download de aproposfix:

http://swandog46.geekstogo.com/aproposfix.exe

dubbelklik op aproposfix.exe en unzip het naar je bureaublad. Gebruik het
nog niet.. Start de computer op in Veilige modus

- Op je bureaublad zoek je de map aproposfix.
- In deze map staat een bestandje dat RunThis.bat heet.
- Dubbelklik er op en volg de instructies.

Wanneer het tooltje klaar is, herstart je de computer in normale modus.

- Open de map aproposfix weer en zoek naar log.txt.
- Plaats de inhoud daarvan even hier..

Greetz chrizz

ik heb de scan gedaan en dit kreeg ik:
Log of AproposFix v1

************

Running from directory:
C:Documents and Settingswendy en marcoBureaubladaproposfix

************

Registry entries found:

[HKEY_LOCAL_MACHINESoftwareC1iOrAD6egtm]
@="\CPpGQIYZZYZZaZmxo0\.yYZZYobZ4uzp
40ZQWQRCKfeZBPGTCPQZNAKQAFCBaQWQ"
"Device"="\\.\ALCSPQM"
"DriverPath"="C:\WINDOWS\system32\drivers\pcmsched.sys"
"DriverName"="PerDisk"
"HideUninstallerName"="C:\Program
Files\Reaahead\dmrkbdsf.exe"
"UninstallerPath"="C:\WINDOWS\system32\glmrv42a.exe"
"UninstallerRegKey"="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D99003B0-5D7A-421E-8F10-D67806FF05A6}"
"UninstallerParams"="/CTUN"
"HDll"="C:\WINDOWS\system32\msrreate.dll"
"ServerAddress"="adchannel.contextplus.net"
"LegalNote"="http://adchannel.contextplus.net/legal-note/nonbranded.html"
"PartnerId"="CP.IST2"
"InstallationId"="{X4823d0c-30c1-2e8a-b804-81a764e3bae0}"
"PageFiltering"=dword:00000001
"ClientName"="C:\Program Files\Reaahead\keytheme.exe"

************

Removing hidden service:
Service PerDisk removed.

Removing hidden folder:
Deletion of folder Reaahead succeeded!

Deleting files:

Deletion of file C:WINDOWSsystem32driverspcmsched.sys
succeeded!
Deletion of file C:WINDOWSsystem32dhcpxspx.exe succeeded!
Deletion of file C:WINDOWSsystem32msrreate.dll succeeded!
Deletion of file C:WINDOWSsystem32glmrv42a.exe succeeded!

Backing up files:
Done!

Removing registry entries:

REGEDIT4

[-HKEY_CURRENT_USERSoftwareC1iOrAD6egtm]
[-HKEY_LOCAL_MACHINESoftwareC1iOrAD6egtm]
[-HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{D99003B0-5D7A-421E-8F10-D67806FF05A6}]

Done!

Finished!

ik hoop dat je mij kunt helpen

greetz marco

Hey..

Je had Inderdaad oNder andere een apropos->infectie
Apropos is echter verwijdert maar het was niet je enige infectie.

FiX:

Zet in mapopties (start-configuratiescherm-extra-mapopties-weergave)
een vinkje bij 'Verborgen bestanden en mappen weergeven' en haal het
vinkje weg bij 'Extensies voor bekende bestandstypen verbergen'. Omdat je
deze fix in veilige modus gaat uitvoeren, raad ik je aan dit even uit te printen
of op te slaan in een tekstdocumentje.


1.Download Hijackthis

--> http://www.majorgeeks.com/download3155.html

--> http://www.spywareinfo.com/~merijn/downloads.html

2.Open hijackthis en run het , dat duurt circa 1 minuut.Bewaar de
logfile die volgt en post die hier.

3.Start op in veilige modus, dat doe je door bij het opstarten de hele
tijd de F-8 Knop in te drukken

4.Leeg je Temp-Mappen
Bij windows XP delete de inhoud van de volgende mappen:
- C:Documents and SettingsGebruikersnaamLocal SettingsTemporary
Internet FilesContent.IE5
- C:Documents and SettingsGebruikersnaamLocal SettingsTemp
- C:Documents and SettingsGebruikersnaamOnlangs geopend
C:WindowsTemp
- C:Windowsprefetch

NB. Leeg van deze prefetchmap alleen de data ouder dan 1 week, omdat
anders je het omgekeerde effect krijgt. Te weten, je PC wordt alsmaar
trager.

