homesearch /about.blank spyware

[Verwijderd]

Logfile of HijackThis v1.99.0
Scan saved at 15:59:01, on 19-1-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\LANCOM\VPNclient\ipssvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Norman\bin\ZANDA.EXE
C:\WINDOWS\System32\snmp.exe
C:\Norman\bin\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\system32\javabr32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\keyhook.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Phoenix\RecoverPro_XP\VBPTASK.EXE
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Norman\bin\ZLH.EXE
C:\WINDOWS\system32\sysjm.exe
C:\Program Files\FRITZ!\IWatch.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\WINDOWS\system32\sistray.exe
D:\install\jabber\jabberwana_20040428\Jabberwana.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\002\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {A3C5C0CE-5122-E73A-AB92-E8EE67589A00} - C:\WINDOWS\system32\syssy.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [13C.tmp] C:\DOCUME~1\002\LOCALS~1\Temp\13C.tmp.exe 4 10001
O4 - HKLM\..\Run: [sysjm.exe] C:\WINDOWS\system32\sysjm.exe
O4 - HKLM\..\RunOnce: [javabr32.exe] C:\WINDOWS\system32\javabr32.exe
O4 - Startup: Snelkoppeling naar Jabberwana.lnk = jabber\jabberwana_20040428\Jabberwana.exe
O4 - Global Startup: FRITZ!fax.lnk = C:\Program Files\FRITZ!\FriFax32.exe
O4 - Global Startup: ISDNWatch.lnk = C:\Program Files\FRITZ!\IWatch.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Gelijkwaardige pagina's - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Koppelingspagina's - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Opgeslagen momentopname van de pagina - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O13 - WWW. Prefix: http://
O14 - IERESET.INF: START_PAGE_URL=http://www.12move.nl
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/...com/housecall/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4789142A-2AAE-4DB5-9C21-2C8FAADFC7F5}: NameServer = 194.134.0.97,194.134.5.5
O23 - Service: AVM FRITZ!web Routing Service - AVM Berlin - C:\Program Files\Common Files\AVM\de_serv.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: IPSec Connection Service - LANCOM Systems GmbH, Germany - C:\Program Files\LANCOM\VPNclient\ipssvc.exe
O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown - C:\Norman\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: Network Security Service (NSS) - Unknown - C:\WINDOWS\system32\mfcbl32.exe (file missing)

Wat hebben we al gedraaid;

- Geupdated Hitmanpro
-SpHjfix.exe (via dit forumsearch naar een duitse site verwezen voor deze util.)
-hsremove.exe
-spysubtract.exe

Zover ik weet elke keer de computer gerestart na 1 van deze removals.

Ik ken hijackthis verder niet, maar moet de regels aanvinken die voor jullie verdacht of hoe gaat dat?

Ps sorry dan iet alles programma afgesloten waren..

Iemand verder nog ideën

[dennismaus]

www.hitmanpro.nl

downloaden en in veilige modus draaien met systeemherstel uit.

[Verwijderd]

dennismaus schreef op woensdag 19 januari 2005 @ 17:19:
www.hitmanpro.nl

downloaden en in veilige modus draaien met systeemherstel uit.

had ik gedraaid (maar niet in veilige modus btw)

[pasta]

code:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\aygcu.dll/sp.html#10001
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {A3C5C0CE-5122-E73A-AB92-E8EE67589A00} - C:\WINDOWS\system32\syssy.dll

Deze kunnen sowieso weg.

code:

O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [13C.tmp] C:\DOCUME~1\002\LOCALS~1\Temp\13C.tmp.exe 4 10001
O4 - HKLM\..\Run: [sysjm.exe] C:\WINDOWS\system32\sysjm.exe

Deze vertrouw ik niet, haal ze eens door Jotti's Online Malware Scan heen.

code:

O13 - WWW. Prefix: http://
O14 - IERESET.INF: START_PAGE_URL=http://www.12move.nl
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)

Deze entries kunnen ook nog weg.

Heb je overigens 2 virusscanners geïnstalleerd? Dit valt niet aan te raden, omdat het van tijd tot tijd mis kan gaan.

Wat je eventueel ook nog kunt doen is die DLL's unregisteren, zie daarvoor [rml]Schouw in "[ IE6] Startpagina kan niet meer wijzigen"[/rml]

[ Voor 6% gewijzigd door pasta op 19-01-2005 18:13 ]