pezo

Het terug opstarten gaat automatisch. En soms blijft dit in een loop hangen. Daarbij blijft de PC telkens opnieuw opstarten. Het blauwe scherm is kort in beeld en geeft iets van "A problem has been detected and windows has been..." verder veel tekst met als het de eerste keer is dat dit is gebeurd, herstart dan de computer, check of er nieuwe hardware is aangesloten, etc. Het donkere scherm rept over dat windows niet goed is afgesloten en vraagt vervolgens of in veilige modus of anders opgestart moet worden. We hebben van alle berichten letterlijk screenprints (foto's) gemaakt: Verder hebben we inmiddels een windows 8 dvd in huis en zijn we van plan te gaan upgraden. Dus formatteren en opnieuw installeren. Dit incident mag derhalve wat ons betreft afgesloten worden, tenzij u nog een suggestie heeft om het probleem opgelost te krijgen. Dank voor de ondersteuning in ieder geval.

Het is nog helemaal mis! De situatie ging was als volgt: Allereerst wilde ik de opdrachten die u aangaf gaan uitvoeren. Ik vond de menu-optie "Strart-> Uitvoeren" niet. Ik startte browser Chrome om te zoeken hoe ik de menu-optie in beeld kan krijgen. Chrome opende niet maar bleef hangen en kwam even later met een foutmelding. Dat was al een slecht voorteken. Intussen uitgeweken naar browser Microsoft IE. Dat werkte wel en ik vond hoe ik "start uitvoeren" in windows 7 zichtbaar kon maken. Ik voerde de actie zoals aangegeven uit. Bij het verwijderen van C:\Qoobox merkte ik dat dit niet lukte omdat ik geen admin rechten had. Dat moest dus ook even anders gedaan worden en alweer dacht ik even te gaan zoeken hoe dit in te regelen. Vervolgens klikte ik nog een keer op Chrome om te kijken of deze al geopend kon worden. Terwijl ik dit wilde bekijken, verschijnt er een blauw scherm met allemaal foutmeldingen en de computer valt uit. Bij terug opkomen wordt gevraagd in welke modus er opgestart moet worden etc. Kortom, het probleem is er nog. Brandende vraag derhalve: Zijn er nog meer mogelijke opties om dit probleem opgelost te krijgen? Ik zit al te denken aan de laptop te gaan upgraden naar windows 8, om zo een oplossing te forceren. Dat is ook wel weer een hoop werk en ook niet kosteloos natuurlijk. Daarom hoor ik eerst graag.

# AdwCleaner v2.300 - Verslag gemaakt op 29/04/2013 om 22:21:19 # Geactualiseerd op 28/04/2013 door Xplode # Besturingssysteem : Windows 7 Home Premium Service Pack 1 (64 bits) # Gebruiker : Inge - INGE-PC # Opstarten Modus : Normale modus # Gelanceerd vanaf : E:\adwcleaner (1).exe # Optie [Verwijderen] ***** [Diensten] ***** ***** [Files / Mappen] ***** ***** [Register] ***** ***** [browsers] ***** -\\ Internet Explorer v10.0.9200.16537 [OK] Het register bevat geen enkele ongeoorloofde invoer. -\\ Google Chrome v26.0.1410.64 File : C:\Users\Inge\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] De file bevat geen enkele ongeoorloofde invoer. ************************* AdwCleaner[R1].txt - [1977 octets] - [28/04/2013 10:31:26] AdwCleaner[R2].txt - [979 octets] - [29/04/2013 22:20:48] AdwCleaner[s1].txt - [1917 octets] - [28/04/2013 10:33:19] AdwCleaner[s2].txt - [916 octets] - [29/04/2013 22:21:19] ########## EOF - C:\AdwCleaner[s2].txt - [975 octets] ########## Ik zie geen verontrustende berichten. Betekent dit dat we nu weer virus-vrij zijn? Kunnen we de laptop weer proberen te gebruiken?

ComboFix 13-04-28.01 - Inge 28-04-2013 20:53:11.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.3767.2441 [GMT 2:00] Gestart vanuit: c:\users\Inge\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5} SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\wininit.ini . . (((((((((((((((((((( Bestanden Gemaakt van 2013-03-28 to 2013-04-28 )))))))))))))))))))))))))))))) . . 2013-04-28 18:59 . 2013-04-28 18:59 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-04-28 08:37 . 2013-04-28 08:37 -------- d-----w- c:\program files (x86)\Google 2013-04-28 07:50 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C6E45772-9557-47FB-951E-5041D124745B}\mpengine.dll 2013-04-27 16:29 . 2013-04-27 16:29 -------- d-----w- c:\program files\Enigma Software Group 2013-04-27 16:28 . 2013-04-27 21:44 -------- d-----w- c:\windows\6B6C4C461B7E4A419E70ACFBB22B1D81.TMP 2013-04-27 16:28 . 2013-04-27 16:28 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard 2013-04-27 06:48 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-04-24 09:17 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys 2013-04-23 19:52 . 2013-04-23 19:52 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0C5BE086-9AB3-4743-8597-6BFA19894344}\gapaengine.dll 2013-04-11 06:24 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll 2013-04-11 06:24 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll 2013-04-11 06:24 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll 2013-04-11 06:24 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll 2013-04-11 06:24 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll 2013-04-11 06:24 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll 2013-04-11 06:24 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys 2013-04-11 06:24 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys 2013-04-11 06:23 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-04-11 06:23 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-04-11 06:23 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-04-11 06:23 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll 2013-04-11 06:23 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe 2013-04-11 06:23 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll 2013-03-31 18:34 . 2013-03-31 18:34 -------- d-----w- c:\users\Inge\AppData\Roaming\VSO 2013-03-31 18:14 . 2013-04-06 13:50 -------- d-----w- c:\programdata\VSO 2013-03-31 18:14 . 2013-03-31 18:14 -------- d-----w- c:\program files (x86)\VSO 2013-03-31 18:14 . 2013-03-31 18:14 -------- d-----w- c:\users\Inge\AppData\Local\Programs . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-04-22 07:07 . 2012-05-18 09:24 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-04-22 07:07 . 2011-08-15 07:37 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-04-11 06:44 . 2011-06-22 20:08 72702784 ----a-w- c:\windows\system32\MRT.exe 2013-04-02 10:34 . 2011-08-11 16:58 282744 ------w- c:\windows\system32\MpSigStub.exe 2013-03-29 18:45 . 2013-03-29 18:45 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-03-29 18:45 . 2013-03-29 18:45 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-03-29 18:45 . 2013-03-29 18:45 523264 ----a-w- c:\windows\SysWow64\vbscript.dll 2013-03-29 18:45 . 2013-03-29 18:45 38400 ----a-w- c:\windows\SysWow64\imgutil.dll 2013-03-29 18:45 . 2013-03-29 18:45 226304 ----a-w- c:\windows\system32\elshyph.dll 2013-03-29 18:45 . 2013-03-29 18:45 185344 ----a-w- c:\windows\SysWow64\elshyph.dll 2013-03-29 18:45 . 2013-03-29 18:45 158720 ----a-w- c:\windows\SysWow64\msls31.dll 2013-03-29 18:45 . 2013-03-29 18:45 150528 ----a-w- c:\windows\SysWow64\iexpress.exe 2013-03-29 18:45 . 2013-03-29 18:45 138752 ----a-w- c:\windows\SysWow64\wextract.exe 2013-03-29 18:45 . 2013-03-29 18:45 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2013-03-29 18:45 . 2013-03-29 18:45 12800 ----a-w- c:\windows\SysWow64\mshta.exe 2013-03-29 18:45 . 2013-03-29 18:45 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-03-29 18:45 . 2013-03-29 18:45 61952 ----a-w- c:\windows\SysWow64\tdc.ocx 2013-03-29 18:45 . 2013-03-29 18:45 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2013-03-29 18:45 . 2013-03-29 18:45 361984 ----a-w- c:\windows\SysWow64\html.iec 2013-03-29 18:45 . 2013-03-29 18:45 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll 2013-03-29 18:45 . 2013-03-29 18:45 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2013-03-29 18:45 . 2013-03-29 18:45 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-03-29 18:45 . 2013-03-29 18:45 97280 ----a-w- c:\windows\system32\mshtmled.dll 2013-03-29 18:45 . 2013-03-29 18:45 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll 2013-03-29 18:45 . 2013-03-29 18:45 81408 ----a-w- c:\windows\system32\icardie.dll 2013-03-29 18:45 . 2013-03-29 18:45 762368 ----a-w- c:\windows\system32\ieapfltr.dll 2013-03-29 18:45 . 2013-03-29 18:45 62976 ----a-w- c:\windows\system32\pngfilt.dll 2013-03-29 18:45 . 2013-03-29 18:45 599552 ----a-w- c:\windows\system32\vbscript.dll 2013-03-29 18:45 . 2013-03-29 18:45 51200 ----a-w- c:\windows\system32\imgutil.dll 2013-03-29 18:45 . 2013-03-29 18:45 452096 ----a-w- c:\windows\system32\dxtmsft.dll 2013-03-29 18:45 . 2013-03-29 18:45 441856 ----a-w- c:\windows\system32\html.iec 2013-03-29 18:45 . 2013-03-29 18:45 281600 ----a-w- c:\windows\system32\dxtrans.dll 2013-03-29 18:45 . 2013-03-29 18:45 27648 ----a-w- c:\windows\system32\licmgr10.dll 2013-03-29 18:45 . 2013-03-29 18:45 270848 ----a-w- c:\windows\system32\iedkcs32.dll 2013-03-29 18:45 . 2013-03-29 18:45 247296 ----a-w- c:\windows\system32\webcheck.dll 2013-03-29 18:45 . 2013-03-29 18:45 235008 ----a-w- c:\windows\system32\url.dll 2013-03-29 18:45 . 2013-03-29 18:45 216064 ----a-w- c:\windows\system32\msls31.dll 2013-03-29 18:45 . 2013-03-29 18:45 197120 ----a-w- c:\windows\system32\msrating.dll 2013-03-29 18:45 . 2013-03-29 18:45 173568 ----a-w- c:\windows\system32\ieUnatt.exe 2013-03-29 18:45 . 2013-03-29 18:45 167424 ----a-w- c:\windows\system32\iexpress.exe 2013-03-29 18:45 . 2013-03-29 18:45 1509376 ----a-w- c:\windows\system32\inetcpl.cpl 2013-03-29 18:45 . 2013-03-29 18:45 149504 ----a-w- c:\windows\system32\occache.dll 2013-03-29 18:45 . 2013-03-29 18:45 144896 ----a-w- c:\windows\system32\wextract.exe 2013-03-29 18:45 . 2013-03-29 18:45 1400416 ----a-w- c:\windows\system32\ieapfltr.dat 2013-03-29 18:45 . 2013-03-29 18:45 13824 ----a-w- c:\windows\system32\mshta.exe 2013-03-29 18:45 . 2013-03-29 18:45 136192 ----a-w- c:\windows\system32\iepeers.dll 2013-03-29 18:45 . 2013-03-29 18:45 102912 ----a-w- c:\windows\system32\inseng.dll 2013-03-29 18:45 . 2013-03-29 18:45 52224 ----a-w- c:\windows\system32\msfeedsbs.dll 2013-03-29 18:45 . 2013-03-29 18:45 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-03-29 18:45 . 2013-03-29 18:45 77312 ----a-w- c:\windows\system32\tdc.ocx 2013-03-29 18:45 . 2013-03-29 18:45 48640 ----a-w- c:\windows\system32\mshtmler.dll 2013-03-29 18:45 . 2013-03-29 18:45 135680 ----a-w- c:\windows\system32\IEAdvpack.dll 2013-03-29 18:45 . 2013-03-29 18:45 12800 ----a-w- c:\windows\system32\msfeedssync.exe 2013-02-12 05:45 . 2013-03-13 15:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45 . 2013-03-13 15:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45 . 2013-03-13 15:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 05:45 . 2013-03-13 15:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 04:48 . 2013-03-13 15:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-13 15:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll 2013-02-12 04:12 . 2013-03-20 19:55 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Facebook Update"="c:\users\Inge\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096] "Spotify Web Helper"="c:\users\Inge\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-04-20 1105408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-04-13 284696] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208] "VideoWebCamera"="c:\program files (x86)\VideoWebCamera\VideoWebCamera.exe" [2010-10-25 1655544] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-18 152392] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-07 161384] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008] R3 NisSrv;Microsoft Netwerkinspectie;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-06-17 246376] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784] R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-06-12 1255736] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-11-02 13784] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-18 2320920] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-04-13 135560] S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 158976] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232] S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2010-05-15 384040] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-04-28 08:37 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe . Inhoud van de 'Gedeelde Taken' map . 2013-04-28 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-18 07:07] . 2013-04-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3792385239-1218621683-318749534-1001Core.job - c:\users\Inge\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-20 22:07] . 2013-04-28 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3792385239-1218621683-318749534-1001UA.job - c:\users\Inge\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-20 22:07] . 2013-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-28 08:37] . 2013-04-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-28 08:37] . 2013-04-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3792385239-1218621683-318749534-1001Core.job - c:\users\Inge\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-11 13:00] . 2013-04-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3792385239-1218621683-318749534-1001UA.job - c:\users\Inge\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-11 13:00] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-22 10920552] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512] "Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.nl/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000 Trusted Zone: abc-antroposofie.nl\www TCP: DhcpNameServer = 212.54.40.25 212.54.35.25 . - - - - ORPHANS VERWIJDERD - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-NWEReboot - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe AddRemove-UnityWebPlayer - c:\users\Inge\AppData\Local\Unity\WebPlayer\Uninstall.exe . . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Voltooingstijd: 2013-04-28 21:02:34 ComboFix-quarantined-files.txt 2013-04-28 19:02 . Pre-Run: 549.017.022.464 bytes beschikbaar Post-Run: 549.790.175.232 bytes beschikbaar . - - End Of File - - 44C4C20073F829AC71BBC54B7361591D - - - Updated - - - We zijn benieuwd of u hier iets uit kunt opmaken. MS security essentials staat weer terug aan.

Op onze laptop met windows 7 werd door microsoft essentials een virus afgevangen en in quarantaine gezet. Toen we later wilde kijken welk virus dit dan geweest was, leek deze niet meer in het lijstje te staan. We zagen alleen nog geïsoleerde zaken met een oude datum. Vervolgens zijn we verder gegaan met het gebruik van de laptop. Maar we liepen tegen ernstige problemen. De browser Chrome viel spontaan uit, Windows 7 viel spontaan uit en wilde daarna in veilige modus weer opstarten, ie browser microsoft viel ook uit.. We hebben geprobeerd Spyhunter te laten scannen en schonen, maar voordat deze alles gescand had viel deze ook uit. Spyhunter kwam als eerste op bij het zoeken, dus die hebben we geprobeerd. Op dit forum lazen we vervolgens een bericht waarbij iemand werd geadviseerd adwcleaner.exe te runnen. Dit hebben we toen ook gedaan. Er werd het e.e.a. verwijderd. Iets met "babylon" in de omschrijving. Daarna dachten we vrij te zijn van de problemen, maar bij het gebruik van outlook om te mailen viel het programma weer uit! We lazen ook dat er aan de hand van een logfile van HjackThis door een kenner binnen jullie team verder gekeken kan worden. Hieronder de logfile van HjackThis: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 14:02:34, on 28-4-2013 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v10.0 (10.00.9200.16537) Boot mode: Normal Running processes: C:\Users\Inge\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe E:\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer! R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer! R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer! R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [VideoWebCamera] "C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe" -a O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Google Update] "C:\Users\Inge\AppData\Local\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Inge\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver O4 - HKCU\..\Run: [spotify Web Helper] "C:\Users\Inge\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O15 - Trusted Zone: ABC Boekenservice O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: TurboBoost - Intel® Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: Intel® Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 10401 bytes We hopen dat een van jullie kan helpen. We zitten met de handen in het haar.