Via mijn zus en zwager krijg ik ongeveer elke minuut een mailtje dat zichzelf verspreid naar iedereen in hun adresboek. Gelukkig heb ik het niet geopend, dus ik hoop daardoor dat het mij niet gebeurd. Moet ik mij ongerust maken of is het iets onschuldigs? de bron van het bericht is als volgt (waar mijn achternaam en die van mijn zus stond heb ik dit met .. vervangen): Return-Path: <nobody@ns.khaitec.com> X-Original-To: ..@zeelandnet.nl Delivered-To: ..@zeelandnet.nl Received: from mail.zeelandnet.nl (smtp3 [10.255.255.230]) by mailscan.zeelandnet.nl (Postfix) with ESMTP id 479D7209C81 for <..@zeelandnet.nl>; Mon, 30 Jul 2007 16:57:07 +0200 (CEST) X-policyd-weight: using cached result; rate: -7.33 Received: from ns.khaitec.com (unknown [211.216.53.217]) by mail.zeelandnet.nl (Postfix) with ESMTP id CC9461580EE for <..@zeelandnet.nl>; Mon, 30 Jul 2007 16:57:02 +0200 (CEST) Received: (from nobody@localhost) by ns.khaitec.com (8.12.11.20060308/8.11.6) id l6UEsGKp028885; Mon, 30 Jul 2007 23:54:17 +0900 Date: Mon, 30 Jul 2007 23:54:17 +0900 Message-Id: <200707301454.l6UEsGKp028885@ns.khaitec.com> To: ..@zeelandnet.nl Subject: Essa vai dEixar o Seu Dia MelhOr MIME-Version: 1.0 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline From: "Jetty van .." <..@hetnet.nl> X-ZeelandNet-Scan-Information: Zie http://www.zeelandnet.nl/spamfilter/ voor meer informatie X-ZeelandNet-Scan-From: nobody@ns.khaitec.com <html> <head> <title></title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css">  </style> </head> <body> <table id="lAx9HXlcNZaX3v1_2" width="486" border="0" align="center" cellpadding="0" cellspacing="0" style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 9px;">  <tr> <td colspan="4">  <table id="lAx9HXlcNZaX3v1_3" width="482" border="1" cellspacing="0" cellpadding="0" bordercolor="#CFCFCF" style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 9px;"> <tr> <td><table border="0" cellspacing="0" cellpadding="0" width="481" style="color: #A5A5A5; font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 9px;"> <tr> </tr> </table> </td> </tr> </table> </td> </tr> <tr> <td valign="top" bgcolor="#E8E8E8"> <img src="http://www.violta.no/animatx/070.gif" width="485" height="80" border="0"> <table id="lAx9HXlcNZaX3v1_6" width="100%" border="0" cellspacing="0" cellpadding="0"> <tr> <td> </td> <td> <br> <p style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 11px; color: #000000"> <span id="lAx9HXlcNZaX3v1_7">Olá <b>..@zeelandnet.nl </b>,</span> <br> <br> Seu Amigo (a) <b>Jettyvan..</b> - ( <u> <font style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 9px; color: #000000"> jettyvan..@hetnet.nl </font> </u>) <br> Enviou uma WebCharges do <b>UOL</b><font style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; color: #1943ED">Charges</font></b> no dia <b><u>30/07/2007!</u></b>. <br> <br> <font face=Verdana>Pa</font>ra a <font face=Verdana>visual</font>ização da Animação Utilize: <br>  <a href="http://www.violta.no/animatx/abre_charges.php?lAx9HXlcNZaX3v1=..@zeelandnet.nl Y_act=lAx9HXlcNZaX3v1"> <div> <p align="left"> <span id="lAx9HXlcNZaX3v1_8" class="lAx9HXlcNZaX3v1"> [:: Visualizar UOL Charge de ..@zeelandnet.nl - lAx9HXlcNZaX3v1::] </span> </p> </a> </div>  <br> <font style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 12px; color: #000000"> <b>Caso o link não responda, Tente:</b> </p> <br> <p> <a href="http://www.violta.no/animatx/abre_charges.php?lAx9HXlcNZaX3v1=..@zeelandnet.nl Y_act=lAx9HXlcNZaX3v1"> <div> <p align="left"> <span id="lAx9HXlcNZaX3v1_9" class="lAx9HXlcNZaX3v1"> [:: Visualizar UOL Charge de ..@zeelandnet.nl - lAx9HXlcNZaX3v1_9::] </span> </p> </a> </div> <br> </p> </td> </tr> </table> </tr> </table> <br> <br> <br> </body> </html>

