Hardnekkige spyware, hoe te verwijderen?

[_Uploader_]

Elke keer als ik mijn computer opstart dan start IE ook automatisch op met de melding:
There seems to be a problem preventing you from proceeding at this time.
The error that occured was:

Download error #2

Please try again later.

---

Ik heb Hitman Pro er ook al overheen gehaald in de veilige modus, maar kennelijk is deze vorm hardnekkig. Ook staat er op de c: schijf een dailerafbeelding met de naam 127021.exe.

Hierbij het logfile van Hijack This:
Logfile of HijackThis v1.99.0
Scan saved at 19:06:01, on 11-2-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\prvdi.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\UploaderLocal Settings\Temporary Internet Files\Content.IE5\YJPT3BEF\hijackthis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://quickmetasearch.com/?said=acc0000_ho
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: STLinksCtrl Class - {B54BFA47-D897-49CA-9657-05EC9F80A32B} - C:\Program Files\STLinks\STLinks2.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\system32\prvdi.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\system32\prvdi.exe
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.m...eb_site.cab?1102628584455
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.co.../HPGetDownloadManager.ocx
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: ISSvc - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

---

Heeft iemand een idee hoe ik van deze troep afkom?

[Acheron]

Ad-aware heeft bij mij eens geholpen nadat ik per ongeluk een verkeerde crack geprobeerd had

[_Uploader_]

Ja, Hitman Pro -waaronder ook Adaware- heb ik al zo'n 5 keer gedraaid.
Ook heeft de virusscanner Norton AV 2005 (die up to date is) de nodige scanpogingen gedaan.

Hitman Pro vind de spyware wel, maar de volgende keer komt de melding weer vrolijk terug.

[aZuL2001]

www.hitmanpro.nl , downloaden, installeren, pc herstarten in veilige modus met netwerkondersteuning en die laten scannen.

[Brobbel]

Een andere optie is Hitman Pro http://www.hitmanpro.nl/

Dit programma laadt een stuk of wat verschillende spyware-removers zoals Ad-aware, Spybot e.a. automatisch in, zorgt voor een update en loopt dan je systeem na. Allemaal achter elkaar, dus wat de ene over het hoofd ziet, wordt door de andere vrijwel zeker wel gedetecteerd.

Werkt vrijwel automatisch, dus echt ideaal voor noodgevallen!

offtopic:
Azul, je was me net voor

[ Voor 7% gewijzigd door Brobbel op 11-02-2005 19:24 ]

[elevator]

_Uploader_ schreef op vrijdag 11 februari 2005 @ 19:18:
C:\WINDOWS\system32\prvdi.exe

Die ken ik niet - upload die eens op http://virusscan.jotti.org ?

[kurt15]

Ik wil meestal niet uren lang spyware zitten verwijderen dus ik installeer gewoon een potdichte windows installatie met norton antivirus 2005 en alles up2date. Als er dan op een website spyware zit dan verwijdert Norton dat vanzelf als Internet Explorer het niet blokkeert. Preventie is dus beter.

Ik heb nu al een paar maanden geen spyware meer .

[_Uploader_]

bovenstaande opties heb ik al geprobeerd, zie vorige entry.
het lukt me niet om dit voorgoed te laten verwijderen.

@elevator, zo ongeveer?
Service load: 0% 100%

File: hijackthis.log
Status: OK
Packers detected: None

AntiVir No viruses found (0.21 seconds taken)
Avast No viruses found (1.51 seconds taken)
AVG Antivirus No viruses found (0.80 seconds taken)
BitDefender No viruses found (0.37 seconds taken)
ClamAV No viruses found (0.41 seconds taken)
Dr.Web No viruses found (0.56 seconds taken)
F-Prot Antivirus No viruses found (0.07 seconds taken)
Fortinet No viruses found (0.34 seconds taken)
Kaspersky Anti-Virus No viruses found (0.62 seconds taken)
mks_vir No viruses found (0.21 seconds taken)
NOD32 No viruses found (0.39 seconds taken)
Norman Virus Control No viruses found (0.27 seconds taken)

Statistics
Last piece of malware found was Win32/Livup.B in msstart.zip, detected by:

Scanner Malware name Time taken
AntiVir X 0.23 seconds
Avast X 1.54 seconds
AVG Antivirus Proxy.3.H 0.85 seconds
BitDefender X 0.41 seconds
ClamAV X 0.42 seconds
Dr.Web BackDoor.Livup 0.58 seconds
F-Prot Antivirus X 0.51 seconds
Fortinet X 0.46 seconds
Kaspersky Anti-Virus Trojan-Proxy.Win32.Agent.s 0.66 seconds
mks_vir Trojan.Trojanproxy.Agent.S 0.22 seconds
NOD32 Win32/Livup.B 0.72 seconds
Norman Virus Control X 46.67 seconds


Service statistics:

12252 files (8356 of those unique) have been uploaded & scanned since 01/02/2005, the day of the last database purge.
2334 of those 8356 files contained a virus or any other form of malware.
This page has been visited 26011 times in this time period.
This service managed to spot 160 pieces of malware no vendor used knew about at the time of uploading.
The service also warned against 1359 suspicious files without any help from scanner results.
However, 0 files reported to be OK were found out to be malware later (this is checked daily).
As far as can be told, all this together makes this service 100.00% accurate. However, since it is very well possible malware has been uploaded no scanner knows about at this time, this number is to be taken with a proper amount of skepticism.

No I am not sitting still! A new, better version of this service is being developed.
If you have suggestions and/or comments, please send me them!
Most popular malware:

Rank Malware name Uploaded Last known filename
1 trojan.spy.agent.y 217 times aimbot_e_cash.exe
2 tr/agent.bd 81 times Dragonbot.zip
3 worm/robobot 69 times install.exe
4 backdoor.win32.agobot.gen 56 times Morp974hed.exe
5 modification of win32.radix.24576 45 times Mikes.zip
6 behaveslike:win32.irc-backdoor 34 times urxcountry.exe
7 worm/peybot.a 34 times defragfatx.exe
8 behaveslike:win32.explorerhijack 33 times fujifilm.exe
9 downloader.agent.7.ba 28 times hiden.exe
10 trojan.agent.ap 27 times aimbotX
11 behaveslike:trojan.downloader 25 times bla.tmp
12 trojan.unremote.a 24 times RuNz_1_.HpRot.zip
13 win32:trojan-gen. {other} 23 times KreW_s_Aimbot.exe
14 bds/singu.v 23 times aimbot.rar
15 tr/lefeat.1 20 times ADDHR32.EXE.VIR

@kurt 15 en brobbel:
NAV 2005 is up to date en mijn adaware etc ook.

[ Voor 94% gewijzigd door _Uploader_ op 11-02-2005 19:30 ]

[ReallyStupidGuy]

code:

C:\WINDOWS\system32\prvdi.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ttp://quickmetasearch.com/?said=acc0000_ho
O2 - BHO: STLinksCtrl Class - {B54BFA47-D897-49CA-9657-05EC9F80A32B} - C:\Program Files\STLinks\STLinks2.dll (file missing) 
O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\system32\prvdi.exe 
O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\system32\prvdi.exe 
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.co.../HPGetDownloadManager.ocx

Toelichting:
1,4,5= Trojan-Dropper.Win32.Small.rd
3,6 : Dingen met getdownload en link ed. vindt ik verdacht.
2 : Zou gewoon www.google.nl of www.gator.com moeten zijn

Ik gebruik trouwens zelf altijd http://www.hijackthis.de om lekker snel door de logs te kunnen spitten.

edit:

Zie ook dat kaspersky de trojandropper wel herkent. Dank Google

[ Voor 6% gewijzigd door ReallyStupidGuy op 11-02-2005 19:33 ]

[Mike Jarod]

Lezen mensen wel

[google=prvdi.exe] geeft meerdere hits over Trojan-Dropper.Win32.Small.rd

[_Uploader_]

Mike Jarod schreef op vrijdag 11 februari 2005 @ 19:30:
Lezen mensen wel

[google=prvdi.exe] geeft meerdere hits over Trojan-Dropper.Win32.Small.rd

Excuses, maar ik wist niet wie nou de boosdoener was.
Bedankt voor de replys! Ik zal proberen het uit te schakelen.

edit:
Het is gelukt om ze te verwijderen, mijn logfile ziet er nu zo uit:
Logfile of HijackThis v1.99.0
Scan saved at 19:56:50, on 11-2-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://quickmetasearch.com/?said=acc0000_ho
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O16 - DPF: {003FADA5-8FEE-11D6-AFB7-0004768F6183} (CryptoRSA Control) - https://www.p3.postbank.nl/sesam/CAX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.m...eb_site.cab?1102628584455
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: ISSvc - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


Volgens mij al een stuk beter, ik heb ook de dailer 127021.exe verwijder. Sorry voor de lange stukken text!

Bedankt voor de zeer snelle replies, damn wat zijn jullie snel!
@elavator en ReallyStupidGuy, http://www.hijackthis.de en http://virusscan.jotti.org staan in mijn favorieten!

[ Voor 102% gewijzigd door _Uploader_ op 11-02-2005 20:00 ]