Archief - Log

ComboFix 07-11-19.4 - Dowmi 2007-11-26 13:27:39.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1043.18.613 [GMT 1:00]
Gestart vanuit: C:\Documents and Settings\Dowmi\Bureaublad\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\gjkkj.bak1
C:\WINDOWS\system32\gjkkj.bak2
C:\WINDOWS\system32\gjkkj.ini
C:\WINDOWS\system32\jkkjg.dll

.
(((((((((((((((((((( Bestanden Gemaakt van 2007-10-26 to 2007-11-26 ))))))))))))))))))))))))))))))
.

2007-11-24 03:27 22 --a------ C:\WINDOWS\system32\mseixml.sei
2007-11-23 14:27 <DIR> d-------- C:\VundoFix Backups
2007-11-23 02:20 37,376 --a------ C:\WINDOWS\system32\urqpnmn.dll
2007-11-23 02:20 37,376 --a------ C:\WINDOWS\system32\jkhfffd.dll
2007-11-19 21:04 <DIR> d-------- C:\Documents and Settings\Dowmi\Application Data\InstallShield
2007-11-19 21:04 53,248 --a------ C:\WINDOWS\system32\ImageOle.dll
2007-11-16 14:14 3,048 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2007-11-16 14:14 3,048 --a------ C:\WINDOWS\system32\settings.sfm
2007-11-16 12:34 <DIR> d-------- C:\WINDOWS\system32\Defaults
2007-11-16 12:33 30,528 --a------ C:\WINDOWS\system32\BMXBkpCtrlState-{00000000-00000000-00000007-00001102-00000004-20021102}.rfx
2007-11-16 12:32 86,446 --a------ C:\WINDOWS\system32\instwdm.ini
2007-11-14 13:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-26 12:31 --------- d-----w C:\Documents and Settings\Dowmi\Application Data\Skype
2007-11-22 14:26 --------- d-----w C:\Documents and Settings\Dowmi\Application Data\dvdcss
2007-11-21 16:06 --------- d-----w C:\Documents and Settings\Dowmi\Application Data\Microgaming
2007-11-19 20:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-16 15:47 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-16 13:13 --------- d-----w C:\Program Files\Creative
2007-11-16 11:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
2007-11-16 11:33 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2007-11-16 11:33 --------- d-----w C:\Documents and Settings\Dowmi\Application Data\Creative
2007-11-14 23:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2007-10-25 13:23 --------- d-----w C:\Program Files\WinTV
2007-10-25 13:22 --------- d-----w C:\Program Files\nanocosmos
2007-10-25 13:21 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2007-10-25 13:17 --------- d-----w C:\Program Files\vtplus
2007-10-25 13:15 --------- d-----w C:\Program Files\Common Files\IviSDK
2007-10-23 16:28 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2007-10-17 23:20 --------- d-----w C:\Documents and Settings\Dowmi\Application Data\teamspeak2
2007-10-12 11:59 --------- d-----w C:\Documents and Settings\Dowmi\Application Data\Renegade Minds
2007-09-26 15:09 --------- d-----w C:\Program Files\Logitech
2007-09-26 15:09 --------- d-----w C:\Program Files\Common Files\Logitech
2007-09-26 13:46 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-09-26 13:39 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-09-26 13:39 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-09-26 13:39 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-09-26 13:02 --------- d-----w C:\Documents and Settings\Dowmi\Application Data\fltk.org
2007-09-26 12:55 94,208 ----a-w C:\WINDOWS\DIIUnin.exe
2007-09-26 12:54 --------- d-----w C:\Documents and Settings\Dowmi\Application Data\U3
2007-09-23 15:40 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-09-16 10:52 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-09-16 08:49 22,328 ----a-w C:\Documents and Settings\Dowmi\Application Data\PnkBstrK.sys
2007-09-11 06:55 81,920 ----a-w C:\WINDOWS\system32\frapsvid.dll
2007-01-24 14:36 45,305 ----a-w C:\Program Files\dxdllreg_x86.cab
2007-01-24 14:36 198,275 ----a-w C:\Program Files\FEB2007_XACT_x64.cab
2007-01-24 14:36 151,583 ----a-w C:\Program Files\FEB2007_XACT_x86.cab
2007-01-24 14:21 976,020 ------w C:\Program Files\BDAXP.cab
2007-01-24 14:21 917,318 ------w C:\Program Files\Apr2006_MDX1_x86.cab
2007-01-24 14:21 91,265 ------w C:\Program Files\OCT2006_xinput_x64.cab
2007-01-24 14:21 88,102 ------w C:\Program Files\AUG2006_xinput_x64.cab
2007-01-24 14:21 87,989 ------w C:\Program Files\Apr2006_xinput_x64.cab
2007-01-24 14:21 86,925 ------w C:\Program Files\Oct2005_xinput_x64.cab
2007-01-24 14:21 85,235 ----a-w C:\Program Files\dxupdate.cab
2007-01-24 14:21 77,160 -c--a-w C:\Program Files\DSETUP.dll
2007-01-24 14:21 503,144 -c--a-w C:\Program Files\DXSETUP.exe
2007-01-24 14:21 49,149 ------w C:\Program Files\OCT2006_xinput_x86.cab
2007-01-24 14:21 47,018 ------w C:\Program Files\AUG2006_xinput_x86.cab
2007-01-24 14:21 46,898 ------w C:\Program Files\Apr2006_xinput_x86.cab
2007-01-24 14:21 46,247 ------w C:\Program Files\Oct2005_xinput_x86.cab
2007-01-24 14:21 4,163,518 -c----w C:\Program Files\Apr2006_MDX1_x86_Archive.cab
2007-01-24 14:21 213,767 ------w C:\Program Files\DEC2006_d3dx10_00_x64.cab
2007-01-24 14:21 193,435 ------w C:\Program Files\DEC2006_XACT_x64.cab
2007-01-24 14:21 192,680 ------w C:\Program Files\DEC2006_d3dx10_00_x86.cab
2007-01-24 14:21 183,863 ------w C:\Program Files\AUG2006_XACT_x64.cab
2007-01-24 14:21 183,321 ------w C:\Program Files\OCT2006_XACT_x64.cab
2007-01-24 14:21 181,745 ------w C:\Program Files\JUN2006_XACT_x64.cab
2007-01-24 14:21 180,021 ------w C:\Program Files\Apr2006_XACT_x64.cab
2007-01-24 14:21 179,247 ------w C:\Program Files\Feb2006_XACT_x64.cab
2007-01-24 14:21 146,559 ------w C:\Program Files\DEC2006_XACT_x86.cab
2007-01-24 14:21 138,977 ------w C:\Program Files\OCT2006_XACT_x86.cab
2007-01-24 14:21 138,195 ------w C:\Program Files\AUG2006_XACT_x86.cab
2007-01-24 14:21 134,631 ------w C:\Program Files\JUN2006_XACT_x86.cab
2007-01-24 14:21 133,991 ------w C:\Program Files\Apr2006_XACT_x86.cab
2007-01-24 14:21 133,297 ------w C:\Program Files\Feb2006_XACT_x86.cab
2007-01-24 14:21 13,265,040 -c----w C:\Program Files\dxnt.cab
2007-01-24 14:21 1,673,576 -c--a-w C:\Program Files\dsetup32.dll
2007-01-24 14:21 1,575,336 ------w C:\Program Files\DEC2006_d3dx9_32_x86.cab
2007-01-24 14:21 1,572,114 ------w C:\Program Files\DEC2006_d3dx9_32_x64.cab
2007-01-24 14:21 1,413,862 ------w C:\Program Files\OCT2006_d3dx9_31_x64.cab
2007-01-24 14:21 1,398,718 ------w C:\Program Files\Apr2006_d3dx9_30_x64.cab
2007-01-24 14:21 1,363,684 ------w C:\Program Files\Feb2006_d3dx9_29_x64.cab
2007-01-24 14:21 1,358,864 ------w C:\Program Files\Dec2005_d3dx9_28_x64.cab
2007-01-24 14:21 1,351,430 ------w C:\Program Files\Aug2005_d3dx9_27_x64.cab
2007-01-24 14:21 1,348,242 ------w C:\Program Files\Apr2005_d3dx9_25_x64.cab
2007-01-24 14:21 1,336,890 ------w C:\Program Files\Jun2005_d3dx9_26_x64.cab
2007-01-24 14:21 1,248,387 ------w C:\Program Files\Feb2005_d3dx9_24_x64.cab
2007-01-24 14:21 1,156,363 ------w C:\Program Files\BDANT.cab
2007-01-24 14:21 1,128,177 ------w C:\Program Files\OCT2006_d3dx9_31_x86.cab
2007-01-24 14:21 1,116,109 ------w C:\Program Files\Apr2006_d3dx9_30_x86.cab
2007-01-24 14:21 1,085,608 ------w C:\Program Files\Feb2006_d3dx9_29_x86.cab
2007-01-24 14:21 1,080,344 ------w C:\Program Files\Dec2005_d3dx9_28_x86.cab
2007-01-24 14:21 1,079,850 ------w C:\Program Files\Apr2005_d3dx9_25_x86.cab
2007-01-24 14:21 1,078,532 ------w C:\Program Files\Aug2005_d3dx9_27_x86.cab
2007-01-24 14:21 1,065,813 ------w C:\Program Files\Jun2005_d3dx9_26_x86.cab
2007-01-24 14:21 1,014,113 ------w C:\Program Files\Feb2005_d3dx9_24_x86.cab
.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3A2224A0-B114-4491-9305-FD0E4B55FA1E}]
2007-11-23 02:20 37376 --a------ C:\WINDOWS\system32\urqpnmn.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:03]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Dowmi\OctoshapeClient.exe" [2006-02-13 17:33]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="Rundll32.exe" [2004-08-04 09:03 C:\WINDOWS\system32\rundll32.exe]
"Copperhead"="C:\Program Files\Razer\Copperhead\razerhid.exe" [2005-11-25 10:53]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-14 16:49]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"CTHelper"="CTHELPER.EXE" [2006-08-11 14:56 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 14:56 C:\WINDOWS\system32\CTXFIHLP.EXE]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{3A2224A0-B114-4491-9305-FD0E4B55FA1E}"= C:\WINDOWS\system32\urqpnmn.dll [2007-11-23 02:20 37376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqpnmn]
urqpnmn.dll 2007-11-23 02:20 37376 C:\WINDOWS\system32\urqpnmn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkjg.dll

