Hijackthis.log -Gossie , ik geloof dat ik bedolven ben

[anoniem]

Hallo, Ja hier ben ik weer met een geinfecteerde pc , je houd het zo moeilijk tegen :( Ik heb lavasoft adaware , spybot en cwschredder erover laten lopen en dit zegt meneer hijackthis dan: Logfile of HijackThis v1.98.2 Scan saved at 22:33:04, on 7-10-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\WINDOWS\System32\ZoneLabs\isafe.exe C:\WINDOWS\System32\inetsrv\inetinfo.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\ASUS\Probe\AsusProb.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE D:\Program Files\Messenger Plus! 3\MsgPlus.exe C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Logitech\Profiler\lwemon.exe D:\Program Files\SigXC\SigX.exe C:\WINDOWS\System32\wuauclt.exe D:\Program Files\FireFox\firefox.exe C:\Program Files\Common Files\soft602\pdfSaver.exe D:\Program Files\Software602\602Pro PC SUITE\602Tab\602Tab.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe D:\Downloads Browser\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - D:\Program Files\iMesh Light\iMeshBHO.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - D:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [CloneCDTray] "D:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Winad Client] C:\Program Files\Winad Client\Winad.exe O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe" O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe" O4 - HKLM\..\RunOnce: [djtopr1150.exe] "C:\DOCUME~1\FREEK~1.THE\LOCALS~1\Temp\djtopr1150.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "d:\steam fuckered mess\steam.exe" -silent O4 - HKCU\..\Run: [lycosInside] C:\Program Files\lycos\Lyc_SysTray.exe O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui O4 - HKCU\..\Run: [SigXC] D:\Program Files\SigXC\SigX.exe O4 - HKCU\..\Run: [pdfSaver3] "c:\Program Files\PDF\pdfSaver\pdfSaver3.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=8c4f4634a6cb3563992c4afb91102a05d8cb6fabaea1d720dfb649ed4800f9e347d3b936bd4ef578beff3de5a7f1248299b0:61c349ac2c9d0346d02ce89775140bcf Weet iemand wat wegkan ? DankU Freek

[anoniem]

zal er een nakijken voordat ik na bed ga. Nu dus

[anoniem]

Open taakbeheer (ctrl+alt+del) en kill deze processen indien ze draaien: [list:f6e1d1aa62][b:f6e1d1aa62]WebRebates0.exe SyncroAd.exe Winad.exe[/b:f6e1d1aa62][/list:u:f6e1d1aa62] Ga naar start --> configuratiescherm --> software en probeer deze te deinstaleren: [list:f6e1d1aa62][b:f6e1d1aa62]Winad webrates synchroad imesh (Misschien leuk om mee te downloaden maar het is rotzooi)[/b:f6e1d1aa62][/list:u:f6e1d1aa62] Sluit alle vensters en laat hijackthis deze fixen indien aanwezig: [list:f6e1d1aa62][b:f6e1d1aa62]O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - D:\Program Files\iMesh Light\iMeshBHO.dll O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll O4 - HKLM\..\Run: [Winad Client] C:\Program Files\Winad Client\Winad.exe O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe" O4 - HKLM\..\RunOnce: [djtopr1150.exe] "C:\DOCUME~1\FREEK~1.THE\LOCALS~1\Temp\djtopr1150.exe O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=8c4f4634a6cb3563992c4afb91102a05d8cb6fabaea1d720dfb649ed4800f9e347d3b936bd4ef578beff3de5a7f1248299b0:61c349ac2c9d0346d02ce89775140bcf[/b:f6e1d1aa62][/list:u:f6e1d1aa62] Herstart in veilige modus: http://users.pandora.be/marcvn/spyware/1378056.htm Laat alle verborgen bestanden weergeven: http://users.pandora.be/marcvn/spyware/1117602.htm Verwijder indien aanwezig: [list:f6e1d1aa62][b:f6e1d1aa62]C:\Program Files\Web_Rebates <--- deze map C:\Program Files\Windows SyncroAd <--- deze map C:\Program Files\Winad Client <--- deze map[/b:f6e1d1aa62][/list:u:f6e1d1aa62] Herstart in gewone modus en post een nieuwe log. Ik twijfel bij deze, weet jij wat het is? Ik kan er iig geen relevante informatie over vinden. O4 - HKCU\..\Run: [lycosInside] C:\Program Files\lycos\Lyc_SysTray.exe

[anoniem]

Bedankt zal het straks doen , moet nu naar school... Dat is van Luycosinside dat laatste , om lycos email te intrigregen in je outlook.. ik dacht dat ik die allang verwijderd had... Freek

[anoniem]

[quote:eb8d831c8a="THE_GAME_MEN!"]Bedankt zal het straks doen , moet nu naar school...[/quote:eb8d831c8a] Arme jij :lol: Ik moet dalijk ook, ga naar een of andere klimhal. [quote:eb8d831c8a]Dat is van Luycosinside dat laatste , om lycos email te intrigregen in je outlook.. ik dacht dat ik die allang verwijderd had... Freek[/quote:eb8d831c8a] probeer hem bij software te verwijderen, als dat niet lukt die sleutel repareren in hijackthis, en dan in veilige modus de map: "C:\Program Files\lycos" eraf kinkelen. (tenminste als je hem weg wilt hebben)

[anoniem]

Tadaa: Logfile of HijackThis v1.98.2 Scan saved at 16:03:22, on 8-10-2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\WINDOWS\System32\ZoneLabs\isafe.exe C:\WINDOWS\System32\inetsrv\inetinfo.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\ASUS\Probe\AsusProb.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe C:\Program Files\Common Files\soft602\pdfSaver.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Logitech\Profiler\lwemon.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\SigXC\SigX.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\PDF\pdfSaver\pdfSaver3.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\WINDOWS\System32\msiexec.exe C:\WINDOWS\System32\wuauclt.exe D:\Program Files\FireFox\firefox.exe D:\Downloads Browser\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - D:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [CloneCDTray] "D:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\soft602\pdfSaver.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "d:\steam fuckered mess\steam.exe" -silent O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui O4 - HKCU\..\Run: [SigXC] D:\Program Files\SigXC\SigX.exe O4 - HKCU\..\Run: [pdfSaver3] "c:\Program Files\PDF\pdfSaver\pdfSaver3.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe Freek

[anoniem]

Als je het mij vraagt ziet het er goed uit, wel zou ik als ik jou was nog even naar de veilige modus gaan, alle bestanden weer laten geven en dan deze map even leeggooien: [list:87783a20e8][b:87783a20e8]C:\DOCUME~1\FREEK~1.THE\LOCALS~1\Temp[/b:87783a20e8][/list:u:87783a20e8]

[anoniem]

Ooh gat nog 84 mb heb hem gedeeltelijk leeggegooid Nogmaals bedankt Freek