mijn logfile. marco1304

marco1304 · Bericht door **marco1304** » za 22 jan 2005, 22:54

Bericht door **MandersOnline** » zo 23 jan 2005, 14:23

Logfile of HijackThis v1.98.2
Scan saved at 21:48:54, on 22-1-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R1 - HKCU\Software\Microsoft\<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... /a></a></a> Explorer,SearchURL = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... /a></a></a> Explorer\Main,Start Page = http://start.home.nl/
R1 - HKLM\Software\Microsoft\<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... /a></a></a> Explorer\Main,Default_Page_URL = http://start.home.nl/
R1 - HKCU\Software\Microsoft\<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... /a></a></a> Explorer\Main,Window Title = Marco & Ingrid
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... /a></a></a> Settings,ProxyServer = proxy:8080
R0 - HKCU\Software\Microsoft\<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... /a></a></a> Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts
O1 - Hosts: 82.179.166.192 new-search.net
O1 - Hosts: 82.179.166.190 x-Google.net
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [kalvsys] C:\Windows\system32\kalvusc32.exe
O4 - HKLM\..\Run: [WinAmpAgent] C:\WINDOWS\winagent.exe /i

O12 - Plugin for .mid: C:\Program Files\<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... a></a>"><a target="_blank" href="http://searchmiracle.com/text/search.php?qq=<a target="_blank" href="http://searchmiracle.com/text/search.ph ... et</a>"><a target="_blank" href="http://searchmiracle.com/text/search.ph ... /a></a></a> Explorer\PLUGINS\npqtplugin2.dll
O14 - IERESET.INF: START_PAGE_URL=http://start.home.nl/
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.145/x15.chm::/trs15.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by3fd.bay3.hotmail.MSN.com/resou ... nPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MSNMessengerSetupDownloadControl Class) - http://messenger.MSN.com/download/MSNMe ... loader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.MSN.com/bin/MSNchat45.cab

Nu ga je die lijst selecteren die ik je heb opgegeven. Daarna ga je de PC herstarten en maak je met de nieuwste versie van Hijackthis een log voor me, dat is 1.99.0

Doe je een online scan bij:
http://www.bitdefender.com/scan/licence.php
http://www.pandasoftware.com/activescan ... ncipal.htm

Beide apart van elkaar doen en zeker niet gelijkertijd.

Wat ik gewoon nu wil doordrukken is dat je Service Pack 2 gaat installeren om dit soort dingen te minimaliseren.

Als laatste krijg je van mij het advies om toch eens te controleren of je wel een goede virusscanner hebt die zijn updates binnen haalt.

LET ER OP DAT JE DIT SNEL DOET!!!

marco1304 · Bericht door **marco1304** » ma 24 jan 2005, 2:06

Logfile of HijackThis v1.99.0
Scan saved at 23:50:17, on 23-1-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.home.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Marco & Ingrid
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PestPatrol Control Center] c:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [kalvsys] C:\Windows\system32\kalvusc32.exe
O4 - HKCU\..\Run: [MSNMsgr] "C:\Program Files\MSN Messenger\MSNMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE"
O4 - HKCU\..\Run: [RamCleaner] C:\Program Files\RamCleaner\RamCleaner.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GoBack Polling Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
O23 - Service: Norton AntiVirus Auto-Protect-service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Dit is mijn logfile met de nieuwe hijackThis 1.99.0
Ben nu nog met de scan van bitdefender bezig en zo te zien gaat dat nog wel ff duren.
Dus ga zo maar naar bed en doe morgen de andere scan nog even,en laat dan wel weer wat van me horen.
P.S ik heb het in blauw niet verwijderd is van nero en in rood heb ik wel verwijderd maar staat er nu nog steeds in.
Heb ook nog steeds een scherm van explorer met iets van een search result ofzo (erg iritant) en als ik deze topic open krijg ik van norton sec. 2005 steeds een melding van een virus dat hij niet kan verwijderen,namelijk:Bloodhound.Exploit.6
groetjes marco

Bericht door **MandersOnline** » ma 24 jan 2005, 2:12

Dat klopt dat je die melding krijgt dat is die informatie op deze pagina die jij me gestuurd hebt.

voor de rest van die search gaan we morgen wel verder als je alle scans hebt uitgevoerd en schoon lijkt te zijn.

