HELP! Browserproblems

Algemeen over alle Windows versies.

Moderator: MandersOnline

Plaats reactie
lodewijk
Beginner
Beginner
Berichten: 7
Lid geworden op: ma 12 jul 2004, 10:52

HELP! Browserproblems

Bericht door lodewijk »

Wie kan mij helpen met dit probleem.
Volgend mij heb ik last van een dos-aanval
Ik kan op geen enkele site in een virus rubriek,
dan wordt mijn browser onmiddellijk afgesloten
Spybot,spysweeper en panda anti-virus worden ook na het opstarten direct weer afgesloten. Ik heb verder allemaal ms-dos koppelingen gevonden op mijn computer met namen als crazy frog , elvis lol en lesbian friend.Op het moment dat je ze verwijderd worden de bestanden
direct gekopieerd.

Pieter zou dit rubriekje even hier mogen staan??
Als je het verplaatst naar de goede rubriek kan ik er niet meer
bij want dan wordt mijn browser weer direct afgesloten.

B.V.D. Lodewijk
Omhoog
ansjo
Beginner
Beginner
Berichten: 31
Lid geworden op: di 25 jan 2005, 23:46

Bericht door ansjo »

heb iets dergelijks gehad
eerst de pc opstarten in veilige modus dan je virusscan erover en daarna hitmanpro toen was ik van alle problemen af misschien dat dat bij jou ook helpt succes.
Omhoog
MandersOnline
Manders Online
Manders Online
Berichten: 23689
Lid geworden op: zo 03 aug 2003, 1:12
Locatie: Amsterdam
Contacteer:
Contacteer MandersOnline

Bericht door MandersOnline »

Eerst maar een Hijackthis log maken denk ik....
Bezoek ook gerust de website https://mandersonline.nl
Omhoog
MandersOnline
Manders Online
Manders Online
Berichten: 23689
Lid geworden op: zo 03 aug 2003, 1:12
Locatie: Amsterdam
Contacteer:
Contacteer MandersOnline

Bericht door MandersOnline »

kreeg alleen een mail dat die er niet meer op kon komen dus moet even reageren er op per mail
Bezoek ook gerust de website https://mandersonline.nl
Omhoog
lodewijk
Beginner
Beginner
Berichten: 7
Lid geworden op: ma 12 jul 2004, 10:52

Bericht door lodewijk »

Hoi hier ben ik weer, volgens mij ging het om de fastoA-worm.
Deze heb ik inmiddels kunnen verwijderen in de veilige modus.
Hier is ook nog het hijack-this log
Misschien dat je er nog wat aan ziet.
Alvast bedankt voor alle hulp. :wink:

Groetjes Lodewijk


Logfile of HijackThis v1.99.1
Scan saved at 21:37:05, on 21-3-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 82.150.139.32:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O1 - Hosts: 64.233.167.104 http://www.symantec.com
O1 - Hosts: 64.233.167.104 http://www.sophos.com
O1 - Hosts: 64.233.167.104 http://www.McAfee.com
O1 - Hosts: 64.233.167.104 http://www.viruslist.com
O1 - Hosts: 64.233.167.104 http://www.f-secure.com
O1 - Hosts: 64.233.167.104 http://www.avp.com
O1 - Hosts: 64.233.167.104 http://www.kaspersky.com
O1 - Hosts: 64.233.167.104 http://www.networkassociates.com
O1 - Hosts: 64.233.167.104 http://www.ca.com
O1 - Hosts: 64.233.167.104 http://www.my-etrust.com
O1 - Hosts: 64.233.167.104 http://www.nai.com
O1 - Hosts: 64.233.167.104 http://www.trendmicro.com
O1 - Hosts: 64.233.167.104 http://www.grisoft.com
O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
O1 - Hosts: 64.233.167.104 symantec.com
O1 - Hosts: 64.233.167.104 sophos.com
O1 - Hosts: 64.233.167.104 McAfee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
O1 - Hosts: 64.233.167.104 viruslist.com
O1 - Hosts: 64.233.167.104 f-secure.com
O1 - Hosts: 64.233.167.104 kaspersky.com
O1 - Hosts: 64.233.167.104 kaspersky-labs.com
O1 - Hosts: 64.233.167.104 avp.com
O1 - Hosts: 64.233.167.104 networkassociates.com
O1 - Hosts: 64.233.167.104 ca.com
O1 - Hosts: 64.233.167.104 mast.McAfee.com
O1 - Hosts: 64.233.167.104 my-etrust.com
O1 - Hosts: 64.233.167.104 download.McAfee.com
O1 - Hosts: 64.233.167.104 dispatch.McAfee.com
O1 - Hosts: 64.233.167.104 secure.nai.com
O1 - Hosts: 64.233.167.104 nai.com
O1 - Hosts: 64.233.167.104 update.symantec.com
O1 - Hosts: 64.233.167.104 updates.symantec.com
O1 - Hosts: 64.233.167.104 us.McAfee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
O1 - Hosts: 64.233.167.104 customer.symantec.com
O1 - Hosts: 64.233.167.104 rads.McAfee.com
O1 - Hosts: 64.233.167.104 trendmicro.com
O1 - Hosts: 64.233.167.104 grisoft.com
O1 - Hosts: 64.233.167.104 sandbox.norman.no
O1 - Hosts: 64.233.167.104 http://www.pandasoftware.com
O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A "C:\WINDOWS\System32\E_S20.tmp"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MSNmsgr] "C:\Program Files\MSN Messenger\MSNmsgr.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Image Transfer.lnk = ?
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Exporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ontvang alles met FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Ontvang met FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MSNMessengerSetupDownloadControl Class) - http://messenger.MSN.com/download/MSNme ... loader.cab
O18 - Filter hijack: application/octet-stream - {6585E5B4-4D2A-4A1D-A219-4102C64BA999} - (no file)
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Omhoog
MandersOnline
Manders Online
Manders Online
Berichten: 23689
Lid geworden op: zo 03 aug 2003, 1:12
Locatie: Amsterdam
Contacteer:
Contacteer MandersOnline

