Log en problemen

[niemaro]

Logfile of HijackThis v1.98.2
Scan saved at 10:21:24, on 24-11-2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\avmon.exe
C:\WINDOWS\mfcsy32.exe
C:\Documents and Settings\nicolaas\Application Data\gn?r.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Norton AntiVirus2002\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\system32\netph.exe
C:\WINDOWS\SYMEVENT.LOG:tjdvq
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\nicolaas\Mijn documenten\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://full-search.biz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://full-search.biz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ykvjd.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ykvjd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\ykvjd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ykvjd.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\ykvjd.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ykvjd.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ykvjd.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://full-search.biz
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus2002\NavShExt.dll
O2 - BHO: (no name) - {C8BDA5CF-B100-E06E-F6CD-5BAC66FA8EAD} - C:\WINDOWS\system32\atlkm32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus2002\NavShExt.dll
O4 - HKLM\..\Run: [avc] C:\WINDOWS\System32\avmon.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [mfcsy32.exe] C:\WINDOWS\mfcsy32.exe
O4 - HKLM\..\RunOnce: [MRUBlaster] C:\Program Files\MRU-Blaster\indexcleaner.exe -CACHE
O4 - HKCU\..\Run: [Wuos] C:\Documents and Settings\nicolaas\Application Data\gn?r.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [Microsoft Update] wuagrd.exe
O9 - Extra button: Corel Network monitor worker - {456E2183-DB8C-4DC6-A7B2-2B876CB62FDA} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {456E2183-DB8C-4DC6-A7B2-2B876CB62FDA} - (no file)
O9 - Extra button: Corel Network monitor worker - {456E2183-DB8C-4DC6-A7B2-2B876CB62FDA} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {456E2183-DB8C-4DC6-A7B2-2B876CB62FDA} - (no file) (HKCU)
O16 - DPF: {00000000-7777-0704-0B53-2C8830E9FAEC} - http://key.one2bill.de/soft/axload.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {18D9C485-7EEC-4395-95DA-DC3875B10E81} (TEInstallPlugIn) - http://www.skylinesoft.com/interactive/terraexplorer/install/TEInstallPlugIn.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {40289096-9F72-4A04-BCB3-E434ECDCEE33} (AppDLCtrl Class) - http://download.howudodat.com/chatterbox/download/appdl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1094980282526
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {A7F82252-EF7F-4E46-8595-84AE76D5FE03} (InstControl Class) - http://neo-toolbar.com/Inst.cab
O16 - DPF: {B73BC7C7-858B-49FA-BBDB-74DD77D1D9F3} ({B73BC7C7-858B-49FA-BBDB-74DD77D1D9F3}) - http://hpintermedia.tintel.nl/installcab.php
O16 - DPF: {DC187740-46A9-11D5-A815-00B0D0428C0C} - http://ds1.downloadtech.net/cn1060/pcpowerscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCA41427-08BC-4C37-A4D5-85F3F7ABA0FB}: NameServer = 195.121.1.34 195.121.1.66

 

[niemaro]

Nu maar hopen dat het hier goed staat m@rio
Logfile of HijackThis v1.98.2
Scan saved at 16:03:51, on 2-12-2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVPersonal\AVGNT.EXE
C:\WINDOWS\system32\apips32.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\netph.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\nicolaas\Mijn documenten\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\temlh.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\temlh.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\temlh.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\temlh.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\temlh.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\temlh.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\temlh.dll/sp.html#37049
O2 - BHO: (no name) - {3D1E8A6D-0FB0-0E2E-D985-66A3F50B7CDB} - C:\WINDOWS\system32\d3ss.dll
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCA41427-08BC-4C37-A4D5-85F3F7ABA0FB}: NameServer = 195.121.1.34 195.121.1.66

 

[buffy]

Je hebt dus wel op eigen houtje van alles zitten fixen.

 

[niemaro]

Ja ik weet het het is dom kwam een beetje van de frustratie het is dan een beetje "alles of niets"

 

[buffy]

Hopelijk zijn de back-ups van wat je gefixt hebt er nog.

Start HijackThis.
Kies "Config..." (rechtsonder).
Kies "Backups".
Zet nu alle back-ups terug. Dat moet één voor één, je kunt niet alle back-ups in één keer terugzetten. Je zet een back-up terug door die te selecteren en op "restore" te klikken. Doe dat dus voor álle back-ups.

Start daarna de pc opnieuw op, maak een nieuw HijackThis-log en plaats dat hier.

 

[niemaro]

Beste Buffy het is bijna te gek voor woorden terugzetten gaat niet steeds rare meldingen Toch maar gewoon formateren en voortaan afblijven ?

 

[buffy]

Geplaatst door niemaro
Beste Buffy het is bijna te gek voor woorden terugzetten gaat niet steeds rare meldingen Toch maar gewoon formateren en voortaan afblijven ?

Dan is hier niets meer aan te doen, helaas. Formatteren dus.
En voorkom dan dat je dit soort ellende weer binnenhaalt: http://www.helpmij.nl/forum/showthread.php?threadid=184512

 

[niemaro]

Met dank voor je uitleg en je tijd
groetjes,Nicoaasl