Bericht door **MandersOnline** » ma 24 jan 2005, 2:14

vergat het te zeggen, maar ik kreeg enkele keren een mail die gestript werd door me virus scanner dus je kan nagaan wat voor troep je nu hebt verwijderd met dat stomme programma die o zo goed werkt hahaha

marco1304 · Bericht door **marco1304** » ma 24 jan 2005, 2:20

Tja zit wat hoop er snel van af te zijn want het is nog niet gedaan heb nog steeds problemen.
Ik kijk morgen vroeg nog ff naar de uitslag van bitdefender en hoop dat ik dat dan ook gelijk kan verwijderen.
En dan morgen avond nog ff de panda online scan.
Daarna ben ik weer hier

Groetjes marco

Bericht door **MandersOnline** » ma 24 jan 2005, 2:58

ik wacht het rustig af...

marco1304 · Bericht door **marco1304** » ma 24 jan 2005, 22:01

Ben ik weer dit is de uitslag van bitdefender:
C:\Documents and Settings\Ingrid\Local Settings\Temporary Internet Files\Content.IE5\4XCTIJ8L\protector_update[1].exe: infected with Trojan.Startpage.NK
C:\Documents and Settings\Ingrid\Local Settings\Temporary Internet Files\Content.IE5\ABQBE5E3\stylewin[1].css: infected with Trojan.Spy.Banker.HQ
C:\Downloads\beveiligingsprogramma's\HijackThis\backups\backup-20041130-232646-968.dll=>(Upc): infected with Trojan.Downloader.Swizzor.BO
C:\Downloads\Chat-United\Scripts\Dessie-Script-V1.0\dll\moo.dll: infected with Application.MBMON.A
C:\Downloads\Chat-United\Scripts\Dessie-Script-V1.0\Dlls\moo.dll: infected with Application.MBMON.A
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\571262AB.htm: infected with JS.Trojan.Downloader.IstBar.A
C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\57150CA8.tmp: infected with JS.Trojan.Downloader.IstBar.A
C:\Program Files\PestPatrol\Spyware.dat=>c: password protected
C:\Program Files\PestPatrol\Spyware.dat=>co: password protected
C:\Program Files\PestPatrol\Spyware.dat=>d: password protected
C:\Program Files\PestPatrol\Spyware.dat=>f: password protected
C:\Program Files\PestPatrol\Spyware.dat=>r: password protected
C:\RECYCLER\S-1-5-21-436374069-764733703-1708537768-500\Dc2\MrDrej.exe: infected with Trojan.Downloader.Small.YA
C:\temp\NCasePackage.exe: infected with Application.Dropper.Ncase.Salm
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\QH2HMJSD\dl[1].exe: suspect Trojan.Downloader.Gen

Heb alles eruit gedaan en heb nu het volgende ik wilde met de panda online scan verder gaan en krijg ik het volgende =http://members.lycos.nl/fmbquats/Afbee ... outmeldingondanks dat ik bij foutopsporing in scripts uitschakelen een vinkje heb staan.
En bij het opstarten van de pc kreeg ik een error blok van pestpatrol die nu niet meer werkt door dat ik Spyware.Dat heb verwijderd dus ga ik die als eerste maar ff terug zetten.
Maar zou niet weten hoe ik nu die online scan toch aan de gang kan krijgen .

Bericht door **MandersOnline** » ma 24 jan 2005, 22:06

Voor die foutmelding moet je bij Norton zijn, verder raad ik je dringend aan om even je Quarantaine box van Norton leeg te gooien en je tijdelijke internet bestanden te legen.

