HijackThis log

Status
Niet open voor verdere reacties.
R

ropes23

Gebruiker
Lid geworden
21 okt 2004
Berichten
23
Hier is mijn HijackThis log, ik heb eerst
Ad-Aware Se laten lopen en 698 dingen in quarantine gegooid!

Logfile of HijackThis v1.98.2
Scan saved at 11:49:19 PM, on 06-12-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD SCAN SERVER\BDSS.EXE
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\BULLGUARD\VSSERV.EXE
C:\PROGRAM FILES\BULLGUARD\BDMCON.EXE
C:\PROGRAM FILES\BULLGUARD\BGNEWSAG.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\MSOFFICE\OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\CASEMA SNELHELP\BIN\MPBTN.EXE
C:\PROGRAM FILES\LAVASOFT\AD-AWARE SE PERSONAL\AD-AWARE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.windowws.cc/sp.htm?id=106
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.linksummary.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=56715
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=56715
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.volleybalkrant.nl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://searchbar.linksummary.com/autosearch.asp?p=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=56715
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://drvvv.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.worldmpeg.com/j.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by @Home
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
R3 - URLSearchHook: (no name) - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
F1 - win.ini: run=hpfsched
O2 - BHO: MultimppObj Class - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINDOWS\MULTIMPP.DLL (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IST Service] \ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [tziwtf] C:\WINDOWS\SYSTEM\XMJWIE.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [BullGuard Virus Shield] C:\Program Files\BullGuard\\vsserv.exe
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\BullGuard\\bdmcon.exe
O4 - HKLM\..\Run: [BGNewsAgent] C:\PROGRAM FILES\BULLGUARD\bgnewsag.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [BullGuard Scan Server] C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BullGuard Communicator] C:\Program Files\Common Files\BullGuard\BullGuard Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BullGuard Live! Init] C:\Program Files\BullGuard\\bdinit.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe
O4 - Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - User Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe
O4 - User Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

Alvst bedankt voor de hulp

Stephen
 
Hoi Ropes :)

1. Vink onderstaande regels aan in HijackThis:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.windowws.cc/sp.htm?id=106
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.linksummary.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=56715
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=56715
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://searchbar.linksummary.com/autosearch.asp?p=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=56715
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://drvvv.com/

R3 - URLSearchHook: (no name) - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)

O2 - BHO: MultimppObj Class - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINDOWS\MULTIMPP.DLL (file missing)

O4 - HKLM\..\Run: [IST Service] \ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [tziwtf] C:\WINDOWS\SYSTEM\XMJWIE.EXE

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
Klik om te vergroten...

2. Sluit alle andere vensters en browsers, en klik op de knop “Fix Checked”.

3. Start opnieuw op in veilige modus.
Zorg ervoor dat verborgen bestanden en mappen zichtbaar zijn: Verkenner > Extra > Mapopties > Tablad Weergave > scroll naar beneden en vink het vakje voor "Verborgen bestanden en mappen weergeven" aan.

4. Ga naar Windows Verkenner (Rechtsklikken op Start - Verkennen). Zoek en verwijder het volgende:
Map:
C:\Program Files\ISTsvc

Bestand:
C:\WINDOWS\SYSTEM\XMJWIE.EXE

5. Start opnieuw op in normale modus, maak een nieuw logje aan met HijackThis, en post dat hier :)
 
nieuwe log

Dit is de nieuwe log,
alvast bedankt voor de hulp! ik kon xmjwie map niet verwijderen omdat ik d=het bericht steeds kreeg Acces denied. Bovendien vind bullguard steeds 2 andere trojans 1 in c:\windows\inst.exe en 1 in c:\windows\preinmpp.exe, kan ik deze 2 files gewoon deleten????

Logfile of HijackThis v1.98.2
Scan saved at 12:41:53 AM, on 08-12-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD SCAN SERVER\BDSS.EXE
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD COMMUNICATOR\XCOMMSVR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\BULLGUARD\VSSERV.EXE
C:\PROGRAM FILES\BULLGUARD\BDMCON.EXE
C:\PROGRAM FILES\BULLGUARD\BGNEWSAG.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\MSOFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.volleybalkrant.nl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.hotmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://www.worldmpeg.com/j.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by @Home
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
F1 - win.ini: run=hpfsched
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [BullGuard Virus Shield] C:\Program Files\BullGuard\\vsserv.exe
O4 - HKLM\..\Run: [BDMCon] C:\Program Files\BullGuard\\bdmcon.exe
O4 - HKLM\..\Run: [BGNewsAgent] C:\PROGRAM FILES\BULLGUARD\bgnewsag.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [BullGuard Scan Server] C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BullGuard Communicator] C:\Program Files\Common Files\BullGuard\BullGuard Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BullGuard Live! Init] C:\Program Files\BullGuard\\bdinit.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe
O4 - Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O4 - User Startup: Casema SnelHelp.lnk = C:\Program Files\Casema SnelHelp\bin\matcli.exe
O4 - User Startup: Office Startup.lnk = C:\Program Files\MSOffice\Office\OSA.EXE
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
 
Je logje is in ieder geval schoon :)

c:\windows\inst.exe
c:\windows\preinmpp.exe

Laat deze bestandjes eens scannen bij Jotti Scan:
http://virusscan.jotti.dhs.org/

Post de resultaten van de scan hier :)
 
virus scan log

Ik heb geprobeerd die bestandjes te scannen maar krijg geen toegang tot ze. Ik heb mijn pc opnieuw gescand voor virussen en krijg deze log, kan ik nog dingen doen/verwijderen. Heel erg bednakt voor je hulp in ieder geval, de computer doet het al beter.


