Ik krijg bij het openen van internet als startpagina http://www.tfil.com. Heb al vanalles geprobeerd maar krijg het met geen mogelijkheid weg. Wie kan mij helpen.
vreemde startpagina
- Onderwerp starter mogi
- Startdatum
- Status
Bennie
Giga Honourable Senior Member †
- Lid geworden
- 10 okt 2000
- Berichten
- 17.585
Download HijackThis. Uitleg en link vind je hier: <http://www.tomcoyote.org/hjt/>
Unzip en run het. Klik op Scan > Save log en sla het log op als een .txt bestand.
Kopieer en plak de inhoud in je volgende post.
Groetjes,
Bennie
Unzip en run het. Klik op Scan > Save log en sla het log op als een .txt bestand.
Kopieer en plak de inhoud in je volgende post.
Groetjes,
Bennie
biertjuh72
Terugkerende gebruiker
- Lid geworden
- 26 mei 2002
- Berichten
- 1.249
Wat een supersnelle reacties. Ik een scan uitgevoerd dus hopelijk kan iemand mij snel van die pagina afhelpen.
Logfile of HijackThis v1.95.0
Scan saved at 22:36:29, on 7-7-2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\cmd32.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\PROGRA~1\Save\Save.exe
C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\WeatherCast\Weather.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
C:\Program Files\Corkboard\CORK.EXE
C:\DOCUME~1\Monique\LOCALS~1\Temp\Vfi1.exe
C:\PROGRA~1\MICROS~3\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Rem4.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Myd6.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
E:\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\SYSTEM\blank.htm
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\System32\cmd32.exe
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O1 - Hosts: microsoft tcp/ip for windows.
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {5789e3e9-6ddc-4aa9-8a74-d814255276b7} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: rglbreeougr - {ed107cdd-e513-4a05-8586-1af9aebd1885} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
O4 - HKLM\..\Run: [WinStart001.EXE] C:\WINDOWS\System\WinStart001.EXE -b
O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [iemwoa] C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe -QuieT
O4 - HKLM\..\Run: [winactive] C:\Program Files\Window Active\winactive.exe
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherCast] C:\Program Files\WeatherCast\Weather.exe /q
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MyCorkboard.lnk = C:\Program Files\Corkboard\CORK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: Win32 Classes -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn-int.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {841A9192-5690-11D4-A258-0040954A01BE} (DialXSCtl Object) - http://dialxs.nl/install/dialxs.ocx
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherInstCAST1202.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\Software\..\Telephony: DomainName = G18194.find-quick.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAC60A01-3A17-445C-8EFA-9AC04F91A513}: Domain = G18194.find-quick.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
Logfile of HijackThis v1.95.0
Scan saved at 22:36:29, on 7-7-2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\cmd32.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\PROGRA~1\Save\Save.exe
C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\WeatherCast\Weather.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
C:\Program Files\Corkboard\CORK.EXE
C:\DOCUME~1\Monique\LOCALS~1\Temp\Vfi1.exe
C:\PROGRA~1\MICROS~3\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Rem4.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Myd6.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
E:\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\SYSTEM\blank.htm
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\System32\cmd32.exe
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O1 - Hosts: microsoft tcp/ip for windows.
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {5789e3e9-6ddc-4aa9-8a74-d814255276b7} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: rglbreeougr - {ed107cdd-e513-4a05-8586-1af9aebd1885} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
O4 - HKLM\..\Run: [WinStart001.EXE] C:\WINDOWS\System\WinStart001.EXE -b
O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [iemwoa] C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe -QuieT
O4 - HKLM\..\Run: [winactive] C:\Program Files\Window Active\winactive.exe
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherCast] C:\Program Files\WeatherCast\Weather.exe /q
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MyCorkboard.lnk = C:\Program Files\Corkboard\CORK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: Win32 Classes -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn-int.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {841A9192-5690-11D4-A258-0040954A01BE} (DialXSCtl Object) - http://dialxs.nl/install/dialxs.ocx
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherInstCAST1202.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\Software\..\Telephony: DomainName = G18194.find-quick.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAC60A01-3A17-445C-8EFA-9AC04F91A513}: Domain = G18194.find-quick.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
Bennie
Giga Honourable Senior Member †
- Lid geworden
- 10 okt 2000
- Berichten
- 17.585
Leuke verzameling Spyware
Laat Hijackthis de volgende items fixen. Sluit daarbij eerst je browser:
C:\WINDOWS\System32\cmd32.exe
C:\PROGRA~1\Save\Save.exe
C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Vfi1.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Rem4.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Myd6.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\System32\cmd32.exe
O2 - BHO: (no name) - {5789e3e9-6ddc-4aa9-8a74-d814255276b7} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
O4 - HKLM\..\Run: [WinStart001.EXE] C:\WINDOWS\System\WinStart001.EXE -b
O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
O4 - HKLM\..\Run: [iemwoa] C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe -QuieT
O4 - HKLM\..\Run: [winactive] C:\Program Files\Window Active\winactive.exe
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O16 - DPF: {841A9192-5690-11D4-A258-0040954A01BE} (DialXSCtl Object) - http://dialxs.nl/install/dialxs.ocx
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\Software\..\Telephony: DomainName = G18194.find-quick.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAC60A01-3A17-445C-8EFA-9AC04F91A513}: Domain = G18194.find-quick.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
Start de PC daarna opnieuw op. Post nieuwe log.
Groetjes,
Bennie
Laat Hijackthis de volgende items fixen. Sluit daarbij eerst je browser:
C:\WINDOWS\System32\cmd32.exe
C:\PROGRA~1\Save\Save.exe
C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Vfi1.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Rem4.exe
C:\DOCUME~1\Monique\LOCALS~1\Temp\Myd6.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\System32\cmd32.exe
O2 - BHO: (no name) - {5789e3e9-6ddc-4aa9-8a74-d814255276b7} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
O4 - HKLM\..\Run: [WinStart001.EXE] C:\WINDOWS\System\WinStart001.EXE -b
O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
O4 - HKLM\..\Run: [iemwoa] C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe -QuieT
O4 - HKLM\..\Run: [winactive] C:\Program Files\Window Active\winactive.exe
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O16 - DPF: {841A9192-5690-11D4-A258-0040954A01BE} (DialXSCtl Object) - http://dialxs.nl/install/dialxs.ocx
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\Software\..\Telephony: DomainName = G18194.find-quick.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAC60A01-3A17-445C-8EFA-9AC04F91A513}: Domain = G18194.find-quick.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
Start de PC daarna opnieuw op. Post nieuwe log.
Groetjes,
Bennie
Pieter Arntz
Spywareslayer
- Lid geworden
- 12 aug 2001
- Berichten
- 15.621
Hoi Mogi,
Kijk eerst in configuratiescherm > Software of je daar SaveNow aka WhenUSave aka Save! kunt vinden.
Zo ja verwijder het dan daar, zo niet gewoon doorgaan met het vervolg.
Vink de onderstaande aan in HijackThis, sluit alle vensters behalve HijackThis en klik op Fix checked:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\System32\cmd32.exe
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: (no name) - {5789e3e9-6ddc-4aa9-8a74-d814255276b7} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
O3 - Toolbar: rglbreeougr - {ed107cdd-e513-4a05-8586-1af9aebd1885} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
O4 - HKLM\..\Run: [WinStart001.EXE] C:\WINDOWS\System\WinStart001.EXE -b
O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
O4 - HKLM\..\Run: [iemwoa] C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe -QuieT
O4 - HKLM\..\Run: [winactive] C:\Program Files\Window Active\winactive.exe
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn-i...sharingctrl.cab
O16 - DPF: {841A9192-5690-11D4-A258-0040954A01BE} (DialXSCtl Object) - http://dialxs.nl/install/dialxs.ocx
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherInstCAST1202.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\Software\..\Telephony: DomainName = G18194.find-quick.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAC60A01-3A17-445C-8EFA-9AC04F91A513}: Domain = G18194.find-quick.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
Start daarna opnieuw op, liefst in veilige modus en verwijder:
C:\PROGRAM FILES\Save <= volledige folder
C:\WINDOWS\System\WinStart001.EXE
C:\DOCUMENTS AND SETTINGS\Monique\APPLICATION DATA\ggloojri.exe
cmd32.exe
en mail het bestand C:\Program Files\Window Active\winactive.exe naar het adres in mijn profiel zodat ik het kan laten analyseren. Tenzij jij weet waar het voor is natuurlijk.
Groetjes,
Pieter
Kijk eerst in configuratiescherm > Software of je daar SaveNow aka WhenUSave aka Save! kunt vinden.
Zo ja verwijder het dan daar, zo niet gewoon doorgaan met het vervolg.
