Setup XP lukt niet

derockere · 8 januari 2011

Het lukt me zelfs niet om HiJackThis te installeren.

Dus dit zal eerder iets voor morgen worden.

Toch bedankt!

Ik ben daarjuist overgeschakeld naar een andere partitie en heb van daaruit een LOG gemaakt!

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 17:24:54, on 8/01/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

F:\WINDOWS\System32\smss.exe

F:\PROGRA~1\AVG\AVG10\avgchsvx.exe

F:\PROGRA~1\AVG\AVG10\avgrsx.exe

F:\WINDOWS\system32\winlogon.exe

F:\WINDOWS\system32\services.exe

F:\WINDOWS\system32\lsass.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\System32\svchost.exe

F:\WINDOWS\system32\spoolsv.exe

F:\WINDOWS\Explorer.EXE

F:\Program Files\AVG\AVG10\avgwdsvc.exe

F:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

F:\Program Files\Java\jre6\bin\jqs.exe

F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

F:\Program Files\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe

F:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

F:\Program Files\AVG\AVG10\avgtray.exe

F:\WINDOWS\RTHDCPL.EXE

F:\Program Files\Logitech\Video\LogiTray.exe

F:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe

F:\Program Files\Common Files\Java\Java Update\jusched.exe

F:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

F:\Program Files\AVG\AVG10\avgnsx.exe

F:\Program Files\CDBurnerXP\NMSAccessU.exe

F:\Program Files\Fighters\SPAMfighter\sfagent.exe

F:\Program Files\AVG\AVG10\avgemcx.exe

F:\Program Files\Norton Ghost\Agent\VProSvc.exe

F:\WINDOWS\system32\RUNDLL32.EXE

F:\WINDOWS\system32\ctfmon.exe

F:\Program Files\Windows Live\Messenger\msnmsgr.exe

F:\Program Files\NotsoSoftware\DriveDiscovery\NSSMR.exe

F:\Program Files\RAMRush\RAMRush.exe

F:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

F:\Program Files\Fighters\SPAMfighter\sfus.exe

F:\Program Files\Logitech\SetPoint\KEM.exe

F:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

F:\Program Files\Fighters\FighterSuiteService.exe

F:\Program Files\Logitech\SetPoint\KHALMNPR.EXE

F:\Program Files\Logitech\Video\FxSvr2.exe

F:\WINDOWS\system32\dllhost.exe

F:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe

F:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

F:\WINDOWS\system32\wuauclt.exe

F:\Program Files\Windows Live\Contacts\wlcomm.exe

F:\WINDOWS\system32\msiexec.exe

F:\WINDOWS\system32\dllhost.exe

F:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

F:\WINDOWS\system32\svchost.exe

F:\WINDOWS\System32\spool\DRIVERS\W32X86\3\cnmsm3e.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/somud/{81669AEB-B9D0-4196-9A50-23C1D529A1BA}

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - F:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll

R3 - URLSearchHook: (no name) - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - (no file)

F2 - REG:system.ini: UserInit=F:\WINDOWS\system32\userinit.exe,F:\Program Files\Soluto\soluto.exe /userinit,

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - F:\Program Files\AVG\AVG10\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - F:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - F:\Program Files\SoMud DB Toolbar\tbcore3.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - F:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll

O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O3 - Toolbar: SoMud DB Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - F:\Program Files\SoMud DB Toolbar\tbcore3.dll

O4 - HKLM\..\Run: [AVG_TRAY] F:\Program Files\AVG\AVG10\avgtray.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [LogitechVideoTray] F:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [LogitechGalleryRepair] F:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [smartDefrag] "F:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp

O4 - HKLM\..\Run: [sunJavaUpdateSched] "F:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "F:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sfagent] F:\Program Files\Fighters\SPAMfighter\sfagent.exe

O4 - HKLM\..\Run: [WinSys2] F:\WINDOWS\system32\winsys2.exe

O4 - HKLM\..\Run: [nwiz] F:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "F:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [DriveDiscoveryMemoryResident] F:\Program Files\NotsoSoftware\DriveDiscovery\NSSMR.exe

O4 - HKCU\..\Run: [Cle] F:\Program Files\5Group\CLE\Cle.exe /startup

O4 - HKCU\..\Run: [ftweak_RAMRush] F:\Program Files\RAMRush\RAMRush.exe

O4 - HKCU\..\Run: [swg] "F:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "F:\Program Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKCU\..\Run: [AlcoholAutomount] "F:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Lokale service')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Netwerkservice')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Logitech SetPoint.lnk = F:\Program Files\Logitech\SetPoint\KEM.exe

O8 - Extra context menu item: Download Web &Images with SoMud - F:\Program Files\SoMud\scripts\ie\images-url.html

O8 - Extra context menu item: Download with SoMud - F:\Program Files\SoMud\scripts\ie\link-url.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://F:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://F:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html