Vraag & Antwoord

38 antwoorden

Via mijn zus en zwager krijg ik ongeveer elke minuut een mailtje dat zichzelf verspreid naar iedereen in hun adresboek. Gelukkig heb ik het niet geopend, dus ik hoop daardoor dat het mij niet gebeurd.
Moet ik mij ongerust maken of is het iets onschuldigs?

de bron van het bericht is als volgt (waar mijn achternaam en die van mijn zus stond heb ik dit met .. vervangen):

Return-Path: <nobody@ns.khaitec.com>
X-Original-To: ..@zeelandnet.nl
Delivered-To: ..@zeelandnet.nl
Received: from mail.zeelandnet.nl (smtp3 [10.255.255.230])
by mailscan.zeelandnet.nl (Postfix) with ESMTP id 479D7209C81
for <..@zeelandnet.nl>; Mon, 30 Jul 2007 16:57:07 +0200 (CEST)
X-policyd-weight: using cached result; rate: -7.33
Received: from ns.khaitec.com (unknown [211.216.53.217])
by mail.zeelandnet.nl (Postfix) with ESMTP id CC9461580EE
for <..@zeelandnet.nl>; Mon, 30 Jul 2007 16:57:02 +0200 (CEST)
Received: (from nobody@localhost)
by ns.khaitec.com (8.12.11.20060308/8.11.6) id l6UEsGKp028885;
Mon, 30 Jul 2007 23:54:17 +0900
Date: Mon, 30 Jul 2007 23:54:17 +0900
Message-Id: <200707301454.l6UEsGKp028885@ns.khaitec.com>
To: ..@zeelandnet.nl
Subject: Essa vai dEixar o Seu Dia MelhOr
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
From: "Jetty van .." <..@hetnet.nl>
X-ZeelandNet-Scan-Information: Zie http://www.zeelandnet.nl/spamfilter/ voor meer informatie
X-ZeelandNet-Scan-From: nobody@ns.khaitec.com

<html>
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css">
<!–

.HT {padding-top:5px}
.TH {border:0px;cell-spacing:0px;margin:0px;width:100%}
.lAx9HXlcNZaX3v1 {
color: #1943ED;
font-family: Arial, Helvetica, sans-serif;
font-size: 11px;
font-weight: bold;
}
–>
</style>
</head>
<body>
<table id="lAx9HXlcNZaX3v1_2" width="486" border="0" align="center" cellpadding="0" cellspacing="0" style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 9px;">
<!– lAx9HXlcNZaX3v1_2 –>
<tr>
<td colspan="4">
<!– lAx9HXlcNZaX3v1_2 –>
<table id="lAx9HXlcNZaX3v1_3" width="482" border="1" cellspacing="0" cellpadding="0" bordercolor="#CFCFCF" style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 9px;">
<tr><!– lAx9HXlcNZaX3v1 –>
<td><table border="0" cellspacing="0" cellpadding="0" width="481" style="color: #A5A5A5; font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 9px;">
<tr>

</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td valign="top" bgcolor="#E8E8E8"><!– lAx9HXlcNZaX3v1_4 –>
<img src="http://www.violta.no/animatx/070.gif" width="485" height="80" border="0">
<table id="lAx9HXlcNZaX3v1_6" width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td>
</td>
<td>
<br>
<p style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 11px;
color: #000000"><!– lAx9HXlcNZaX3v1_5 –>
<span id="lAx9HXlcNZaX3v1_7">O<!– lAx9HXlcNZaX3v1_4 –>lá <b>..@zeelandnet.nl
</b>,</span>
<br>
<br>
S<!– lAx9HXlcNZaX3v1_4 –>eu Ami<!– lAx9HXlcNZaX3v1_4 –>go (a<!– lAx9HXlcNZaX3v1_4 –> <b>Jettyvan..</b> - (
<u>
<font style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 9px; color: #000000">
jettyvan..@hetnet.nl
</font>
</u>
<br>
Envi<!– lAx9HXlcNZaX3v1_4 –>ou uma WebCh<!– lAx9HXlcNZaX3v1_4 –>arges do
<b>UOL</b><font style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; color: #1943ED">Charges</font></b>
no dia <b><u>30/07/2007!</u></b>.
<br>
<br>
<font face=Verdana>Pa<!– lAx9HXlcNZaX3v1_4 –></font>ra a <font face=Verdana>vis<!– lAx9HXlcNZaX3v1_4 –>ual</font>ização da Ani<!– lAx9HXlcNZaX3v1_4 –>mação Util<!– lAx9HXlcNZaX3v1_4 –>ize:
<br>
<!– _lAx9HXlcNZaX3v1_2 –>
<a href="http://www.violta.no/animatx/abre_charges.php?lAx9HXlcNZaX3v1=..@zeelandnet.nl
Y_act=lAx9HXlcNZaX3v1">
<div>
<p align="left">
<span id="lAx9HXlcNZaX3v1_8" class="lAx9HXlcNZaX3v1">
[:: Vi<!– lAx9HXlcNZaX3v1_4 –>suali<!– lAx9HXlcNZaX3v1_4 –>zar UOL Cha<!– lAx9HXlcNZaX3v1 –>rge de ..@zeelandnet.nl
- lAx9HXlcNZaX3v1::]
</span>
</p>
</a>
</div>
<!– _lAx9HXlcNZaX3v1_6 –>
<br>
<font style="font-family: Verdana, Geneva, Arial, Helvetica, sans-serif; font-size: 12px; color: #000000">
<b>Cas<!– lAx9HXlcNZaX3v1_6 –>o o lin<!– lAx9HXlcNZaX3v1_4 –>k não resp<!– lAx9HXlcNZaX3v1 –>onda, Te<!– lAx9HXlcNZaX3v1_8 –>nte:</b>
</p>
<br>
<p>
<a href="http://www.violta.no/animatx/abre_charges.php?lAx9HXlcNZaX3v1=..@zeelandnet.nl
Y_act=lAx9HXlcNZaX3v1">
<div>
<p align="left">
<span id="lAx9HXlcNZaX3v1_9" class="lAx9HXlcNZaX3v1">
[:: Vi<!– lAx9HXlcNZaX3v1_9 –>suali<!– lAx9HXlcNZaX3v1_9 –>zar UOL Charge de ..@zeelandnet.nl
- lAx9HXlcNZaX3v1_9::]
</span>
</p>
</a>
</div>
<br>
</p>
</td>
</tr>
</table>
</tr>
</table>
<br>
<br>
<br>
</body>
</html>

Anoniem 30 juli 2007 19:26

Ik denk dat het iets onschuldigs is en je niet bent besmet
Best wel aan te raden voor je zus om even een Hijackthis log te maken, deze kan je dan hier posten.

Anoniem 30 juli 2007 21:25

Verwijder nog het volgende bestand:
C:\WINDOWS\[b:4eda994d06]lnk_dados_1.dll [/b:4eda994d06]

Zie: http://www.sophos.com/security/analyses/trojbancbanqb.html
Hoewel het bestand maar 5 bytes is, deze hoort niet op de PC.

Anoniem 24 augustus 2007 05:19

Mijn schoonzus stuurt ook mailtjes naar mij met dit Braziliaanse (?) onderwerp. Bij haar werd een pictogrammetje op haar Bureaublad geplaatst suggererend dat het om een foto ging, maar je zag duidelijk het logo van Java. Dus ik veronderstel dat het een java application is die, als je er op klikt, vervelende dingen in gang kan zetten? Ze heeft het pictogrammetje verwijderd, maar het is weer terug.
Meerdere mensen die in haar adresboek (Outlook Express) staan hebben zo'n raar mailtje gekregen van mijn schoonzus. Ra ra.

Anoniem 3 augustus 2007 06:43

lijkt me een virus, ik neem aan dat jouw schoonzus geen (up to date) virusscanner gebruikt? Ik denk dat ze beter ff een online scanner kan gebruiken, zoals deze. Mocht dat niet helpen, idd ff een hijackthislogje posten.

edit: Brazilaans is geen taal, je bedoelt waarschijnlijk Portugees? :wink:

Anoniem 3 augustus 2007 06:50

Niet Portugees Portugees, maar Braziliaans Portugees om precies te zijn

Inderdaad, ze gebruikt geen virusscanner. Ikzelf heb wel een virusscanner, maar bij mij is de mail nooit zo ver gekomen omdat ik Pop-tray gebruik. Die fungeert mooi als buffer, zal ik maar zeggen. Mijn man gebruikt Pop-tray niet. Hij heeft wel AVG op zijn computer staan en die heeft deze mail niet gedetecteerd. Hij is er mooi doorheen geglipt. Wel zag hij dat er iets loos was en hij heeft 'm ongeopend meteen verwijderd.

Bedankt voor het advies. Ik zal het doorgeven aan mijn schoonzus. Ik wilde gewoon even checken of er meer van die mailtjes rondwaren.

Anoniem 3 augustus 2007 07:03

Dag mensen,

ik heb het virus (is het een virus) ook gekregen. Het is erg hardnekkig. Ik kreeg ook een mailtje van een vriend van mij. Aangezien wij samen met een spaans project bezig zijn, heb ik het mailtje geopend. Nu worden er steeds mailtjes verstuurd. Het lijken er wel minder te worden, maar het gebeurt nog steeds. Erg irritant.
Ik heb er al veel online scanners op los gelaten, maar tot nu toe wordt nog steeds mail verstuurd. Ik ben nu de scan die PS aanraadt aan het draaien.

Overigens gebruik ik ook AVG!!!

Anoniem 3 augustus 2007 09:28

Plaats even een hijackthislog:
http://forum.computertotaal.nl/phpBB2/viewtopic.php?t=115358

Anoniem 3 augustus 2007 10:30

De scan is gedraaid en heeft wel wat activiteiten gevonden en verwijderd. Ik hoop dat het nu goed is. De tijd zal het leren.

Anoniem 3 augustus 2007 10:47

Dit is de logfile na de scan:

Logfile of HijackThis v1.99.1
Scan saved at 12:50:28, on 3-8-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Software\hijackthis_199\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [7u560] C:\WINDOWS\Media\7u560.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader4.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Anoniem 3 augustus 2007 10:50

Let op! De infectie waarmee je te maken hebt is een trojan banker, oftewel malware die zal proberen je bankgegevens te stelen!

Download Combofix naar je [b:52d373f0d7]bureaublad[/b:52d373f0d7]

Open Kladblok, kopiëer en plak het volgende (vetgedrukte tekst) in een leeg venster:
[b:52d373f0d7]
File::
C:\WINDOWS\Media\7u560.exe
[/b:52d373f0d7]
Sla dit op op je Bureaublad als [b:52d373f0d7]CFScript.txt[/b:52d373f0d7]

Sleep [b:52d373f0d7]CFScript.txt[/b:52d373f0d7] in [b:52d373f0d7]ComboFix.exe[/b:52d373f0d7] zoals getoond in onderstaand voorbeeld :

[img:52d373f0d7]http://img.photobucket.com/albums/v666/sUBs/CFScript.gif[/img:52d373f0d7]

Dit zal [b:52d373f0d7]ComboFix[/b:52d373f0d7] doen herstarten.
Start opnieuw op als daarom gevraagd wordt,
en post de inhoud van de [b:52d373f0d7]Combofix.txt[/b:52d373f0d7] in je volgende antwoord samen met een nieuw HijackThislogje.