Vink de onderstaande aan in HijackThis, sluit alle vensters behalve HijackThis en klik op Fix checked:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://tfil.com/searchbar.html
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\System32\cmd32.exe
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: (no name) - {5789e3e9-6ddc-4aa9-8a74-d814255276b7} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
O3 - Toolbar: rglbreeougr - {ed107cdd-e513-4a05-8586-1af9aebd1885} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\Save\Save.exe
O4 - HKLM\..\Run: [WinStart001.EXE] C:\WINDOWS\System\WinStart001.EXE -b
O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
O4 - HKLM\..\Run: [iemwoa] C:\DOCUME~1\Monique\APPLIC~1\ggloojri.exe -QuieT
O4 - HKLM\..\Run: [winactive] C:\Program Files\Window Active\winactive.exe
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn-i...sharingctrl.cab
O16 - DPF: {841A9192-5690-11D4-A258-0040954A01BE} (DialXSCtl Object) - http://dialxs.nl/install/dialxs.ocx
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherInstCAST1202.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\Software\..\Telephony: DomainName = G18194.find-quick.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAC60A01-3A17-445C-8EFA-9AC04F91A513}: Domain = G18194.find-quick.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = G18194.find-quick.com
Start daarna opnieuw op, liefst in veilige modus en verwijder:
C:\PROGRAM FILES\Save <= volledige folder
C:\WINDOWS\System\WinStart001.EXE
C:\DOCUMENTS AND SETTINGS\Monique\APPLICATION DATA\ggloojri.exe
cmd32.exe
en mail het bestand C:\Program Files\Window Active\winactive.exe naar het adres in mijn profiel zodat ik het kan laten analyseren. Tenzij jij weet waar het voor is natuurlijk.
Groetjes,
Pieter
Nou Bennie, ik heb gedaan wat je vroeg. Daar komt ie weer.
Logfile of HijackThis v1.95.0
Scan saved at 23:18:52, on 7-7-2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\WeatherCast\Weather.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
C:\Program Files\Corkboard\CORK.EXE
C:\PROGRA~1\MICROS~3\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
E:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\SYSTEM\blank.htm
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O1 - Hosts: microsoft tcp/ip for windows.
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
O2 - BHO: (no name) - {d117e7bc-3ac9-4884-ac5c-dcf12d6806f3} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: rglbreeougr - {e9ad291a-257b-4387-99fc-bbdb36d56c35} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherCast] C:\Program Files\WeatherCast\Weather.exe /q
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MyCorkboard.lnk = C:\Program Files\Corkboard\CORK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: Win32 Classes -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn-int.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherInstCAST1202.cab
Logfile of HijackThis v1.95.0
Scan saved at 23:18:52, on 7-7-2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\WeatherCast\Weather.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MICROSTAR\Bluetooth Software\BTTray.exe
C:\Program Files\Corkboard\CORK.EXE
C:\PROGRA~1\MICROS~3\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
E:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\SYSTEM\blank.htm
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O1 - Hosts: microsoft tcp/ip for windows.
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
O2 - BHO: (no name) - {d117e7bc-3ac9-4884-ac5c-dcf12d6806f3} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: rglbreeougr - {e9ad291a-257b-4387-99fc-bbdb36d56c35} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WeatherCast] C:\Program Files\WeatherCast\Weather.exe /q
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MyCorkboard.lnk = C:\Program Files\Corkboard\CORK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: Win32 Classes -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn-int.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherInstCAST1202.cab
Pieter Arntz
Spywareslayer
- Lid geworden
- 12 aug 2001
- Berichten
- 15.621
Hoi mogi,
Deze nog:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
O2 - BHO: (no name) - {d117e7bc-3ac9-4884-ac5c-dcf12d6806f3} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKCU\..\Run: [WeatherCast] C:\Program Files\WeatherCast\Weather.exe /q
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherInstCAST1202.cab
Zorg dat alle vensters behalve HijackTHis gesloten zijn als je op Fix checked klikt en start meteen daarna opnieuw op.
Groetjes,
Pieter
Deze nog:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=tfil.com
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
O2 - BHO: (no name) - {d117e7bc-3ac9-4884-ac5c-dcf12d6806f3} - C:\DOCUME~1\Monique\APPLIC~1\eoaqoumwf.dll
O4 - HKCU\..\Run: [WeatherCast] C:\Program Files\WeatherCast\Weather.exe /q
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherInstCAST1202.cab
Zorg dat alle vensters behalve HijackTHis gesloten zijn als je op Fix checked klikt en start meteen daarna opnieuw op.
Groetjes,
Pieter
- Status