O8 - Extra context menu item: Se&nd to OneNote - res://F:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll/105

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - (no file)

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - (no file)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =

O17 - HKLM\Software\..\Telephony: DomainName =

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =

O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - F:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - F:\Program Files\AVG\AVG10\avgpp.dll

O20 - Winlogon Notify: !SASWinLogon - F:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - F:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - F:\WINDOWS\system32\browseui.dll

O23 - Service: AVG Security Toolbar Service - Unknown owner - F:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - F:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - F:\Program Files\AVG\AVG10\avgwdsvc.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - F:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - F:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LiveUpdate - Symantec Corporation - F:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: mental ray 3.8 Satellite for Autodesk 3ds Max 2011 32-bit 32-bit (mi-raysat_3dsmax2011_32) - Unknown owner - F:\Program Files\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - F:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

O23 - Service: NMSAccess - Unknown owner - F:\Program Files\CDBurnerXP\NMSAccessU.exe

O23 - Service: Norton Ghost - Symantec Corporation - F:\Program Files\Norton Ghost\Agent\VProSvc.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - F:\Program Files\Fighters\SPAMfighter\sfus.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - F:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: Suite Service - SPAMfighter ApS - F:\Program Files\Fighters\FighterSuiteService.exe

O23 - Service: SymSnapService - Symantec - F:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe

--

End of file - 12231 bytes

8 januari 2011 aangepast door derockere

kape · 8 januari 2011

De "kleurboek" van NCF heb ik maar even verwijderd : mooi om zien, maar geen enkele meerwaarde ;-)

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - URLSearchHook: (no name) - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - (no file)

F2 - REG:system.ini: UserInit=F:\WINDOWS\system32\userinit.exe,F:\Program Files\Soluto\soluto.exe /userinit,

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - F:\Program Files\SoMud DB Toolbar\tbcore3.dll

O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

O3 - Toolbar: SoMud DB Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - F:\Program Files\SoMud DB Toolbar\tbcore3.dll

O4 - HKLM\..\Run: [WinSys2] F:\WINDOWS\system32\winsys2.exe

O4 - HKCU\..\Run: [Cle] F:\Program Files\5Group\CLE\Cle.exe /startup

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - (no file)

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - (no file)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =

O17 - HKLM\Software\..\Telephony: DomainName =

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =

Klik op 'Fix checked' om de items te verwijderen.

Download MBAM (Malwarebytes Anti-Malware)

Dubbelklik op mbam-setup.exe om het programma te installeren.

Zorg ervoor dat er een vinkje geplaatst is voor Update Malwarebytes' Anti-Malware en Start Malwarebytes' Anti-Malware, Klik daarna op "Voltooien".

Indien een update gevonden werd, zal die gedownload en geïnstalleerd worden.

Wanneer het programma volledig up to date is, selecteer dan in het tabblad Scanner : "Snelle Scan", daarna klik op Scan.

Het scannen kan een tijdje duren, dus wees geduldig.

Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.

Zorg ervoor dat daar alles aangevinkt is, daarna klik op: Verwijder geselecteerde.

Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten. (Zie verder).

Indien er de rootkit (TDSS) aanwezig is, zal MBAM vragen te herstarten. Doe dit dan ook.

MBAM zal na de herstart opnieuw scannen en de rootkit verwijderen.

Het log wordt automatisch bewaard door MBAM en kan je terugvinden door op de "Logs" tab te klikken in het programma.

Indien MBAM moeilijkheden heeft met het verwijderen van bepaalde bestanden zal het enkele meldingen geven waar je OK moet klikken. Daarna zal het vragen om de computer opnieuw op te starten... dus sta toe dat MBAM de computer opnieuw opstart.

Plak de inhoud van het logje in je volgende bericht, samen met een nieuw HijackThis log.

derockere · 9 januari 2011

Ik heb al gedaan wat je hebt voorgesteld! Daarvoor dank. De PC start wel sneller op nu, doch het opstarten via de Setup-cdrom is er nog niet bij. Spijtig.

Hier volgen de logjes:

Malwarebytes' Anti-Malware 1.50.1.1100

Malwarebytes

Databaseversie: 5487

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

9/01/2011 9:47:24

mbam-log-2011-01-09 (09-47-24).txt

Scantype: Snelle scan

Objecten gescand: 185918

Verstreken tijd: 3 minuut/minuten, 23 seconde(n)

Geheugenprocessen geïnfecteerd: 0

Geheugenmodulen geïnfecteerd: 0

Registersleutels geïnfecteerd: 0

Registerwaarden geïnfecteerd: 0

Registerdata geïnfecteerd: 0

Mappen geïnfecteerd: 0

Bestanden geïnfecteerd: 5

Geheugenprocessen geïnfecteerd: