Mededeling

Collapse
No announcement yet.

HijackThis Log na installeren Freewire

Collapse
X
Collapse
  •  
  • Page of 1
  • Filter
  • Tijd
  • Show
Clear All
new posts
Vorige template Volgende
  • #1

    HijackThis Log na installeren Freewire

    Hoi, ik heb vandaag Freewire(een soort Limewire) geinstalleerd en zit nu met een boel spyware. Op de site van wintips stond dat je de minimale installatie moest doen, zodat je geen spyware zou meekrijgen, maar ik deed dat en zit nu toch met een hoop spyware opgescheept....
    Hier is mijn HijachThis Log:

    Logfile of HijackThis v1.99.0
    Scan saved at 14:57:44, on 29-12-2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\ATI-CPanel\atiptaxx.exe
    C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    C:\WINDOWS\system32\CTHELPER.EXE
    C:\Virusscanner\Alwil Software\Avast4\aswUpdSv.exe
    C:\Virusscanner\Alwil Software\Avast4\ashServ.exe
    C:\VIRUSS~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Muziekprogrammas\Winamp\winampa.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
    C:\WINDOWS\System32\CTsvcCDA.exe
    C:\Utilities\Diskeeper Lite\DKService.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Virusscanner\Alwil Software\Avast4\ashMaiSv.exe
    C:\Utilities\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGrab.dll
    O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\bxxs5.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\Internet\FreshDownload\fdcatch.dll
    O2 - BHO: (no name) - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
    O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [avast!] C:\VIRUSS~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Muziekprogrammas\Winamp\winampa.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Download met Download &Express - C:\Internet\Download Express\Add_Url.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{02A8ABA2-E36F-4D4F-A6FF-047CE522CD65}: NameServer = 192.168.0.1
    O17 - HKLM\System\CS1\Services\Tcpip\..\{02A8ABA2-E36F-4D4F-A6FF-047CE522CD65}: NameServer = 192.168.0.1
    O17 - HKLM\System\CS2\Services\Tcpip\..\{02A8ABA2-E36F-4D4F-A6FF-047CE522CD65}: NameServer = 192.168.0.1
    O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Virusscanner\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown - C:\Virusscanner\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Virusscanner\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Utilities\Diskeeper Lite\DKService.exe
    O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)

    Kan iemand me hiermee helpen??
    Labels: Geen
    • Citaat
  • #2
    Hoi,

    Ik twijfel over dit item:

    O2 - BHO: (no name) - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll

    Heb je het bewust geïnstalleerd en wil je het houden, fix het dan niet. Zegt het je niets of wil je het kwijt, fix het dan wel.


    1. Scan met HijackThis en vink de volgende items aan:

    O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGrab.dll
    O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\bxxs5.dll
    O2 - BHO: (no name) - {FFFFDA2C-A0D5-4D60-8EE1-1B7F8929E24D} - C:\Program Files\Lycos\sst.dll

    O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun
    Sluit alle vensters behalve HijackThis zelf en klik op "Fix checked".

    2. Herstart de pc in veilige modus.
    Mocht je niet weten hoe dat moet, kijk dan hier even: http://www.virushelp.nl/veilige_modus.htm

    Zorg ervoor dat verborgen bestanden en mappen worden weergegeven.
    Hier kun je lezen hoe dat moet: http://users.telenet.be/marcvn/spyware/1117602.htm

    Verwijder nu, in veilige modus dus, de volgende bestanden (als ze er nog zijn):

    C:\WINDOWS\bxxs5.dll
    C:\WINDOWS\BTGrab.dll

    (Het is goed mogelijk dat ze al verdwenen zijn.)

    3. Herstart de pc in 'normale modus'.

    4. Maak een nieuw log en plaats dat hier.
    • Citaat

    Comment

    • #3
      Hier is mijn nieuwe HijackThis Log:

      Logfile of HijackThis v1.99.0
      Scan saved at 17:04:55, on 29-12-2004
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\ATI-CPanel\atiptaxx.exe
      C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
      C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
      C:\WINDOWS\system32\CTHELPER.EXE
      C:\VIRUSS~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Muziekprogrammas\Winamp\winampa.exe
      C:\Program Files\Java\jre1.5.0\bin\jusched.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Virusscanner\Alwil Software\Avast4\aswUpdSv.exe
      C:\Virusscanner\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\System32\CTsvcCDA.exe
      C:\Utilities\Diskeeper Lite\DKService.exe
      C:\WINDOWS\system32\slserv.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\Virusscanner\Alwil Software\Avast4\ashMaiSv.exe
      C:\Utilities\HijackThis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\Internet\FreshDownload\fdcatch.dll
      O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
      O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
      O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
      O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
      O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
      O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
      O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
      O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [avast!] C:\VIRUSS~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [WinampAgent] C:\Muziekprogrammas\Winamp\winampa.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: Download met Download &Express - C:\Internet\Download Express\Add_Url.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O17 - HKLM\System\CCS\Services\Tcpip\..\{02A8ABA2-E36F-4D4F-A6FF-047CE522CD65}: NameServer = 192.168.0.1
      O17 - HKLM\System\CS1\Services\Tcpip\..\{02A8ABA2-E36F-4D4F-A6FF-047CE522CD65}: NameServer = 192.168.0.1
      O17 - HKLM\System\CS2\Services\Tcpip\..\{02A8ABA2-E36F-4D4F-A6FF-047CE522CD65}: NameServer = 192.168.0.1
      O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Virusscanner\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: avast! Antivirus - Unknown - C:\Virusscanner\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Virusscanner\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
      O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Utilities\Diskeeper Lite\DKService.exe
      O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)

      Volgens mij staan die items er niet meer in!
      Alleen heb ik nog wel een vraagje over deze:
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

      Hoort dat gewoon bij Acrobat 6.0, of is het spyware?

      Bedankt voor de hulp!
      • Citaat

      Comment

      • #4
        Oorspronkelijk geplaatst door Tha Boss
        Alleen heb ik nog wel een vraagje over deze:
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

        Hoort dat gewoon bij Acrobat 6.0, of is het spyware?
        Dat hoort bij Acrobat. Dit is de plug-in die ervoor zorgt dat je *.pdf-bestanden kunt openen in Internet Explorer. Rustig laten staan dus.

        Je log is schoon.

        Lees dit eens: http://www.nucia.eu/forum/showthread.php?t=55
        • Citaat

        Comment

        Vorige template Volgende
        Sorry, you are not authorized to view this page
        Working...
        X