R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys
R2 ISPMonitorSrv;ISP Monitor;F:\ISP Monitor\ISPMonitorSrv.exe
R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys
R3 UsbFltr;%SvcDisplayName%;C:\WINDOWS\system32\drivers\copperhd.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmFilter;Logitech Gaming HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys
S3 DSDrv4;DSDrv4;\??\F:\DScaler\DSDrv4.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys
S3 O200AVS;Osprey-2X0 AVStream Audio Device;C:\WINDOWS\system32\DRIVERS\o200avs.sys
S3 SetupNTGLM7X;SetupNTGLM7X;\??\I:\NTGLM7X.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {3CBBEE47-C8F4-316A-92FF-ED7E3DFAE41E} /qb
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-26 13:34:06
Windows 5.1.2600 Service Pack 2 NTFS

scannen van verborgen processen ...

scannen van verborgen autostart items ...

scannen van verborgen bestanden ...

Scan succesvol afgerond
verborgen bestanden: 0

**************************************************************************
.
Voltooingstijd: 2007-11-26 13:35:50 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-24 15:31
C:\ComboFix2.txt ... 2007-07-24 15:32
C:\ComboFix3.txt ... 2007-07-21 23:22
.
--- E O F ---

Klik om te vergroten...

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:37:52, on 26/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
F:\ISP Monitor\ISPMonitorSrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Razer\Copperhead\razerhid.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\WinTV\Ir.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Razer\Copperhead\razertra.exe
C:\Program Files\Razer\Copperhead\razerofa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\livecall.exe
F:\mIRC\mirc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\HiJackThis\HiJackThis_v2.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3A2224A0-B114-4491-9305-FD0E4B55FA1E} - C:\WINDOWS\system32\urqpnmn.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Dowmi\OctoshapeClient.exe" -inv:bootrun
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - F:\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - F:\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://www.quadv.com/quadvtv2/Rawflow.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/NL-BE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - Winlogon Notify: urqpnmn - C:\WINDOWS\SYSTEM32\urqpnmn.dll
O22 - SharedTaskScheduler: Preloader van browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Cache-daemon voor onderdeelcategorieën - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: ISP Monitor (ISPMonitorSrv) - How2 Studios - F:\ISP Monitor\ISPMonitorSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 6557 bytes

Klik om te vergroten...

• Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
• Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
• Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
• Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
• Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
• Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
• Klik daarna de groene pijl rechts om de scan te starten.
• Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
• Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
  
• Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
  
  
  
  Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
• Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
• Sluit daarna Dr.Web Cureit.
• Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
• Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post.

• Scroll omlaag naar : "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Klik op de "Download" knop aan de rechterkant.
• Vink aan: "Accept License Agreement".
• De pagina zal herladen.
• Klik op de link om Windows Offline Installation te downloaden met Meerdere-talen, en bewaar het naar je Bureaublad.
• Sluit alle programma's die eventueel open zijn - Zeker je web browser!
• Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java uit de Softwarelijst.
• Vink alles aan met Java Runtime Environment (JRE of J2SE) in de naam.
• Klik dan op Verwijderen of op de Wijzig/Verwijder knop.
• Herhaal dit tot alle oudere versies verdwenen zijn.
• Na het verwijderen van alle oudere versies, herstart je pc.
• Dubbelklik vervolgens op jre-6u3-windows-i586-p.exe op je Bureaublad om de nieuwste versie van Java te installeren.

• Dubbelklik drweb-cureit.exe en sta het toe om de express scan te starten.
• Dit zal de bestanden scannen die momenteel in het geheugen geladen zijn en wanneer er iets gevonden wordt, klik de Yes to all knop bij de vraag 'cure it?'. Dit is enkel een korte scan.
• Eenmaal de korte scan is beeïndigd, Klik Options > Change Settings
• Kies de "Scan"-tab en verwijder het vinkje bij "Heuristic analyse"
• Terug in het hoofdvenster kan je de drives selecteren die je wilt laten scannen.
• Selecteer hier alle drives. Een rood bolletje zal dan tevoorschijn komen op de drives die je laat scannen.
• Klik daarna de groene pijl rechts om de scan te starten.
• Klik 'Yes to all' wanneer er gevraagd wordt om cure of move uit te voeren.
• Wanneer de scan gedaan is, kijk of je volgende icoontje kan aanklikken dat staat naast hetgeen gevonden werd:
  
• Indien wel, klik erop en daarna klik op het icoontje er net onder en kies: Move incurable zoals je zal zien in volgende afbeelding:
  
  
  
  Dit zal de bestanden verplaatsen naar volgende map %userprofile%\DoctorWeb\quarantaine-folder indien het niet gedesinfecteerd kan worden. (dit in het geval dat we samples nodig hebben)
• Na bovenstaande te selecteren, in het menu bovenaan van Dr.Web CureIt, klik file en kies save report list. Bewaar de log op je bureaublad.
• Sluit daarna Dr.Web Cureit.
• Herstart je computer!! Belangrijke stap, want het kan zijn dat Dr.Web Cureit bestanden zal verplaatsen/verwijderen tijdens herstart.
• Na het herstarten, Kopieer en plak de inhoud van die log die je eerder hebt bewaard in je volgende post.