searchcentral.cc

[anoniem]

telkens als ik na een opstart IE opstart kom ik terecht op de site seachcentral.cc. Deze site is niet mijn standaard opstartsite. (dat is tweakers,net) Ondanks dat ik dit elke keer weer wijzig komt dit elke dag terug. Hoe los ik dit op?

[anoniem]

Scan op spyware met [url=http://download.com.com/redir?pid=10214379&merid=69274&mfgid=69274&edId=3&siteId=4&oId=3002-20-10214379&ontId=20&ltype=dl_dlnow&lop=link&dlrs=1&destUrl=ftp%3A%2F%2Fftpx.download.com%2Fpub%2Fwin95%2Futilities%2Faaw6.exe]AdAware[/url] en [url=http://download.com.com/redir?pid=10194058&merid=104443&mfgid=104443&edId=3&siteId=4&oId=3000-2144-10194058&ontId=2144&ltype=dl_dlnow&lop=link&destUrl=%2F3001-2144-10194058.html]Spybot Search & Destroy[/url]. Update beide programma's na de installatie. Lost dit het probleem niet op download dan [url=http://www.merijn.org/files/CWShredder.exe]CWShredder[/url] Indien hiermee je probleem nog niet opgelost is, dan download je [url=http://www.merijn.org/files/hijackthis.zip] HijackThis[/url]. Unzip en run het programma. Klik op scan, save log en sla het log op als een .txt bestand. Kopieer en plak de inhoud in je volgende bericht.

[anoniem]

Bedankt voor je snell;e antwoord M@rc ik ga het meteen proberen.

[anoniem]

Hier is de log van Hijak This: Logfile of HijackThis v1.97.7 Scan saved at 19:39:09, on 4-2-2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\CMEII\CMESys.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\ctfmon.exe E:\tyd\nood\UD.exe E:\tyd\nood\ud_6800466.exe E:\tyd\nood\ud_6800466_0.dir\ud_ligfit_Release.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\EP\Bureaublad\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.hotsearchbox.com/ie/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.hotsearchbox.com/ie/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://81.211.105.43/search.php?v=5 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://81.211.105.43/index.php?v=5 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tweakers.net/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hotsearchbox.com/ie/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SystemSearch] REGEDIT.EXE -S c:\system.reg O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe" O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O4 - HKLM\..\Run: [AVG7_RegCleaner] C:\PROGRA~1\Grisoft\AVG7\avgregcl.exe /BOOT O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O10 - Broken Internet access because of LSP provider 'imon.dll' missing O16 - DPF: {11111111-1111-1111-1111-111300000000} - mhtml:C:\\NO_SUCH_MHT.MHT!http://66.79.166.152/go.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8D3D8B54-29ED-4586-AEEE-75F4B31922BE}: NameServer = 213.239.154.10,212.120.66.195 zeg het maar wat moet ik hiermee?

[anoniem]

CW Shredder: Done! Removed from your system: - CWS.Xplugin - 3 infected IE registry values Windows XP (5.01.2600 ) CWShredder v1.47.5 Written by Merijn - merijn@spywareinfo.com For any additional help with this program or removing CWS, visit http://forums.spywareinfo.com/ For information and documentation on the Coolwebsearch trojan and its variants, visit http://www.merijn.org/cwschronicles.html Spybot oa verwijderd Gator en Cydoor.

[anoniem]

Laat HijackThis volgende items repareren. Zorg dat alle andere vensters gesloten zijn: R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.hotsearchbox.com/ie/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.hotsearchbox.com/ie/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://81.211.105.43/search.php?v=5 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://81.211.105.43/index.php?v=5 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.hotsearchbox.com/ie/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.hotsearchbox.com/ie/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotsearchbox.com/ie/ O4 - HKLM\..\Run: [SystemSearch] REGEDIT.EXE -S c:\system.reg O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe" O16 - DPF: {11111111-1111-1111-1111-111300000000} - mhtml:C:\\NO_SUCH_MHT.MHT!http://66.79.166.152/go.exe Je hebt gator op je pc en de oorzaak is O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe" Hoe verwijderen zie: http://www.pchell.com/support/gator.shtml Reboot je pc in veilige modus en verwijder het volgende bestand indien aanwezig: system.reg in c:\ edit: iets te laat Post nog even een nieuwe log. (om zeker te zijn dat alles weg is.) en deze mag je ook verwijderen in veilige modus: het bestand CMESys.exe in de map C:\Program Files\Common Files\CMEII\

[anoniem]

Hoe staan we er nu voor? Logfile of HijackThis v1.97.7 Scan saved at 20:08:01, on 4-2-2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\ctfmon.exe E:\tyd\nood\UD.exe E:\tyd\nood\ud_6800466.exe E:\tyd\nood\ud_6800466_0.dir\ud_ligfit_Release.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\EP\Bureaublad\HijackThis.exe C:\WINDOWS\totalcmd\TOTALCMD.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tweakers.net/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O4 - HKLM\..\Run: [AVG7_RegCleaner] C:\PROGRA~1\Grisoft\AVG7\avgregcl.exe /BOOT O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O10 - Broken Internet access because of LSP provider 'imon.dll' missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8D3D8B54-29ED-4586-AEEE-75F4B31922BE}: NameServer = 213.239.154.10,212.120.66.195

[anoniem]

Droopy, Deze ziet er goed uit.

[anoniem]

Geweldig M@rc, dus de pc is weer gezond. Ik zal deze progjes iig bij de hand houden als zoiets weer gebeurd. thx

[anoniem]

Graag gedaan, en voeg deze er ook maar aan toe: [url=http://www.javacoolsoftware.com/spywareblaster.html]SpywareBlaster[/url] :wink:

[anoniem]

M@rc, bij deze ook gedowned en geinstalled.