Ga naar inhoud

virus


Aanbevolen berichten

Ik heb een trojaans paard in de map win32 file avifil3.dll. Antivirusprog is Avast home edition. Het bestand kan niet verwijderd verplaatst naar kluis of hersteld worden. Ik heb ook al opgestart met systeemherstel uitgeschakeld en daarna opgestart met systeemherstel terug ingeschakeld.Niet geholpen. Weet er iemand raad?? Alvast bedankt voor de reply. Dean:pcguru:

Link naar reactie
Delen op andere sites



Geprobeerd in veilige modus, maar juist hetzelfde, hieronder logfile van hijack.

gr Dean

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:42:30, on 6/01/2008

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\DELLMMKB.EXE

C:\Program Files\Dell\USBKEYBLCK\USBKeyBlock.exe

C:\WINDOWS\System32\hkcmd.exe

C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

C:\Program Files\Spyware Doctor\SDTrayApp.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Lexmark X74-X75\lxbbbmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\WebCam\M1000\M1000Mnt.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Netropa\OSD.exe

C:\WINDOWS\Nhksrv.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\Spyware Doctor\svcntaux.exe

C:\Program Files\Spyware Doctor\swdsvc.exe

C:\Documents and Settings\Marcel\Bureaublad\HiJackThis.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

C:\WINDOWS\System32\wuauclt.exe

C:\WINDOWS\System32\WgaTray.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Alwil Software\Avast4\setup\avast.setup

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7C732EE8-82E8-4EC3-B2FA-FC7F4282A5E2} - C:\WINDOWS\System32\avifil3.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE

O4 - HKLM\..\Run: [Dell Performance USB keyboard hotkey blocker] C:\Program Files\Dell\USBKEYBLCK\USBKeyBlock.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "C:\Program Files\Hitman Pro\xphelper.exe"

O4 - HKLM\..\Run: [sDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--

End of file - 6450 bytes

Link naar reactie
Delen op andere sites

Download Combofix.exe en zet het op je Bureaublad.

Start Hijackthis op en kies voor 'Do a system scan only'. Selecteer alleen de items hieronder genoemd:

O2 - BHO: (no name) - {7C732EE8-82E8-4EC3-B2FA-FC7F4282A5E2} - C:\WINDOWS\System32\avifil3.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 –k

O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

Klik op 'Fix checked' om de items te verwijderen.

Dubbelklik op Combofix.exe en volg de instructies, aanvaard de disclaimer door y te typen. Tijdens het runnen van de fix, NIET in het venster klikken, want dit zal je pc doen vasthangen.

Wanneer de fix voltooid is en na herstart, zal de log combofix.txt openen.

NOTA: Indien je virusscanner reageert met een melding van een scriptuitvoering, moet je dit toestaan.

Zet nu het log van Combofix en een nieuw log van HJT in een volgend bericht en laat eens horen hoe het met de problemen (het bestand) zit.

Link naar reactie
Delen op andere sites

goedeavond heb de stappen ondernomen, maar het virus is nog niet verwijderd

file Hijack

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:35:54, on 9/01/2008

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\DELLMMKB.EXE

C:\Program Files\Dell\USBKEYBLCK\USBKeyBlock.exe

C:\WINDOWS\System32\hkcmd.exe

C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Lexmark X74-X75\lxbbbmon.exe

C:\Program Files\Spyware Doctor\SDTrayApp.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\WINDOWS\WebCam\M1000\M1000Mnt.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Program Files\Netropa\OSD.exe

C:\WINDOWS\Nhksrv.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\Spyware Doctor\svcntaux.exe

C:\Program Files\Spyware Doctor\swdsvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\System32\WgaTray.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe

C:\Documents and Settings\Marcel\Bureaublad\HiJackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7C732EE8-82E8-4EC3-B2FA-FC7F4282A5E2} - C:\WINDOWS\System32\avifil3.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE

O4 - HKLM\..\Run: [Dell Performance USB keyboard hotkey blocker] C:\Program Files\Dell\USBKEYBLCK\USBKeyBlock.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Hitman Pro Expiration Helper] "C:\Program Files\Hitman Pro\xphelper.exe"

O4 - HKLM\..\Run: [sDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--

End of file - 6124 bytes

Logfile combofix

ComboFix 08-01-09.2 - Marcel 2008-01-09 18:38:44.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.0.1252.1.1043.18.182 [GMT 1:00]

Gestart vanuit: C:\Documents and Settings\Marcel\Bureaublad\ComboFix.exe

* Nieuw herstelpunt werd aangemaakt

.

The following files were disabled during the run:

C:\WINDOWS\System32\wmfhotfix.dll

(((((((((((((((((((( Bestanden Gemaakt van 2007-12-09 to 2008-01-09 ))))))))))))))))))))))))))))))

.