Heb je nog last van die Rommel van eerst? Maak dan een nieuwe log voor me aan dan kan ik weer het een en ander proberen te fixen indien nodig.

marco1304 · Bericht door **marco1304** » ma 24 jan 2005, 22:15

Ik heb eerst de quarantaine leeg gegooid van norton.
En gelijk een log gemaakt.
Bedoelde je dat ik bij norton site iets kan vinden over die foutmelding?

Logfile of HijackThis v1.99.0
Scan saved at 21:12:21, on 24-1-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.home.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Marco & Ingrid
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [kalvsys] C:\Windows\system32\kalvusc32.exe
O4 - HKCU\..\Run: [MSNMsgr] "C:\Program Files\MSN Messenger\MSNMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE"
O4 - HKCU\..\Run: [RamCleaner] C:\Program Files\RamCleaner\RamCleaner.exe
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GoBack Polling Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
O23 - Service: Norton AntiVirus Auto-Protect-service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Bericht door **MandersOnline** » ma 24 jan 2005, 22:22

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll

Dat is de enigste waar ik ruzie mee krijg. Verwijder die ook even na herstarten van je harde schijf die gehele map: C:\WINDOWS\EliteToolBar\

Daarnaast wou ik je even vragen om SP2 te installeren mogelijk zijn dan de problemen met dat foutmeldingsscherm weg, die heeft te maken met Norton, maar hoe je dat weg krijgt, misschien Norton Tijdelijk uitschakelen....

marco1304 · Bericht door **marco1304** » ma 24 jan 2005, 22:35

Ga ik nu ff doen .
Denk alleen niet dat het aan norton ligt je doelt erop dat het een virus programma site is waar hij dit bij doet, maar dit is niet de enige pagina
waarbij ik die foutmelding krijg dus ik denk dat het elders te zoeken moet zijn maar ik sluit niet uit dat het wel zo is
Kan het gewoon zo ff proberen .

marco1304 · Bericht door **marco1304** » ma 24 jan 2005, 22:59

Ik blijf last houden van die rare vensters eerst komt dezehttp://members.lycos.nl/fmbquats/Afbeel ... %20(1).bmp
daarna komt deze http://members.lycos.nl/fmbquats/Afbeel ... %20(2).bmp
Ik ga nu eerst nog maar even sp2 installeren

Bericht door **MandersOnline** » ma 24 jan 2005, 23:12

Ja je zult dus het een en ander met bijvoorbeeld Spysweeper moeten verwijderen...

marco1304 · Bericht door **marco1304** » di 25 jan 2005, 0:48

Ben ik weer

Ik heb nu sp2 geïnstalleerd maar ben nog geen steek verder.
Ik heb dus nog steeds die 2 schermen waar ik het de vorige mail over had.
En script foutmelding blijft ook nog steeds aan houden ondanks dat hij staat aangevinkt.
Dus al met al is er nog niks veranderd.
Wat moet ik nu

Ik heb ook gelijk nog maar een log gemaakt.

Logfile of HijackThis v1.99.0
Scan saved at 23:47:36, on 24-1-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\PestPatrol\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\MSN Messenger\MSNMsgr.Exe
C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE
C:\Program Files\RamCleaner\RamCleaner.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.home.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.home.nl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Marco & Ingrid
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [kalvsys] C:\Windows\system32\kalvusc32.exe
O4 - HKCU\..\Run: [MSNMsgr] "C:\Program Files\MSN Messenger\MSNMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperProfessional] "C:\PROGRA~1\PANICW~1\POP-UP~1\POPUPS~1.EXE"
O4 - HKCU\..\Run: [RamCleaner] C:\Program Files\RamCleaner\RamCleaner.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GoBack Polling Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
O23 - Service: Norton AntiVirus Auto-Protect-service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe