rudy52

ComboFix 13-05-04.01 - rudy 04/05/2013 10:43:16.1.4 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.32.1043.18.3063.1782 [GMT 2:00] Gestart vanuit: c:\users\rudy\Downloads\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Internet Explorer c:\internet explorer\Custom\eBay.ico c:\program files\Common Files\337 c:\program files\Common Files\337\libcef\1.1364.1123\locales\en-US.pak c:\users\rudy\AppData\Roaming\inst.exe c:\users\rudy\WINDOWS c:\windows\IsUn0413.exe c:\windows\system32\roboot.exe . . (((((((((((((((((((( Bestanden Gemaakt van 2013-04-04 to 2013-05-04 )))))))))))))))))))))))))))))) . . 2013-05-04 08:51 . 2013-05-04 08:55 -------- d-----w- c:\users\rudy\AppData\Local\temp 2013-05-04 08:51 . 2013-05-04 08:51 -------- d-----w- c:\users\pcxp\AppData\Local\temp 2013-05-04 08:51 . 2013-05-04 08:51 -------- d-----w- c:\users\Gast\AppData\Local\temp 2013-05-04 08:51 . 2013-05-04 08:51 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-05-04 08:44 . 2013-05-04 08:44 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AFF3CC56-0FB2-46A7-A94A-0FAE27CE51B1}\offreg.dll 2013-05-03 23:46 . 2013-05-03 23:46 -------- d-----w- c:\programdata\PC Drivers HeadQuarters 2013-05-03 22:35 . 2013-05-03 22:40 -------- d-----w- c:\program files\Registry Easy 2013-05-03 21:21 . 2013-05-03 21:21 -------- d-----w- c:\program files\Coopoint 2013-05-03 21:07 . 2013-04-10 03:08 6906960 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AFF3CC56-0FB2-46A7-A94A-0FAE27CE51B1}\mpengine.dll 2013-05-03 17:46 . 2013-05-03 17:46 -------- d-----w- c:\programdata\RegAce 2013-05-02 22:41 . 2013-05-02 22:41 -------- d-----w- c:\users\Default\AppData\Local\Google 2013-05-02 17:49 . 2013-05-02 17:49 -------- d-----w- c:\program files\Common Files\ParetoLogic 2013-05-02 17:49 . 2013-05-02 17:49 -------- d-----w- c:\program files\ParetoLogic 2013-05-02 13:07 . 2013-05-02 13:37 -------- d-----w- c:\users\rudy\AppData\Roaming\Desk 365 2013-05-02 11:38 . 2013-05-02 11:38 -------- d-----w- C:\NVIDIA 2013-05-02 11:17 . 2005-11-14 06:19 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe 2013-04-28 10:31 . 2013-04-28 10:31 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys 2013-04-28 10:29 . 2013-04-28 10:29 369856 ----a-w- c:\windows\system32\drivers\cng.sys 2013-04-28 10:29 . 2013-04-28 10:29 247808 ----a-w- c:\windows\system32\schannel.dll 2013-04-28 10:29 . 2013-04-28 10:29 136560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys 2013-04-28 10:29 . 2013-04-28 10:29 1039360 ----a-w- c:\windows\system32\lsasrv.dll 2013-04-28 10:28 . 2013-04-28 10:28 514560 ----a-w- c:\windows\system32\qdvd.dll 2013-04-28 10:06 . 2013-05-02 09:38 -------- d-----w- c:\program files\Common Files\Spigot 2013-04-28 10:06 . 2013-04-28 10:06 -------- d-----w- c:\programdata\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A} 2013-04-28 10:04 . 2013-04-28 10:04 -------- d-----w- c:\users\rudy\AppData\Local\Programs 2013-04-26 13:49 . 2013-05-02 14:48 -------- d-----w- c:\program files\Common Files\Java 2013-04-26 13:49 . 2013-04-04 03:35 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-04-23 10:18 . 2013-05-02 14:52 -------- d---a-w- c:\windows\system32\catroot2.old 2013-04-23 08:59 . 2012-06-02 04:36 140288 ----a-w- c:\windows\system32\cryptsvc.dll 2013-04-23 08:59 . 2012-06-02 04:36 103936 ----a-w- c:\windows\system32\cryptnet.dll 2013-04-23 08:59 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\system32\crypt32.dll 2013-04-19 13:09 . 2013-04-19 13:09 -------- d-----w- c:\program files\Mozilla Maintenance Service 2013-04-19 13:09 . 2013-04-19 13:09 26520 ----a-w- c:\program files\Mozilla Firefox\plugin-hang-ui.exe 2013-04-12 14:19 . 2013-03-06 22:33 368176 ----a-w- c:\windows\system32\drivers\aswSP.sys 2013-04-12 14:19 . 2013-03-06 22:33 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2013-04-12 14:19 . 2013-03-06 22:33 60656 ----a-w- c:\windows\system32\drivers\aswRdr2.sys 2013-04-12 14:19 . 2013-03-06 22:33 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2013-04-12 14:19 . 2013-03-06 22:33 62376 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2013-04-12 14:19 . 2013-03-06 22:33 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2013-04-12 14:19 . 2013-03-06 22:32 228600 ----a-w- c:\windows\system32\aswBoot.exe 2013-04-12 14:18 . 2013-03-06 22:32 41664 ----a-w- c:\windows\avastSS.scr 2013-04-11 16:44 . 2013-04-11 16:44 -------- d-----w- c:\users\rudy\AppData\Roaming\ParetoLogic 2013-04-11 16:44 . 2013-04-11 16:44 -------- d-----w- c:\users\rudy\AppData\Roaming\DriverCure 2013-04-11 16:44 . 2013-05-02 17:49 -------- d-----w- c:\programdata\ParetoLogic 2013-04-11 16:26 . 2013-03-01 03:09 2347008 ----a-w- c:\windows\system32\win32k.sys 2013-04-11 16:26 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-04-11 16:26 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-04-11 16:26 . 2013-03-19 04:48 38912 ----a-w- c:\windows\system32\csrsrv.dll 2013-04-11 16:26 . 2013-03-19 02:49 69632 ----a-w- c:\windows\system32\smss.exe 2013-04-11 16:25 . 2013-01-24 04:47 196328 ----a-w- c:\windows\system32\drivers\fvevol.sys 2013-04-11 15:54 . 2013-04-11 15:54 -------- d-----w- c:\programdata\AVS4YOU 2013-04-11 15:54 . 2013-04-11 15:54 -------- d-----w- c:\users\rudy\AppData\Roaming\AVS4YOU 2013-04-11 15:53 . 2013-04-11 16:10 -------- d-----w- c:\program files\Common Files\AVSMedia 2013-04-11 15:40 . 2013-05-02 13:11 -------- d-----w- c:\users\rudy\compilatie-cd's 2013-04-10 15:56 . 2013-05-03 17:59 -------- d-----w- c:\users\rudy\AppData\Roaming\Systweak . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-05-02 00:06 . 2010-08-30 16:46 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-04-28 10:30 . 2013-04-28 10:30 3584 ----a-w- c:\windows\system32\drivers\nl-NL\tsusbflt.sys.mui 2013-04-18 08:42 . 2012-04-11 06:51 691592 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-04-18 08:42 . 2011-06-20 20:08 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-04-17 18:20 . 2012-04-12 07:43 23872 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe 2013-03-07 11:21 . 2012-09-13 12:29 861088 ----a-w- c:\windows\system32\npdeployJava1.dll 2013-03-07 11:21 . 2010-08-30 10:05 782240 ----a-w- c:\windows\system32\deployJava1.dll 2013-03-06 23:33 . 2013-03-15 15:16 164736 ----a-w- c:\windows\system32\drivers\aswVmm.sys 2013-03-06 23:33 . 2013-03-15 15:16 49248 ----a-w- c:\windows\system32\drivers\aswRvrt.sys 2013-02-12 04:48 . 2013-03-15 15:31 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-15 15:31 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll 2013-02-12 03:32 . 2013-03-26 09:39 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys 2013-04-19 13:09 . 2011-05-04 05:59 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}] 2012-01-04 23:02 233288 ----a-w- c:\program files\Expat Shield\HssIE\ExpatIE.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2013-03-06 22:32 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2013-03-07 14:31 576976 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2013-03-07 14:31 576976 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2013-03-07 14:31 576976 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2013-03-07 14:31 576976 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2010-08-09 248832] "RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2011-12-10 107000] "Advanced SystemCare 6"="c:\program files\IObit\Advanced SystemCare 6\ASCTray.exe" [2013-04-18 491840] "SRS Audio Sandbox"="c:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe" [2010-01-07 3216664] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-06-14 9288296] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-27 98304] "NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-03-06 4767304] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Advanced SystemCare 6"="c:\program files\IObit\Advanced SystemCare 6\ASCTray.exe" [2013-04-18 491840] . c:\users\rudy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ EvernoteClipper.lnk - c:\program files\Evernote\Evernote\EvernoteClipper.exe [2012-12-3 1044320] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" . R3 aswVmm;aswVmm; [x] R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [x] R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [x] R3 ExpatTrayService;Expat Shield Tray Service;c:\program files\Expat Shield\bin\ExpatTrayService.EXE [x] R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 SliceDisk5;SliceDisk5;c:\program files\A-FF Find and Mount\slicedisk.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 aswRvrt;aswRvrt; [x] S0 hotcore3;hc3ServiceName;c:\windows\system32\DRIVERS\hotcore3.sys [x] S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files\IObit\Advanced SystemCare 6\ASCService.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x] S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x] S2 ExpatShieldService;Expat Shield Service;c:\program files\Expat Shield\bin\openvpnas.exe [x] S2 ExpatSrv;Expat Shield Routing Service;c:\program files\Expat Shield\HssWPR\hsssrv.exe [x] S2 ExpatWd;Expat Shield Monitoring Service;c:\program files\Expat Shield\bin\hsswd.exe [x] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x] S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Nitro PDF\Reader\NitroPDFReaderDriverService2.exe [x] S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [x] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x] S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [x] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x] S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [x] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc GPSvcGroup REG_MULTI_SZ GPSvc . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-05-02 23:31 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe . Inhoud van de 'Gedeelde Taken' map . 2013-05-03 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 08:42] . 2013-05-04 c:\windows\Tasks\GlaryInitialize.job - c:\program files\Glary Utilities\initialize.exe [2012-08-26 16:59] . 2013-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-24 13:39] . 2013-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-24 13:39] . . ------- Bijkomende Scan ------- . uStart Page = about:blank uInternet Settings,ProxyOverride = 127.0.0.1 TCP: DhcpNameServer = 195.130.130.2 195.130.131.2 TCP: Interfaces\{ACFD45BF-ACFE-4DDF-B2E4-630826F78D39}: NameServer = 8.8.8.8 FF - ProfilePath - c:\users\rudy\AppData\Roaming\Mozilla\Firefox\Profiles\0iqgl65m.default\ FF - prefs.js: browser.search.defaulturl - FF - prefs.js: browser.startup.homepage - hxxp://www.hln.be/ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=198484&p= FF - ExtSQL: 2013-04-12 16:19; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF FF - ExtSQL: 2013-04-28 12:06; ascsurfingprotection@iobit.com; c:\users\rudy\AppData\Roaming\Mozilla\Firefox\Profiles\0iqgl65m.default\extensions\ascsurfingprotection@iobit.com FF - user.js: browser.blink_allowed - true FF - user.js: browser.chrome.favicons - false FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.search.openintab - false FF - user.js: browser.tabs.closeButtons - 1 FF - user.js: browser.tabs.opentabfor.middleclick - true FF - user.js: browser.tabs.tabMinWidth - 100 FF - user.js: browser.turbo.enabled - true FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.urlbar.autoFill - false FF - user.js: browser.urlbar.autofill - true FF - user.js: browser.urlbar.hideGoButton - false FF - user.js: content.maxtextrun - 4095 FF - user.js: content.notify.backoffcount - 5 FF - user.js: content.notify.interval - 1000000 FF - user.js: content.notify.ontimer - true FF - user.js: dom.disable_window_status_change - true FF - user.js: layout.spellcheckDefault - 1 FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: network.http.pipelining - true FF - user.js: network.http.pipelining.firstrequest - true FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.proxy.pipelining - true FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: network.prefetch-next - true FF - user.js: nglayout.initialpaint.delay - 1000 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.switch.threshold - 750000 FF - user.js: extentions.y2layers.installId - b6a80aea-3fd3-428d-9d6b-6aebb7a6dfd4 FF - user.js: extentions.y2layers.defaultEnableAppsList - DropDownDeals,buzzdock,YontooNewOffers FF - user.js: extensions.autoDisableScopes - 14 . - - - - ORPHANS VERWIJDERD - - - - . SafeBoot-BsScanner . . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ChromeHTML" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Andere Aktieve Processen ------------------------ . c:\windows\system32\atieclxx.exe c:\program files\AVAST Software\Avast\AvastSvc.exe c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe c:\windows\system32\taskhost.exe c:\program files\IObit\Smart Defrag 2\SmartDefrag.exe c:\program files\Common Files\Protexis\License Service\PsiService_2.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\System32\WUDFHost.exe c:\program files\Expat Shield\bin\openvpntray.exe c:\windows\servicing\TrustedInstaller.exe c:\windows\system32\conhost.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Voltooingstijd: 2013-05-04 11:03:43 - machine werd herstart ComboFix-quarantined-files.txt 2013-05-04 09:03 . Pre-Run: 1.091.809.988.608 bytes beschikbaar Post-Run: 1.091.769.942.016 bytes beschikbaar . - - End Of File - - 9BAFB9C1D5AAFB11B952B0F2F7100047 Hopelijk BRUIKBAAR !

Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 20:11:00, on 3/05/2013 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v9.00 (9.00.8112.16476) Boot mode: Normal Running processes: C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe C:\Program Files\Evernote\Evernote\EvernoteClipper.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Expat Shield\bin\openvpntray.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe C:\Program Files\Windows Live\Mail\wlmail.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Users\rudy\Downloads\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files\Expat Shield\HssIE\ExpatIE.dll O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll O2 - BHO: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~1\IObit\ADVANC~3\BROWER~1\ASCPLU~1.DLL O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll O4 - HKLM\..\Run: [iAStorIcon] C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [FileHippo.com] "C:\Program Files\FileHippo.com\UpdateChecker.exe" /background O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" O4 - HKCU\..\Run: [Advanced SystemCare 6] "C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart O4 - HKCU\..\Run: [sRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme O4 - HKUS\S-1-5-18\..\Run: [Advanced SystemCare 6] "C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Advanced SystemCare 6] "C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart (User 'Default user') O4 - Startup: EvernoteClipper.lnk = C:\Program Files\Evernote\Evernote\EvernoteClipper.exe O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{ACFD45BF-ACFE-4DDF-B2E4-630826F78D39}: NameServer = 8.8.8.8 O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Advanced SystemCare Service 6 (AdvancedSystemCareService6) - IObit - C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe O23 - Service: Expat Shield Service (ExpatShieldService) - Unknown owner - C:\Program Files\Expat Shield\bin\openvpnas.exe O23 - Service: Expat Shield Routing Service (ExpatSrv) - AnchorFree Inc. - C:\Program Files\Expat Shield\HssWPR\hsssrv.exe O23 - Service: Expat Shield Tray Service (ExpatTrayService) - Unknown owner - C:\Program Files\Expat Shield\bin\ExpatTrayService.EXE O23 - Service: Expat Shield Monitoring Service (ExpatWd) - Unknown owner - C:\Program Files\Expat Shield\bin\hsswd.exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe O23 - Service: NitroPDFReaderDriverCreatorReadSpool2 (NitroReaderDriverReadSpool2) - Nitro PDF Software - C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService2.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- End of file - 7826 bytes

Hallo Passer, Hartelijk dank voor de moeite, maar ik geef de strijd na 2 dagen èn een nacht op. Zelf de (betalende) softwares die expliciet beloven C00D11B1 te repareren helpen niet (reg clean Pro bijv.). ik denk dat alle miserie begonnen is omdat ik merkte dat ik elke dag nieuwe Microsoft-updates had. Dat was natuurlijk omdat altijd dezelfde updates terugkwamen omdat hun installatie telkens mislukte. Heb dan wat geknoeid met mogelijke oplossingen die ook niet gewerkt hebben en nu zit ik met de gebakken peren. Een volledige herinstallatie van windows 7 schrikt mij af, trouwens wie zegt dat ik daarna weer geluid heb ? Beste Groeten !

Hallo Passer, bij apparaten staat alles als normaal werkend vermeld. Het probleem is inderdaad plots opgedoken, ik heb de laatste weken wel wat opkuis gedaan met revo unistaller en had wat miserie met opdringerige sites zoals Portaldo. Ben sedert het geluidsprobleem herhaaldelijk teruggegaan naar een vorig herstelpunt maar kreeg wel het gevreesde blauwe scherm waarna het systeem dan zelf terug gekeerd is naar een wel werkend herstelpunt . Zou het kunnen dat ik problemen heb met het register ?

Hallo Passer, heb vannacht inderdaad al deze mogelijkheden geprobeerd, zonder resultaat...

Hallo, heb alle mogelijke oplossingen doorlopen, maar krijg NERGENS geluid meer uit, zelfs niet uit de test op de luidsprekers ("testtoon kan niet worden afgespeeld"). Windows media player geeft direct fout bij afspelen : "Het bestand kan niet door Windows Media Player worden afgespeeld" en verwijst naar deze foutmelding : [h=1]Windows Media Player C00D11B1[/h]Met de geluidskaart is er normaal niets aan de hand (gecontroleerd met Speccy) Kan iemand mij helpen ?