Als je ook gebruik maakt van MS Office dan kan je bij Windows XP ook de
inhoud deleten van de map:
C:Documents and SettingsGebruikersnaamApplication
DataMicrosoftOfficeRecent

NB. Bij het legen van sommige mappen zal je PC aangeven dat hij het
bestand index.dat niet kan verwijderen, dit is in orde.

5. schoon je tijdelijke internet bestanden op:
Het opschonen van tijdelijke internetbestanden. Ga naar Start -->
Configuratiescherm --> Internetopties --> tabblad 'Algemeen':
- Cookies verwijderen.
- Internetbestanden (incl. offline) verwijderen.
- Geschiedenis wissen

6.Download de ewido malware suite:
http://www.ewido.net/en/

7.Post de logje van hijackthis en ewido malware suite

Succes..

greetz chrizz

Beste lezers,

Ook ik heb de zelfde melding gekregen als het bovenstaande verhaal:

virus alert the error was likely caused by a computer virus that is know by
the following names:
win32/apropos.b
winNT/Zufyx.A
spyware.apropos.C
trojan.win32.Crypt.t

Ik heb aproposfix gedownload en in de veilige module laten draaien.
mijn log.txt gaf het volgende weer:
Log of AproposFix v1.1

************

Running from directory:
C:Documents and Settingsmike kuipersBureaubladaproposfix

************


Registry entries found:

[HKEY_LOCAL_MACHINESoftwareC7XO8A0mcRn5]
@="4:\215qABBABBCBr os1qGABBAQDBkWbRckgB2823s
HGBr1w5s12B6o\z3 u1C282"
"Device"="\\.\dmaerc2"
"DriverPath"="C:\WINDOWS\system32\drivers\wanltmgr.sys"
"DriverName"="upnsrvc"
"HideUninstallerName"="C:\Program Files\Pixpress\icwemeui.exe"
"UninstallerPath"="C:\WINDOWS\system32\cousbkup.exe"
"UninstallerRegKey"="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wi
ndows\CurrentVersion\Uninstall\{885DE54A-318B-4625-AA0F-
39D868E82ED6}"
"UninstallerParams"="/CTUN"
"HDll"="C:\WINDOWS\system32\dumtsddd.dll"
"ServerAddress"="adchannel.contextplus.net"
"LegalNote"="http://adchannel.contextplus.net/legal-note/nonbranded.html"
"PartnerId"="CP.IST2"
"InstallationId"="{X2007222-880c-17a9-a972-1dc8f8c503db}"
"PageFiltering"=dword:00000001
"CrMnTmt"=dword:0036ee80

************

Removing hidden service:
Service upnsrvc removed.

Removing hidden folder:
Deletion of folder Pixpress succeeded!

Deleting files:

Deletion of file C:WINDOWSsystem32driverswanltmgr.sys succeeded!
Deletion of file C:WINDOWSsystem32tfterror.exe succeeded!
Deletion of file C:WINDOWSsystem32dumtsddd.dll succeeded!
Deletion of file C:WINDOWSsystem32cousbkup.exe succeeded!

Backing up files:
Done!

Removing registry entries:

REGEDIT4

[-HKEY_CURRENT_USERSoftwareC7XO8A0mcRn5]
[-HKEY_LOCAL_MACHINESoftwareC7XO8A0mcRn5]
[-
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
Uninstall{885DE54A-318B-4625-AA0F-39D868E82ED6}]

Done!

Finished!

Uit het bovenstaande bericht las ik dat er nog meer handelingen gedaan
moesten worden om het probleem op te lossen.
Aan gezien mijn log.txt iets anders is, ga ik er vanuit dat er bij mijn pc
andere handelingen gedaan moeten worden.

Kunnen jullie mij veder helpen?

probeer evt. deze instructie-set:
http://www.ludocools.info/Security/index.htm

Hoi .. Chris weer( me vorige post is op 1 of andere manier niet
doorgekomen) Excuses hiervoor..

Voer eerst de handelingen hierboven uit,Van hijackthis,Zonder dat
programma kunnen we het niet wegkrijgen Post dan het logje van
hijackthis en ik zal verder voor je kijken.