Bericht door MandersOnline »

Logfile of HijackThis v1.99.1
Scan saved at 21:37:05, on 21-3-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startpagina.nl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door @Home

R3 - Default URLSearchHook is missing
O1 - Hosts: 64.233.167.104 http://www.symantec.com
O1 - Hosts: 64.233.167.104 http://www.sophos.com
O1 - Hosts: 64.233.167.104 http://www.McAfee.com
O1 - Hosts: 64.233.167.104 http://www.viruslist.com
O1 - Hosts: 64.233.167.104 http://www.f-secure.com
O1 - Hosts: 64.233.167.104 http://www.avp.com
O1 - Hosts: 64.233.167.104 http://www.kaspersky.com
O1 - Hosts: 64.233.167.104 http://www.networkassociates.com
O1 - Hosts: 64.233.167.104 http://www.ca.com
O1 - Hosts: 64.233.167.104 http://www.my-etrust.com
O1 - Hosts: 64.233.167.104 http://www.nai.com
O1 - Hosts: 64.233.167.104 http://www.trendmicro.com
O1 - Hosts: 64.233.167.104 http://www.grisoft.com
O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
O1 - Hosts: 64.233.167.104 symantec.com
O1 - Hosts: 64.233.167.104 sophos.com
O1 - Hosts: 64.233.167.104 McAfee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
O1 - Hosts: 64.233.167.104 viruslist.com
O1 - Hosts: 64.233.167.104 f-secure.com
O1 - Hosts: 64.233.167.104 kaspersky.com
O1 - Hosts: 64.233.167.104 kaspersky-labs.com
O1 - Hosts: 64.233.167.104 avp.com
O1 - Hosts: 64.233.167.104 networkassociates.com
O1 - Hosts: 64.233.167.104 ca.com
O1 - Hosts: 64.233.167.104 mast.McAfee.com
O1 - Hosts: 64.233.167.104 my-etrust.com
O1 - Hosts: 64.233.167.104 download.McAfee.com
O1 - Hosts: 64.233.167.104 dispatch.McAfee.com
O1 - Hosts: 64.233.167.104 secure.nai.com
O1 - Hosts: 64.233.167.104 nai.com
O1 - Hosts: 64.233.167.104 update.symantec.com
O1 - Hosts: 64.233.167.104 updates.symantec.com
O1 - Hosts: 64.233.167.104 us.McAfee.com
O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
O1 - Hosts: 64.233.167.104 customer.symantec.com
O1 - Hosts: 64.233.167.104 rads.McAfee.com
O1 - Hosts: 64.233.167.104 trendmicro.com
O1 - Hosts: 64.233.167.104 grisoft.com
O1 - Hosts: 64.233.167.104 sandbox.norman.no
O1 - Hosts: 64.233.167.104 http://www.pandasoftware.com
O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com

O4 - HKLM\..\Run: [Realtime Audio Engine] mmrtkrnl.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Image Transfer.lnk = ?

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MSNMessengerSetupDownloadControl Class) - http://messenger.MSN.com/download/MSNme ... loader.cab
O18 - Filter hijack: application/octet-stream - {6585E5B4-4D2A-4A1D-A219-4102C64BA999} - (no file)
Bezoek ook gerust de website https://mandersonline.nl
Omhoog
Plaats reactie

Terug naar “Windows Algemeen”