Mededeling

Collapse
No announcement yet.

ook ff mijn Logje

Collapse
X
Collapse
  •  
  • Page of 1
  • Filter
  • Tijd
  • Show
Clear All
new posts
Vorige template Volgende
  • #1

    ook ff mijn Logje

    Verplaatst van de sectie HijackThis naar de subsectie HijackThis logs.



    Heb nogal last van die irritante icoontjes in m'n bureaublad die je niet ken verwijderen.

    Searchweb2 ofso ook krijg 'k ook nie weg alles spy progs zo'n beetje gehad

    BVD...


    Logfile of HijackThis v1.98.2
    Scan saved at 17:21:00, on 30-12-2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\PROGRA~1\Support.com\bin\tgcmd.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Messenger Plus! 3\MsgPlus1.exe
    C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\devldr32.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Winamp\winamp.exe
    c:\progra~1\intern~1\iexplore.exe
    c:\Program Files\interMute\SpySubtract\SpySub.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\DOCUME~1\Werner\LOCALS~1\Temp\Rar$EX00.453\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.qkzlkdtzfklzdhyhdqbymzmt.net/LmUNJSmD5VJMEfaJIUUUTLIhE964Qs3qiNMcsLSbRkjcX9421ogj9xDmG0pq3Nel.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.campzone.lan:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {D2EBFE13-B928-FEC6-915E-874A2DF2892F} - C:\DOCUME~1\Werner\APPLIC~1\SETTIN~1\Once enc.exe
    O4 - HKLM\..\Run: [[Ephemeral 2.3] by TreeHugger, ] C:\DOCUME~1\Werner\LOCALS~1\Temp\4.tmp.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
    O4 - HKLM\..\Run: [tgcmd] "C:\PROGRA~1\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
    O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
    O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
    O4 - HKLM\..\Run: [MMTray] MMTray.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus1.exe"
    O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\givdi.exe
    O4 - HKLM\..\Run: [Bird atom blue dale] C:\Documents and Settings\All Users.WINDOWS\Application Data\View That Bird Atom\nurb acid.exe
    O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [platform bike idle third] C:\Documents and Settings\All Users.WINDOWS\Application Data\64SAVEPLATFORMBIKE\Iso About.exe
    O4 - HKCU\..\Run: [show grim] C:\DOCUME~1\Werner\APPLIC~1\Greyrule\16 flaw axis.exe
    O4 - HKCU\..\Run: [Spyware Assassin v.4.0] "C:\Program Files\Spyware Assassin 4.0\Spyware Assassin.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus1.exe" /WinStart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
    O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
    O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    Last edited by Eagle Creek; 30-12-04, 16:55.
    Labels: Geen
    • Citaat
  • #2
    Hoi,

    Je hebt blijkbaar messenger plus met sponsers geïnstalleerd. Dus, ik raad je aan om eerst messenger plus te deïnstalleren. Die kan je wanneer je systeem terug clean is terug installeren, maar deze keer zonder sponsers. (Deze optie kan je kiezen bij het begin van de installatie).

    Tijdens de uninstall ervan zal je een sponservenster krijgen zoals je hier een voorbeeld ziet: http://www.msgplus.net/images/sponsor_uninstall.jpg
    Als je deze niet ziet, kijk dan eens in je taakbar. In dat venster typ je de code in die je te zien krijgt en klik op uninstall.
    Dan gewoon verdere instructies opvolgen die gegeven worden.

    Ik zie dat je nog een oudere versie van hijackthis gebruikt. Dus, beter om die eerst te updaten.
    Start hijackthis, klik op 'misc tools'>Check for update online. Download de nieuwe versie (1.99), unzip het en plaats het in een permanente map, dus niet in je TEMP-map zoals dat het geval nu is.
    Ga naar Deze Computer > C > Program Files. Klik op Bestand > Nieuw > Map. Noem deze map HijackThis.
    Plaats nu de HijackThis.exe in die map.
    (Als de update-functie niet werkt kan je de nieuwste versie hier downloaden)

    REBOOT je pc en post daarna een nieuw logje met de nieuwe versie van hijackthis.
    Microsoft MVP - Consumer Security
    Director of Research @ Malwarebytes
    Mijn Blog
    • Citaat

    Comment

    • #3
      Heb MSN & kazaa d'r afgedonderd maar hou die irritante icoontjes die niet te verwijderen zijn er werd niet gevraagd om 'n verwijder code.. kan me ook niet heugen dat ik het met sponsor geinstaleerd heb.

      Ik weet 't niet meer

      Logfile of HijackThis v1.99.0
      Scan saved at 22:19:52, on 30-12-2004
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Winamp\winampa.exe
      C:\PROGRA~1\Support.com\bin\tgcmd.exe
      C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
      E:\Program Files\QuickTime\qttask.exe
      C:\WINDOWS\system32\MMTrayLSI.exe
      C:\WINDOWS\system32\MMTray2k.exe
      C:\WINDOWS\system32\MMTray.exe
      C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\WINDOWS\system32\ctfmon.exe
      C:\WINDOWS\system32\devldr32.exe
      c:\progra~1\intern~1\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\interMute\SpySubtract\SpySub.exe
      C:\Program Files\VIA\RAID\raid_tool.exe
      C:\Program Files\SpywareGuard\sgmain.exe
      C:\Program Files\SpywareGuard\sgbhp.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      C:\WINDOWS\System32\svchost.exe
      C:\DOCUME~1\Werner\LOCALS~1\Temp\Rar$EX00.922\HijackThis.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\WinRAR\WinRAR.exe
      C:\DOCUME~1\Werner\LOCALS~1\Temp\Rar$EX00.923\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.campzone.lan:8080
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
      O2 - BHO: (no name) - {D2EBFE13-B928-FEC6-915E-874A2DF2892F} - C:\DOCUME~1\Werner\APPLIC~1\SETTIN~1\Once enc.exe
      O4 - HKLM\..\Run: [[Ephemeral 2.3] by TreeHugger, ] C:\DOCUME~1\Werner\LOCALS~1\Temp\4.tmp.exe
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
      O4 - HKLM\..\Run: [tgcmd] "C:\PROGRA~1\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
      O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
      O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
      O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
      O4 - HKLM\..\Run: [MMTray] MMTray.exe
      O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\givdi.exe
      O4 - HKLM\..\Run: [Bird atom blue dale] C:\Documents and Settings\All Users.WINDOWS\Application Data\View That Bird Atom\nurb acid.exe
      O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [platform bike idle third] C:\Documents and Settings\All Users.WINDOWS\Application Data\64SAVEPLATFORMBIKE\Iso About.exe
      O4 - HKCU\..\Run: [show grim] C:\DOCUME~1\Werner\APPLIC~1\Greyrule\16 flaw axis.exe
      O4 - HKCU\..\Run: [Spyware Assassin v.4.0] "C:\Program Files\Spyware Assassin 4.0\Spyware Assassin.exe"
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
      O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
      O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
      O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
      O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
      O17 - HKLM\System\CCS\Services\Tcpip\..\{108E937A-4DA9-4536-887B-2E789AAD1166}: NameServer = 172.16.160.2,172.16.160.3
      O17 - HKLM\System\CS1\Services\Tcpip\..\{108E937A-4DA9-4536-887B-2E789AAD1166}: NameServer = 172.16.160.2,172.16.160.3
      O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
      • Citaat

      Comment

      • #4
        Oja ik krijg ook om de minuut ofso een post van SpywareGuard dat hij m'n internet instellingen wil veranderen..
        • Citaat

