Archief - ctrl probleem

Logfile of HijackThis v1.99.1
Scan saved at 21:19:56, on 18/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
F:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
F:\Program Files\AVPersonal\AVWUPSRV.EXE
F:\WINDOWS\System32\cisvc.exe
F:\WINDOWS\System32\CTSvcCDA.EXE
c:\wamp\apache\Apache.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\D-Tools\daemon.exe
F:\Program Files\AVPersonal\AVGNT.EXE
c:\wamp\mysql\bin\mysqld-nt.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\QuickTime\qttask.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
F:\Program Files\ISP Monitor\isp.exe
F:\WINDOWS\System32\MsPMSPSv.exe
C:\wamp\wampserver.exe
c:\wamp\apache\Apache.exe
F:\WINDOWS\system32\wscntfy.exe
F:\WINDOWS\system32\wuauclt.exe
F:\WINDOWS\system32\cidaemon.exe
C:\Program Files\mIRC\mirc.exe
F:\Program Files\Winamp\winamp.exe
F:\Program Files\MSN Messenger\msnmsgr.exe
F:\Program Files\Mozilla Firefox\firefox.exe
F:\WINDOWS\system32\calc.exe
F:\Documents and Settings\Brouckaert\Bureaublad\Travel.exe
F:\Documents and Settings\Brouckaert\Bureaublad\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.tiswrxopcxobmmhsitry.com...Lj1raxkZIKEOxhEbw/8kQW3egE60/vVvucJpCrTKQ.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rzjsioqwlh.com/iylRYWsv9tjy5Y__Jo407SIAaoKrl9up7hakdjgqdR4.jpg
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://t2o.flexgaming.com/phpBB2
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REGystem.ini: UserInit=F:\WINDOWS\System32\Userinit.exe
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://cq2.mct.nu"); (F:\Documents and Settings\Brouckaert\Application Data\Mozilla\Profiles\default\zk1dpyr7.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://F%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (F:\Documents and Settings\Brouckaert\Application Data\Mozilla\Profiles\default\zk1dpyr7.slt\prefs.js)
O1 - Hosts: 172.19.3.3 michel
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {44A95D8B-F623-4666-E5E8-9F19F2E6A1DB} - F:\DOCUME~1\BROUCK~1\APPLIC~1\CLOCKS~1\nurb phone.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - F:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - F:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll
O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - F:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll
O4 - HKLM\..\Run: [ATIPTA] F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [MessengerPlus3] "F:\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] "F:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [long burn vc nurb] F:\Documents and Settings\All Users\Application Data\bonepinglongburn\open way.exe
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [wayaudio] F:\DOCUME~1\BROUCK~1\APPLIC~1\MATHBA~1\Pile once flaw.exe
O4 - HKCU\..\Run: [ISPMonitor] F:\Program Files\ISP Monitor\isp.exe
O4 - Startup: Polaris X.lnk = C:\mIRCScripts\PolarisX\mirc.exe
O4 - Startup: Snelkoppeling naar mirc.lnk = F:\mIRC\mirc.exe
O4 - Startup: WampServer.lnk = C:\wamp\wampserver.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - F:\Program Files\Poker.com\poker.exe
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: F:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:default.mht!http://www.realizeit.biz/v278/dropper.chm::/dropper.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - F:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Autodesk Licensing Service - Unknown owner - F:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - F:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\System32\HPZipm12.exe
O23 - Service: wampapache - Unknown owner - c:\wamp\apache\Apache.exe" --ntservice (file missing)
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe

Hoi,

* Je hebt een LOP-infectie omdat je messenger plus hebt geïnstalleerd met sponsor.
Als eerste moet je dus Messenger Plus deïnstalleren via: Start > Configuratiescherm > Software

* Start HJT, scan en vink de volgende items aan:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.tiswrxopcxobmmhsitry.com...VvucJpCrTKQ.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rzjsioqwlh.com/iylRYWsv9...7hakdjgqdR4.jpg
O2 - BHO: (no name) - {44A95D8B-F623-4666-E5E8-9F19F2E6A1DB} - F:\DOCUME~1\BROUCK~1\APPLIC~1\CLOCKS~1\nurb phone.exe (file missing)
O4 - HKLM\..\Run: [long burn vc nurb] F:\Documents and Settings\All Users\Application Data\bonepinglongburn\open way.exe
O4 - HKCU\..\Run: [wayaudio] F:\DOCUME~1\BROUCK~1\APPLIC~1\MATHBA~1\Pile once flaw.exe
O16 - DPF: {11120607-1001-1111-1000-110199901123} - ms-its:mhtml:file://c:default.mht!http://www.realizeit.biz/v278/dropper.chm::/dropper.exe
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

* Sluit alle vensters behalve HJT en klik op "Fix checked"

* Verwijder volgende mappen via verkenner:
F:\Documents and Settings\BROUCK~1\Application Data\CLOCKS~1\ <-- de naam van deze map begint met deze 6 karakters
F:\Documents and Settings\All Users\Application Data\bonepinglongburn\

* Open kladblok en kopieer en plak het volgende erin:

dir %Windir%\tasks /a h > files.txt
notepad files.txt

Sla dit op als findjobs.bat , kies voor opslaan als alle bestanden en plaats het op je bureaublad.
Dubbelklik op findjobs.bat en post de inhoud van het txtbestandje die je verkrijgt.

* Herstarten en een nieuw logje plaatsen (samen met het findjob logje )

Het volume in station F heeft geen naam.
Het volumenummer is 2CB4-6C52

Map van F:\WINDOWS\tasks

16/07/2005 17:00 <DIR> .
16/07/2005 17:00 <DIR> ..
20/10/2005 00:00 280 86657C2490A315EC.job
07/09/2001 14:00 65 desktop.ini
20/10/2005 00:04 6 SA.DAT
3 bestand(en) 351 bytes

Map van F:\Documents and Settings\Brouckaert\Bureaublad







Logfile of HijackThis v1.99.1
Scan saved at 0:06:42, on 20/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
F:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
F:\Program Files\AVPersonal\AVWUPSRV.EXE
F:\WINDOWS\System32\cisvc.exe
F:\WINDOWS\System32\CTSvcCDA.EXE
F:\WINDOWS\Explorer.EXE
c:\wamp\apache\Apache.exe
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\D-Tools\daemon.exe
F:\Program Files\AVPersonal\AVGNT.EXE
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\QuickTime\qttask.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
F:\Program Files\ISP Monitor\isp.exe
F:\mIRC\mirc.exe
C:\wamp\wampserver.exe
c:\wamp\mysql\bin\mysqld-nt.exe
F:\WINDOWS\System32\MsPMSPSv.exe
F:\Program Files\Mozilla Firefox\firefox.exe
c:\wamp\apache\Apache.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\WINDOWS\system32\wscntfy.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\wuauclt.exe
F:\WINDOWS\system32\wuauclt.exe
F:\WINDOWS\system32\NOTEPAD.EXE
F:\Documents and Settings\Brouckaert\Bureaublad\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://t2o.flexgaming.com/phpBB2
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
F2 - REGystem.ini: UserInit=F:\WINDOWS\System32\Userinit.exe
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://cq2.mct.nu"); (F:\Documents and Settings\Brouckaert\Application Data\Mozilla\Profiles\default\zk1dpyr7.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://F%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (F:\Documents and Settings\Brouckaert\Application Data\Mozilla\Profiles\default\zk1dpyr7.slt\prefs.js)
O1 - Hosts: 172.19.3.3 michel
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - F:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: Helper Class - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - F:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll
O3 - Toolbar: NavExcel Toolbar - {5AA06644-BC46-4220-A460-47A6EB47C96D} - F:\Program Files\NavExcel Search Toolbar\NavExcelBar.dll
O4 - HKLM\..\Run: [ATIPTA] F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AVGCtrl] "F:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ISPMonitor] F:\Program Files\ISP Monitor\isp.exe
O4 - Startup: Polaris X.lnk = C:\mIRCScripts\PolarisX\mirc.exe
O4 - Startup: Snelkoppeling naar mirc.lnk = F:\mIRC\mirc.exe
O4 - Startup: WampServer.lnk = C:\wamp\wampserver.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - F:\Program Files\Poker.com\poker.exe
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - F:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: F:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - F:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Autodesk Licensing Service - Unknown owner - F:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - F:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - F:\WINDOWS\System32\HPZipm12.exe
O23 - Service: wampapache - Unknown owner - c:\wamp\apache\Apache.exe" --ntservice (file missing)
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe

Hoi,

* Open kladblok en kopieer en plak het volgende erin:

%systemdrive%
cd %WinDir%\Tasks
attrib -r -s -h 86657C2490A315EC.job
del 86657C2490A315EC.job

Sla dit op als remjob.bat , kies onder opslaan voor alle bestanden en plaats het op je bureaublad.
Dubbelklik op remjob.bat.

* Herstarten

* Dubbelklik op Findjobs.bat en post de inhoud van het log nogmaals ter controle.

Het volume in station F heeft geen naam.
Het volumenummer is 2CB4-6C52

Map van F:\WINDOWS\tasks

20/10/2005 21:15 <DIR> .
20/10/2005 21:15 <DIR> ..
07/09/2001 14:00 65 desktop.ini
21/10/2005 22:44 6 SA.DAT
2 bestand(en) 71 bytes

Map van F:\Documents and Settings\Brouckaert\Bureaublad

Ziet er goed uit. Zijn er nog problemen?

Lees volgende instructies om de PC schoon te houden in de toekomst:

Scan de PC af en toe met een online scanner
Dit zijn twee goede online virusscanners:
- Housecall
- Bitdefender

* Update uw antivirussoftware - Het is erg belangrijk dat u uw antivirus software minstens 1 keer per week update (Het liefst vaker). Als u uw antivirus software niet up-to-date houdt is het niet meer in staat om de nieuwste varianten te herkennen/verwijderen.

* Gebruik een Firewall - Ook de firewall is een erg belangrijk onderdeel voor uw computer. Zonder een firewall staat uw computer open voor hackers en kan de computer door hackers worden overgenomen. Indien je nog geen firewall geïnstalleerd hebt raad ik je één van de volgende gratis programma's aan:

- Sygate Personal Firewall
- ZoneAlarm
- Outpost Personal Firewall
- Kerio Personal Firewall

* Bezoek regelmatig de Microsoft's Windows Update Site - Het is belangrijk dat u deze site regelmatig bezoekt. Dit verzekert u ervan dat uw computer altijd de laatste beveiligingsupdates bevat. Als er nieuwe updates zijn, installeer ze dan direct, start uw computer opnieuw op, en bezoek de site opnieuw om te kijken of er nog meer updates geïnstalleerd kunnen worden.

* Installeer Ad-Aware - Download en Installeer Ad-Aware.

* Installeer SpywareBlaster - Het programma houdt alle pop-ups tegen, waardoor de kans kleiner is dat softwarespionnen zich via een webpagina installeren. Het blokkeert ook een groot aantal bekende malafide websites.

* Update al deze programma's regelmatig - Update alle programma's die aangeraden zijn. Zonder regelmatige updates zult u niet beschermd zijn wanneer er nieuwe verdachte programma's uitkomen.