID = 2253)
19:03: Found Spy Cookie: metriweb.be cookie
19:03: pa@metriweb[1].txt (ID = 2992)
19:03: Cookie Sweep Complete, Elapsed Time: 00:00:00
19:03: Starting File Sweep
19:03: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:03: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:05: Found Adware: spysheriff
19:05: secure32.html (ID = 184319)
19:06: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:06: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:14: Found Adware: command
19:14: lzp5v3prkhtdv35t.vbs (ID = 185675)
19:14: satmat.ini (ID = 83499)
19:14: satmat.inf (ID = 83498)
19:14: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:14: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:18: Warning: Unhandled Archive Type
19:18: Warning: Unhandled Archive Type
19:18: Warning: Unhandled Archive Type
19:18: Warning: File not found
19:18: File Sweep Complete, Elapsed Time: 00:15:44
19:18: Full Sweep has completed. Elapsed time 00:18:18
19:18: Traces Found: 270
19:19: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
19:19: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
19:21: Removal process initiated
19:21: Quarantining All Traces: 180search assistant/zango
19:21: Quarantining All Traces: directrevenue-abetterinternet
19:21: Quarantining All Traces: icannnews
19:21: icannnews is in use. It will be removed on reboot.
19:21: D:\WINDOWS\system32\wwnsrv.dll is in use. It will be removed on reboot.
19:21: D:\WINDOWS\system32\lv0409dqe.dll is in use. It will be removed on reboot.
19:21: Quarantining All Traces: spysheriff
19:21: Quarantining All Traces: websearch toolbar
19:21: Quarantining All Traces: hotbar
19:21: Quarantining All Traces: switchdialer
19:21: Quarantining All Traces: command
19:21: Quarantining All Traces: cws_secure32.html hijack
19:21: Quarantining All Traces: ebates money maker
19:21: Quarantining All Traces: ist sidefind
19:22: Quarantining All Traces: webrebates
19:22: Quarantining All Traces: atlas dmt cookie
19:22: Quarantining All Traces: metriweb.be cookie
19:23: Preparing to restart your computer. Please wait...
19:23: Removal process completed. Elapsed time 00:01:27

////HiJackThisLog (na een reboot met een 'early delete' door SpySweep):

Logfile of HijackThis v1.99.1
Scan saved at 19:34:29, on 17/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
D:\WINDOWS\system32\dslagent.exe
D:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Microsoft Office\Office\FINDFAST.EXE
D:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\SpywareGuard\sgmain.exe
D:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpywareGuard\sgbhp.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Filip\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.be
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.be
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] D:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office Snelzoeken.lnk = D:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Opstarten.lnk = D:\Program Files\Microsoft Office\Office\OSA.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0ED14DF-1A9B-4861-8FDB-7BEA60AF9999}: NameServer = 195.238.2.22 195.238.2.21
O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: DefWatch - Symantec Corporation - D:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - D:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

ziet er goed uit, hoe werkt alles verder?

Super oké! 1000 keer merci, beste man!!

graag gedaan