AUB hulp bij Generic.dx virus!

[Anoniem2]

Hoi,\r\n\r\nIk heb sinds 1 dag problemen met mijn computer. Alles is enorm langzaam en ik kan niets meer opstarten in de normale opstart. (geen internet e.d.) Mcafee heeft gevonden dat het een Generic.dx virus is echter kan hij deze niet verwijderen. Na het gebruiken van een superspyware programma was er nog geen progressie (hij heeft niets gevonden) Nu zag ik dat ik met HJT een log-file moest maken om dit ter discussie te stellen. Ik heb daarom in de veilige modus HJT gebruikt (ook dit lukte niet met een log-file in de normale modus) hieronder de log-file. Kan iemand mij misschien helpen met het oplossen van dit probleem want ik krijg het niet opgelost.\r\n\r\nBedankt\r\n\r\n\r\nLogfile of Trend Micro HijackThis v2.0.2\r\nScan saved at 8:15:14, on 31-3-2010\r\nPlatform: Windows XP SP3 (WinNT 5.01.2600)\r\nMSIE: Internet Explorer v8.00 (8.00.6001.18702)\r\nBoot mode: Safe mode with network support\r\n\r\nRunning processes:\r\nC:\\WINDOWS\\System32\\smss.exe\r\nC:\\WINDOWS\\system32\\winlogon.exe\r\nC:\\WINDOWS\\system32\\services.exe\r\nC:\\WINDOWS\\system32\\lsass.exe\r\nC:\\WINDOWS\\system32\\svchost.exe\r\nC:\\WINDOWS\\system32\\svchost.exe\r\nC:\\WINDOWS\\Explorer.EXE\r\nC:\\PROGRA~1\\McAfee\\MSC\\mcmscsvc.exe\r\nC:\\Program Files\\McAfee\\MPF\\MPFSrv.exe\r\nc:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe\r\nC:\\Program Files\\Trend Micro\\HijackThis\\HijackThis.exe\r\n\r\nR1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Search Bar = [url]http://dellsearchedit.myway.com/samisc/dellsidebar.jhtml?p=DW[/url]\r\nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = [url]http://www.google.nl/[/url]\r\nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]\r\nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]\r\nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]\r\nR0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]\r\nR1 - HKCU\\Software\\Microsoft\\Internet Connection Wizard,ShellNext = [url]http://www.euro.dell.com/[/url]\r\nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Koppelingen\r\nR3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)\r\nO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\\Program Files\\Adobe\\Acrobat 7.0\\ActiveX\\AcroIEHelper.dll\r\nO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)\r\nO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\\WINDOWS\\system32\\dla\\tfswshx.dll\r\nO2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\\Program Files\\Canon\\Easy-WebPrint\\EWPBrowseLoader.dll\r\nO2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\\Program Files\\Microsoft\\Search Enhancement Pack\\Search Helper\\SEPsearchhelperie.dll\r\nO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\\Program Files\\McAfee\\VirusScan\\scriptsn.dll\r\nO2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WindowsLiveLogin.dll\r\nO2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\\PROGRA~1\\mcafee\\SITEAD~1\\mcieplg.dll\r\nO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\\Program Files\\Java\\jre6\\bin\\jp2ssv.dll\r\nO2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\\Program Files\\Windows Live\\Toolbar\\wltcore.dll\r\nO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\\Program Files\\Java\\jre6\\lib\\deploy\\jqs\\ie\\jqs_plugin.dll\r\nO3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\\Program Files\\Canon\\Easy-WebPrint\\Toolband.dll\r\nO3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\\PROGRA~1\\mcafee\\SITEAD~1\\mcieplg.dll\r\nO3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\\Program Files\\Windows Live\\Toolbar\\wltcore.dll\r\nO4 - HKLM\\..\\Run: [SunJavaUpdateSched] \"C:\\Program Files\\Java\\jre6\\bin\\jusched.exe\"\r\nO4 - HKLM\\..\\Run: [SigmatelSysTrayApp] stsystra.exe\r\nO4 - HKLM\\..\\Run: [ATIPTA] \"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\"\r\nO4 - HKLM\\..\\Run: [DVDLauncher] \"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\"\r\nO4 - HKLM\\..\\Run: [DMXLauncher] C:\\Program Files\\Dell\\Media Experience\\DMXLauncher.exe\r\nO4 - HKLM\\..\\Run: [dla] C:\\WINDOWS\\system32\\dla\\tfswctrl.exe\r\nO4 - HKLM\\..\\Run: [ISUSPM Startup] C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup\r\nO4 - HKLM\\..\\Run: [ISUSScheduler] \"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start\r\nO4 - HKLM\\..\\Run: [SSBkgdUpdate] \"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot\r\nO4 - HKLM\\..\\Run: [OpwareSE4] \"C:\\Program Files\\ScanSoft\\OmniPageSE4.0\\OpwareSE4.exe\"\r\nO4 - HKLM\\..\\Run: [QuickTime Task] \"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime\r\nO4 - HKLM\\..\\Run: [mcagent_exe] \"C:\\Program Files\\McAfee.com\\Agent\\mcagent.exe\" /runkey\r\nO4 - HKLM\\..\\Run: [McENUI] C:\\PROGRA~1\\McAfee\\MHN\\McENUI.exe /hide\r\nO4 - HKLM\\..\\Run: [b-783] C:\\Program Files\\Ozfudditqdkvbqz\\qxiodmmrc.exe q\r\nO4 - HKLM\\..\\Run: [TrayServer] C:\\Program Files\\MAGIX\\Film_op_DVD_7\\TrayServer.exe\r\nO4 - HKCU\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\ctfmon.exe\r\nO4 - HKCU\\..