//-----------------------------------------------------------------
//
// BullGuard report file
//
// Created on: 08/12/2004 18:30:13
//
//-----------------------------------------------------------------


Summary:

C:\WINDOWS\SYSTEM\xmjwie.exe=>(Upx) Infected Trojan.Downloader.Agent.AE
C:\WINDOWS\SYSTEM\xmjwie.exe=>(Upx) Disinfection failed - Trying second action
C:\WINDOWS\SYSTEM\xmjwie.exe
C:\WINDOWS\PREINMPP.EXE Infected Trojan.Spy.Bispy.A
C:\WINDOWS\PREINMPP.EXE Disinfection failed - Trying second action
C:\WINDOWS\PREINMPP.EXE Moved
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>arrow1.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>arrow2.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bck1.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bck2.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt11.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt12.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt13.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt21.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt22.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt23.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt31.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt32.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt33.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt41.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt42.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt43.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt51.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt52.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt53.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt61.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>bt62.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>checkbox1.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>checkbox2.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>checkbox3.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>checkbox4.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>default.skn Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>defbtn1.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>defbtn2.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>defbtn3.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>glyph1.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>glyph2.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>glyph3.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>glyph4.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>glyph5.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>glyph6.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>glyph7.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>main.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>preview.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>sprite1.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>tab1.bmp Password protected
C:\WINDOWS\Profiles\stephen\Desktop\aawsepersonal.exe=>wise0023=>tab2.bmp Password protected
C:\WINDOWS\Downloaded Program Files\ISTactivex.dll=>(Upx) Infected Trojan.Downloader.IstBar.GA
C:\WINDOWS\Downloaded Program Files\ISTactivex.dll=>(Upx) Disinfection failed - Trying second action
C:\WINDOWS\Downloaded Program Files\ISTactivex.dll
C:\WINDOWS\inst.exe Infected Trojan.Downloader.Tooncom.P
C:\WINDOWS\inst.exe Disinfection failed - Trying second action
C:\WINDOWS\inst.exe Moved
C:\DELL\wbt.dat=>WINDOWS/HWINFO.DAT Password protected
C:\DELL\wbt.dat=>WINDOWS/JAUTOEXP.DAT Password protected
C:\DELL\wbt.dat=>WINDOWS/SYSTEM.DAT Password protected
C:\DELL\wbt.dat=>WINDOWS/USER.DAT Password protected
C:\DELL\wbt.dat=>WINDOWS/hh.dat Password protected
C:\Program Files\Common Files\SearchUpgrader\SearchUpgrader.exe Infected Trojan.Downloader.Keenval.G
C:\Program Files\Common Files\SearchUpgrader\SearchUpgrader.exe Disinfection failed - Trying second action
C:\Program Files\Common Files\SearchUpgrader\SearchUpgrader.exe Moved
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>arrow1.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>arrow2.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bck1.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bck2.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt11.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt12.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt13.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt21.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt22.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt23.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt31.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt32.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt33.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt41.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt42.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt43.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt51.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt52.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt53.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt61.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>bt62.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>checkbox1.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>checkbox2.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>checkbox3.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>checkbox4.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>default.skn Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>defbtn1.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>defbtn2.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>defbtn3.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>glyph1.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>glyph2.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>glyph3.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>glyph4.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>glyph5.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>glyph6.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>glyph7.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>main.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>preview.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>sprite1.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>tab1.bmp Password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\~GLH000b.TMP=>tab2.bmp Password protected

Statistics

Scan path : A:\
C:\
D:\
Folders : 1287
Files : 61995
Archives : 693
Packed files : 2144
Identified viruses : 5
Infected files : 5
Warnings : 0
Suspect files : 0
Disinfected files : 0
Deleted files : 0
Copied files : 0
Moved files : 5
Renamed files : 0
I/O errors : 3
Scan time : 00:45:09
Scan speed (files/sec) : 22

Virus definitions : 95933
Scan plugins : 13
Archive plugins : 38
Unpack plugins : 4
Mail plugins : 6
System plugins : 1

Scan options

Detection
[X] Scan boot sectors
[X] Scan archives
[X] Scan packed files
[X] Scan email

File mask
[ ] Programs
[X] All files
[ ] User defined extensions:
[ ] Exclude extensions: ;

Action

Infected objects
[ ] Ignore
[X] Disinfect
[ ] Delete
[ ] Copy to quarantine
[ ] Move to quarantine
[ ] Rename
[ ] Prompt user

Second action
[ ] Ignore
[ ] Delete
[ ] Copy to quarantine
[X] Move to quarantine
[ ] Rename
[ ] Prompt user

Scan options
[X] Enable warnings
[X] Enable heuristics
[ ] Show all files in log
[X] Report file: vscan.log
[ ] Append to existing report
 
Je kunt onderstaande bestanden/mappen verwijderen, terwijl je in veilige modus bent:

C:\WINDOWS\Downloaded Program Files\ISTactivex.dll << bestand
C:\WINDOWS\inst.exe << bestand
C:\WINDOWS\SYSTEM\xmjwie.exe << bestand
C:\WINDOWS\PREINMPP.EXE << bestand
C:\Program Files\Common Files\SearchUpgrader << map

Start hierna opnieuw op in normale modus :)
 
veilige modus

hartelijk bedankt voord tip, maar hoe kom ik precies in de veilige modus?? ik heb een engelstalig ingestelde pc met windows 98

Alvast bedankt
 
Als het goed is (ik heb zelf XP, dus weet het niet helemaal zeker van 98), tijdens het opstarten continu F8, F5 of Ctrl indrukken. Dan zou je op moeten starten in veilige modus :)
 
Status
Niet open voor verdere reacties.
                    Steun ons                    

Nieuwste berichten

Terug
Bovenaan Onderaan