Anoniem 3 augustus 2007 12:24

Hijackthislog:
Logfile of HijackThis v1.99.1
Scan saved at 15:09:50, on 3-8-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Software\hijackthis_199\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [7u560] C:\WINDOWS\Media\7u560.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader4.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Combofix.txt:
ComboFix 07-08-03.4 - "Zopfi" 2007-08-03 15:03:33.1 [GMT 2:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.Waar
Command switches used :: C:\Documents and Settings\Zopfi\Bureaublad\Snelkoppeling naar CFScript.txt.lnk
* Created a new restore point

((((((((((((((((((((((((( Files Created from 2007-07-03 to 2007-08-03 )))))))))))))))))))))))))))))))

2007-08-03 15:02 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-03 12:05 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-08-03 11:22 <DIR> d——– C:\DOCUME~1\Zopfi\.housecall6.6
2007-08-02 11:06 <DIR> d——– C:\Program Files\Windows Live Safety Center
2007-08-01 15:54 <DIR> d——– C:\DOCUME~1\Zopfi\APPLIC~1\Lavasoft
2007-08-01 15:49 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-08-01 15:48 164 –a—— C:\install.dat
2007-08-01 15:48 <DIR> d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-01 15:38 <DIR> d——– C:\WINDOWS\system32\GroupPolicy
2007-08-01 15:38 <DIR> d——– C:\Program Files\Hitman Pro
2007-07-31 17:28 5 –a—— C:\WINDOWS\lnk_dados_1.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-20 17:26 ——— d——– C:\DOCUME~1\Zopfi\APPLIC~1\Google
2007-06-20 17:25 ——— d——– C:\Program Files\Google
2007-05-29 21:30 376 –a—— C:\WINDOWS\mozregistry.dat
2007-05-16 17:19 86528 –a–c— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:19 85504 –a–c— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:19 683520 –a–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:19 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:19 510976 –a–c— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:19 1314816 –a–c— C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-08 11:01 3583488 –a–c— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-03-20 21:24 128 –a—— C:\Program Files\14370217.PAS
2007-03-20 21:23 116 –a—— C:\Program Files\14109197.PAS

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-21 09:11]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2003-12-31 17:39]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-19 17:47]
"7u560"="C:\WINDOWS\Media\7u560.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 20:28]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-10-21 16:22:25]
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]

R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
R3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys
S3 GMSIPCI;GMSIPCI;\??\F:\INSTALL\GMSIPCI.SYS
S3 MTD80X;Myson MTD80X Based 100/10 PCI Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\MTD80X.SYS

*Newly Created Service* - TMCOMM

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-03 15:05:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-03 15:06:57

— E O F —

Anoniem 3 augustus 2007 13:11

Hoi,

Je hebt de instructies niet goed uitgevoerd. Zorg ervoor dat je het kladblok bestand [b:d7d86a6167]opslaat[/b:d7d86a6167] op je [b:d7d86a6167]Bureaublad[/b:d7d86a6167] en dan CFscript in combofix sleept. Je hebt er nu een snelkoppeling van gemaakt en dan werkt het niet

Succes!

Pim 8)

Anoniem 3 augustus 2007 18:46

Oké,
ogenschijnlijk doet de computer hetzelfde als vorige keer. Onderstaand wederom de Hijackthislog en de combofixlog.

Logfile of HijackThis v1.99.1
Scan saved at 13:39:09, on 4-8-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Software\hijackthis_199\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [7u560] C:\WINDOWS\Media\7u560.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader4.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

ComboFix 07-08-03.4 - "Zopfi" 2007-08-04 13:34:40.2 [GMT 2:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.Waar
Command switches used :: C:\Documents and Settings\Zopfi\Bureaublad\CFScript.txt.txt
* Created a new restore point

((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 )))))))))))))))))))))))))))))))

2007-08-03 15:02 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-03 12:05 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-08-03 11:22 <DIR> d——– C:\DOCUME~1\Zopfi\.housecall6.6
2007-08-02 11:06 <DIR> d——– C:\Program Files\Windows Live Safety Center
2007-08-01 15:54 <DIR> d——– C:\DOCUME~1\Zopfi\APPLIC~1\Lavasoft
2007-08-01 15:49 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-08-01 15:48 164 –a—— C:\install.dat
2007-08-01 15:48 <DIR> d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-01 15:38 <DIR> d——– C:\WINDOWS\system32\GroupPolicy
2007-08-01 15:38 <DIR> d——– C:\Program Files\Hitman Pro
2007-07-31 17:28 5 –a—— C:\WINDOWS\lnk_dados_1.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-20 17:26 ——— d——– C:\DOCUME~1\Zopfi\APPLIC~1\Google
2007-06-20 17:25 ——— d——– C:\Program Files\Google
2007-05-29 21:30 376 –a—— C:\WINDOWS\mozregistry.dat
2007-05-16 17:19 86528 –a–c— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:19 85504 –a–c— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:19 683520 –a–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:19 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:19 510976 –a–c— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:19 1314816 –a–c— C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-08 11:01 3583488 –a–c— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-03-20 21:24 128 –a—— C:\Program Files\14370217.PAS
2007-03-20 21:23 116 –a—— C:\Program Files\14109197.PAS

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-21 09:11]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2003-12-31 17:39]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-19 17:47]
"7u560"="C:\WINDOWS\Media\7u560.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 20:28]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-10-21 16:22:25]
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]

R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
R3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys
S3 GMSIPCI;GMSIPCI;\??\F:\INSTALL\GMSIPCI.SYS
S3 MTD80X;Myson MTD80X Based 100/10 PCI Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\MTD80X.SYS

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-04 13:36:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

C:\WINDOWS\system32\cmd.exe [2088] 0x81A38A08

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-04 13:37:49
C:\ComboFix2.txt … 2007-08-03 15:06

— E O F —

Anoniem 4 augustus 2007 11:40

Nog niet helemaal goed. Het bestandje heet nu:
:\Documents and Settings\Zopfi\Bureaublad\[b:ce3d313bb2]CFScript.txt.txt [/b:ce3d313bb2]
Rename deze tot CFScript.txt

Pim

Anoniem 4 augustus 2007 15:51

Pim, bedankt voor je engelen geduld. En dat vlak voor je vakantie.
Nogmaals een poging:

Combofixlog:
ComboFix 07-08-03.4 - "Zopfi" 2007-08-05 10:02:40.3 [GMT 2:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1043.18.Waar
Command switches used :: C:\Documents and Settings\Zopfi\Bureaublad\CFScript.txt
* Created a new restore point

((((((((((((((((((((((((( Files Created from 2007-07-05 to 2007-08-05 )))))))))))))))))))))))))))))))

2007-08-03 15:02 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-03 12:05 76,560 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2007-08-03 11:22 <DIR> d——– C:\DOCUME~1\Zopfi\.housecall6.6
2007-08-02 11:06 <DIR> d——– C:\Program Files\Windows Live Safety Center
2007-08-01 15:54 <DIR> d——– C:\DOCUME~1\Zopfi\APPLIC~1\Lavasoft
2007-08-01 15:49 626,688 –a—— C:\WINDOWS\system32\msvcr80.dll
2007-08-01 15:48 164 –a—— C:\install.dat
2007-08-01 15:48 <DIR> d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-01 15:38 <DIR> d——– C:\WINDOWS\system32\GroupPolicy
2007-08-01 15:38 <DIR> d——– C:\Program Files\Hitman Pro
2007-07-31 17:28 5 –a—— C:\WINDOWS\lnk_dados_1.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-20 17:26 ——— d——– C:\DOCUME~1\Zopfi\APPLIC~1\Google
2007-06-20 17:25 ——— d——– C:\Program Files\Google
2007-05-29 21:30 376 –a—— C:\WINDOWS\mozregistry.dat
2007-05-16 17:19 86528 –a–c— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 17:19 85504 –a–c— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 17:19 683520 –a–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 17:19 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 17:19 510976 –a–c— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 17:19 1314816 –a–c— C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-08 11:01 3583488 –a–c— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-03-20 21:24 128 –a—— C:\Program Files\14370217.PAS
2007-03-20 21:23 116 –a—— C:\Program Files\14109197.PAS

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-09-22 10:42 C:\WINDOWS\soundman.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-21 09:11]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2003-12-31 17:39]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-19 17:47]
"7u560"="C:\WINDOWS\Media\7u560.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 20:28]

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-10-21 16:22:25]
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]
Adobe Reader Snelle start.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]

R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe
R3 Ptserlp;PCTEL Serial Device Driver for PCI;C:\WINDOWS\system32\DRIVERS\ptserlp.sys
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys
S3 GMSIPCI;GMSIPCI;\??\F:\INSTALL\GMSIPCI.SYS
S3 MTD80X;Myson MTD80X Based 100/10 PCI Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\MTD80X.SYS

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-05 10:04:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

C:\WINDOWS\system32\cmd.exe [452] 0x82252340

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-05 10:05:44
C:\ComboFix2.txt … 2007-08-04 13:37
C:\ComboFix3.txt … 2007-08-03 15:06

— E O F —

Hijackthislog:
Logfile of HijackThis v1.99.1
Scan saved at 10:08:06, on 5-8-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Software\hijackthis_199\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [7u560] C:\WINDOWS\Media\7u560.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader4.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Ik hoop dat het nu klopt…

Anoniem 5 augustus 2007 08:09

Hmm, dat is gek, op de één of andere manier heeft het niet gewerkt :-?

Probeer het volgende eens:

Download Killbox naar je bureaublad.
Klik op killbox.exe.
Selecteer de optie "[b:188f044726]Delete on reboot[/b:188f044726]".
In het veld "Full Path of File to Delete" kopieer en plak je het volgende:
[b:188f044726]
C:\WINDOWS\Media\7u560.exe
[/b:188f044726]
Klik op de knop: [b:188f044726]single file[/b:188f044726] (!Belangrijk!)

Daarna, Klik op de rode cirkel met het wit kruisje erin.
Killbox zal zeggen dat deze file zal verwijderd worden on reboot.. vraagt om nu te rebooten. Klik YES.

Je pc moet nu herstarten.

Plaats een Hijackthis log ter controle.

Succes

Anoniem 5 augustus 2007 11:52

De computer geeft een melding:
OendingFileRenameOperations Registry Data has been Removed by External Process.

De computer start daarna niet opnieuw op. Ik ben dan maar uit programma Killbox gegaan.

Hieronder nieuw Hijackthislog:

Logfile of HijackThis v1.99.1
Scan saved at 17:47:32, on 5-8-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Software\hijackthis_199\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [7u560] C:\WINDOWS\Media\7u560.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader4.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914090/activex/IPSUploader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Anoniem 5 augustus 2007 15:46

Hoi Twan,

Ik heb voor me vakantie geen tijd meer om ernaar te kijken, ik zal een andere helper vragen om het van me over te nemen.

We komen er wel uit!

Pim

Anoniem 5 augustus 2007 18:42

Dag Twan,

Probeer dit eens:
Download KillAFile.exe en plaats het op je bureaublad: http://users.telenet.be/marcvn/tools/KillAFile.exe
Dubbelklik op KillAFile.exe om de tool te starten.
In het keuzemenu kies je voor optie 1:
1: Delete a file on reboot
Wanneer deze melding verschijnt
[code:1:4f406a1d72]Insert full path and filename to delete.
and then press enter: [/code:1:4f406a1d72]
tik je dit in: [b:4f406a1d72]C:\WINDOWS\Media\7u560.exe [/b:4f406a1d72]
Indien het bestandje aanwezig is, zal de computer vragen om te herstarten.
Sta dit toe.
Wanneer de computer opnieuw opgestart is, opent er een kladblokbestandje. Post de inhoud van dit bestand samen met een nieuwe hijackthislog.

Anoniem 5 augustus 2007 18:51

Beantwoord deze vraag

Dit is een gearchiveerde pagina. Antwoorden is niet meer mogelijk.

Vraag & Antwoord

mailtjes met onderwerp: Essa vai dEixar o Seu Dia MelhO

Beantwoord deze vraag

Gerelateerde vragen

Inloggen

Registreren

We hebben je een e-mail gestuurd!

Oops… er ging wat mis.

Hoera, je account is nu geactiveerd!

Dit token is niet meer valide.

Wachtwoord vergeten?

Je aanvraag is verstuurd

Wachtwoord herstellen

Wachtwoord herstellen

Dit token is niet meer valide.

Bedankt!

Je vraag is geplaatst!

Je antwoord is geplaatst!

Bevestigingsmail verstuurd!

Cookies op Reshift websites

Wij maken gebruik van cookies, en dit doen we:

Waarom moet je eigenlijk akkoord gaan met cookies?

Geen cookie ondersteuning