startpagina

[teunissen50]

hier de hijackfile



Logfile of HijackThis v1.98.0
Scan saved at 22:32:47, on 13-10-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\nl\msnappau.exe
C:\Program Files\Warez P2P Client\Warez.exe
C:\Program Files\Spyware Doctor\spydoctor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Documents and Settings\Jan\Bureaublad\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coobmpujytikzqszv.com/BsWO3sOX0A5Hv2VTVPe3NwMVV3ci7EzbW4n0E5jhxDQ.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nfirqjcdyxaqaklpsevu.com...NK5rSnvdgksi86sgSOa06hMuTFBuVxC7Iqw0bPV0z.jpg
F0 - system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\nl\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\nl\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Error Heck] C:\PROGRA~1\SHOWSI~1\gpl axis.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\nl\msnappau.exe"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\Warez.exe" -h
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Visit CrackPortal.com - Cracks, serialz, keygens - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - http://www.crackportal.com/ie/btn.php (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Visit CrackPortal.com - Cracks, serialz, keygens - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - http://www.crackportal.com/ie/btn.php (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab

 

[buffy]

Geplaatst door teunissen50

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coobmpujytikzqszv.com/BsWO3sOX0A5Hv2VTVPe3NwMVV3ci7EzbW4n0E5jhxDQ.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.nfirqjcdyxaqaklpsevu.com...NK5rSnvdgksi86sgSOa06hMuTFBuVxC7Iqw0bPV0z.jpg

O4 - HKLM\..\Run: [Error Heck] C:\PROGRA~1\SHOWSI~1\gpl axis.exe

O9 - Extra button: Visit CrackPortal.com - Cracks, serialz, keygens - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - http://www.crackportal.com/ie/btn.php (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Visit CrackPortal.com - Cracks, serialz, keygens - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - http://www.crackportal.com/ie/btn.php (file missing) (HKCU)

1. Scan met HijackThis, vink de bovenstaande items (zie quote) aan, sluit alle vensters behalve HijackThis zelf en klik op "Fix checked".

2. Herstart de pc in veilige modus.
Mocht je niet weten hoe dat moet, kijk dan hier even: http://www.virushelp.nl/veilige_modus.htm

Zorg ervoor dat verborgen bestanden en mappen worden weergegeven.
Hier kun je lezen hoe dat moet: http://users.telenet.be/marcvn/spyware/1117602.htm

Verwijder nu, in veilige modus dus, de volgende map:

C:\PROGRAM FILES\SHOWSI~1 <- d.w.z. die map waarvan de naam begint met "Showsi..."

3. Herstart de pc in 'normale modus'.

4. Installeer de nieuwste versie van HijackThis, dat is versie 1.98.2: http://downloads.subratam.org/hijackthis.zip
Maak daarmee een nieuw log en plaats dat hier.

 

[teunissen50]

het probleem is nu opgelost, mijn dank daarvoor
Jan

 

[buffy]

Geplaatst door teunissen50
het probleem is nu opgelost, mijn dank daarvoor
Jan

Nog even een nieuw log plaatsen alstublieft, er moeten waarschijnlijk nog restjes worden opgeruimd.