Op deze website gebruiken we cookies om content en advertenties te personaliseren, om functies voor social media te bieden en om ons websiteverkeer te analyseren. Ook delen we informatie over uw gebruik van onze site met onze partners voor social media, adverteren en analyse. Deze partners kunnen deze gegevens combineren met andere informatie die u aan ze heeft verstrekt of die ze hebben verzameld op basis van uw gebruik van hun services. Meer informatie.

Akkoord

Vraag & Antwoord

Beveiliging & privacy

Hijackthis log beoordelen

Anoniem
juisterr
5 antwoorden
  • Hallo,

    Ik heb met een computer wat problemen: beetje traag, met name op internet. Heb reeds van alles geprobeerd, onder andere met Spybot en AdAware. Die vonden wel een en ander, maar dat was niet echt de oorzaak. De virusscanner (McAfee Enterprise) loopt op ca. 1/3 van het totaal te scannen geheel vast. Ook de Online versie van Network Associates loopt vast (althans IE loopt vast). Zouden jullie eens een blik op onderstaand Hijackthis log willen werpen, want ik weet even niet meer hoe nu verder te gaan. Alvast bedankt voor de moeite.

    Logfile of HijackThis v1.99.1
    Scan saved at 23:01:56, on 4-7-2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\td\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper\DkIcon.exe"
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [FLMK08KB] C:\Program Files\Multimedia keyboard Utility\1.3\KbdAp32A.exe
    O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
    O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin
    pjpi142.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin
    pjpi142.dll
    O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4795/mcfscan.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

  • Download en installeer .[list:87618c0407]
    Na de installatie, open Ewido Anti-Spyware 4.0:
    * onder "[b:87618c0407]Status[/b:87618c0407]", klik op [b:87618c0407]Change state[/b:87618c0407] naast "Resident shield". (wijzig van active naar [b:87618c0407]inactive[/b:87618c0407]!)
    * onder "[b:87618c0407]Update[/b:87618c0407]", klik op de [b:87618c0407]Start update[/b:87618c0407] knop.
    * onder "[b:87618c0407]Scanner[/b:87618c0407]", tab "Settings":[list:87618c0407]- onder "How to act?", klik op "[u:87618c0407]Recommended actions[/u:87618c0407]" en selecteer [b:87618c0407]Quarantine[/b:87618c0407]. ([b:87618c0407]ZEER BELANGRIJK![/b:87618c0407])
    - onder "Reports", selecteer [b:87618c0407]Automatically generate report after every scan[/b:87618c0407] en [u:87618c0407]verwijder[/u:87618c0407] het vinkje bij [b:87618c0407]Only if threats were found[/b:87618c0407][/list:u:87618c0407]
    Sluit Ewido. Laat het [b:87618c0407]nog niet[/b:87618c0407] scannen.[/list:u:87618c0407]

    Start op in veilige modus(tijdens opstarten op F8 drukken,"getapt"en dan kiezen voor veilige modus)

    Start
  • Ewido geinstalleerd en beschreven acties uitgevoerd. Dit resulteerde in het volgende rapport:

    ———————————————————
    ewido anti-spyware - Scan Report
    ———————————————————

    + Created at: 17:26:00 5-7-2006

    + Scan result:



    C:\Documents and Settings\Bas\Local Settings\Temp\lredbooo.sys -> Backdoor.Genlot.DX : Cleaned with backup (quarantined).
    C:\Documents and Settings\Mariëlle\Local Settings\Temp\lredbooo.sys -> Backdoor.Genlot.DX : Cleaned with backup (quarantined).
    C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@maxis.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@tgn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@ostg.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@ad.adocean[2].txt -> TrackingCookie.Adocean : Cleaned with backup (quarantined).
    C:\Documents and Settings\Mariëlle\Cookies\mariëlle@ad.adocean[2].txt -> TrackingCookie.Adocean : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@ad.adocean[1].txt -> TrackingCookie.Adocean : Cleaned with backup (quarantined).
    C:\Documents and Settings\Mariëlle\Cookies\mariëlle@www.belstat[2].txt -> TrackingCookie.Belstat : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
    C:\Documents and Settings\Mariëlle\Cookies\mariëlle@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@www.burstbeacon[2].txt -> TrackingCookie.Burstbeacon : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
    C:\Documents and Settings\Mariëlle\Cookies\mariëlle@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@cj[1].txt -> TrackingCookie.Cj : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
    C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@www.epilot[1].txt -> TrackingCookie.Epilot : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@e-2dj6wfkocpdpcco.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@e-2dj6wfl4uhdzskq.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@e-2dj6wgk4uldpego.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@e-2dj6wgkiajazgcp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@e-2dj6wjl4whajiho.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@e-2dj6wjl4woajcco.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@e-2dj6wjlokjdpiep.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@e-2dj6wjmisiazsbp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@ehg-dig.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@ehg-idgentertainment.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@ivwbox[2].txt -> TrackingCookie.Ivwbox : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@ivwbox[2].txt -> TrackingCookie.Ivwbox : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@komtrack[1].txt -> TrackingCookie.Komtrack : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@sales.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
    C:\Documents and Settings\Administrator\Cookies\administrator@stat.onestat[2].txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@data3.perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@data3.perf.overture[2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@ads.realcastmedia[2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@ads1.revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@starware[2].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@h.starware[1].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@try.starware[1].txt -> TrackingCookie.Starware : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    C:\Documents and Settings\Mariëlle\Cookies\mariëlle@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@server3.web-stat[1].txt -> TrackingCookie.Web-stat : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@yadro[1].txt -> TrackingCookie.Yadro : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Cookies\bas@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    C:\Documents and Settings\Bas\Local Settings\Temp\Cookies\bas@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    C:\Documents and Settings\Mariëlle\Cookies\mariëlle@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    C:\Documents and Settings\tom\Cookies\tom@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).


    ::Report end
  • Ik zie 4 namen maar ik zie 1 logje, zijn deze namen allemaal andere accounts op deze pc ,? Zo ja mag ik dan van elke account een logje zien aub.



    Bas
    Mariëlle
    Administrator
    Tom

    Bvd
    Juisterr
  • En terwijl ik de overige accounts aan het scannen ben, schiet me ineens weer te binnen dat ik, toen ik deze PC heb ingericht, een image van de 'verse' installatie heb gemaakt. Ik voel er veel voor om niet verder te speuren, het image terug te zetten en de PC (nog wat verder dichtgetimmerd) weer voor fris en schoon te verklaren!

    @ juisterr: Sorry dat ik hier zelf niet eerder aan gedacht heb. In elk geval bedankt voor het meedenken!

Beantwoord deze vraag

Dit is een gearchiveerde pagina. Antwoorden is niet meer mogelijk.