\\Run: [H/PC Connection Agent] \"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\"\r\nO4 - HKCU\\..\\Run: [b-783] C:\\Program Files\\Ozfudditqdkvbqz\\qxiodmmrc.exe q\r\nO4 - HKCU\\..\\Run: [SUPERAntiSpyware] C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe\r\nO4 - HKUS\\S-1-5-19\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'Lokale service\')\r\nO4 - HKUS\\S-1-5-20\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'Netwerkservice\')\r\nO4 - HKUS\\S-1-5-18\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'SYSTEM\')\r\nO4 - HKUS\\.DEFAULT\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\CTFMON.EXE (User \'Default user\')\r\nO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe\r\nO4 - Global Startup: ImageMixer HDD Camera Monitor.lnk = ?\r\nO8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\\PROGRA~1\\MICROS~3\\OFFICE11\\EXCEL.EXE/3000\r\nO8 - Extra context menu item: Easy-WebPrint Afdrukken - res://C:\\Program Files\\Canon\\Easy-WebPrint\\Toolband.dll/RC_Print.html\r\nO8 - Extra context menu item: Easy-WebPrint Afdrukvoorbeeld - res://C:\\Program Files\\Canon\\Easy-WebPrint\\Toolband.dll/RC_Preview.html\r\nO8 - Extra context menu item: Easy-WebPrint Toevoegen aan afdruklijst - res://C:\\Program Files\\Canon\\Easy-WebPrint\\Toolband.dll/RC_AddToList.html\r\nO8 - Extra context menu item: Easy-WebPrint Versneld afdrukken - res://C:\\Program Files\\Canon\\Easy-WebPrint\\Toolband.dll/RC_HSPrint.html\r\nO9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\\Program Files\\Windows Live\\Writer\\WriterBrowserExtension.dll\r\nO9 - Extra \'Tools\' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\\Program Files\\Windows Live\\Writer\\WriterBrowserExtension.dll\r\nO9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MICROS~4\\INetRepl.dll\r\nO9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MICROS~4\\INetRepl.dll\r\nO9 - Extra \'Tools\' menuitem: Mobiele favorieten maken - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\\PROGRA~1\\MICROS~4\\INetRepl.dll\r\nO9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\\PROGRA~1\\MICROS~3\\OFFICE11\\REFIEBAR.DLL\r\nO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe\r\nO9 - Extra \'Tools\' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe\r\nO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe\r\nO9 - Extra \'Tools\' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe\r\nO16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - [url]http://www.cult3d.com/download/cult.cab[/url]\r\nO16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - [url]http://foto.hema.nl/ips-opdata/layout/hema/objects/jordan.cab[/url]\r\nO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - [url]http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab[/url]\r\nO16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - [url]http://cache.hyves-static.net/statics/Aurigma/ImageUploader4.cab[/url]\r\nO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - [url]http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab[/url]\r\nO16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - [url]http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab[/url]\r\nO16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - [url]http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader.cab[/url]\r\nO16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - [url]http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab[/url]\r\nO18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\\PROGRA~1\\mcafee\\SITEAD~1\\mcieplg.dll\r\nO20 - Winlogon Notify: !SASWinLogon - C:\\Program Files\\SUPERAntiSpyware\\SASWINLO.dll\r\nO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\\WINDOWS\\system32\\Ati2evxx.exe\r\nO23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\\Program Files\\MAGIX\\Common\\Database\\bin\\fbserver.exe\r\nO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\\Program Files\\Java\\jre6\\bin\\jqs.exe\r\nO23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\\Program Files\\McAfee\\SiteAdvisor\\McSACore.exe\r\nO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\\PROGRA~1\\McAfee\\MSC\\mcmscsvc.exe\r\nO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\\program files\\common files\\mcafee\\mna\\mcnasvc.exe\r\nO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\\PROGRA~1\\McAfee\\VIRUSS~1\\mcods.exe\r\nO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\\PROGRA~1\\COMMON~1\\mcafee\\mcproxy\\mcproxy.exe\r\nO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\\PROGRA~1\\McAfee\\VIRUSS~1\\mcshield.exe\r\nO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\\PROGRA~1\\McAfee\\VIRUSS~1\\mcsysmon.exe\r\nO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\\Program Files\\McAfee\\MPF\\MPFSrv.exe\r\nO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\\Program Files\\Intel\\PROSetWired\\NCS\\Sync\\NetSvc.exe\r\n\r\n--\r\nEnd of file - 10240 bytes

[Anoniem2]

Een virus? Wel vreemd dat McAfee er geen raad mee weet, maar goed. Ook al eens McAfee geprobeerd in de veilige modus? \r\nHeb je al eens geprobeerd de bestanden die McAfee aan gaf als geïnfecteerd handmatig te verwijderen? Als je dat gaat doen let dan even goed op of het geen systeembestanden zijn, want anders moet McAfee als nog zijn werk gaan doen.

[Anoniem2]

Hoi,\r\n\r\nBedankt voor de reactie echter kan de scanner In de veilige modus dit virus niet vinden. Pas zodra ik hem normaal opstart werkt de computer ook niet goed en ziet de scanner dit virus.

[Anoniem2]

Dat is wel heel raar. Helaas zie ik het nu ook niet meer. Al eens online scanner geprobeerd in de veilige modus?

[Anoniem2]

Start HijackThis nogmaals en zet een vinkje voor de volgende regels;\n \n \nR1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Search Bar = [URL=\"http://dellsearchedit.myway.com/sami...bar.jhtml?p=DW\"][COLOR=#004770]http://dellsearchedit.myway.com/sami...bar.jhtml?p=DW[/COLOR][/URL]\n \nR3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)\n \nO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)\n \n O4 - HKLM\\..\\Run: [b-783] C:\\Program Files\\Ozfudditqdkvbqz\\qxiodmmrc.exe q\n \nO4 - HKCU\\..\\Run: [b-783] C:\\Program Files\\Ozfudditqdkvbqz\\qxiodmmrc.exe q\n \n \n \nKlik onderin HijackThis op \"Fix checked\".\n \nPC opnieuw opstarten en kijken of het probleem is verholpen en of McAfee het nu wel kan verwijderen.