        Comment

        • #5
          Heb hem nog ff op C gezet
          hoop dat je 'r wat mee kan

          Logfile of HijackThis v1.99.0
          Scan saved at 22:41:22, on 30-12-2004
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Winamp\winampa.exe
          C:\PROGRA~1\Support.com\bin\tgcmd.exe
          C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
          E:\Program Files\QuickTime\qttask.exe
          C:\WINDOWS\system32\MMTrayLSI.exe
          C:\WINDOWS\system32\MMTray2k.exe
          C:\WINDOWS\system32\MMTray.exe
          C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
          C:\WINDOWS\system32\RUNDLL32.EXE
          C:\WINDOWS\system32\ctfmon.exe
          C:\WINDOWS\system32\devldr32.exe
          c:\progra~1\intern~1\iexplore.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\interMute\SpySubtract\SpySub.exe
          C:\Program Files\VIA\RAID\raid_tool.exe
          C:\Program Files\SpywareGuard\sgmain.exe
          C:\Program Files\SpywareGuard\sgbhp.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\Hijack This\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.campzone.lan:8080
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
          O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
          O2 - BHO: (no name) - {D2EBFE13-B928-FEC6-915E-874A2DF2892F} - C:\DOCUME~1\Werner\APPLIC~1\SETTIN~1\Once enc.exe
          O4 - HKLM\..\Run: [[Ephemeral 2.3] by TreeHugger, ] C:\DOCUME~1\Werner\LOCALS~1\Temp\4.tmp.exe
          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
          O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
          O4 - HKLM\..\Run: [tgcmd] "C:\PROGRA~1\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
          O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
          O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
          O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
          O4 - HKLM\..\Run: [MMTray] MMTray.exe
          O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\givdi.exe
          O4 - HKLM\..\Run: [Bird atom blue dale] C:\Documents and Settings\All Users.WINDOWS\Application Data\View That Bird Atom\nurb acid.exe
          O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [platform bike idle third] C:\Documents and Settings\All Users.WINDOWS\Application Data\64SAVEPLATFORMBIKE\Iso About.exe
          O4 - HKCU\..\Run: [show grim] C:\DOCUME~1\Werner\APPLIC~1\Greyrule\16 flaw axis.exe
          O4 - HKCU\..\Run: [Spyware Assassin v.4.0] "C:\Program Files\Spyware Assassin 4.0\Spyware Assassin.exe"
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
          O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
          O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
          O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
          O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
          O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
          O17 - HKLM\System\CCS\Services\Tcpip\..\{108E937A-4DA9-4536-887B-2E789AAD1166}: NameServer = 172.16.160.2,172.16.160.3
          O17 - HKLM\System\CS1\Services\Tcpip\..\{108E937A-4DA9-4536-887B-2E789AAD1166}: NameServer = 172.16.160.2,172.16.160.3
          O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
          • Citaat

          Comment

          • #6
            Och jawel hoor.. je hebt die wel met sponsers geïnstalleerd.

            * Download en installeer CCleaner
            Nog niet gebruiken

            * Zorg ervoor dat je verborgen mappen en bestanden weergegeven zijn. Hoe deze weer te geven.
            * Start hijackthis en vink volgende items aan:

            O2 - BHO: (no name) - {D2EBFE13-B928-FEC6-915E-874A2DF2892F} - C:\DOCUME~1\Werner\APPLIC~1\SETTIN~1\Once enc.exe
            O4 - HKLM\..\Run: [[Ephemeral 2.3] by TreeHugger, ] C:\DOCUME~1\Werner\LOCALS~1\Temp\4.tmp.exe
            O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\givdi.exe
            O4 - HKLM\..\Run: [Bird atom blue dale] C:\Documents and Settings\All Users.WINDOWS\Application Data\View That Bird Atom\nurb acid.exe
            O4 - HKLM\..\Run: [platform bike idle third] C:\Documents and Settings\All Users.WINDOWS\Application Data\64SAVEPLATFORMBIKE\Iso About.exe
            O4 - HKCU\..\Run: [show grim] C:\DOCUME~1\Werner\APPLIC~1\Greyrule\16 flaw axis.exe
            O4 - HKCU\..\Run: [Spyware Assassin v.4.0] "C:\Program Files\Spyware Assassin 4.0\Spyware Assassin.exe"
            O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe

            * Sluit alle open vensters behalve hijackthis en klik: Fix Checked.

            * Start nu je pc op in VEILIGE MODE. Hoe start ik in veilige mode op.

            Ga via configuratiescherm naar software > programma's wijzigen/verwijderen en kijk of volgende programma's aanwezig zijn en de-installeer die:

            GMT
            Spyware Assassin             => Lees hier waarom

            * Zoek daarna via verkenner volgende items en verwijder deze manueel indien nog aanwezig:

            C:\DOCUMENTS AND SETTINGS\Werner\APPLICATION DATA\SETTIN... <==deze map (begint met deze letters en bevat het bestand Once enc.exe)
            C:\WINDOWS\System32\givdi.exe
            C:\Documents and Settings\All Users.WINDOWS\Application Data\View That Bird Atom <==deze map
            C:\Documents and Settings\All Users.WINDOWS\Application Data\64SAVEPLATFORMBIKE <==deze map
            C:\DOCUMENTS AND SETTINGS\Werner\APPLICATION DATA\Greyrule <==deze map
            C:\Program Files\Spyware Assassin 4.0 <==deze map
            C:\Program Files\Common Files\GMT <==deze map

            * Start Ccleaner en klik op Run Cleaner (rechts onderaan)

            * Reboot je pc terug normaal en post een nieuw hijackthislogje.
            Microsoft MVP - Consumer Security
            Director of Research @ Malwarebytes
            Mijn Blog
            • Citaat

            Comment

            Vorige template Volgende
            Sorry, you are not authorized to view this page
            Working...
            X