Archief - Logje

Gisteren is er door een vrienden een .exe uitgevoerd en deze heeft er dus voor gezorgd dat ik overal pop-up's krijg in mijn ie. Ik gebruik firefox maar ik wil het toch wel van mijn PC (vooral omdat hij soms ook gewoon een pop-up geeft in IE zonder dat hij is opgestart)

thx!!!


Logfile of HijackThis v1.99.1
Scan saved at 23:51:00, on 6/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\ismon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\f1c56988.exe
C:\Program Files\Common Files\{320D180E-07CA-1043-0727-050711050020}\Update.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\TSKS~1\winspool.exe
C:\WINDOWS\system32\??sks\s?ool32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\isnotify.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cool.exe
C:\Documents and Settings\Olivier\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {D30CD524-14C1-1669-BEAB-62848EE31D94} - C:\WINDOWS\system32\druotsba.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\Safety Bar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [f1c56988.exe] C:\WINDOWS\system32\f1c56988.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [f1c56988.exe] C:\Documents and Settings\Olivier\Local Settings\Application Data\f1c56988.exe
O4 - HKCU\..\Run: [Hepc] "C:\WINDOWS\system32\TSKS~1\winspool.exe" -vt yax
O4 - HKCU\..\Run: [Dokm] C:\WINDOWS\system32\??sks\s?ool32.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~4\msgrapp.dll" (file missing)
O18 - Filter: text/html - {03974811-C15F-462c-B6B0-2D2336AA57D0} - C:\WINDOWS\system32\hlwin.dll
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

* Je kan deze instructies best uitprinten of opslaan in een kladblokbestand, want straks zal je in veilige modus
moeten gaan werken, en dan is deze pagina niet beschikbaar (geen internet)

* Download en run deze uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

* Download smitRem.exe en sla dit op op het Bureaublad.
Dubbelklik op het bestand en pak het uit naar zijn eigen map op het Bureaublad.

* Je Java software is verouderd. oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem. Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren:

• Download de nieuwtse versie hier: Java Runtime Environment (JRE) 5.0 Update 7.
• Scroll naar beneden tot waar er staat: "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Klik dan rechts op de "Download" knop.
• Vink get volgende aan waar er staat: "Accept License Agreement".
• De pagina zal herladen.
• Klik op de link om Windows Offline Installationte downloaden met zonder Meerdere-talen En bewaar het naar je bureaublad.
• Sluit alle programma's die eventueel open zijn - Zeker je web browser!
• Ga dan naar Start > Configuratiescherm en dubbelklik op software en verwijder alle oudere versies van Java.
• Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
• Klik dan op Verwijderen of Wijzig/Verwijder knop.
• Herhaal dit tot alle oudere versies verdwenen zijn.
• Na het verwijderen van alle oudere versies, herstart dan je pc.
• Dubbelkik dan op jre-1_5_0_07-windowsi586-p.exe op je bureaublad om de nieuwste versie van Java te installeren.

* Download en installeer Ewido Anti-Spyware 4.0.

• 
  Na de installatie, open Ewido Anti-Spyware 4.0:
  * onder "Status", klik op Change state naast "Resident shield".
  * onder "Update", klik op de Start update knop.
  * onder "Scanner", tab "Settings":
  • - onder "How to act?", klik op "Recommended actions" en selecteer Quarantine.
    - onder "Reports", selecteer Automatically generate report after every scan en verwijder het vinkje bij Only if threats were found
  Sluit Ewido. Laat het nog niet scannen.

* Als je Adaware SE nog niet geïnstalleerd hebt, download, installeer en update het dan volgens de richtlijnen
die je kan vinden op: http://users.pandora.be/marcvn/spyware/1414188.htm

* Start je computer op in VEILIGE MODUS


* open hijackthis en vink volgende regels aan:

R3 - URLSearchHook: (no name) - {D30CD524-14C1-1669-BEAB-62848EE31D94} - C:\WINDOWS\system32\druotsba.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\Safety Bar.dll
O4 - HKLM\..\Run: [f1c56988.exe] C:\WINDOWS\system32\f1c56988.exe
O4 - HKCU\..\Run: [f1c56988.exe] C:\Documents and Settings\Olivier\Local Settings\Application Data\f1c56988.exe
O4 - HKCU\..\Run: [Hepc] "C:\WINDOWS\system32\TSKS~1\winspool.exe" -vt yax
O4 - HKCU\..\Run: [Dokm] C:\WINDOWS\system32\??sks\s?ool32.exe
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/Yazzl...cab?refid=1123
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll

* sluit dan alle vensters behalve hijackthis en klik op 'fix checked'


* Open de smitrem-map op je bureaublad, en dubbelklik op RunThis.bat. Volg de aanwijzigingen op het scherm.
Je bureaublad en ikoontjes zullen even verdwijnen en daarna terug verschijnen, dit is normaal.
Wacht tot het tooltje zijn werk heeft gedaan en Disk Cleanup afgelopen is. Dit kan enige tijd duren, dus wees geduldig.

* Voer een volledige scan uit met Adaware en verwijder alles wat gevonden wordt.

• open ewido en klik op de Scanner tab bovenaan en klik dan op Complete System Scan. Deze scan zal heel je systeem afcannen dus dit kan een tijdje duren
• Ewido zal alle geïnfecteerde objecten aan de linkerkant tonen. Waneer de scan gedaan is, zal het alles naar de 'Quarantine' optie zetten. klik dan op de Apply all actions knop. Ewido zal dan het volgend bericht tonen aan de rechterkant: "All actions have been applied"
• Klik dan op "Save Report", en dan op "Save Report As". dit zal een rapport maken Wees zeker dat je het rapport makkelijk kunt terugvinden (ijvoorbeeld op je bureaublad).

* Ga dan naar Start -> configuratiescherm -> vormgeving en thema's -> bureaublad ->bureaublad aanpassen -> Website -> haal het vinkje weg bij "Security Info" als het er nog staat.

* Herstart je computer in normale modus.

* Download ATF cleaner (by Atribune)

Dubbelklik op ATF cleaner om het programma te starten.
Op het tabblad "Main", plaats je een vinkje bij Select All.
Klik op de knop Empty Selected.

Gebruik je ook Firefox als browser:
Klik op tabblad "Firefox", plaats een vinkje bij Select All.
Wil je de door Firefox opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
(dit verwijdert het vinkje bij "Firefox saved passwords")
Klik op de knop Empty Selected.

Gebruik je ook Opera als browser:
Klik op tabblad "Opera", plaats een vinkje bij Select All.
Wil je de door Opera opgeslagen wachtwoorden behouden, dan klik je in het venster dat verschijnt op "No".
Klik op de knop Empty Selected.
Ga naar het tabblad "Main" en klik op de knop Exit om het programma af te sluiten.

* Doe een online scan via Panda's online virus scan en bewaar het rapport dat je krijgt na het scannen

* Herstart je pc nogmaals en plaats dan een nieuw logje van Hijackthis, samen met het rapport van Ewido en Panda, Post de log van de smitRem tool, die je hier kan vinden: C:\smitfiles.txt.

Al hartelijk bedankt! Waar kan ik dat ook leren eigelijk?

Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 13:59:25, on 8/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\issearch.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TEMP\win1D.tmp.exe
C:\Program Files\Common Files\{320D180E-07CA-1043-0727-050711050020}\Update.exe
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\ismon.exe
C:\WINDOWS\system32\cool.exe
C:\PROGRA~1\COMMON~1\ASKS~1\lsass.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Olivier\Mijn documenten\?dobe\n?tepad.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Documents and Settings\Olivier\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - {8208D074-4F97-103B-BEAB-62848EE34BC5} - C:\WINDOWS\system32\dljzue.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [f1c56988.exe] C:\WINDOWS\system32\f1c56988.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [f1c56988.exe] C:\Documents and Settings\Olivier\Local Settings\Application Data\f1c56988.exe
O4 - HKCU\..\Run: [Hepc] "C:\PROGRA~1\COMMON~1\ASKS~1\lsass.exe" -vt yax
O4 - HKCU\..\Run: [Dtripjw] C:\Documents and Settings\Olivier\Mijn documenten\?dobe\n?tepad.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter: text/html - {03974811-C15F-462c-B6B0-2D2336AA57D0} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

Ewido
---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 19:06:18 8/08/2006

+ Scan result:



[376] VM_13140000 -> Trojan.Dialer.qs : Error during cleaning.


::Report end

Hiij gaf eerst wel 162 infecties maar uit eindelijk kon ik er maar 1 verwijderen...