Greetz chriz

hey, ik heb ook hetzelfde probleem gehad en heb de fix eroverheen
gegooid met onderstaande log:
Log of AproposFix v1.1

************

Running from directory:
C:Documents and SettingsRoelBureaubladaproposfixaproposfix

************


Registry entries found:

[HKEY_LOCAL_MACHINESoftwareCpiX7A2EgW9m]
@="W431u88GHHGHHIH8ywmnilGHHGWJHqchXiqmH8E89y2NMHx7.By7
8HA5x 5OOKI8E8"
"Device"="\\.\secSTOR"
"DriverPath"="C:\WINDOWS\system32\drivers\updgp440.sys"
"DriverName"="Conlass"
"HideUninstallerName"="C:\Program Files\D-lrplus\ifsrle32.exe"
"UninstallerPath"="C:\WINDOWS\system32\nv4chdog.exe"
"UninstallerRegKey"="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wi
ndows\CurrentVersion\Uninstall\{1ED2BF48-66F0-4B7A-8CBE-
725DBA7471C4}"
"UninstallerParams"="/CTUN"
"HDll"="C:\WINDOWS\system32\slraccrc.dll"
"ServerAddress"="adchannel.contextplus.net"
"LegalNote"="http://adchannel.contextplus.net/legal-note/nonbranded.html"
"PartnerId"="CP.IST2"
"InstallationId"="{X2b9d0cf-3cdd-4456-731b-861900cae16e}"
"PageFiltering"=dword:00000001
"CrMnTmt"=dword:0036ee80

************

Removing hidden service:
Service Conlass removed.

Removing hidden folder:
Deletion of folder D-lrplus succeeded!

Deleting files:

Deletion of file C:WINDOWSsystem32driversupdgp440.sys succeeded!
Deletion of file C:WINDOWSsystem32tskdyctl.exe succeeded!
Deletion of file C:WINDOWSsystem32slraccrc.dll succeeded!
Deletion of file C:WINDOWSsystem32nv4chdog.exe succeeded!

Backing up files:
Done!

Removing registry entries:

REGEDIT4

[-HKEY_CURRENT_USERSoftwareCpiX7A2EgW9m]
[-HKEY_LOCAL_MACHINESoftwareCpiX7A2EgW9m]
[-
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
Uninstall{1ED2BF48-66F0-4B7A-8CBE-725DBA7471C4}]

Done!

Finished!

Kunnen jullie hierin zien of dit apropos ook daadwerkelijk weg is? ook heb
ik hier een hijack this log aangezien ik ook nog een ander spyware
bestand heb wat ik niet weg krijg en ik me afvroeg of jullie misschien
konden helpen. Ook heb ik mijn temp mappen en dergelijke al
opgeschoont zoals hierboven vermeldt werd.

Logfile of HijackThis v1.99.0
Scan saved at 23:00:41, on 8-2-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1GrisoftAVG7avgamsvr.exe
C:PROGRA~1GrisoftAVG7avgupsvc.exe
C:WINDOWSsystem32CTsvcCDA.EXE
C:Program Filesewidosecurity suiteewidoctrl.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:Program FilesQuickTimeqttask.exe
C:Program FilesD-Toolsdaemon.exe
C:Program FilesJavajre1.5.0_06binjusched.exe
C:WINDOWSsystem32rundll32.exe
C:PROGRA~1GrisoftAVG7avgcc.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCreativeMediaSourceDetectorCTDetect.exe
C:Program FilesMicrosoft AntiSpywaregcasDtServ.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesMSN Messengermsnmsgr.exe
c:progra~1intern~1iexplore.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesD-Link AirPlusAirPlus.exe
C:WINDOWSsystem32msiexec.exe
C:Program FilesInternet Exploreriexplore.exe
C:Documents and
SettingsRoelBureaubladSnelkoppelingenHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.hotmail.com/
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.hotmail.com
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName
= Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-
7695ECA05670} - C:Program FilesYahoo!
CompanionInstallscpnycomp5_3_19_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:Program FilesAdobeAcrobat 6.0
ReaderActiveXAcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-
D4DAF1D92D43} - C:Program FilesJavajre1.5.0_06binssv.dll
O2 - BHO: (no name) - {8C671E02-D8E5-2F5E-BB55-4054C937709D} -
C:DOCUME~1RoelAPPLIC~1PlusThisPoll Data.exe (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-
CF10577473F7} - c:program filesgooglegoogletoolbar2.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-
0090271D4F88} - C:Program FilesYahoo!
CompanionInstallscpnycomp5_3_19_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE
C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE
C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [QuickTime Task] "C:Program
FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32
NeroCheck.exe
O4 - HKLM..Run: [DAEMON Tools-1033] "C:Program FilesD-
Toolsdaemon.exe" -lang 1033
O4 - HKLM..Run: [SunJavaUpdateSched] C:Program
FilesJavajre1.5.0_06binjusched.exe
O4 - HKLM..Run: [BluetoothAuthenticationAgent] rundll32.exe
bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVG7
avgcc.exe /STARTUP
O4 - HKLM..Run: [Active Help 2 Trans] C:Documents and SettingsAll
UsersApplication DatagrimcornactivehelpDraw Ford.exe
O4 - HKLM..Run: [gcasServ] "C:Program FilesMicrosoft
AntiSpywaregcasServ.exe"
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [Creative Detector] C:Program
FilesCreativeMediaSourceDetectorCTDetect.exe /R
O4 - HKCU..Run: [Sixth Book] C:DOCUME~1RoelAPPLIC~1SECTDA~1
One Free.exe
O4 - HKCU..Run: [msnmsgr] "C:Program FilesMSN
Messengermsnmsgr.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:Program FilesCommon
FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 - Startup: Stardock ObjectDock.lnk = C:Program
FilesStardockObjectDockObjectDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program
FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:program
filesgoogleGoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:program
filesgoogleGoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:program
filesgoogleGoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:program
filesgoogleGoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:program
filesgoogleGoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English -
res://c:program filesgoogleGoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:Program FilesJavajre1.5.0_06binssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-
AAA5-00401C608501} - C:Program FilesJavajre1.5.0_06binssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-
3C9C571A8263} - D:PROGRA~1MICROS~1OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-
BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers
Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC}
(MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab30149
.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows
Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?
linkid=48835
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper
Flags Class) -
http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo
Upload Tool) -
http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live
Safety Center Base Module) -
https://scan.safety.live.com/resource/download/scanner/en-
us/wlscbase3401.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}
(MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.c
ab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMessengerSetupDownloader.ca
b
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro
Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess
Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire
Showdown Class) -
http://messenger.zone.msn.com/binary/SolitaireShowdown.cab30149.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
"C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:Program
FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:PROGRA~1
GrisoftAVG7avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:PROGRA~1
GrisoftAVG7avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology
Ltd - C:WINDOWSsystem32CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:Program
Filesewidosecurity suiteewidoctrl.exe
O23 - Service: InstallDriver Table Manager - Macrovision Corporation -
C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:Program
FilesCommon FilesMacromedia SharedServiceMacromedia
Licensing.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation -
C:WINDOWSsystem32nvsvc32.exe
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:Program
FilesAnalog DevicesSoundMAXSMAgent.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:Program
FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe

Ewido log volgt nog

Hier mijn ewido scanlog als toevoeging op mijn eerdere reactie:
---------------------------------------------------------
ewido security suite - Scan rapport
---------------------------------------------------------

+ Gemaakt op: 23:55:38, 8-2-2006
+ Rapport samenvatting: 7290D67

+ Scan resultaten:

:mozilla.37:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Doubleclick : Schoongemaakt zonder backup
:mozilla.72:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Yieldmanager : Schoongemaakt zonder backup
:mozilla.75:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Yieldmanager : Schoongemaakt zonder backup
:mozilla.76:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Yieldmanager : Schoongemaakt zonder backup
:mozilla.77:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Yieldmanager : Schoongemaakt zonder backup
:mozilla.78:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Yieldmanager : Schoongemaakt zonder backup
:mozilla.79:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Yieldmanager : Schoongemaakt zonder backup
:mozilla.84:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.2o7 : Schoongemaakt zonder backup
:mozilla.88:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Atdmt : Schoongemaakt zonder backup
:mozilla.95:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Hitbox : Schoongemaakt zonder backup
:mozilla.102:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Onestat : Schoongemaakt zonder backup
:mozilla.103:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Onestat : Schoongemaakt zonder backup
:mozilla.104:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Onestat : Schoongemaakt zonder backup
:mozilla.106:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Adjuggler : Schoongemaakt zonder backup
:mozilla.107:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Adjuggler : Schoongemaakt zonder backup
:mozilla.112:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Statcounter : Schoongemaakt zonder backup
:mozilla.113:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Statcounter : Schoongemaakt zonder backup
:mozilla.114:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Falkag : Schoongemaakt zonder backup
:mozilla.115:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Falkag : Schoongemaakt zonder backup
:mozilla.116:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Falkag : Schoongemaakt zonder backup
:mozilla.117:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Falkag : Schoongemaakt zonder backup
:mozilla.138:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Advertising : Schoongemaakt zonder backup
:mozilla.139:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Valueclick : Schoongemaakt zonder backup
:mozilla.140:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Tribalfusion : Schoongemaakt zonder backup
:mozilla.142:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Smartadserver : Schoongemaakt zonder backup
:mozilla.143:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Smartadserver : Schoongemaakt zonder backup
:mozilla.144:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Smartadserver : Schoongemaakt zonder backup
:mozilla.153:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Sitestat : Schoongemaakt zonder backup
:mozilla.154:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Sitestat : Schoongemaakt zonder backup
:mozilla.155:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Spylog : Schoongemaakt zonder backup
:mozilla.164:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Com : Schoongemaakt zonder backup
:mozilla.165:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Com : Schoongemaakt zonder backup
:mozilla.173:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Serving-sys : Schoongemaakt zonder backup
:mozilla.174:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Serving-sys : Schoongemaakt zonder backup
:mozilla.175:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Serving-sys : Schoongemaakt zonder backup
:mozilla.176:C:Documents and SettingsRoelApplication
DataMozillaFirefoxProfilestwvl96bt.defaultcookies.txt
-> Spyware.Cookie.Serving-sys : Schoongemaakt zonder backup
C:Documents and SettingsRoelCookiesroel@atdmt[2].txt ->
Spyware.Cookie.Atdmt : Schoongemaakt zonder backup
C:Documents and SettingsRoelCookiesroel@http://www.lop[1].txt
-> Spyware.Cookie.Lop : Schoongemaakt zonder backup


::Einde rapport

hopelijk kunnen jullie mij hierbij verder helpen,

Mvg,

Ralph

In hijackthis aanvinken:

R3 - Default URLSearchHook is missing

wil je het vetgedrukte bestand eens scannen bij Jotti? www.jotti.org

:Documents and SettingsAll
UsersApplication DatagrimcornactivehelpDraw Ford.exe

Doe ook nog even een scan bij panda:{bewaar het logfile}

http://www.pandasoftware.com/products/activescan?
NRMODE=Published&NRORIGINALURL=%2fproducts%2factivescan%
2f&NRNODEGUID=%7b9859722A-7EA6-4C60-9B11-0EE3DE16CB4F%
7d&NRCACHEHINT=Guest

Hoe is het met je problemen? :D

GreetZ ChRiZz..

ik wil jullie allemaal een compliment maken voor alle hulp die jullie hier
geven.
Persoonlijk heb ik die nog niet nodig gehad, gelukkig.
Maar petje af.....dat jullie iedereen weer zo goed op weg proberen te
helpen.

Groetjes van een trouwe lezer

Beste mensen,

Hou er rekening mee, dat een virus verwijderen op een XP/Me machine
betekent, dat je System Restore moet uitschakelen. Doe je dat niet, dan
wordt een kopie van het viraal bestand gewoon opgeslagen. Na het
schoonmaken je System Restore weer aanzetten.

Mijn HijackThis.Log:

Logfile of HijackThis v1.99.1
Scan saved at 17:42:18, on 18-2-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program Filesewido anti-malwareSecuritySuite.exe
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSexplorer.exe
C:Documents and SettingspascalBureaubladaproposfixHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.google.nl/
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.google.nl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet
Settings,ProxyOverride = localhost
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName
=
R3 - URLSearchHook: {1A03F196-9617-4CA0-842B-A83CEECB022B} - -
(no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-
CF10577473F7} - c:program filesgooglegoogletoolbar1.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-
FADC6B084872} - C:Program FilesNorton SystemWorksNorton
AntivirusNavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-
7859DF00B1D6} - C:Program FilesNorton SystemWorksNorton
AntivirusNavShExt.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
(no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:program filesgooglegoogletoolbar1.dll
O4 - HKLM..Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM..Run: [AudioDeck] C:Program
FilesVIAudioiSBADeckADeck.exe 1
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec
SharedccApp.exe"
O4 - HKLM..Run: [AcctMgr] C:Program FilesNorton
SystemWorksPassword ManagerAcctMgr.exe /startup
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1
SNDMon.exe /Consumer
O4 - HKLM..Run: [Lexmark X1100 Series] "C:Program FilesLexmark
X1100 Serieslxbkbmgr.exe"
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32
NeroCheck.exe
O4 - HKLM..Run: [MessengerPlus3] "C:Program FilesMessengerPlus! 3
MsgPlus.exe"
O4 - HKLM..Run: [MSConfig]
C:WINDOWSPCHealthHelpCtrBinariesMSConfig.exe /auto
O4 - HKLM..Run: [AdwareAlert] C:Program
FilesAdwareAlertadwarealert.Exe -boot
O4 - HKCU..Run: [Shareaza] "C:Program FilesShareazaShareaza.exe" -
tray
O4 - HKCU..Run: [IncrediMail] C:PROGRA~1INCRED~1binIncMail.exe /c
O4 - Global Startup: Utility Tray.lnk = C:WINDOWSsystem32sistray.exe
O8 - Extra context menu item: &Google Zoeken - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search -
http://bar.mywebsearch.com/menusearch.html?p=ZR
O8 - Extra context menu item: &Woord vertalen in het Nederlands -
res://C:Program FilesGoogleGoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Gelijkwaardige pagina's - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de
pagina - res://C:Program FilesGoogleGoogleToolbar1.dll/cmcache.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-
11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers
Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper
Flags Class) -
http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo
Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows
Live Safety Center Base Module) -
https://scan.safety.live.com/resource/download/scanner/en-
us/wlscbase3401.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}
(MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.c
ab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMessengerSetupDownloader.ca
b
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
(PopCapLoader Object) -
http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits
Software XUpload) - http://www.hema.nl/SITE/xupload/XUpload.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat
Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
"C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O18 - Protocol: vskype - (no CLSID) - (no file)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec
Corporation - C:Program FilesCommon FilesSymantec
SharedccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:Program FilesCommon FilesSymantec
SharedccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
Corporation - C:Program FilesCommon FilesSymantec
SharedccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:Program
Filesewido anti-malwareewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
C:WINDOWSsystem32LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec
Corporation - C:Program FilesNorton SystemWorksNorton
Antivirusnavapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec
Corporation - C:PROGRA~1NORTON~1NORTON~2NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:Program FilesNorton
SystemWorksNorton AntivirusSAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
O23 - Service: SmartLinkService (SLService) - Smart Link -
C:WINDOWSSYSTEM32slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:Program FilesCommon FilesSymantec
SharedSNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:PROGRA~1
NORTON~1NORTON~2SPEEDD~1NOPDB.EXE
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation -
C:Program FilesCommon FilesSymantec SharedSecurity
CenterSymWSC.exe

Vorige keer is mijn reactie blijkbaar niet langs de
moderators gekomen. In ieder geval werd in het DrawFord.exe
bestand een aantal spyware/virus bestanden gevonden. Kan ik
deze file gewoon deleten of heb ik daarvoor een bepaalde
scanner nodig. Mijn panda log gaf ook een probleem aan maar
die scan moet ik even opnieuw doen.

Mvg,

Ralph

Hoi.

Als je inlogt op je eigen naam, of 1 aanmaakt,kan je altijd posten:)

Wil je dat bestand nog eens laten scannen en het logje bewaren (kopieren
plakken) want ik weetniet of je het mag verwijderen voordat ik het jotti logje
heb gesien :)

Greetz chrizz

hey ik heb een scan gedaan met"hijacktis" omdat ik ook dat virus heb
trojan.win32.crypt.t en ik ga nu men log posten en als iemand me kan
laten weten wat ik mag verwijderen(ik wil namelijks niets misdoen het is
pc van broer) enz! thx!!

Logfile of HijackThis v1.99.1
Scan saved at 16:24:46, on 16/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesNorton SystemWorksNorton GoBackGBPoll.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:Program FilesNorton SystemWorksNorton AntiVirusnavapsvc.exe
C:Program FilesEsetnod32krn.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesJavajre1.5.0_05binjusched.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:Program FilesNorton SystemWorksNorton AntiVirusIWPNPFMntor.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:PROGRA~1NORTON~1NORTON~1NPROTECT.EXE
C:WINDOWSsystem32rundll32.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesQuickTimeqttask.exe
C:Program FilesCommon FilesLogitechQCDriver2LVCOMS.EXE
C:Program FilesHighCriteriaTotalRecorderTotRecSched.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMSN MessengerMsnMsgr.Exe
C:WINDOWSsystem32NotifyPhoneBook.exe
C:DOCUME~1User01MIJNDO~1YMBOLS~1explorer.exe
C:WINDOWS??semblyw?aclt.exe
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesSpyware Doctorsdhelp.exe
C:Program FilesHewlett-PackardDigital Imagingbinhpohmr08.exe
C:Program FilesHewlett-PackardDigital Imagingbinhpotdd01.exe
C:Program FilesNorton SystemWorksNorton GoBackGBTray.exe
C:Documents and SettingsUser01BureaubladSOF2 programma's en
andereQ3E Minimizer_v1.45.EXE
C:PROGRA~1NORTON~1NORTON~1SPEEDD~1NOPDB.EXE
C:Program FilesOpenOffice.org 2.0programsoffice.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesWebrootSpy SweeperWRSSSDK.exe
C:Program FilesOpenOffice.org 2.0programsoffice.BIN
C:Program FilesHewlett-PackardDigital Imagingbinhpoevm08.exe
C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
C:WINDOWSsystem32wscntfy.exe
C:WINDOWSsystem32HPZipm12.exe
C:Program FilesHewlett-PackardDigital ImagingBinhpoSTS08.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Documents and SettingsUser01BureaubladhijackthisHijackThis.exe
C:Program FilesMessengermsmsgs.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://www.google.be/
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,SearchURL =
prosearching.com
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL
= prosearching.com
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page =
prosearching.com
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
prosearching.com
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,SearchURL =
prosearching.com
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
about:blank
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak =
prosearching.com
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
prosearching.com
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page_bak =
prosearching.com
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName
= Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:Program FilesAdobeAcrobat 7.0
ActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-
7859DF00B1D6} - C:Program FilesNorton SystemWorksNorton
AntiVirusNavShExt.dll
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [SunJavaUpdateSched] C:Program
FilesJavajre1.5.0_05binjusched.exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32
NeroCheck.exe
O4 - HKLM..Run: [RemoteControl] "C:Program
FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec
SharedccApp.exe"
O4 - HKLM..Run: [CloseDNF] C:WINDOWSsystem32Utility.exe 1008
O4 - HKLM..Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1
SNDMon.exe /Consumer
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE
C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE
C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [QuickTime Task] "C:Program
FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [LVCOMS] C:Program FilesCommon
FilesLogitechQCDriver2LVCOMS.EXE
O4 - HKLM..Run: [TotalRecorderScheduler] "C:Program
FilesHighCriteriaTotalRecorderTotRecSched.exe"
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN
MessengerMsnMsgr.Exe" /background
O4 - HKCU..Run: [NBJ] "C:Program FilesAheadNero BackItUpNBJ.exe"
O4 - HKCU..Run: [18Wheels_of_Steel.exe] C:DOCUME~1User01
BUREAU~118WHEE~1.EXE /r
O4 - HKCU..Run: [Bset] "C:DOCUME~1User01MIJNDO~1YMBOLS~1
explorer.exe" -vt yazr
O4 - HKCU..Run: [Vumzg] C:WINDOWS??semblyw?aclt.exe
O4 - HKCU..Run: [Steam] "c:program filessteamsteam.exe" -silent
O4 - HKCU..RunOnce: [Q3E Minimizer v1.45] C:Documents and
SettingsUser01BureaubladSOF2 programma's en andereQ3E
Minimizer_v1.45.EXE
O4 - Startup: OpenOffice.org 2.0.lnk = C:Program FilesOpenOffice.org 2.0
programquickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:Program
FilesAdobeAcrobat 7.0Readerreader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Norton GoBack.lnk = C:Program FilesNorton
SystemWorksNorton GoBackGBTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:Program FilesJavajre1.5.0_05binnpjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-
AAA5-00401C608501} - C:Program FilesJavajre1.5.0_05
binnpjpi150_05.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-
4C56B4E14E84} - C:PROGRA~1SPYWAR~2toolsiesdpb.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-
3C9C571A8263} - C:DOCUME~1User01BUREAU~1OFFICE~1
OFFICE11REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-
00C0F0318AFE} - C:WINDOWSsystem32Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-
BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows
Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?
linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo
Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} -
http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live
Safety Center Base Module) -
http://scan.safety.live.com/resource/download/scanner/wlscbase5059.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}
(MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/mu
web_site.cab?1149885337359
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMessengerSetupDownloader.ca
b
O17 - HKLMSystemCCSServicesTcpip..{F997DD60-1482-4210-A5EF-
A9D729183B43}: NameServer = 195.238.2.22 195.238.2.21
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
"C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:WINDOWSsystem32ati2evxx.dll
O20 - Winlogon Notify: winrkp32 - winrkp32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:WINDOWSSYSTEM32
WRLogonNTF.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec
Corporation - C:Program FilesCommon FilesSymantec
SharedccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:Program FilesCommon FilesSymantec
SharedccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
Corporation - C:Program FilesCommon FilesSymantec
SharedccSetMgr.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation -
C:Program FilesNorton SystemWorksNorton GoBackGBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:Program FilesCommon FilesInstallShieldDriver11Intel
32IDriverT.exe
O23 - Service: Norton AntiVirus Auto-Protect-service (navapsvc) - Symantec
Corporation - C:Program FilesNorton SystemWorksNorton
AntiVirusnavapsvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:Program
FilesEsetnod32krn.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -
Symantec Corporation - C:Program FilesNorton SystemWorksNorton
AntiVirusIWPNPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec
Corporation - C:PROGRA~1NORTON~1NORTON~1NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:WINDOWSsystem32nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:WINDOWSsystem32
HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:Program FilesNorton
SystemWorksNorton AntiVirusSAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -
C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research
Pty Ltd - C:Program FilesSpyware Doctorsdhelp.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:Program FilesCommon FilesSymantec
SharedSNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:PROGRA~1
NORTON~1NORTON~1SPEEDD~1NOPDB.EXE
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot
Software, Inc. - C:Program FilesWebrootSpy SweeperWRSSSDK.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:Program
FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe

Hallo Chrizz

Net zoals 'anoniem' geeft mijn computer deze melding:
virus alert the error was likely caused by a computer virus that is know by
the following names:
win32/apropos.b
winNT/Zufyx.A
spyware.apropos.C
trojan.win32.Crypt.t

IK HEB JOU TIP VAN HIERONDER TOEGEPAST.
ZOU JIJ NAAR MIJN LOG.TXT WILLEN KIJKEN OF IK OOK Hijackthis MOET
DOWNLOADEN??

Log of AproposFix v1.1

************

Running from directory:
C:Documents and SettingsIshŠleBureaubladaproposfix

************


Registry entries found:

[HKEY_LOCAL_MACHINESoftwareCoVWmABEYf83]
@="6E8O86JWXXWXXYXU:JSt9fSWXXWmZX2sxny2.XOUOPAIdcX9NERAN
OX9IEIQOE8YOUO"
"Device"="\\.\yTnwJd5w"
"DriverPath"="C:\WINDOWS\system32\drivers\dmimusic.sys"
"DriverName"="aicscan"
"HideUninstallerName"="C:\Program Files\Xerrlink\rnrmodem.exe"
"UninstallerPath"="C:\WINDOWS\system32\eudpid.exe"
"UninstallerRegKey"="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wi
ndows\CurrentVersion\Uninstall\{83184AD5-C79C-483D-80B0-
04662A628DB6}"
"UninstallerParams"="/CTUN"
"HDll"="C:\WINDOWS\system32\redoglnt.dll"
"ServerAddress"="adchannel.contextplus.net"
"LegalNote"="http://adchannel.contextplus.net/legal-note/nonbranded.html"
"PartnerId"="CP.IST2"
"InstallationId"="{X507e1a7-9f2b-1486-7f3f-08275ca1b509}"
"PageFiltering"=dword:00000001
"ClientName"="C:\Program Files\Xerrlink\ftssobjs.exe"

************

Removing hidden service:
Service aicscan removed.

Removing hidden folder:
Deletion of folder Xerrlink succeeded!

Deleting files:

Deletion of file C:WINDOWSsystem32driversdmimusic.sys succeeded!
Deletion of file C:WINDOWSsystem32recodins.exe succeeded!
Deletion of file C:WINDOWSsystem32redoglnt.dll succeeded!
Deletion of file C:WINDOWSsystem32eudpid.exe succeeded!

Backing up files:
Done!

Removing registry entries:

REGEDIT4

[-HKEY_CURRENT_USERSoftwareCoVWmABEYf83]
[-HKEY_LOCAL_MACHINESoftwareCoVWmABEYf83]
[-
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
Uninstall{83184AD5-C79C-483D-80B0-04662A628DB6}]

Done!

Finished!


ALVAST THANKS!
WEET JIJ TOEVALLIG HOE IK AAN DIE VIRUSSEN KOM?

GROETEN ISHELE

de computer op veilige modus starten en dan door de virusscanner
laten scannen bij mij zijn er toen 4 fouten uit gehaald

Deze thread mag na een half jaar met pensioen.