AstroJack

Beste kweezie wabbit, Ik had idd even moeten vermelden wat er gebeurt als ik normaal op probeer te starten: Op het moment dat het voortgangsbalkje van Vista verschijnt, wordt heel even een blauw scherm getoond (te kort om te lezen wat er staat) om vervolgens weer te booten. Opstarten van CD/DVD (en diskette) lukt nog wel. Omdat ik van alle belangrijke data een backup heb, overweeg ik nu om met een schone lei te beginnen. Het is misschien wel handig om de oude harde schijf te proberen te klonen zodat als ik belangrijke data die ik toch nog blijk te missen, misschien alsnog terug kan vinden. Is Clonezilla zo slim dat bij bad sectors het programma dit detecteert en verder leest ipv alsong in een loop terecht komt van het lezen van steeds dezelfde bad sector? Ik zou ook graag de overstap maken van Vista naar Windows 7, wat volgens mij prima zou moeten kunnen met mijn configuratie: gigabyte ga35-ep35-ds3r moederboard, 4GB inten geheugen, Q9300 qua core processor. Groet, Jack

Het lijkt er op dat het klonen niet gaat lukken omdat inmiddels de PC niet meer op wil starten. Wat ik me afvraag is of, mocht het klonen nog lukken, ik niet ook met de nieuwe HDD alsnog problemen ga ondervinden doordat bestanden van DOS enof windows mogelijk beschadigd zijn geraakt door alle ellende met de oude HDD? Worden dat soort fouten immers niet mee gekloond in de image die gemaakt wordt?

Daar was ik inderdaad ook benieuwd naar KW dus dat heb ik gelijk gechecked, HD Tune vond daarna nog 1 damaged block. Mooi resultaat, dus ik denk ik voer CHKDSK nog een keer uit in de veronderstelling dat het dit keer een stuk sneller zou gaan. De eerste keer duurde CHKDSK zeker 8 uur maar ook de tweede keer duurt het zeker zolang (is momenteel nog bezig). Wat me vooral verrast is dat vaak dezelfde bad clusters worden gevonden maar ook nieuwe. Dat kan ik niet helemaal plaatsen omdat HDTune maar 1 damaged block aangaf. Hoe dan ook lijkt het me raadzaam deze schijf te vervangen door een nieuwe. Nu ben ik aan het uitzoeken wat de beste manier is om zonder dat ik windows opnieuw hoef te installeren (+ alle updates + alle overige programmatuur) de nieuwe schijf kan voorzien met alles wat op de oude schijf staat, een soort van 1 op 1 copy dus. Kunnen jullie daar wat over zeggen? Jack

Beste K W, Bedankt voor je reactie. HD TUne heeft de scan uiteindelijk volledig afgerond maar het resultaat is idd niet best, zie de screenshots. Het lijkt er op dat ik de HDD aan het verliezen ben. Kan dit trouwens ook de reden zijn dat sfc niet alles kan 'repareren' zie eerdere bericht/bijlage?. Heeft het zin sfc /scannow nog eens uit te voeren nadat ik je advies heb opgevolgd? Is je advies trouwens hetzelfde als CHKDSK /R?

Ik ben nu de scan met HD Tune aan het uitvoeren maar na 17 minuten heeft ie nog maar 8 GB gehad van de 500. van de ongeveer 80 blokken is al ongeveer een derde damaged. De snelheid waarmee dat gaat was in het begin ongeveer 50 a 60MBsec maar na 10 minuten was dat nog maar 1 MB/s. Ik vrees dat HD Tune het niet gaat redden op deze manier.

Ik vrees dat ik de boosdoener heb gevonden, het lijkt één van mijn twee HHD's te zijn. Nadat ik de kast geopend had en de geheugen bankjes en grafische kaart eruit en er weer ingezet, viel me een zacht klikkend geluid op. Het leek van het moederboard/CPU te komen maar toen ik de hardeschijven één voor één vast pakte voelde ik bij één van de schijven de lees/schrijfkop (denk ik) bewegen steeds gevolgd door een zacht klikje en dat herhaalde zich om de paar seconden. Na verloop van tijd was het weer verdwenen, maar even later was het er weer en op dat moment hing de PC/ toepassing regeert niet e.d. De mogelijk defecte HDD zit op SATA110 van mijn Gigabyte GA EP35-DS3R moederboard, dus ik ga ervan uit dat dit de opstart/windows schijf is, op de andere HDD (SATA111) staat mijn data maar daarop staan ook een aantal programma's geinstalleerd. Op C staan naast mijn 'gebruikers' bestanden afbeeldingen etc. ook de nodige programma's. Vorige week heb ik al eens mijn C schijf getest op mogelijke fouten mbv een progje op mijn UBCD, maar daar kwam toen niets uit. Voordat ik nu ook maar iets ga ondernemen wilde ik jullie advies, hoe nu verder? En klopt mijn aanname dat het de opstart HD is? Bedankt alvast weer voor jullie reactie, Groeten, Jack

Het is niet gelukt om ComboFix te verwijderen. Combofix.exe blijft bestaan. Los daarvan verschijnt heel soms een melding "Het maken van het dialoogvenster over beveiligingsopties door het proces voor aan . . . . . " met de knop OK. Geen idee waar die melding vandaan komt. Bovendien; als ik taakbeheer raadpleeg dan vliegt regelmatig het aantal Harde fouten/min omhoog. Kan dit wijzen op een geheugenprobleem? Wat is de beste manier om hier achter te komen? memtest86? Het logfile sfcdetails heb ik als bijlage bijgevoegd. Ik ben benieuwd naar je bevindingen. Overigens is er niet gevraagd naar installatiedisks. sfcdetails.txt

Ik heb ook een screenshot gemaakt op een willekeurig moment ongeveer 10 minuten na herstart van de PC. Misschien dat je hier ook nog iets aan opvalt

Dat zou heel goed het blauwe scherm geweest kunnen zijn, maar het was heel snel weg Ik heb de uitkomst van het verwijderen in AdwCleaner toegevoegd: Ondertussen blijft het probleem zich voordoen terwijl ik dit zit te typen. Alvast weer bedankt # AdwCleaner v2.105 - Logfile created 01/09/2013 at 14:45:08 # Updated 08/01/2013 by Xplode # Operating system : Windows Vista Ultimate Service Pack 2 (64 bits) # User : Jack - JACK-PC # Boot Mode : Normal # Running from : C:\Users\Jack\Downloads\adwcleaner.exe # Option [Delete] # Switch Used : /DisableAskDetection ***** [services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Program Files (x86)\Conduit Deleted on reboot : C:\Program Files (x86)\DAEMON Tools Toolbar Deleted on reboot : C:\Program Files (x86)\yourfiledownloader Deleted on reboot : C:\Users\Jack\AppData\Local\AVG Security Toolbar Deleted on reboot : C:\Users\Jack\AppData\Local\Conduit Deleted on reboot : C:\Users\Jack\AppData\LocalLow\Conduit Deleted on reboot : C:\Users\Jack\AppData\LocalLow\PriceGong Deleted on reboot : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\Conduit Deleted on reboot : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\ConduitCommon Deleted on reboot : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\CT1060933 Deleted on reboot : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612} Deleted on reboot : C:\Users\Jack\AppData\Roaming\yourfiledownloader File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml File Deleted : C:\Windows\SysWOW64\conduitEngine.tmp ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT1060933 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\Freeze.com Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} Key Deleted : HKLM\Software\YourFileDownloader Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [OK] Registry is clean. -\\ Mozilla Firefox v17.0.1 (nl) File : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\prefs.js Deleted : user_pref("CT1060933..clientLogIsEnabled", true); Deleted : user_pref("CT1060933..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Deleted : user_pref("CT1060933..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Deleted : user_pref("CT1060933.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Deleted : user_pref("CT1060933.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Deleted : user_pref("CT1060933.AppTrackingLastCheckTime", "Thu Nov 22 2012 17:39:24 GMT+0100"); Deleted : user_pref("CT1060933.BrowserCompStateIsOpen_129633202291172081", true); Deleted : user_pref("CT1060933.BrowserCompStateIsOpen_129652058719725628", true); Deleted : user_pref("CT1060933.BrowserCompStateIsOpen_129681785283868963", true); Deleted : user_pref("CT1060933.BrowserCompStateIsOpen_129686665230467549", true); Deleted : user_pref("CT1060933.CTID", "CT1060933"); Deleted : user_pref("CT1060933.CommunitiesChangesLastCheckTime", "Tue Nov 27 2012 09:39:24 GMT+0100"); Deleted : user_pref("CT1060933.CommunitiesChangesLastUrl", "hxxp://grouping.services.conduit.com/GroupingReque[...] Deleted : user_pref("CT1060933.CommunityChanged", true); Deleted : user_pref("CT1060933.CurrentServerDate", "27-11-2012"); Deleted : user_pref("CT1060933.DialogsAlignMode", "LTR"); Deleted : user_pref("CT1060933.DialogsGetterLastCheckTime", "Sun Nov 25 2012 13:38:07 GMT+0100"); Deleted : user_pref("CT1060933.DownloadDomainsCheckInterval", "168"); Deleted : user_pref("CT1060933.DownloadDomainsListLastCheckTime", "Wed Nov 21 2012 17:16:31 GMT+0100"); Deleted : user_pref("CT1060933.DownloadDomainsListLastServerUpdateTime", "1201069983"); Deleted : user_pref("CT1060933.DownloadReferralCookieData", ""); Deleted : user_pref("CT1060933.FirstServerDate", "22-3-2011"); Deleted : user_pref("CT1060933.FirstTime", true); Deleted : user_pref("CT1060933.FirstTimeFF3", true); Deleted : user_pref("CT1060933.FixPageNotFoundErrors", false); Deleted : user_pref("CT1060933.GroupingServerCheckInterval", 1440); Deleted : user_pref("CT1060933.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Deleted : user_pref("CT1060933.HasUserGlobalKeys", true); Deleted : user_pref("CT1060933.HomePageProtectorEnabled", false); Deleted : user_pref("CT1060933.Initialize", true); Deleted : user_pref("CT1060933.InitializeCommonPrefs", true); Deleted : user_pref("CT1060933.InstallationAndCookieDataSentCount", 3); Deleted : user_pref("CT1060933.InstalledDate", "Tue Mar 22 2011 20:03:28 GMT+0100"); Deleted : user_pref("CT1060933.InvalidateCache", false); Deleted : user_pref("CT1060933.IsAlertDBUpdated", true); Deleted : user_pref("CT1060933.IsGrouping", false); Deleted : user_pref("CT1060933.IsMulticommunity", true); Deleted : user_pref("CT1060933.IsOpenThankYouPage", true); Deleted : user_pref("CT1060933.IsOpenUninstallPage", true); Deleted : user_pref("CT1060933.LanguagePackLastCheckTime", "Mon Nov 26 2012 19:38:50 GMT+0100"); Deleted : user_pref("CT1060933.LanguagePackReloadIntervalMM", 1440); Deleted : user_pref("CT1060933.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Deleted : user_pref("CT1060933.LastLogin_3.14.1.0", "Wed Aug 22 2012 08:36:06 GMT+0200"); Deleted : user_pref("CT1060933.LastLogin_3.15.1.0", "Tue Nov 06 2012 18:07:09 GMT+0100"); Deleted : user_pref("CT1060933.LastLogin_3.16.0.3", "Tue Nov 27 2012 09:39:24 GMT+0100"); Deleted : user_pref("CT1060933.LastLogin_3.2.1.3", "Thu Mar 24 2011 13:59:04 GMT+0100"); Deleted : user_pref("CT1060933.LastLogin_3.3.2.1", "Wed May 04 2011 17:39:42 GMT+0200"); Deleted : user_pref("CT1060933.LastLogin_3.3.3.2", "Wed Jun 22 2011 13:20:14 GMT+0200"); Deleted : user_pref("CT1060933.LastLogin_3.5.0.12", "Mon Aug 15 2011 18:13:46 GMT+0200"); Deleted : user_pref("CT1060933.LastLogin_3.6.0.10", "Wed Sep 28 2011 18:20:55 GMT+0200"); Deleted : user_pref("CT1060933.LastLogin_3.7.0.6", "Mon Nov 07 2011 17:55:57 GMT+0100"); Deleted : user_pref("CT1060933.LastLogin_3.8.0.8", "Tue Dec 06 2011 17:19:05 GMT+0100"); Deleted : user_pref("CT1060933.LastLogin_3.8.1.0", "Fri Dec 09 2011 22:07:38 GMT+0100"); Deleted : user_pref("CT1060933.LatestVersion", "3.16.0.3"); Deleted : user_pref("CT1060933.Locale", "en-us"); Deleted : user_pref("CT1060933.MCDetectTooltipHeight", "83"); Deleted : user_pref("CT1060933.MCDetectTooltipShow", true); Deleted : user_pref("CT1060933.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Deleted : user_pref("CT1060933.MCDetectTooltipWidth", "295"); Deleted : user_pref("CT1060933.MyStuffEnabledAtInstallation", true); Deleted : user_pref("CT1060933.RadioIsPodcast", false); Deleted : user_pref("CT1060933.RadioLastCheckTime", "Mon Nov 26 2012 19:39:20 GMT+0100"); Deleted : user_pref("CT1060933.RadioLastUpdateIPServer", "0"); Deleted : user_pref("CT1060933.RadioLastUpdateServer", "129326918102570000"); Deleted : user_pref("CT1060933.RadioMediaID", "21504191"); Deleted : user_pref("CT1060933.RadioMediaType", "Media Player"); Deleted : user_pref("CT1060933.RadioMenuSelectedID", "EBRadioMenu_CT106093321504191"); Deleted : user_pref("CT1060933.RadioShrinkedFromSetup", false); Deleted : user_pref("CT1060933.RadioStationName", "KFOG"); Deleted : user_pref("CT1060933.RadioStationURL", "hxxp://live.cumulusstreaming.com/KFOG-FM"); Deleted : user_pref("CT1060933.RadioVolume", "67"); Deleted : user_pref("CT1060933.SHRINK_TOOLBAR", 1); Deleted : user_pref("CT1060933.SearchEngineBeforeUnload", "Google"); Deleted : user_pref("CT1060933.SearchFromAddressBarIsInit", true); Deleted : user_pref("CT1060933.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT106[...] Deleted : user_pref("CT1060933.SearchInNewTabEnabled", true); Deleted : user_pref("CT1060933.SearchInNewTabIntervalMM", 1440); Deleted : user_pref("CT1060933.SearchInNewTabLastCheckTime", "Mon Nov 26 2012 19:38:49 GMT+0100"); Deleted : user_pref("CT1060933.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Deleted : user_pref("CT1060933.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...] Deleted : user_pref("CT1060933.SearchInNewTabUserEnabled", false); Deleted : user_pref("CT1060933.SearchProtectorEnabled", false); Deleted : user_pref("CT1060933.SearchProtectorToolbarDisabled", true); Deleted : user_pref("CT1060933.ServiceMapLastCheckTime", "Mon Nov 26 2012 19:38:49 GMT+0100"); Deleted : user_pref("CT1060933.SettingsLastCheckTime", "Tue Nov 27 2012 09:39:24 GMT+0100"); Deleted : user_pref("CT1060933.SettingsLastUpdate", "1352142245"); Deleted : user_pref("CT1060933.ThirdPartyComponentsInterval", 504); Deleted : user_pref("CT1060933.ThirdPartyComponentsLastCheck", "Tue Nov 13 2012 07:17:27 GMT+0100"); Deleted : user_pref("CT1060933.ThirdPartyComponentsLastUpdate", "1331805997"); Deleted : user_pref("CT1060933.ToolbarDisabled", true); Deleted : user_pref("CT1060933.ToolbarShrinkedFromSetup", false); Deleted : user_pref("CT1060933.TrusteLinkUrl", "hxxp://trust.conduit.com/CT1060933"); Deleted : user_pref("CT1060933.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Deleted : user_pref("CT1060933.UserID", "UN62666383492897277"); Deleted : user_pref("CT1060933.ValidationData_Search", 2); Deleted : user_pref("CT1060933.ValidationData_Toolbar", 2); Deleted : user_pref("CT1060933.alertChannelId", "15651"); Deleted : user_pref("CT1060933.appApproved.129272674122038321", true); Deleted : user_pref("CT1060933.approveUntrustedApps", false); Deleted : user_pref("CT1060933.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B474[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e.:2z527", "2423"); Deleted : user_pref("CT1060933.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e06cg5el8:", "6E6D6C6E737470717072"); Deleted : user_pref("CT1060933.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A74737274797A76777678242F4B4947[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347513[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...] Deleted : user_pref("CT1060933.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...] Deleted : user_pref("CT1060933.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...] Deleted : user_pref("CT1060933.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...] Deleted : user_pref("CT1060933.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...] Deleted : user_pref("CT1060933.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...] Deleted : user_pref("CT1060933.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...] Deleted : user_pref("CT1060933.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934235[...] Deleted : user_pref("CT1060933.backendstorage./9b-0?3g>d", "3B3C6C3E3D7271737A74454476207C7B4E4B254E7A4E542A52[...] Deleted : user_pref("CT1060933.backendstorage./9b-0?3g@6:5;", ""); Deleted : user_pref("CT1060933.backendstorage./9b-0?3gfa7ef", "393F352F3E"); Deleted : user_pref("CT1060933.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F292A212C393D44307832332[...] Deleted : user_pref("CT1060933.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576"); Deleted : user_pref("CT1060933.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484777213F3E484F4E4D464[...] Deleted : user_pref("CT1060933.backendstorage./9b5ba==9cjag", "3A6A3F6A4271436F7A6F787279767B7D4A7B507A20"); Deleted : user_pref("CT1060933.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6C6E737470717070727976"); Deleted : user_pref("CT1060933.backendstorage./9b90e@8ff=eg", "393F352F3E"); Deleted : user_pref("CT1060933.backendstorage./9b9643g3/9e", "6A"); Deleted : user_pref("CT1060933.backendstorage./9b;45>:bi9i7ie", "2B2E2C3D"); Deleted : user_pref("CT1060933.backendstorage./9b<:222h64<", "393F352F3E"); Deleted : user_pref("CT1060933.backendstorage./9b=+03eh8h8j?:", "4443"); Deleted : user_pref("CT1060933.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...] Deleted : user_pref("CT1060933.backendstorage./9b?b0d:8aj62<h", "6D"); Deleted : user_pref("CT1060933.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B"); Deleted : user_pref("CT1060933.backendstorage.autocompletepro_enable", "31"); Deleted : user_pref("CT1060933.backendstorage.autocompletepro_enable_auto", "31"); Deleted : user_pref("CT1060933.backendstorage.cb_experience_000", "313133"); Deleted : user_pref("CT1060933.backendstorage.cb_firstuse0100", "31"); Deleted : user_pref("CT1060933.backendstorage.cb_user_id_000", "43423630383938333935393638385F46697265666F78")[...] Deleted : user_pref("CT1060933.backendstorage.cbcountry_001", "4E4C"); Deleted : user_pref("CT1060933.backendstorage.cbfirsttime", "547565204F637420313620323031322030303A31383A33302[...] Deleted : user_pref("CT1060933.backendstorage.cbopenmamsettings", "30"); Deleted : user_pref("CT1060933.backendstorage.printitgreenstatus", "74727565"); Deleted : user_pref("CT1060933.backendstorage.shoppingapp.gk.exipres", "536174204F637420323020323031322031343A[...] Deleted : user_pref("CT1060933.backendstorage.shoppingapp.gk.geolocation", "6E65746865726C616E6473"); Deleted : user_pref("CT1060933.backendstorage.url_history0001", "687474703A2F2F7777772E726F73652E6E6C2F70726F6[...] Deleted : user_pref("CT1060933.components.129633202291172081", false); Deleted : user_pref("CT1060933.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...] Deleted : user_pref("CT1060933.globalFirstTimeInfoLastCheckTime", "Tue Nov 20 2012 11:32:48 GMT+0100"); Deleted : user_pref("CT1060933.homepageProtectorEnableByLogin", true); Deleted : user_pref("CT1060933.initDone", true); Deleted : user_pref("CT1060933.isAppTrackingManagerOn", true); Deleted : user_pref("CT1060933.isFirstRadioInstallation", false); Deleted : user_pref("CT1060933.myStuffEnabled", true); Deleted : user_pref("CT1060933.myStuffPublihserMinWidth", 400); Deleted : user_pref("CT1060933.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...] Deleted : user_pref("CT1060933.myStuffServiceIntervalMM", 1440); Deleted : user_pref("CT1060933.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...] Deleted : user_pref("CT1060933.oldAppsList", "200,128346981843587669,128280995260143876,111,129272674122038321[...] Deleted : user_pref("CT1060933.revertSettingsEnabled", true); Deleted : user_pref("CT1060933.searchProtectorDialogDelayInSec", 10); Deleted : user_pref("CT1060933.searchProtectorEnableByLogin", true); Deleted : user_pref("CT1060933.testingCtid", ""); Deleted : user_pref("CT1060933.toolbarAppMetaDataLastCheckTime", "Mon Nov 26 2012 19:38:49 GMT+0100"); Deleted : user_pref("CT1060933.toolbarContextMenuLastCheckTime", "Tue Nov 27 2012 09:39:24 GMT+0100"); Deleted : user_pref("CT1060933.usagesFlag", 2); Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT1060933/CT1060933[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/15651/15317/NL", "\"1-20911[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/NL", "\"0\"")[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT1060933", [...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.2[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.16[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.6.[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT1060933",[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"63433363123173[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT1060933&octid=[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT1060933/CT1060933[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/equaliz[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/minimiz[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/play.gi[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/stop.gi[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/vol.gif[...] Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...] Deleted : user_pref("CommunityToolbar.EngineOwner", ""); Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"); Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "freecorder"); Deleted : user_pref("CommunityToolbar.IsEngineShown", true); Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true); Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Jack\\AppData\\Roaming\\Mozilla\\Fi[...] Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.16.0.3"); Deleted : user_pref("CommunityToolbar.MiniIPageGadgetPosition.hxxp://freecorder.com/fc6/gadget/video.html", "3[...] Deleted : user_pref("CommunityToolbar.MiniIPageGadgetPosition.hxxp://www.applian.com/freecorder-gadget/loader.[...] Deleted : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://freecorder.com/fc6/gadget/video.html", "833x2[...] Deleted : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/agreement/agree.html#pg_e[...] Deleted : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/menu_dlg/pg_dlg.html#pg_e[...] Deleted : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/menu_dlg/pg_dlg.html#pg_e[...] Deleted : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pricegong.conduitapps.com/v4//agreement/agree[...] Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "CT1060933"); Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"); Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "freecorder"); Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.avg.com/route/?d=4ae8daf1&[...] Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT1060933"); Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT1060933"); Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Thu Mar 24 2011 16:48:55 GMT+01[...] Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440); Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Tue Jun 21 2011 22:52:45 GMT+0200"); Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com"); Deleted : user_pref("CommunityToolbar.alert.locale", "en"); Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440); Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Tue Jun 21 2011 22:52:37 GMT+0200"); Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559"); Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20); Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com"); Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false); Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300); Deleted : user_pref("CommunityToolbar.alert.userId", "b3d35dce-e82e-4ad2-821e-67cca4710ec7"); Deleted : user_pref("CommunityToolbar.globalUserId", "514da764-2ef4-478c-9d8f-9219f718d2dd"); Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); Deleted : user_pref("CommunityToolbar.killedEngine", true); Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Nov 21 2012 15:08:3[...] Deleted : user_pref("CommunityToolbar.notifications.alertEnabled", false); Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440); Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Wed Dec 07 2011 17:19:14 GMT+010[...] Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com"); Deleted : user_pref("CommunityToolbar.notifications.firstTimeAlertShown", true); Deleted : user_pref("CommunityToolbar.notifications.locale", "en"); Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440); Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Mon Nov 26 2012 19:38:50 GMT+0100"); Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611"); Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com"); Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false); Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); Deleted : user_pref("CommunityToolbar.notifications.userId", "13fb8f00-2b30-4099-8a57-90dd1d52eb3d"); Deleted : user_pref("CommunityToolbar.undefined", ""); ************************* AdwCleaner[R1].txt - [27845 octets] - [09/01/2013 13:05:18] AdwCleaner[s1].txt - [27552 octets] - [09/01/2013 14:45:08] ########## EOF - C:\AdwCleaner[s1].txt - [27613 octets] ##########

Eerste keer uitvoeren van AVG 2013 Removal Tool 64 bits gaf uiteindeijk een blauw scherm/reboot. tweede keer heb ik het als administrator uitgevoerd, dat ging goed. Vervolgens AdwCleaner uitgevoerd, wat me daarbij opvalr is dat in het startscherm van AdwCleaner alleen de knoppen verschijnen en niet de merknaam met 'by Xplode". Overigens kost het veel moeite om uberhaupt iets probleemloos uit te voeren of het nu firefox (ook iexplorer) is of taakbeheer of welk ander programma ook: vaak traag opstarten (soms helemaal niet) en als het dan opgestart is resulteert vrijwel elke actie in wachten en met name in firefox/iezplorer geeft telkens programma reageert niet. maar het logfile is iig gelukt # AdwCleaner v2.105 - Logfile created 01/09/2013 at 13:05:18 # Updated 08/01/2013 by Xplode # Operating system : Windows Vista Ultimate Service Pack 2 (64 bits) # User : Jack - JACK-PC # Boot Mode : Normal # Running from : C:\Users\Jack\Downloads\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml File Found : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\searchplugins\Askcom.xml File Found : C:\Windows\SysWOW64\conduitEngine.tmp Folder Found : C:\Program Files (x86)\Conduit Folder Found : C:\Program Files (x86)\DAEMON Tools Toolbar Folder Found : C:\Program Files (x86)\yourfiledownloader Folder Found : C:\ProgramData\Ask Folder Found : C:\Users\Jack\AppData\Local\AVG Security Toolbar Folder Found : C:\Users\Jack\AppData\Local\Conduit Folder Found : C:\Users\Jack\AppData\LocalLow\Conduit Folder Found : C:\Users\Jack\AppData\LocalLow\PriceGong Folder Found : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\Conduit Folder Found : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\ConduitCommon Folder Found : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\CT1060933 Folder Found : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612} Folder Found : C:\Users\Jack\AppData\Roaming\yourfiledownloader ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\Conduit Key Found : HKCU\Software\AppDataLow\Software\PriceGong Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKCU\Software\Ask&Record Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT1060933 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Found : HKLM\Software\Conduit Key Found : HKLM\Software\Freeze.com Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} Key Found : HKLM\Software\YourFileDownloader Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Key Found : HKU\S-1-5-21-4219763062-4223626-4134929344-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [OK] Registry is clean. -\\ Mozilla Firefox v17.0.1 (nl) File : C:\Users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\prefs.js Found : user_pref("CT1060933..clientLogIsEnabled", true); Found : user_pref("CT1060933..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...] Found : user_pref("CT1060933..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...] Found : user_pref("CT1060933.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); Found : user_pref("CT1060933.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx"); Found : user_pref("CT1060933.AppTrackingLastCheckTime", "Thu Nov 22 2012 17:39:24 GMT+0100"); Found : user_pref("CT1060933.BrowserCompStateIsOpen_129633202291172081", true); Found : user_pref("CT1060933.BrowserCompStateIsOpen_129652058719725628", true); Found : user_pref("CT1060933.BrowserCompStateIsOpen_129681785283868963", true); Found : user_pref("CT1060933.BrowserCompStateIsOpen_129686665230467549", true); Found : user_pref("CT1060933.CTID", "CT1060933"); Found : user_pref("CT1060933.CommunitiesChangesLastCheckTime", "Tue Nov 27 2012 09:39:24 GMT+0100"); Found : user_pref("CT1060933.CommunitiesChangesLastUrl", "hxxp://grouping.services.conduit.com/GroupingReque[...] Found : user_pref("CT1060933.CommunityChanged", true); Found : user_pref("CT1060933.CurrentServerDate", "27-11-2012"); Found : user_pref("CT1060933.DialogsAlignMode", "LTR"); Found : user_pref("CT1060933.DialogsGetterLastCheckTime", "Sun Nov 25 2012 13:38:07 GMT+0100"); Found : user_pref("CT1060933.DownloadDomainsCheckInterval", "168"); Found : user_pref("CT1060933.DownloadDomainsListLastCheckTime", "Wed Nov 21 2012 17:16:31 GMT+0100"); Found : user_pref("CT1060933.DownloadDomainsListLastServerUpdateTime", "1201069983"); Found : user_pref("CT1060933.DownloadReferralCookieData", ""); Found : user_pref("CT1060933.FirstServerDate", "22-3-2011"); Found : user_pref("CT1060933.FirstTime", true); Found : user_pref("CT1060933.FirstTimeFF3", true); Found : user_pref("CT1060933.FixPageNotFoundErrors", false); Found : user_pref("CT1060933.GroupingServerCheckInterval", 1440); Found : user_pref("CT1060933.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/"); Found : user_pref("CT1060933.HasUserGlobalKeys", true); Found : user_pref("CT1060933.HomePageProtectorEnabled", false); Found : user_pref("CT1060933.Initialize", true); Found : user_pref("CT1060933.InitializeCommonPrefs", true); Found : user_pref("CT1060933.InstallationAndCookieDataSentCount", 3); Found : user_pref("CT1060933.InstalledDate", "Tue Mar 22 2011 20:03:28 GMT+0100"); Found : user_pref("CT1060933.InvalidateCache", false); Found : user_pref("CT1060933.IsAlertDBUpdated", true); Found : user_pref("CT1060933.IsGrouping", false); Found : user_pref("CT1060933.IsMulticommunity", true); Found : user_pref("CT1060933.IsOpenThankYouPage", true); Found : user_pref("CT1060933.IsOpenUninstallPage", true); Found : user_pref("CT1060933.LanguagePackLastCheckTime", "Mon Nov 26 2012 19:38:50 GMT+0100"); Found : user_pref("CT1060933.LanguagePackReloadIntervalMM", 1440); Found : user_pref("CT1060933.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...] Found : user_pref("CT1060933.LastLogin_3.14.1.0", "Wed Aug 22 2012 08:36:06 GMT+0200"); Found : user_pref("CT1060933.LastLogin_3.15.1.0", "Tue Nov 06 2012 18:07:09 GMT+0100"); Found : user_pref("CT1060933.LastLogin_3.16.0.3", "Tue Nov 27 2012 09:39:24 GMT+0100"); Found : user_pref("CT1060933.LastLogin_3.2.1.3", "Thu Mar 24 2011 13:59:04 GMT+0100"); Found : user_pref("CT1060933.LastLogin_3.3.2.1", "Wed May 04 2011 17:39:42 GMT+0200"); Found : user_pref("CT1060933.LastLogin_3.3.3.2", "Wed Jun 22 2011 13:20:14 GMT+0200"); Found : user_pref("CT1060933.LastLogin_3.5.0.12", "Mon Aug 15 2011 18:13:46 GMT+0200"); Found : user_pref("CT1060933.LastLogin_3.6.0.10", "Wed Sep 28 2011 18:20:55 GMT+0200"); Found : user_pref("CT1060933.LastLogin_3.7.0.6", "Mon Nov 07 2011 17:55:57 GMT+0100"); Found : user_pref("CT1060933.LastLogin_3.8.0.8", "Tue Dec 06 2011 17:19:05 GMT+0100"); Found : user_pref("CT1060933.LastLogin_3.8.1.0", "Fri Dec 09 2011 22:07:38 GMT+0100"); Found : user_pref("CT1060933.LatestVersion", "3.16.0.3"); Found : user_pref("CT1060933.Locale", "en-us"); Found : user_pref("CT1060933.MCDetectTooltipHeight", "83"); Found : user_pref("CT1060933.MCDetectTooltipShow", true); Found : user_pref("CT1060933.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); Found : user_pref("CT1060933.MCDetectTooltipWidth", "295"); Found : user_pref("CT1060933.MyStuffEnabledAtInstallation", true); Found : user_pref("CT1060933.RadioIsPodcast", false); Found : user_pref("CT1060933.RadioLastCheckTime", "Mon Nov 26 2012 19:39:20 GMT+0100"); Found : user_pref("CT1060933.RadioLastUpdateIPServer", "0"); Found : user_pref("CT1060933.RadioLastUpdateServer", "129326918102570000"); Found : user_pref("CT1060933.RadioMediaID", "21504191"); Found : user_pref("CT1060933.RadioMediaType", "Media Player"); Found : user_pref("CT1060933.RadioMenuSelectedID", "EBRadioMenu_CT106093321504191"); Found : user_pref("CT1060933.RadioShrinkedFromSetup", false); Found : user_pref("CT1060933.RadioStationName", "KFOG"); Found : user_pref("CT1060933.RadioStationURL", "hxxp://live.cumulusstreaming.com/KFOG-FM"); Found : user_pref("CT1060933.RadioVolume", "67"); Found : user_pref("CT1060933.SHRINK_TOOLBAR", 1); Found : user_pref("CT1060933.SearchEngineBeforeUnload", "Google"); Found : user_pref("CT1060933.SearchFromAddressBarIsInit", true); Found : user_pref("CT1060933.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT106[...] Found : user_pref("CT1060933.SearchInNewTabEnabled", true); Found : user_pref("CT1060933.SearchInNewTabIntervalMM", 1440); Found : user_pref("CT1060933.SearchInNewTabLastCheckTime", "Mon Nov 26 2012 19:38:49 GMT+0100"); Found : user_pref("CT1060933.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...] Found : user_pref("CT1060933.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...] Found : user_pref("CT1060933.SearchInNewTabUserEnabled", false); Found : user_pref("CT1060933.SearchProtectorEnabled", false); Found : user_pref("CT1060933.SearchProtectorToolbarDisabled", true); Found : user_pref("CT1060933.ServiceMapLastCheckTime", "Mon Nov 26 2012 19:38:49 GMT+0100"); Found : user_pref("CT1060933.SettingsLastCheckTime", "Tue Nov 27 2012 09:39:24 GMT+0100"); Found : user_pref("CT1060933.SettingsLastUpdate", "1352142245"); Found : user_pref("CT1060933.ThirdPartyComponentsInterval", 504); Found : user_pref("CT1060933.ThirdPartyComponentsLastCheck", "Tue Nov 13 2012 07:17:27 GMT+0100"); Found : user_pref("CT1060933.ThirdPartyComponentsLastUpdate", "1331805997"); Found : user_pref("CT1060933.ToolbarDisabled", true); Found : user_pref("CT1060933.ToolbarShrinkedFromSetup", false); Found : user_pref("CT1060933.TrusteLinkUrl", "hxxp://trust.conduit.com/CT1060933"); Found : user_pref("CT1060933.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...] Found : user_pref("CT1060933.UserID", "UN62666383492897277"); Found : user_pref("CT1060933.ValidationData_Search", 2); Found : user_pref("CT1060933.ValidationData_Toolbar", 2); Found : user_pref("CT1060933.alertChannelId", "15651"); Found : user_pref("CT1060933.appApproved.129272674122038321", true); Found : user_pref("CT1060933.approveUntrustedApps", false); Found : user_pref("CT1060933.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B474[...] Found : user_pref("CT1060933.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...] Found : user_pref("CT1060933.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...] Found : user_pref("CT1060933.backendstorage./9b+7e.:2z527", "2423"); Found : user_pref("CT1060933.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...] Found : user_pref("CT1060933.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...] Found : user_pref("CT1060933.backendstorage./9b+7e06cg5el8:", "6E6D6C6E737470717072"); Found : user_pref("CT1060933.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A74737274797A76777678242F4B4947[...] Found : user_pref("CT1060933.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...] Found : user_pref("CT1060933.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...] Found : user_pref("CT1060933.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...] Found : user_pref("CT1060933.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...] Found : user_pref("CT1060933.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...] Found : user_pref("CT1060933.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...] Found : user_pref("CT1060933.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...] Found : user_pref("CT1060933.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347513[...] Found : user_pref("CT1060933.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...] Found : user_pref("CT1060933.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...] Found : user_pref("CT1060933.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...] Found : user_pref("CT1060933.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...] Found : user_pref("CT1060933.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...] Found : user_pref("CT1060933.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...] Found : user_pref("CT1060933.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...] Found : user_pref("CT1060933.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...] Found : user_pref("CT1060933.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...] Found : user_pref("CT1060933.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...] Found : user_pref("CT1060933.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...] Found : user_pref("CT1060933.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...] Found : user_pref("CT1060933.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...] Found : user_pref("CT1060933.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...] Found : user_pref("CT1060933.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934235[...] Found : user_pref("CT1060933.backendstorage./9b-0?3g>d", "3B3C6C3E3D7271737A74454476207C7B4E4B254E7A4E542A52[...] Found : user_pref("CT1060933.backendstorage./9b-0?3g@6:5;", ""); Found : user_pref("CT1060933.backendstorage./9b-0?3gfa7ef", "393F352F3E"); Found : user_pref("CT1060933.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F292A212C393D44307832332[...] Found : user_pref("CT1060933.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576"); Found : user_pref("CT1060933.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484777213F3E484F4E4D464[...] Found : user_pref("CT1060933.backendstorage./9b5ba==9cjag", "3A6A3F6A4271436F7A6F787279767B7D4A7B507A20"); Found : user_pref("CT1060933.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6C6E737470717070727976"); Found : user_pref("CT1060933.backendstorage./9b90e@8ff=eg", "393F352F3E"); Found : user_pref("CT1060933.backendstorage./9b9643g3/9e", "6A"); Found : user_pref("CT1060933.backendstorage./9b;45>:bi9i7ie", "2B2E2C3D"); Found : user_pref("CT1060933.backendstorage./9b<:222h64<", "393F352F3E"); Found : user_pref("CT1060933.backendstorage./9b=+03eh8h8j?:", "4443"); Found : user_pref("CT1060933.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...] Found : user_pref("CT1060933.backendstorage./9b?b0d:8aj62<h", "6D"); Found : user_pref("CT1060933.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B"); Found : user_pref("CT1060933.backendstorage.autocompletepro_enable", "31"); Found : user_pref("CT1060933.backendstorage.autocompletepro_enable_auto", "31"); Found : user_pref("CT1060933.backendstorage.cb_experience_000", "313133"); Found : user_pref("CT1060933.backendstorage.cb_firstuse0100", "31"); Found : user_pref("CT1060933.backendstorage.cb_user_id_000", "43423630383938333935393638385F46697265666F78")[...] Found : user_pref("CT1060933.backendstorage.cbcountry_001", "4E4C"); Found : user_pref("CT1060933.backendstorage.cbfirsttime", "547565204F637420313620323031322030303A31383A33302[...] Found : user_pref("CT1060933.backendstorage.cbopenmamsettings", "30"); Found : user_pref("CT1060933.backendstorage.printitgreenstatus", "74727565"); Found : user_pref("CT1060933.backendstorage.shoppingapp.gk.exipres", "536174204F637420323020323031322031343A[...] Found : user_pref("CT1060933.backendstorage.shoppingapp.gk.geolocation", "6E65746865726C616E6473"); Found : user_pref("CT1060933.backendstorage.url_history0001", "687474703A2F2F7777772E726F73652E6E6C2F70726F6[...] Found : user_pref("CT1060933.components.129633202291172081", false); Found : user_pref("CT1060933.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...] Found : user_pref("CT1060933.globalFirstTimeInfoLastCheckTime", "Tue Nov 20 2012 11:32:48 GMT+0100"); Found : user_pref("CT1060933.homepageProtectorEnableByLogin", true); Found : user_pref("CT1060933.initDone", true); Found : user_pref("CT1060933.isAppTrackingManagerOn", true); Found : user_pref("CT1060933.isFirstRadioInstallation", false); Found : user_pref("CT1060933.myStuffEnabled", true); Found : user_pref("CT1060933.myStuffPublihserMinWidth", 400); Found : user_pref("CT1060933.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...] Found : user_pref("CT1060933.myStuffServiceIntervalMM", 1440); Found : user_pref("CT1060933.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...] Found : user_pref("CT1060933.oldAppsList", "200,128346981843587669,128280995260143876,111,129272674122038321[...] Found : user_pref("CT1060933.revertSettingsEnabled", true); Found : user_pref("CT1060933.searchProtectorDialogDelayInSec", 10); Found : user_pref("CT1060933.searchProtectorEnableByLogin", true); Found : user_pref("CT1060933.testingCtid", ""); Found : user_pref("CT1060933.toolbarAppMetaDataLastCheckTime", "Mon Nov 26 2012 19:38:49 GMT+0100"); Found : user_pref("CT1060933.toolbarContextMenuLastCheckTime", "Tue Nov 27 2012 09:39:24 GMT+0100"); Found : user_pref("CT1060933.usagesFlag", 2); Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT1060933/CT1060933[...] Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/15651/15317/NL", "\"1-20911[...] Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/NL", "\"0\"")[...] Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT1060933", [...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...] Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.2[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.16[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.6.[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...] Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...] Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT1060933",[...] Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"63433363123173[...] Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...] Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...] Found : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT1060933&octid=[...] Found : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT1060933/CT1060933[...] Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/equaliz[...] Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/minimiz[...] Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/play.gi[...] Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/stop.gi[...] Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Cornflower/vol.gif[...] Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...] Found : user_pref("CommunityToolbar.EngineOwner", ""); Found : user_pref("CommunityToolbar.EngineOwnerGuid", "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"); Found : user_pref("CommunityToolbar.EngineOwnerToolbarId", "freecorder"); Found : user_pref("CommunityToolbar.IsEngineShown", true); Found : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true); Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Jack\\AppData\\Roaming\\Mozilla\\Fi[...] Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.16.0.3"); Found : user_pref("CommunityToolbar.MiniIPageGadgetPosition.hxxp://freecorder.com/fc6/gadget/video.html", "3[...] Found : user_pref("CommunityToolbar.MiniIPageGadgetPosition.hxxp://www.applian.com/freecorder-gadget/loader.[...] Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://freecorder.com/fc6/gadget/video.html", "833x2[...] Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/agreement/agree.html#pg_e[...] Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/menu_dlg/pg_dlg.html#pg_e[...] Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/menu_dlg/pg_dlg.html#pg_e[...] Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pricegong.conduitapps.com/v4//agreement/agree[...] Found : user_pref("CommunityToolbar.OriginalEngineOwner", "CT1060933"); Found : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"); Found : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "freecorder"); Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.avg.com/route/?d=4ae8daf1&[...] Found : user_pref("CommunityToolbar.ToolbarsList", "CT1060933"); Found : user_pref("CommunityToolbar.ToolbarsList2", "CT1060933"); Found : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Thu Mar 24 2011 16:48:55 GMT+01[...] Found : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440); Found : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Tue Jun 21 2011 22:52:45 GMT+0200"); Found : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com"); Found : user_pref("CommunityToolbar.alert.locale", "en"); Found : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440); Found : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Tue Jun 21 2011 22:52:37 GMT+0200"); Found : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559"); Found : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20); Found : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com"); Found : user_pref("CommunityToolbar.alert.showTrayIcon", false); Found : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300); Found : user_pref("CommunityToolbar.alert.userId", "b3d35dce-e82e-4ad2-821e-67cca4710ec7"); Found : user_pref("CommunityToolbar.globalUserId", "514da764-2ef4-478c-9d8f-9219f718d2dd"); Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); Found : user_pref("CommunityToolbar.killedEngine", true); Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Nov 21 2012 15:08:3[...] Found : user_pref("CommunityToolbar.notifications.alertEnabled", false); Found : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440); Found : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Wed Dec 07 2011 17:19:14 GMT+010[...] Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com"); Found : user_pref("CommunityToolbar.notifications.firstTimeAlertShown", true); Found : user_pref("CommunityToolbar.notifications.locale", "en"); Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440); Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Mon Nov 26 2012 19:38:50 GMT+0100"); Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611"); Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com"); Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false); Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); Found : user_pref("CommunityToolbar.notifications.userId", "13fb8f00-2b30-4099-8a57-90dd1d52eb3d"); Found : user_pref("CommunityToolbar.undefined", ""); Found : user_pref("browser.search.defaultengine", "Ask.com"); Found : user_pref("browser.search.defaultenginename", "Ask.com"); Found : user_pref("browser.search.order.1", "Ask.com"); ************************* AdwCleaner[R1].txt - [27724 octets] - [09/01/2013 13:05:18] ########## EOF - C:\AdwCleaner[R1].txt - [27785 octets] ##########

Ik heb ComboFix gedraaid. Dat is goed verlopen op een melding na van Avira dat er een block geweest is vanwege een poging de registry te benaderen. Ik had Avira wel disabled. Verder heb ik de inhoud van logfile bijgevoed. Het lukte me wederom niet om het logfile via beheer bijlagen bij te voegen als bijlage. Vriendelijke groeten, Jack ComboFix 13-01-06.01 - Jack 08-01-2013 15:33:47.1.4 - x64 Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.31.1033.18.4094.2463 [GMT 1:00] Gestart vanuit: c:\users\Jack\Desktop\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Jack\AppData\Roaming\.# c:\windows\NCLAUNCH.EXe . . (((((((((((((((((((( Bestanden Gemaakt van 2012-12-08 to 2013-01-08 )))))))))))))))))))))))))))))) . . 2013-01-08 14:50 . 2013-01-08 14:50 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2013-01-08 14:50 . 2013-01-08 14:50 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-01-07 12:10 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0D7F2DAA-04BD-4135-B02D-8D053FEFA703}\mpengine.dll 2013-01-06 20:13 . 2013-01-06 20:13 -------- d-----w- c:\users\Jack\AppData\Roaming\Malwarebytes 2013-01-06 20:13 . 2013-01-06 20:13 -------- d-----w- c:\programdata\Malwarebytes 2013-01-06 20:13 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-12-31 18:10 . 2012-12-31 18:10 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-12-31 18:10 . 2012-12-31 18:10 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-12-24 17:53 . 2009-04-11 07:10 42496 -c--a-w- c:\programdata\Microsoft\Windows\WER\ReportQueue\Report0ace7293\TrustedInstaller.exe 2012-12-21 07:12 . 2012-12-16 13:31 48128 ----a-w- c:\windows\system32\atmlib.dll 2012-12-21 07:12 . 2012-12-16 13:12 34304 ----a-w- c:\windows\SysWow64\atmlib.dll 2012-12-21 07:12 . 2012-12-16 11:08 368128 ----a-w- c:\windows\system32\atmfd.dll 2012-12-21 07:12 . 2012-12-16 10:50 293376 ----a-w- c:\windows\SysWow64\atmfd.dll 2012-12-20 20:26 . 2013-01-08 13:37 -------- d-----w- c:\program files (x86)\SpywareBlaster 2012-12-16 18:36 . 2008-01-21 02:47 20992 -c--a-w- c:\programdata\Microsoft\Windows\WER\ReportQueue\Report19e445e8\LogonUI.exe 2012-12-15 13:45 . 2012-12-15 13:45 -------- d-----w- c:\users\Jack\AppData\Roaming\Avira 2012-12-15 13:39 . 2012-12-03 14:36 129216 ----a-w- c:\windows\system32\drivers\avipbb.sys 2012-12-15 13:39 . 2012-12-03 14:36 99912 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2012-12-15 13:39 . 2012-11-16 19:17 27800 ----a-w- c:\windows\system32\drivers\avkmgr.sys 2012-12-15 13:39 . 2012-12-15 13:39 -------- d-----w- c:\programdata\Avira 2012-12-15 13:39 . 2012-12-15 13:39 -------- d-----w- c:\program files (x86)\Avira 2012-12-15 13:27 . 2012-12-15 13:27 -------- d-----w- c:\users\Jack\AppData\Local\Avg2013 2012-12-12 07:31 . 2012-11-14 05:53 96768 ----a-w- c:\windows\system32\mshtmled.dll 2012-12-12 07:30 . 2012-09-28 16:34 1210368 ----a-w- c:\windows\system32\kernel32.dll 2012-12-12 07:30 . 2012-08-21 11:50 267648 ----a-w- c:\windows\system32\drivers\volsnap.sys 2012-12-12 07:29 . 2012-11-13 01:55 2770432 ----a-w- c:\windows\system32\win32k.sys 2012-12-12 07:29 . 2012-11-13 01:45 2048 ----a-w- c:\windows\system32\tzres.dll 2012-12-12 07:29 . 2012-11-13 01:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2012-12-12 07:28 . 2012-11-02 10:45 477696 ----a-w- c:\windows\system32\dpnet.dll 2012-12-12 07:28 . 2012-11-02 10:45 68096 ----a-w- c:\windows\system32\dpnathlp.dll 2012-12-12 07:28 . 2012-11-02 10:18 376320 ----a-w- c:\windows\SysWow64\dpnet.dll 2012-12-12 07:28 . 2012-11-02 08:59 26112 ----a-w- c:\windows\system32\dpnsvr.exe 2012-12-12 07:28 . 2012-11-02 08:26 23040 ----a-w- c:\windows\SysWow64\dpnsvr.exe . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-30 13:26 . 2012-10-27 08:17 236216 ----a-w- c:\windows\system32\drivers\RapportKE64.sys 2012-12-12 07:34 . 2006-11-02 12:35 67413224 ----a-w- c:\windows\system32\mrt.exe 2012-10-25 02:12 . 2012-10-25 02:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2012-10-25 02:12 . 2012-10-25 02:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts 2012-10-10 20:23 . 2012-10-10 20:23 1867112 ----a-w- c:\windows\SysWow64\nvcuvenc.dll 2012-10-10 20:23 . 2009-07-14 23:54 18252136 ----a-w- c:\windows\system32\nvd3dumx.dll 2012-10-10 20:23 . 2012-10-10 20:23 1482600 ----a-w- c:\windows\system32\nvdispgenco64.dll 2012-10-10 20:23 . 2012-10-10 20:23 6127464 ----a-w- c:\windows\SysWow64\nvopencl.dll 2012-10-10 20:23 . 2012-10-10 20:23 2574696 ----a-w- c:\windows\SysWow64\nvcuvid.dll 2012-10-10 20:23 . 2012-10-10 20:23 25256296 ----a-w- c:\windows\system32\nvcompiler.dll 2012-10-10 20:23 . 2012-10-10 20:23 7414632 ----a-w- c:\windows\system32\nvopencl.dll 2012-10-10 20:23 . 2009-07-14 23:54 2731880 ----a-w- c:\windows\system32\nvapi64.dll 2012-10-10 20:23 . 2012-10-10 20:23 14922600 ----a-w- c:\windows\system32\nvwgf2umx.dll 2012-10-10 20:23 . 2012-10-10 20:23 9146728 ----a-w- c:\windows\system32\nvcuda.dll 2012-10-10 20:23 . 2012-10-10 20:23 7697768 ----a-w- c:\windows\SysWow64\nvcuda.dll 2012-10-10 20:23 . 2012-10-10 20:23 2218344 ----a-w- c:\windows\system32\nvcuvenc.dll 2012-10-10 20:23 . 2010-07-10 04:38 12501352 ----a-w- c:\windows\SysWow64\nvwgf2um.dll 2012-10-10 20:22 . 2010-07-10 04:38 2428776 ----a-w- c:\windows\SysWow64\nvapi.dll 2012-10-10 20:22 . 2012-10-10 20:22 26331496 ----a-w- c:\windows\system32\nvoglv64.dll 2012-10-10 20:22 . 2011-08-30 13:53 1760104 ----a-w- c:\windows\system32\nvdispco64.dll 2012-10-10 20:22 . 2012-10-10 20:22 15309160 ----a-w- c:\windows\SysWow64\nvd3dum.dll 2012-10-10 20:22 . 2012-10-10 20:22 2747240 ----a-w- c:\windows\system32\nvcuvid.dll 2012-10-10 20:22 . 2012-10-10 20:22 19906920 ----a-w- c:\windows\SysWow64\nvoglv32.dll 2012-10-10 20:22 . 2012-10-10 20:22 13443944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys 2012-10-10 20:22 . 2012-10-10 20:22 17559912 ----a-w- c:\windows\SysWow64\nvcompiler.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 94208 ----a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-02 39408] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2009-12-08 611712] "Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2012-07-31 41944] "Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2012-07-30 640480] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008] "ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424] "ArcSoft MediaImpression Monitor"="c:\program files (x86)\Kodak\MediaImpression\ArcMonitor.exe" [2010-12-15 80448] "FUFAXSTM"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-02 847872] "EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-12-04 384800] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="userinit.exe" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2009-12-08 288112] S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048] . . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . Inhoud van de 'Gedeelde Taken' map . 2013-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-06 08:21] . 2013-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-06 08:21] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-06-30 04:19 97792 ----a-w- c:\users\Jack\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Bluetooth Connection Assistant"="LBTWIZ.EXE -silent" [X] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-18 8067616] "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-01-27 1612880] . ------- Bijkomende Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Jack\AppData\Roaming\Mozilla\Firefox\Profiles\g1abqqub.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://cookievrij.nos.nl/ FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q= FF - ExtSQL: !HIDDEN! 2009-10-01 20:42; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension . - - - - ORPHANS VERWIJDERD - - - - . Wow6432Node-HKCU-Run-AdobeBridge - (no file) SafeBoot-WudfPf SafeBoot-WudfRd WebBrowser-{1392B8D2-5C05-419F-A8F6-B9F15A596612} - (no file) . . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*1*] @="?????????????????? v1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*1*\CLSID] @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*2*] @="?????????????????? v2" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\VideoLAN.VLCPlugin.*2*\CLSID] @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*] @="?????????????????? v1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID] @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*] @="?????????????????? v2" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID] @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Voltooingstijd: 2013-01-08 15:56:14 ComboFix-quarantined-files.txt 2013-01-08 14:56 . Pre-Run: 268.370.227.200 bytes beschikbaar Post-Run: 267.315.109.888 bytes beschikbaar . - - End Of File - - 7071A3FEB19BFC1E6239FE2458CE3CA0

Hoi Mako, Ik heb alles uitgevoerd. Dat ging goed. MalwareBytes geeft geen 'gevaarlijke objecten'. De PC heeft nog steeds dezelfde kuren, bovendien lukt het me nu niet meer om het Hijack logbestand als bijlage bij te voegen. 'Beheer Bijlagen' geeft aan dat het bestand Invalid is. Overigens heb ik ook grote problemen om uberhaupt het bestand te selecteren (soms staat het bestand er en soms niet). Ik heb de inhoud van zowel MalwareBytes log en Hijack log maar even geplakt in dit bericht. De scan is uitgevoerd nadat ik de eerder door jou aangegeven items heb laten fixen door HijackThis. Wat opvalt is dat twee van de items er nog steeds (of weer) staan. Ik hoop dat je hier wat mee kunt Alvast bedankt, vriendelijke groeten, Jack Malwarebytes Anti-Malware 1.70.0.1100 Malwarebytes : Free anti-malware download Databaseversie: v2013.01.08.04 Windows Vista Service Pack 2 x64 NTFS Internet Explorer 9.0.8112.16421 Jack :: JACK-PC [administrator] 8-1-2013 12:13:43 mbam-log-2013-01-08 (12-13-43).txt Scan type: Snelle scan Ingeschakelde scan opties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM | P2P Uitgeschakelde scan opties: Objecten gescand: 236545 Verstreken tijd: 4 minuut/minuten, 35 seconde(n) Geheugenprocessen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Geheugenmodulen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registersleutels gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registerwaarden gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registerdata gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Mappen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Bestanden gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) (einde) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 13:24:17, on 8-1-2013 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.8112.16457) Boot mode: Normal Running processes: C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files (x86)\Kodak\MediaImpression\ArcMonitor.exe C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Users\Jack\Downloads\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm F2 - REG:system.ini: UserInit=userinit.exe O1 - Hosts: ::1 localhost O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [ArcSoft Connection Service] "C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" O4 - HKLM\..\Run: [ArcSoft MediaImpression Monitor] "C:\Program Files (x86)\Kodak\MediaImpression\ArcMonitor.exe" O4 - HKLM\..\Run: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe" O4 - HKLM\..\Run: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [EPSON SX620FW Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGBE.EXE /FU "C:\Windows\TEMP\E_S4337.tmp" /EF "HKCU" O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - ABBYY - C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files (x86)\GIGABYTE\GEST\GSvr.exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files (x86)\Maxtor\Sync\SyncServices.exe O23 - Service: mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit (mi-raysat_3dsmax2010_32) - Unknown owner - C:\Program Files (x86)\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 13344 bytes

Hierbij het complete logje (hoop ik). Wat me trouwens opvalt is dat wanneer er weer eens een programma niet reageert dit (tijdelijk) verholpen lijk te worden door alleen al het starten van taakbeheer. In taak beheer zie ik verder ook dat wanneer ik vervolgens een programma opstart, het proces dat verschijnt, niet laad, of in elk geval loopt het aantal bytes niet op zolang het 'niet reageert' Ik hoop dat je hier iets mee kunt hijackthis2.txt

Ik heb het probleem dat vrijwel alles wat ik op de PC doe vertraagd wordt uitgevoerd, met de regelmatige melding toepassing reageert niet. Uiteindelijk werkt dan alles wel maar telkens met ddie frustrerende meldingen en 'hangers' Ik heb al veel geprobeerd maar tot nog toe zonder succes. Ik heb inmiddels HiJackThis gedraaid en zou het logfile graag eens aan jullie voorleggen. Ik heb het bestandje bijgevoegd. Alvast bedankt, Jack hijackthis.log