Panda
Die moet ik per ongeluk afgesloten hebben tijdens het surfen -_-' verbruikt dat veel internet verkeer?


SmitRem

smitRem © log file
version 3.1

by noahdfear


Microsoft Windows XP [versie 5.1.2600]
"IE"="6.0000"

Running from
C:\Documents and Settings\Olivier\Bureaublad\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"
"incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!


checking for drsmartload2 key


drsmartload2 key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
AlfaCleaner uninstaller NOT present
SpyFalcon uninstaller NOT present
SpywareQuake uninstaller NOT present
SpywareSheriff uninstaller NOT present
Trust Cleaner uninstaller NOT present
SpyHeal uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~
~~~ Shortcuts ~~~

Online Security Guide.url
Security Troubleshooting.url

~~~ Favorites ~~~
~~~ system32 folder ~~~

ishost.exe
ismon.exe
isnotify.exe
issearch.exe
ixt*.dll
amcompat.tlb
nscompat.tlb
logfiles

~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1216 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system32 folder ~~~

ishost.exe
ismon.exe
issearch.exe
ixt*.dll


~~~ Icons in System32 ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~ Wininet.dll ~~~

CLEAN!

Vervolg
Alleen dit vind ik niet:
Ga dan naar Start -> configuratiescherm -> vormgeving en thema's -> bureaublad ->bureaublad aanpassen -> Website -> haal het vinkje weg bij "Security Info" als het er nog staat.

En bij mij IE heb ik altijd deze startpagina wat ik ook doe: http://www.syssecuritypage.com/

Bedankt nog eens.

* Ga naar start==>configuratiescherm==>software en de-installeer indien aanwezig:

Oin
Yazzle by Oin
Purityscan by Oin
Snowballwars by Oin
Cowabanga by OIN
Of iets gelijkaardigs met Oin erin.

Als OIN niet aanwezig is, download en laat deze runnen:

* open hijackthis en vink volgende regels aan indien aanwezig:

R3 - URLSearchHook: (no name) - {8208D074-4F97-103B-BEAB-62848EE34BC5} - C:\WINDOWS\system32\dljzue.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [f1c56988.exe] C:\WINDOWS\system32\f1c56988.exe
O4 - HKCU\..\Run: [f1c56988.exe] C:\Documents and Settings\Olivier\Local Settings\Application Data\f1c56988.exe
O4 - HKCU\..\Run: [Hepc] "C:\PROGRA~1\COMMON~1\ASKS~1\lsass.exe" -vt yax
O4 - HKCU\..\Run: [Dtripjw] C:\Documents and Settings\Olivier\Mijn documenten\?dobe\n?tepad.exe

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* heb nog een vraagje: Je hebt niet gedaan wat ik vroeg! heb je eigelijk smitrem en ewido in veilige modus uitgevoerd? Je post het rapport niet compleet van ewido en ik zie ook geen rapport van panda, want als je nu geïnfecteerd bent is het niet het moment om te surfen, wie weet zit je nu op illegale site's zonder je van kwaad bewust bent en geraak je terug geïnfecteerd.

* Dus doe deze stappen nog en doe daarna de vorige stappen opnieuw.

Ik heb nu alles gescant in veilige modus. Ik sluit af en ga trg in veiligemodus maar met netwerkopties en hij geeft direct al een raar programma -_-' hoe zou dat komen? Zal eerst maar eens die panda doen.

Uh, gewoon in veilige modus zonder netwerkmogelijkheden booten aub.

Jurgenv1 zei:

Uh, gewoon in veilige modus zonder netwerkmogelijkheden booten aub.

Klik om te vergroten...

Maar hoe scan ik dan met Panda?

Ik heb nog maar 3 echte problemen en dat is altijd een uitroepteken onderaan en die geeft dan zo'n tekstballonetje... Mijn startpagina is ook nog altijd een "rare' en ik krijg soms ook gewoon pop-up's zonder dat ik surf.

Log's:

HijackThis
Logfile of HijackThis v1.99.1
Scan saved at 19:24:36, on 10/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\ismon.exe
C:\WINDOWS\system32\isnotify.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\{320D180E-07CA-1043-0727-050711050020}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Olivier\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [f1c56988.exe] C:\WINDOWS\system32\f1c56988.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe


smitRem
smitRem © log file
version 3.1

by noahdfear


Microsoft Windows XP [versie 5.1.2600]
"IE"="6.0000"

Running from
C:\Documents and Settings\Olivier\Bureaublad\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!


checking for drsmartload2 key


drsmartload2 key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
AlfaCleaner uninstaller NOT present
SpyFalcon uninstaller NOT present
SpywareQuake uninstaller NOT present
SpywareSheriff uninstaller NOT present
Trust Cleaner uninstaller NOT present
SpyHeal uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~

ishost.exe
ismon.exe
isnotify.exe
issearch.exe
ixt*.dll


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 916 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Preloader van browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Cache-daemon voor onderdeelcategorieën"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~


~~~ Wininet.dll ~~~

CLEAN!

VERVOLG!


Activescan
Incident Status Location

Adware:Adware/SuperSpider Not disinfected C:\WINDOWS\system32\winjvd32.dll
Adware:Adware/SystemDoctor Not disinfected C:\WINDOWS\system32\f1c56988.exe
Spywarepyware/LinkReplacer Not disinfected C:\WINDOWS\system32\PreUninstallHL.exe
Adware:adware/mediatickets Not disinfected C:\WINDOWS\system32\oins.exe
Adware:Adware/SystemDoctor Not disinfected C:\WINDOWS\system32\components\flx6.dll
Adware:Adware/SystemDoctor Not disinfected C:\WINDOWS\system32\components\flx22.dll
Adware:Adware/Maxifiles Not disinfected C:\WINDOWS\temp\win7.tmp.exe
Adware:Adware/DollarRevenue Not disinfected C:\WINDOWS\temp\nslB.tmp\nsProcess.dll
Adware:Adware/SystemDoctor Not disinfected C:\WINDOWS\temp\winC.tmp.exe
Adware:Adware/Yazzle Not disinfected C:\WINDOWS\temp\win12.tmp.exe
Adware:Adware/PurityScan Not disinfected C:\WINDOWS\temp\win51.tmp.exe
Adware:adware/yazzle Not disinfected C:\WINDOWS\Downloaded Program Files\YazzleActiveX.inf
Adware:Adware/Yazzle Not disinfected C:\WINDOWS\Downloaded Program Files\__delete_on_reboot__Y_A_Z_Z_L_E_~_1_._O_C_X_
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Olivier\Bureaublad\smitRem.exe[smitRem/Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Olivier\Bureaublad\smitRem\Process.exe
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@toplist[1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@cgi-bin[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@xiti[2].txt
Spyware:Cookie/Malwarewipe Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@malwarewipe[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Olivier\Cookies\[email protected][3].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@belnk[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Olivier\Cookies\[email protected][2].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@adultfriendfinder[1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@cgi-bin[5].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@atwola[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@go[2].txt
Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\Olivier\Cookies\[email protected][1].txt
Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Olivier\Cookies\[email protected][2].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@adultfriendfinder[2].txt
Spyware:Cookie/SpywareQuake Not disinfected C:\Documents and Settings\Olivier\Cookies\[email protected][1].txt
Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@xmts[1].txt
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Olivier\Cookies\[email protected][1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@cgi-bin[7].txt
Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Olivier\Cookies\[email protected][3].txt
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@errorsafe[1].txt
Spyware:Cookie/WinFixer Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@winfixer[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Olivier\Cookies\olivier@atwola[2].txt
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt[.metriweb.be/]
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\zfzgdk3z.Standaardgebruiker\cookies.txt[.metriweb.be/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\zfzgdk3z.Standaardgebruiker\cookies.txt[.go.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\zfzgdk3z.Standaardgebruiker\cookies.txt[.realmedia.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\zfzgdk3e.Olivier\cookies.txt[.atwola.com/]
Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\zfzgdk3e.Olivier\cookies.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\zfzgdk3e.Olivier\cookies.txt[.toplist.cz/]
Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\zfzgdk3e.Olivier\cookies.txt[landing.domainsponsor.com/]
Adware:Adware/SystemDoctor Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6O233P3V\wlzip32[1].exe
Adware:Adware/Yazzle Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\GF1VUTV7\YazzleActiveX[1].cab[YazzleActiveX.ocx]
Adware:Adware/Yazzle Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WKZA8P8D\mulbin32[1].exe
Adware:Adware/Maxifiles Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\LJPKJ0WT\wlzip32[1].exe
Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\LJPKJ0WT\wind32[1].exe
Adware:Adware/SystemDoctor Not disinfected C:\Documents and Settings\Administrator\Local Settings\Application Data\f1c56988.exe
Adware:adware/securityerror Not disinfected C:\Documents and Settings\Administrator\Favorieten\Antivirus Test Online.url
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@metriweb[1].txt
Spyware:Cookie/SpywareQuake Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ai2ry37j.default\cookies.txt[www.spywarequake.com/]
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ai2ry37j.default\cookies.txt[.metriweb.be/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ai2ry37j.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ai2ry37j.default\cookies.txt[.doubleclick.net/]
Adware:Adware/SecurityError Not disinfected C:\Program Files\Common Files\{320D180E-07CA-1043-0727-050711050020}\services.dll
Spywarepyware/Virtumonde Not disinfected C:\Program Files\Common Files\{320D180E-07CB-1043-0727-050711050020}\services.dll
Adware:Adware/Mytoolbar Not disinfected C:\Program Files\ToolBar888\MyToolBar.dll
Adware:Adware/Mytoolbar Not disinfected C:\Program Files\ToolBar888\Activate.exe
Adware:Adware/DollarRevenue Not disinfected C:\Program Files\ToolBar888\Uninst.exe[²ÜÇ\nsProcess.dll]
Adware:Adware/SafetyBar Not disinfected C:\Program Files\Safety Bar\Uninstall.bat
Adware:Adware/PurityScan Not disinfected C:\Program Files\Cowabanga\Cowabanga.exe
Adware:Adware/PurityScan Not disinfected C:\Program Files\Cowabanga\uninstaller.exe
Potentially unwanted tool:Application/SpywareQuake Not disinfected C:\Program Files\SpyQuake2.com\Spy-Quake2.exe

Vervolg

ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 16:24:58 10/08/2006

+ Scan result:



C:\Program Files\Safety Bar -> Adware.Generic : No action taken.
C:\Program Files\Safety Bar\Uninstall.bat -> Adware.Generic : No action taken.
HKLM\SOFTWARE\Classes\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4} -> Adware.Generic : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{873eb32d-ae1a-4183-89bd-45a77f761be4} -> Adware.Generic : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP237\A0071497.exe -> Adware.MediaTickets : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP239\A0073233.dll -> Adware.MediaTickets : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP240\A0074367.exe -> Adware.MediaTickets : No action taken.
C:\Documents and Settings\Olivier\Mijn documenten\Аdobe\__delete_on_reboot__n_ο_t_e_p_a_d_._e_x_e_ -> Adware.PurityScan : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP237\A0072441.DLL -> Adware.PurityScan : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP237\A0072442.exe -> Adware.PurityScan : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP188\A0056649.dll -> Adware.SaveNow : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP242\A0077500.exe -> Downloader.INService : No action taken.
C:\Documents and Settings\Olivier\Local Settings\Application Data\f1c56988.exe -> Downloader.Obfuscated.a : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP238\A0072497.EXE -> Downloader.Obfuscated.a : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP238\A0072498.exe -> Downloader.Obfuscated.a : No action taken.
C:\WINDOWS\system32\f1c56988.exe -> Downloader.Obfuscated.a : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP240\A0074363.exe -> Downloader.PurityScan.cq : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP237\A0072443.exe -> Downloader.PurityScan.cu : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP237\A0072433.exe -> Downloader.Zlob.acr : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP237\A0071495.exe -> Downloader.Zlob.act : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP237\A0071496.dll -> Downloader.Zlob.acu : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP237\A0072431.dll -> Downloader.Zlob.adb : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP238\A0072495.DLL -> Downloader.Zlob.adb : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP239\A0072594.dll -> Downloader.Zlob.adb : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP238\A0072500.dll -> Not-A-Virus.Hoax.Win32.Renos.ds : No action taken.
C:\WINDOWS\system32\components\flx6.dll -> Not-A-Virus.Hoax.Win32.Renos.ds : No action taken.
:mozilla.132:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.347:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.430:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.73:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.91:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Adbrite : No action taken.
:mozilla.439:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.440:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.323:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Adviva : No action taken.
:mozilla.319:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Bfast : No action taken.
:mozilla.21:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Bluestreak : No action taken.
:mozilla.92:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.93:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.94:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.95:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.266:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.267:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.271:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.272:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.315:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.316:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.332:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.333:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.116:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.368:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Coremetrics : No action taken.
:mozilla.31:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.253:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Estat : No action taken.
:mozilla.33:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.34:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.35:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.36:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.40:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Falkag : No action taken.
:mozilla.84:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.85:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.87:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.88:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.89:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.90:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.262:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.263:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.290:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.341:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.391:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.99:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Hotlog : No action taken.
:mozilla.278:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Masterstats : No action taken.
:mozilla.72:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.334:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Ne : No action taken.
:mozilla.265:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.415:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Revenue : No action taken.
:mozilla.296:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.297:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.298:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.133:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.134:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.135:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.136:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.137:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.138:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.139:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.140:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.141:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexcounter : No action taken.
:mozilla.268:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexlist : No action taken.
:mozilla.269:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexlist : No action taken.
:mozilla.270:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sexlist : No action taken.
:mozilla.32:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.377:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.39:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.434:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.45:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Sitestat : No action taken.
:mozilla.109:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Starware : No action taken.
:mozilla.110:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Starware : No action taken.
:mozilla.111:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Starware : No action taken.
:mozilla.112:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Starware : No action taken.
:mozilla.81:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.82:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.225:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.226:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.227:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.228:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Tacoda : No action taken.
:mozilla.18:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.19:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.244:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.389:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Weborama : No action taken.
:mozilla.390:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Weborama : No action taken.
:mozilla.69:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.71:C:\Documents and Settings\Olivier\Application Data\Mozilla\Firefox\Profiles\2es27i2p.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\I123456P\srvewg[1].exe -> Trojan.Dialer.qs : No action taken.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\LFZCOYQO\srvpng[1].exe -> Trojan.Dialer.qs : No action taken.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\LFZCOYQO\srvpta[1].exe -> Trojan.Dialer.qs : No action taken.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\LODAXQ4V\srvnlr[1].exe -> Trojan.Dialer.qs : No action taken.
C:\Documents and Settings\Olivier\Local Settings\Temporary Internet Files\Content.IE5\VW0P5IMH\srveij[1].exe -> Trojan.Dialer.qs : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP237\A0072435.exe -> Trojan.Dialer.qs : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP239\A0073219.exe -> Trojan.Dialer.qs : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP240\A0073337.exe -> Trojan.Dialer.qs : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP240\A0075383.exe -> Trojan.Dialer.qs : No action taken.
C:\System Volume Information\_restore{9C78D941-2EF5-49F8-B58F-32A69F0C264A}\RP242\A0076480.exe -> Trojan.Dialer.qs : No action taken.


::Report end

Vervolg

En dan om te stoppen:

Hij geeft altijd dit als ik scan als ik blijf scannen blijft hij dat ook geven gewoon.

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 17:11:11 10/08/2006

+ Scan result:



HKLM\SOFTWARE\Classes\CLSID\{873eb32d-ae1a-4183-89bd-45a77f761be4} -> Adware.Generic : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{873eb32d-ae1a-4183-89bd-45a77f761be4} -> Adware.Generic : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\\kernel32.dll -> Trojan.Small : No action taken.


::Report end

THX AL é!!!!!

Ik hoop dat je eerst de log gemaakt hebt en dan alles hebt laten verwijderen...

Ennu om te scannen met panda kan je toch terug in normale modus booten zoals ik heb gezegd?


Download SmitfraudFix (by S!Ri), en pak het uit op je bureaublad.

Open de SmitfraudFix map en dubbelklik op smitfraudfix.cmd
Kies optie #1 - Search door1 te typen, en druk op "Enter";
Er zal een tekstbestandje openen.
Plaats de inhoud van dat tekstbestandje in je volgende antwoord.

Jurgenv1 zei:

Ik hoop dat je eerst de log gemaakt hebt en dan alles hebt laten verwijderen...

Ennu om te scannen met panda kan je toch terug in normale modus booten zoals ik heb gezegd?


Download SmitfraudFix (by S!Ri), en pak het uit op je bureaublad.

Open de SmitfraudFix map en dubbelklik op smitfraudfix.cmd
Kies optie #1 - Search door1 te typen, en druk op "Enter";
Er zal een tekstbestandje openen.
Plaats de inhoud van dat tekstbestandje in je volgende antwoord.

Klik om te vergroten...

SmitFraudFix v2.81

Scan done at 23:58:18,46, do 10/08/2006
Run from C:\Documents and Settings\Olivier\Bureaublad\Op\SmitfraudFix
OS: Microsoft Windows XP [versie 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ishost.exe FOUND !
C:\WINDOWS\system32\ismon.exe FOUND !
C:\WINDOWS\system32\isnotify.exe FOUND !
C:\WINDOWS\system32\issearch.exe FOUND !
C:\WINDOWS\system32\ixt?.dll FOUND !
C:\WINDOWS\system32\ixt??.dll FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\ts.ico FOUND !
C:\WINDOWS\system32\components\flx?.dll FOUND !
C:\WINDOWS\system32\components\flx??.dll FOUND !
C:\WINDOWS\system32\components\flx???.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Olivier\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\OLIVIER\FAVORI~1

C:\DOCUME~1\OLIVIER\FAVORI~1\Antivirus Test Online.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Safety Bar\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Mijn huidige introductiepagina"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End


De scan van panda had ik hier boven al gepost dacht ik. Ik had dan veilige modus genomen met netwerkoptie gewoon

Je kan deze instructies best uitprinten of opslaan in een tekstbestandje, want
je zal in veilige modus moeten gaan werken en dan is deze pagina niet beschikbaar (geen internet).

Start de computer in veilige modus.
(Kijk hier eventueel voor uitleg.)

Open de map smitfraudfix en dubbelklik op smitfraudfix.cmd
Kies optie #2 - Clean door2 te typen, en druk op "Enter" om de
geïnfecteerde bestanden te verwijderen.

Je zal een vraag krijgen: ""Registry cleaning - Do you want to clean the registry ?"
Antwoord "yes" door y te typen en druk op "Enter".

Als je pc daarna niet heropstart, start hem dan handmatig terug op in normale modus.

Het tooltje zal nu onderzoeken of wininet.dll geïnfecteerd is. Je kan dus de vraag krijgen of je
het geïnfecteerde bestandje wil vervangen. Antwoord dan "yes" door y te typen en druk op "Enter".

Het kan zijn dat het tooltje je pc opnieuw laat opstarten om zijn werk te kunnen afmaken.
Als dat niet zo is, start je pc dan handmatig opnieuw op in normale modus.
Er zal een tekstbestandje openen met de resultaten van de fix. Post de inhoud van dit bestandje in je volgende antwoord met een nieuw hijackthis logje.
(Je kan het rapport ook vinden in c:\rapport.txt

Ik heb de tool laten draaien hem handmatig heropgestart (aangezien hij het niet automatisch deed) maar hij heeft niet meer naar die wininet.dll gevraagd...

Bij Ewido geeft hij nu nog maar ééntje wel

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 13:20:02 11/08/2006

+ Scan result:



HKU\S-1-5-21-2640496484-3770639791-848383940-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{052B12F7-86FA-4921-8482-26C42316B522} -> Adware.Generic : No action taken.
HKU\S-1-5-21-2640496484-3770639791-848383940-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{873EB32D-AE1A-4183-89BD-45A77F761BE4} -> Adware.Generic : No action taken.

::Report end

RAPPORT
SmitFraudFix v2.81

Scan done at 13:14:08,78, vr 11/08/2006
Run from C:\Documents and Settings\Olivier\Bureaublad\Op\SmitfraudFix
OS: Microsoft Windows XP [versie 5.1.2600] - Windows_NT
Fix ran in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

HijackThis
Logfile of HijackThis v1.99.1
Scan saved at 13:22:45, on 11/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\{320D180E-07CA-1043-0727-050711050020}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Olivier\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [f1c56988.exe] C:\Documents and Settings\Olivier\Local Settings\Application Data\f1c56988.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

bijna zeker

* Open hijackthis en vink volgende regels aan:

O4 - HKCU\..\Run: [f1c56988.exe] C:\Documents and Settings\Olivier\Local Settings\Application Data\f1c56988.exe
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/Yazzl...cab?refid=1123

* Sluit dan alle vensters behalve hijackthis en klik op 'fix checked'

* Download en unzip Killbox naar je bureaublad.
Klik op killbox.exe.
Selecteer de optie "Delete on reboot".
In het veld "Full Path of File to Delete" kopieer en plak je het volgende:

C:\Documents and Settings\Olivier\Local Settings\Application Data\f1c56988.exe

Klik op de knop: single file (!Belangrijk!)

Daarna, Klik op de rode cirkel met het wit kruisje erin.
Killbox zal zeggen dat deze file zal verwijderd worden on reboot.. vraagt om nu te rebooten. Klik YES.

Je pc moet nu rebooten.

* post dan een nieuw hijackthis logje hier en vertel hoe alles verder werkt.

Hij zei dat het al verwijderd was door een extern proces (mss door in hijackthis het te verwijderen?).

Voor de rest, nog geen pop-up's gehad en mijn IE heeft ook google trg als start pagina (niet dat ik IE gebruik maar zien dat hij nog werkt is altijd goed . Ik krijg ook dat uitroepteken niet meer. We zullen zien wat het einde van de dag geeft! Hij start toch al sneller op en surfen ook

Logfile of HijackThis v1.99.1
Scan saved at 14:57:19, on 11/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\{320D180E-07CA-1043-0727-050711050020}\Update.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Olivier\Bureaublad\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verzenden naar &Bluetooth - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\School Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe


Merci voor alles hier! Kan je dat ergens "leren" zodat je ziet waarom je welke stap juist moet op welk moment? Want voor elk ding is er wel een oplossing maar je moet ze weten en het aantal programma's dat ik hier al heb gebruikt Kan je die ook gebruiken om af en toe eens te laten draaien? Vb. in java een programma maken die al die programma's opstart elke vrijdag avond om alles eens te scannen en te verwijderen? Of is dat niet zo'n goed idee?

thx

Je kan dat leren maar het is tijdrovend en je zal het niet alleen voor eigen gebruik doen...



Nog een paar tips om problemen te voorkomen in de toekomst:

Installeer alvast volgende GRATIS programmatjes indien je ze nog niet hebt:

Spywareblaster
Adaware se
Spybot s&d


Tijdens het surfen, klik niet overal klakkeloos op ja als je dit gevraagd wordt... doe dit enkel wanneer je het volledig vertrouwt.

En kies eventueel een alternatieve browser zoals Opera of Firefox.

En ik raad je ook aan om af en toe een online virusscan uit te voeren. housecall en/of Bitdefender. Want, wat de ene scanner niet kan vinden, kan een andere misschien wel.
Zorg er ook voor dat je virusscanner die op je systeem geïnstalleerd is altijd up to date is!!

En... geregeld eens een bezoekje brengen aan: http://windowsupdate.microsoft.com/

Bekijk ook eens deze 2 filmpjes.. Heel interessant:
http://www2.trosradar.nl/mediaplayer/player.php?videoID=524&mode=dossier#
http://www.benedelman.org/spyware/security-111804.wmv


Meer preventietips zijn ook op volgende sites te vinden:

http://www.bluemedicine.be
http://users.telenet.be/marcvn/spyware
How did I get infected in the first place (article by TonyKlein)
Het voorkomen van spyware-infecties en browserhijacking

Jurgenv1 zei:

Je kan dat leren maar het is tijdrovend en je zal het niet alleen voor eigen gebruik doen...



Nog een paar tips om problemen te voorkomen in de toekomst:

Installeer alvast volgende GRATIS programmatjes indien je ze nog niet hebt:

Spywareblaster
Adaware se
Spybot s&d


Tijdens het surfen, klik niet overal klakkeloos op ja als je dit gevraagd wordt... doe dit enkel wanneer je het volledig vertrouwt.

En kies eventueel een alternatieve browser zoals Opera of Firefox.

En ik raad je ook aan om af en toe een online virusscan uit te voeren. housecall en/of Bitdefender. Want, wat de ene scanner niet kan vinden, kan een andere misschien wel.
Zorg er ook voor dat je virusscanner die op je systeem geïnstalleerd is altijd up to date is!!

En... geregeld eens een bezoekje brengen aan: http://windowsupdate.microsoft.com/

Bekijk ook eens deze 2 filmpjes.. Heel interessant:
http://www2.trosradar.nl/mediaplayer/player.php?videoID=524&mode=dossier#
http://www.benedelman.org/spyware/security-111804.wmv


Meer preventietips zijn ook op volgende sites te vinden:

http://www.bluemedicine.be
http://users.telenet.be/marcvn/spyware
How did I get infected in the first place (article by TonyKlein)
Het voorkomen van spyware-infecties en browserhijacking

Klik om te vergroten...

thx heb er al wat aardig mee bijgeleerd