2008-01-09 18:37 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe

2008-01-09 11:28 . 2008-01-09 11:28 <DIR> dr-h----- C:\Documents and Settings\Marcel\Onlangs geopend

2008-01-09 08:45 . 2004-03-09 02:59 648,192 --a------ C:\WINDOWS\system32\sxs.dll

2008-01-09 08:45 . 2004-03-09 02:59 648,192 --a--c--- C:\WINDOWS\system32\dllcache\sxs.dll

2008-01-02 10:46 . 2008-01-02 10:46 <DIR> d-------- C:\Documents and Settings\Marcel\Application Data\Lavasoft

2008-01-02 10:36 . 2008-01-02 10:36 <DIR> d-------- C:\Program Files\Lavasoft

2008-01-02 10:35 . 2008-01-02 10:35 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys

2008-01-02 10:35 . 2008-01-02 10:35 298,104 --a------ C:\WINDOWS\system32\imon.dll

2008-01-02 10:35 . 2008-01-02 10:35 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys

2008-01-02 10:33 . 2008-01-02 10:34 <DIR> d-------- C:\Temp

2008-01-02 10:23 . 2008-01-09 18:26 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

2007-12-29 18:02 . 2007-12-29 18:02 301,568 --a--c--- C:\WINDOWS\system32\dllcache\netapi32.dll

2007-12-29 18:02 . 2007-12-29 18:02 254,464 --a------ C:\WINDOWS\system32\mstask.dll

2007-12-29 18:02 . 2007-12-29 18:02 254,464 --a--c--- C:\WINDOWS\system32\dllcache\mstask.dll

2007-12-29 18:02 . 2007-12-29 18:02 160,256 --a------ C:\WINDOWS\system32\schedsvc.dll

2007-12-29 18:02 . 2007-12-29 18:02 160,256 --a--c--- C:\WINDOWS\system32\dllcache\schedsvc.dll

2007-12-29 18:02 . 2007-12-29 18:02 48,640 --a--c--- C:\WINDOWS\system32\dllcache\browser.dll

2007-12-29 18:02 . 2007-12-29 18:02 48,640 --a------ C:\WINDOWS\system32\browser.dll

2007-12-29 18:02 . 2007-12-29 18:02 9,728 --a------ C:\WINDOWS\system32\mstinit.exe

2007-12-29 18:02 . 2007-12-29 18:02 9,728 --a--c--- C:\WINDOWS\system32\dllcache\mstinit.exe

2007-12-29 17:54 . 2008-01-09 08:45 <DIR> d--h----- C:\WINDOWS\$hf_mig$

2007-12-24 20:31 . 2007-12-24 20:31 422,408 --a------ C:\winizgq.exe

2007-12-21 21:04 . 2007-12-21 21:04 416,776 --a------ C:\wintmhl.exe

2007-12-17 21:32 . 2007-12-17 21:32 268 --ah----- C:\sqmdata07.sqm

2007-12-17 21:32 . 2007-12-17 21:32 244 --ah----- C:\sqmnoopt07.sqm

2007-12-10 08:11 . 2007-12-10 08:11 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared

2007-12-10 07:43 . 2007-12-10 08:11 <DIR> d-------- C:\Program Files\Norton Security Scan

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-01-09 17:26 --------- d-----w C:\Program Files\Hitman Pro

2008-01-08 06:57 --------- d-----w C:\Program Files\Spyware Doctor

2008-01-03 07:42 74,240 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys

2008-01-03 07:42 56,832 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys

2008-01-02 11:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-01-02 09:36 --------- d-----w C:\Program Files\SpywareBlaster

2007-12-27 09:29 --------- d-----w C:\Documents and Settings\Marcel\Application Data\LimeWire

2007-12-07 09:25 19,456 ----a-w C:\WINDOWS\system32\drivers\dtnvwpyu.dat

2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-11-29 19:49 16,752 ----a-w C:\Documents and Settings\Marcel\Application Data\GDIPFONTCACHEV1.DAT

2007-11-26 21:03 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SurfRight

2007-11-26 16:57 --------- d-----w C:\Documents and Settings\Marcel\Application Data\PC Tools

2007-11-26 16:56 164 ----a-w C:\install.dat

2007-11-26 16:56 --------- d-----w C:\Program Files\Webroot

2007-11-26 16:56 --------- d-----w C:\Documents and Settings\Marcel\Application Data\Webroot

2007-11-26 16:56 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Webroot

2007-11-26 16:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Webroot

2007-11-26 16:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Prevx

2007-11-26 16:49 --------- d-----w C:\Program Files\SurfRight

2007-11-26 16:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\SurfRight

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7C732EE8-82E8-4EC3-B2FA-FC7F4282A5E2}]

2001-09-07 13:00 106496 --a------ C:\WINDOWS\System32\avifil3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 13:32 94208]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-17 15:51 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DellTouch"="C:\WINDOWS\DELLMMKB.EXE" [2001-09-23 07:14 163840]

"Dell Performance USB keyboard hotkey blocker"="C:\Program Files\Dell\USBKEYBLCK\USBKeyBlock.exe" [2002-12-02 13:54 53248]

"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2004-02-10 11:55 155648]

"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2004-02-10 11:51 118784]

"Lexmark X74-X75"="C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe" [2002-07-31 10:54 57344]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23 75520]

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

"M1000Mnt"="M1000Rmv.exe" []

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]

"Hitman Pro Expiration Helper"="C:\Program Files\Hitman Pro\xphelper.exe" [2007-01-30 14:41 596760]

"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24 1065800]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=C:\WINDOWS\System32\wmfhotfix.dll

R0 tbtongth;tbtongth;C:\WINDOWS\System32\drivers\dtnvwpyu.dat []

R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe [2001-08-06 13:41]

R3 M1000Srv;M5603C USB2.0 Camera Driver;C:\WINDOWS\System32\Drivers\M1000KNT.sys [2004-06-24 04:55]

R3 Msikbd2k;DellTouch;C:\WINDOWS\System32\DRIVERS\msikbd2k.sys [2000-10-03 15:18]

S1 ctredrv.sys;ctredrv.sys;C:\WINDOWS\System32\drivers\ctredrv.sys []

*Newly Created Service* - PROCEXP90

.

Inhoud van de 'Gedeelde Taken' map

"2007-12-10 06:43:39 C:\WINDOWS\Tasks\Norton Security Scan.job"

- C:\Program Files\Norton Security Scan\Nss.exe

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-09 18:42:06

Windows 5.1.2600 NTFS

detected NTDLL code modification:

ZwClose

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond

verborgen bestanden: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe

-> C:\WINDOWS\System32\wmfhotfix.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.0000]

-> C:\WINDOWS\System32\wmfhotfix.dll

.

Voltooingstijd: 2008-01-09 18:43:24

.

2007-12-05 08:28:39 --- E O F ---

Dit zijn de 2 logfiles

groeten Dean

Link naar reactie
Delen op andere sites


@ Karel

Deze regel

O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt

hoort normaal bij deze webcam (zie programma's)

C:\WINDOWS\WebCam\M1000\M1000Mnt.exe

Het bestand kan inderdaad soms tot problemen leiden, maar hier geloof ik het niet.

@ papatje

Om zeker te zijn en om de (terechte) twijfel van Karel te kunnen uitschakelen, kan je misschien het bestand C:\WINDOWS\WebCam\M1000\M1000Mnt.exe

even scannen bij Jotti

Mocht het te druk zijn bij Jotti (wat wel eens vaak durft voorkomen), gebruik dan volgend alternatief : Virustotal.com

Laat nog eerst eventjes de resultaten hiervan weten.

En dan mag je dit nog eens uitvoeren (in veilige modus) :

Start Hijackthis op en kies voor 'Do a system scan only'. Selecteer alleen de items hieronder genoemd:

O2 - BHO: (no name) - {7C732EE8-82E8-4EC3-B2FA-FC7F4282A5E2} - C:\WINDOWS\System32\avifil3.dll

Klik op 'Fix checked' om de items te verwijderen.

Verwijder volgend bestand :

C:\WINDOWS\System32\avifil3.dll

Start je PC terug op, maak een nieuw log van HJT en plak dit in een volgend bericht.

Nog dit :je Java software is verouderd. oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem. Doe eerst deze stappen om Java te de-installeren en de nieuwere versie te installeren: Download Java Runtime Environment (JRE) 6u3.

[*]Scroll omlaag naar : "Java Runtime Environment (JRE) 6u3".

[*]Klik op de "Download" knop aan de rechterkant.

[*]Vink aan: "Accept License Agreement".

[*]De pagina zal herladen.

[*]Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen, en bewaar het naar je Bureaublad.

[*]Sluit alle programma's die eventueel open zijn - Zeker je web browser!

[*]Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java uit de Softwarelijst.

[*]Vink alles aan met Java Runtime Environment (JRE of J3SE) in de naam.

[*]Klik dan op Verwijderen of op de Wijzig/Verwijder knop.

[*]Herhaal dit tot alle oudere versies verdwenen zijn.

[*]Na het verwijderen van alle oudere versies, herstart je pc.

[*]Dubbelklik vervolgens op jre-6u3-windows-i586-p.exe op je Bureaublad om de nieuwste versie van Java te installeren.

Link naar reactie
Delen op andere sites

  • 2 weken later...
 Delen

×
×
  • Nieuwe aanmaken...