[Spyware] Site start bij het laden van windows

[Verwijderd]

Op 1 van de pc in dit bedrijf wordt bij opstarten van de pc een website geladen. Zonder dat IE eerst actief is.
Het komt ook af en toe voor dat dit later gebeurt.

Het vage is dat het vaak nederlandse sites zijn:
- http://webmail.nhl.nl
- http://www.webwereld.nl
- http://login.passport.net/uilogin.srf?id=2

Ik heb de laatste versie van Hitman Pro er 2x overheen gehaald alleen dat lost het probleem niet op.

Heb even in de faq gekeken, en een HijackThis log laten uitdraaien waarvan ik zelf niks vreemds zie.

code:

Logfile of HijackThis v1.97.7
Scan saved at 11:01:19, on 14-12-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\ePOAgent\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe
C:\WINNT\system32\Promon.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\ePOAgent\UpdaterUI.exe
C:\Siemens\Common\S7ubtoox\s7ubtstx.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\CQCS_WIN\FTP\VFTPD.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Beeldschermtachograaf\Bstmon.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Siemens\Common\Sqlany\dbsrv7.exe
C:\WINNT\system32\regsvc.exe
C:\CQCS_WIN\CTERM.EXE
Q:\Bestanden Uitwissellen\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://beenen2003
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Beenen Electrotechniek bv
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.9.160.3:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.9.160.*;192.9.170.*;145.33.6.*;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.beenen.nl/
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1043,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [cpqek] C:\Program Files\Compaq\Compaq EAB Software\cpqek.exe
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\ePOAgent\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [S7UB Start] "C:\Siemens\Common\S7ubtoox\s7ubtstx.exe" -StartDB
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\WINNT\Cpqdiag\CpqDfwAg.exe
O4 - HKLM\..\RunServices: [vftpd] c:\cqcs_win\ftp\vftpd.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: Beeldschermtachograaf.lnk = C:\Program Files\Beeldschermtachograaf\Bstmon.exe
O4 - Startup: Microsoft Outlook.lnk = C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Snelkoppeling naar VFTPD.lnk = C:\CQCS_WIN\FTP\VFTPD.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Onderzoek (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://beenen2003
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.nl
O16 - DPF: {2430796B-BE9C-4FC1-8409-FAD31E770DE7} (Project1.testDropfabriek) - http://192.9.160.185/testdropfabriek.ocx
O16 - DPF: {270E717B-B46D-47D2-912E-0D9599E2CC17} (Client.Client3) - http://192.9.160.185/client.ocx
O16 - DPF: {35FC4672-1FFC-4D81-BD66-F71768970596} (Project1.UserControl1) - http://192.9.160.185/test.ocx
O16 - DPF: {394544C7-A909-4BCF-B3A5-DD50728275AB} (Project1.Client1) - http://192.9.160.151/client.ocx
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {4034495F-3965-40B1-8783-78E84D074D42} (Project1.testDropfabriek) - http://192.9.160.185/testdropfabriek.ocx
O16 - DPF: {53C0B50D-4B4B-45AB-A39A-109DA38799E0} (Project1.ClientDropfabriek) - http://192.9.160.185/client.ocx
O16 - DPF: {6554EC31-59D1-4540-93C2-6A89149C72F9} (Project1.Client2) - http://192.9.160.185/testdropfabriek.ocx
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD LT 2000i\AcDcToday.ocx
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38249.958587963
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (NOXLATE) - file://C:\Program Files\AutoCAD LT 2000i\InstFred.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DB84F468-9E40-473C-9580-87D2E41994A0} (Client.Client3) - http://192.9.160.181/client.ocx
O16 - DPF: {EBF51226-D0CE-48A5-ADCA-64D5C3C0D53C} (Client.Client3) - http://192.9.160.181/Drop_Client.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD LT 2000i\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = dmn-beenen
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D27C6B5-41BD-4E41-8439-688437EE2FC5}: NameServer = 192.9.160.4
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = dmn-beenen
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D27C6B5-41BD-4E41-8439-688437EE2FC5}: NameServer = 192.9.160.4
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = dmn-beenen
O17 - HKLM\System\CS2\Services\Tcpip\..\{0D27C6B5-41BD-4E41-8439-688437EE2FC5}: NameServer = 192.9.160.4

[Frostbite]

IERESET.INF: START_PAGE_URL=http://beenen2003
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.nl

Zoek eens op IERESET.INF

Denk dat dit de boosdoener is. Zoek er maar eens op in Google

http://www.adoko.com/hijackers-reset.html (eerste link)

http://vil.nai.com/vil/content/v_100844.htm

[ Voor 30% gewijzigd door Frostbite op 15-12-2004 12:51 ]