Politie Virus

[Gast GotWood]

Ja mail.ru is inderdaad normaal, virus is er nog steeds.

[juisterr]

Download de 32 of 64 bit versie van HitmanPro via één van de onderstaande links naar het bureaublad.

• 32 Bit - http://files.surfright.nl/HitmanPro36.exe
  
• 64 Bit - http://dl.surfright.nl/HitmanPro36_x64.exe
  
• Dubbelklik op "HitmanPro36.exe" en klik op "volgende"
  
• Vink de optie "Ik accepteer de voorwaarden van de gebruikersovereenkomst aan" en klik op "Volgende"
  
• Sluit nu het programma.
  
• Open hitmanpro36 opnieuw
  
• Onderin zie je nu naast 'nu kopen' ook de knop instellingen, klik daarop.
  
• Daarna klik je op de knop 'licentie' hier kan je voor 30 dagen gebruik maken van de gratis licentie.
  
• Klik op "Activeer gratis licentie". Nu komt de melding "Het product is succesvol geactiveerd."
  
• Klik nu op annuleren om weer in het beginscherm te komen.
  
• Klik op volgende. Selecteer de optie "Nee, ik wil deze computer slechts eenmalig controleren" en klik op "Volgende".
  De scan zal nu gestart worden, doe verder niets op de computer totdat de scan gereed is.
  
• Als de scan klaar is klik je op "volgende"
  
• Klik onderin het scherm op "Save log" of "Logbestand opslaan" en sla deze op bijvoorbeeld het bureaublad op.
  Post dit logje.
  

[Gast GotWood]

Hier is het logje van HitmanPro

HitmanPro 3.7.2.190
www.hitmanpro.com


  Computer name . . . . : NATALIA-DCFB5BE
  Windows . . . . . . . : 5.1.3.2600.X86/4
  Safe Mode Boot  . . . : NETWORK
  User name . . . . . . : NATALIA-DCFB5BE\Administrator
  License . . . . . . . : Trial (30 days left)


  Scan date . . . . . . : 2013-03-08 19:47:15
  Scan mode . . . . . . : Normal
  Scan duration . . . . : 2m 17s
  Disk access mode  . . : Direct disk access (SRB)
  Cloud . . . . . . . . : Internet
  Reboot  . . . . . . . : Yes


  Threats . . . . . . . : 2
  Traces  . . . . . . . : 37


  Objects scanned . . . : 526.560
  Files scanned . . . . : 32.790
  Remnants scanned  . . : 137.495 files / 356.275 keys


Malware _____________________________________________________________________


  C:\Documents and Settings\Natalia\Application Data\skype.dat -> Quarantined
     Size . . . . . . . : 188.416 bytes
     Age  . . . . . . . : 0.4 days (2013-03-08 10:54:45)
     Entropy  . . . . . : 6.1
     SHA-256  . . . . . : 2A50FC2DA0A14F6DB99241C4E89F1BAE4093566D47022721DDED949D51FFF11C
   > G Data . . . . . . : Win32:FakeAV-ELD [Trj]
     Fuzzy  . . . . . . : 154.0
        One or more antivirus vendors have indicated that the file is malicious.
        Substitutes Explorer.exe as the default shell. Malware tends to start this way.
        This file was most recently added as automatic startup.
        The file name extension of this program is not common.
        Authors name is missing in version info. This is not common to most programs.
        Version control is missing. This file is probably created by an individual. This is not typical for most programs.
        Program starts automatically without user intervention.
        Time indicates that the file appeared recently on this computer.
     Startup
        HKU\S-1-5-21-1343024091-688789844-839522115-1004\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
     Forensic Cluster
        -2.7s C:\WINDOWS\Prefetch\VIDEO.****TUBE.COM-056158AF.pf
         0.0s C:\Documents and Settings\Natalia\Application Data\skype.dat


  C:\Documents and Settings\Natalia\Bureaublad\video.****tube\video.****tube\video.****tube.com -> Quarantined
     Size . . . . . . . : 188.416 bytes
     Age  . . . . . . . : 0.4 days (2013-03-08 10:54:13)
     Entropy  . . . . . : 6.1
     SHA-256  . . . . . : 2A50FC2DA0A14F6DB99241C4E89F1BAE4093566D47022721DDED949D51FFF11C
   > G Data . . . . . . : Win32:FakeAV-ELD [Trj]
     Fuzzy  . . . . . . : 108.0
     References
        HKU\S-1-5-21-1343024091-688789844-839522115-1004\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Natalia\Bureaublad\video.****tube\video.****tube\video.****tube.com
     Forensic Cluster
         0.0s C:\Documents and Settings\Natalia\Bureaublad\video.****tube\video.****tube\
         0.0s C:\Documents and Settings\Natalia\Bureaublad\video.****tube\video.****tube\video.****tube.com




Cookies _____________________________________________________________________


  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:2o7.net
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:ad.yieldmanager.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:atdmt.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:c.atdmt.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:doubleclick.net
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:eurostar.122.2o7.net
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:fl01.ct2.comclick.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:h.atdmt.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:h2****.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:hotlog.ru
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:invitemedia.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:msgvarsitynetwork.122.2o7.net
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:****tube.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:russian.sextubea.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:sextubea.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:sortedsextube.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:spylog.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:statcounter.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:statse.webtrendslive.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:thomascookag.122.2o7.net
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:tpgpost.122.2o7.net
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:www.****tube.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:www.sortedsextube.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:www.zega****.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:xiti.com
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:yadro.ru
  C:\Documents and Settings\Natalia\Application Data\Mozilla\Firefox\Profiles\wk58g890.default\cookies.sqlite:zega****.com
  C:\Documents and Settings\Natalia\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:doubleclick.net
  C:\Documents and Settings\Natalia\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:invitemedia.com
  C:\Documents and Settings\Natalia\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:media6degrees.com
  C:\Documents and Settings\Natalia\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:track.adform.net
  C:\Documents and Settings\Natalia\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:track.hubrus.com
  C:\Documents and Settings\Natalia\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies:yadro.ru

[juisterr]

Prima gedaan, vertel even hoe het nu gaat.

[Gast GotWood]

Het gaat goed, ik had de pc opgestart in normale modus en ik kreeg het virus niet meer xD

[juisterr]

Heel fijn, je kan de gebruikte tools weer verwijderen. Als het dan nog steeds goed gaat kan je het topic op opgelost.

[Gast GotWood]

Alles gaat goed, ben alleen nog wat malware tegengekomen maar voor de rest gaat het goed denk ik

Hartelijk Bedankt voor jullie hulp:adore:

[juisterr]

Prima hoor, graag gedaan.