Random Freezes - Geen spoor van virus of malware - Netwerkprobleem - W7 - 64-bit

[Cujo]

OK, dan zoeken we in de andere thread(s) verder. Alvast bedankt voor alle hulp !

[kape]

OK, dan zoeken we in de andere thread(s) verder. Alvast bedankt voor alle hulp !

OK, graag gedaan ... alzijn we er dan hier niet helemaal uitgeraakt

Dit topic sluiten we dan ook beter af. Gaan we verder in je andere threads !

[Cujo]

Toch terug geopend op aanraden van Kurtt, zie Fix It handleiding topic

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:48:10, on 2/06/2011

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16421)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Innovative Solutions\DriverMax\devices.exe

C:\Garmin\ANT Agent\ANT Agent.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10p_ActiveX.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: LastPass Browser Helper Object - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPBar.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPBar.dll

O4 - HKCU\..\Run: [DriverMax] "C:\Program Files (x86)\Innovative Solutions\DriverMax\devices.exe" -agent

O4 - HKCU\..\Run: [ANT Agent] C:\Garmin\ANT Agent\ANT Agent.exe

O8 - Extra context menu item: LastPass - file://C:\Program Files (x86)\LastPass\context.html?cmd=lastpass

O8 - Extra context menu item: LastPass Fill Forms - file://C:\Program Files (x86)\LastPass\context.html?cmd=fillforms

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPBar.dll

O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB

O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/select/asusTek_sys_ctrl3.cab

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} (UploadListView Class) - http://picasaweb.google.com/s/v/66.25/uploader2.cab

O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} (BitDefender QuickScan Control) - http://quickscan.bitdefender.com/qsax/qsax.cab

O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - AppInit_DLLs: {DLL_Str}

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 7934 bytes

[kweezie wabbit]

Op het eerste zicht is er niets mis met dit logje.

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

• Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:
  Klik hier
  Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.
  
• Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.
  
• ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.
  **Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.
  
• Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.
  

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:

Klik op Ja om verder te gaan met het scannen naar malware.

Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Indien je problemen hebt bij het uitvoeren van ComboFix, gelieve dit te melden.

[Cujo]

Ik kreeg eerst een boodschap dat Combofix niet dikwijls gedownload wordt en schadelijk kan zijn voor de computer.

MSE heb ik real-time bescherming afgezet.

Combofix gedraaid, geen tussenschermen betrreffende WRC gekregen.

ComboFix 11-06-02.02 - Gunther 03/06/2011 9:19.2.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.32.1043.18.4094.2655 [GMT 2:00]

Gestart vanuit: c:\users\Gunther\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-05-03 to 2011-06-03 ))))))))))))))))))))))))))))))

.

.

2011-06-03 07:02 . 2011-05-09 22:00 8718160 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F21D17EB-C4FE-449B-A95F-2D1934CBDBEA}\mpengine.dll

2011-06-02 11:29 . 2011-06-02 11:29 -------- d-----w- c:\users\Public\D-Link

2011-06-02 11:29 . 2008-05-15 01:28 26624 ----a-w- c:\windows\system32\drivers\jswpslwfx.sys

2011-06-02 11:29 . 2011-06-02 11:29 -------- d-----w- c:\windows\pcidevice

2011-06-02 11:29 . 2010-04-21 09:13 1601024 ----a-w- c:\windows\system32\drivers\athrx.sys

2011-06-02 11:29 . 2008-05-15 01:28 26624 ----a-w- c:\windows\SysWow64\drivers\jswpslwfx.sys

2011-06-02 11:29 . 2011-06-02 11:29 -------- d-----w- c:\program files (x86)\D-Link

2011-06-02 11:27 . 2011-06-02 11:27 -------- d-----w- c:\users\Gunther\AppData\Roaming\InstallShield

2011-06-02 10:44 . 2011-06-02 10:44 388096 ----a-r- c:\users\Gunther\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-05-30 18:01 . 2011-05-30 18:02 -------- d-----w- c:\users\Gunther Standaard

2011-05-29 21:19 . 2011-05-29 21:19 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll

2011-05-26 20:16 . 2011-05-26 20:16 -------- d-----w- c:\windows\ehome

2011-05-26 20:16 . 2011-05-26 20:16 -------- d-----w- c:\users\Default\AppData\Roaming\Media Center Programs

2011-05-24 20:56 . 2011-04-22 22:15 27520 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2011-05-20 22:08 . 2011-05-20 22:08 9322696 ----a-w- c:\program files (x86)\Common Files\lpuninstall.exe

2011-05-20 10:27 . 2011-05-05 19:14 601424 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2011-05-20 10:27 . 2011-05-05 19:14 601424 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EA6B4AF9-CA2C-4DFC-8B18-592343EB676E}\gapaengine.dll

2011-05-13 15:46 . 2011-05-13 15:47 -------- d-----w- c:\program files\Speccy

2011-05-12 16:50 . 2011-04-09 06:58 142336 ----a-w- c:\windows\system32\poqexec.exe

2011-05-12 16:50 . 2011-04-09 05:56 123904 ----a-w- c:\windows\SysWow64\poqexec.exe

2011-05-11 21:21 . 2011-05-11 21:21 -------- d-----w- c:\users\Gunther\DoctorWeb

2011-05-11 18:24 . 2011-04-09 07:02 5562240 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-05-11 18:24 . 2011-04-09 06:02 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2011-05-11 18:24 . 2011-04-09 06:02 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2011-05-11 18:24 . 2011-03-25 03:29 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys

2011-05-11 18:24 . 2011-03-25 03:29 98816 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2011-05-11 18:24 . 2011-03-25 03:29 325120 ----a-w- c:\windows\system32\drivers\usbport.sys

2011-05-11 18:24 . 2011-03-25 03:29 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys

2011-05-11 18:24 . 2011-03-25 03:29 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys

2011-05-11 18:24 . 2011-03-25 03:29 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys

2011-05-11 18:24 . 2011-03-25 03:28 7936 ----a-w- c:\windows\system32\drivers\usbd.sys

2011-05-11 15:50 . 2011-05-11 15:50 -------- d-----w- c:\program files (x86)\Trend Micro

2011-05-07 06:19 . 2011-05-09 22:00 8718160 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-05-05 19:12 . 2011-05-05 19:12 -------- d-----w- c:\program files (x86)\Microsoft Security Client

2011-05-05 19:12 . 2011-05-05 19:12 -------- d-----w- c:\program files\Microsoft Security Client

2011-05-04 21:41 . 2011-05-04 21:41 -------- d-----w- c:\users\Gunther\AppData\Roaming\AVG10

2011-05-04 16:06 . 2011-05-04 16:06 -------- d-----w- c:\program files (x86)\VS Revo Group

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-31 14:44 . 2009-11-23 21:23 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2011-05-29 21:19 . 2009-11-23 21:23 704320 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2011-04-21 20:52 . 2011-04-21 20:52 16384 ----a-w- c:\windows\system32\drivers\EIO64.sys

2011-04-17 22:01 . 2011-04-17 22:01 521448 ----a-w- c:\windows\system32\deployJava1.dll

2011-04-17 22:00 . 2011-04-17 22:00 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2011-04-15 16:29 . 2011-04-15 16:29 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe

2011-04-15 16:29 . 2011-04-15 16:29 161792 ----a-w- c:\windows\SysWow64\msls31.dll

2011-04-15 16:29 . 2011-04-15 16:29 1126912 ----a-w- c:\windows\SysWow64\wininet.dll

2011-04-15 16:29 . 2011-04-15 16:29 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-04-15 16:29 . 2011-04-15 16:29 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2011-04-15 16:29 . 2011-04-15 16:29 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll

2011-04-15 16:29 . 2011-04-15 16:29 85504 ----a-w- c:\windows\system32\iesetup.dll

2011-04-15 16:29 . 2011-04-15 16:29 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2011-04-15 16:29 . 2011-04-15 16:29 76800 ----a-w- c:\windows\system32\tdc.ocx

2011-04-15 16:29 . 2011-04-15 16:29 74752 ----a-w- c:\windows\SysWow64\iesetup.dll

2011-04-15 16:29 . 2011-04-15 16:29 63488 ----a-w- c:\windows\SysWow64\tdc.ocx

2011-04-15 16:29 . 2011-04-15 16:29 603648 ----a-w- c:\windows\system32\vbscript.dll

2011-04-15 16:29 . 2011-04-15 16:29 49664 ----a-w- c:\windows\system32\imgutil.dll

2011-04-15 16:29 . 2011-04-15 16:29 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2011-04-15 16:29 . 2011-04-15 16:29 48640 ----a-w- c:\windows\system32\mshtmler.dll

2011-04-15 16:29 . 2011-04-15 16:29 448512 ----a-w- c:\windows\system32\html.iec

2011-04-15 16:29 . 2011-04-15 16:29 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2011-04-15 16:29 . 2011-04-15 16:29 367104 ----a-w- c:\windows\SysWow64\html.iec

2011-04-15 16:29 . 2011-04-15 16:29 35840 ----a-w- c:\windows\SysWow64\imgutil.dll

2011-04-15 16:29 . 2011-04-15 16:29 30720 ----a-w- c:\windows\system32\licmgr10.dll

2011-04-15 16:29 . 2011-04-15 16:29 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-04-15 16:29 . 2011-04-15 16:29 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-04-15 16:29 . 2011-04-15 16:29 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll

2011-04-15 16:29 . 2011-04-15 16:29 2303488 ----a-w- c:\windows\system32\jscript9.dll

2011-04-15 16:29 . 2011-04-15 16:29 222208 ----a-w- c:\windows\system32\msls31.dll

2011-04-15 16:29 . 2011-04-15 16:29 1797632 ----a-w- c:\windows\SysWow64\jscript9.dll

2011-04-15 16:29 . 2011-04-15 16:29 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2011-04-15 16:29 . 2011-04-15 16:29 165888 ----a-w- c:\windows\system32\iexpress.exe

2011-04-15 16:29 . 2011-04-15 16:29 160256 ----a-w- c:\windows\system32\wextract.exe

2011-04-15 16:29 . 2011-04-15 16:29 152064 ----a-w- c:\windows\SysWow64\wextract.exe

2011-04-15 16:29 . 2011-04-15 16:29 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2011-04-15 16:29 . 2011-04-15 16:29 1492992 ----a-w- c:\windows\system32\inetcpl.cpl

2011-04-15 16:29 . 2011-04-15 16:29 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2011-04-15 16:29 . 2011-04-15 16:29 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2011-04-15 16:29 . 2011-04-15 16:29 1389056 ----a-w- c:\windows\system32\wininet.dll

2011-04-15 16:29 . 2011-04-15 16:29 135168 ----a-w- c:\windows\system32\IEAdvpack.dll

2011-04-15 16:29 . 2011-04-15 16:29 12288 ----a-w- c:\windows\system32\mshta.exe

2011-04-15 16:29 . 2011-04-15 16:29 11776 ----a-w- c:\windows\SysWow64\mshta.exe

2011-04-15 16:29 . 2011-04-15 16:29 114176 ----a-w- c:\windows\system32\admparse.dll

2011-04-15 16:29 . 2011-04-15 16:29 111616 ----a-w- c:\windows\system32\iesysprep.dll

2011-04-15 16:29 . 2011-04-15 16:29 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2011-04-15 16:29 . 2011-04-15 16:29 101888 ----a-w- c:\windows\SysWow64\admparse.dll

2011-04-07 21:19 . 2011-04-07 21:19 61032 ----a-w- c:\windows\system32\nvshext.dll

2011-04-07 21:19 . 2011-04-07 21:19 2582120 ----a-w- c:\windows\system32\nvsvcr.dll

2011-04-07 21:19 . 2011-04-07 21:19 117864 ----a-w- c:\windows\system32\nvmctray.dll

2011-04-07 21:19 . 2011-04-07 21:19 1012328 ----a-w- c:\windows\system32\nvvsvc.exe

2011-04-07 21:19 . 2011-04-07 21:19 797288 ----a-w- c:\windows\system32\easyUpdatusAPIU64.dll

2011-04-07 21:19 . 2011-04-07 21:19 6338152 ----a-w- c:\windows\system32\nvcpl.dll

2011-04-07 21:18 . 2011-04-07 21:18 3041384 ----a-w- c:\windows\system32\nvsvc64.dll

2011-03-21 19:22 . 2011-04-23 12:33 74272 ----a-w- c:\windows\system32\RtNicProp64.dll

2011-03-21 19:22 . 2011-04-23 12:33 452200 ----a-w- c:\windows\system32\drivers\Rt64win7.sys

2011-03-21 19:22 . 2011-04-20 21:53 107552 ----a-w- c:\windows\system32\RTNUninst64.dll

2011-03-13 07:24 . 2010-06-24 09:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-03-12 12:08 . 2011-04-27 15:07 1465344 ----a-w- c:\windows\system32\XpsPrint.dll

2011-03-12 11:23 . 2011-04-27 15:07 870912 ----a-w- c:\windows\SysWow64\XpsPrint.dll

2011-03-11 06:41 . 2011-04-27 15:07 189824 ----a-w- c:\windows\system32\drivers\storport.sys

2011-03-11 06:41 . 2011-04-27 15:07 1659776 ----a-w- c:\windows\system32\drivers\ntfs.sys

2011-03-11 06:41 . 2011-04-27 15:07 166272 ----a-w- c:\windows\system32\drivers\nvstor.sys

2011-03-11 06:41 . 2011-04-27 15:07 148352 ----a-w- c:\windows\system32\drivers\nvraid.sys

2011-03-11 06:41 . 2011-04-27 15:07 410496 ----a-w- c:\windows\system32\drivers\iaStorV.sys

2011-03-11 06:41 . 2011-04-27 15:07 27008 ----a-w- c:\windows\system32\drivers\amdxata.sys

2011-03-11 06:41 . 2011-04-27 15:07 107904 ----a-w- c:\windows\system32\drivers\amdsata.sys

2011-03-11 06:34 . 2011-04-15 11:15 1359872 ----a-w- c:\windows\system32\mfc42u.dll

2011-03-11 06:34 . 2011-04-15 11:15 1395712 ----a-w- c:\windows\system32\mfc42.dll

2011-03-11 06:33 . 2011-04-27 15:07 2565632 ----a-w- c:\windows\system32\esent.dll

2011-03-11 06:30 . 2011-04-27 15:07 96768 ----a-w- c:\windows\system32\fsutil.exe

2011-03-11 05:33 . 2011-04-15 11:15 1164288 ----a-w- c:\windows\SysWow64\mfc42u.dll

2011-03-11 05:33 . 2011-04-15 11:15 1137664 ----a-w- c:\windows\SysWow64\mfc42.dll

2011-03-11 05:33 . 2011-04-27 15:07 1699328 ----a-w- c:\windows\SysWow64\esent.dll

2011-03-11 05:31 . 2011-04-27 15:07 74240 ----a-w- c:\windows\SysWow64\fsutil.exe

2011-03-08 06:29 . 2011-04-15 11:14 976896 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-08 05:28 . 2011-04-15 11:14 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ANT Agent"="c:\garmin\ANT Agent\ANT Agent.exe" [2011-04-14 12036968]

.

c:\users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Install LastPass IE RunOnce.lnk - c:\program files (x86)\Common Files\lpuninstall.exe [2011-5-21 9322696]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Wireless Connection Manager.lnk - c:\program files (x86)\D-Link\DWA-547 revA\wirelesscm.exe [2011-6-2 517440]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]

R3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\DRIVERS\a38usb.sys [x]

R3 jswpsapi;JumpStart Wi-Fi Protected Setup;c:\program files (x86)\D-Link\DWA-547 revA\jswpsapi.exe [2008-09-26 954368]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 gupdate;Google Updateservice (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-07 135664]

R4 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-07 135664]

R4 SdReadSpool;SolidPDFCreatorReadSpool;c:\program files (x86)\SolidDocuments\SolidPDFCreator\SPC\SolidPdfService.exe [2009-03-18 189696]

S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [x]

S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]

S1 EIO64;EIO Driver;c:\windows\system32\DRIVERS\EIO64.sys [x]

S1 JSWPSLWF;JumpStart Wireless Filter Driver;c:\windows\system32\DRIVERS\jswpslwfx.sys [2008-05-15 26624]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-04-07 378472]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

iissvcs REG_MULTI_SZ w3svc was

apphost REG_MULTI_SZ apphostsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-07 18:12]

.

2011-06-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-12-07 18:12]

.

.

--------- x86-64 -----------

.

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: LastPass - file://c:\program files (x86)\LastPass\context.html?cmd=lastpass

IE: LastPass Fill Forms - file://c:\program files (x86)\LastPass\context.html?cmd=fillforms

TCP: DhcpNameServer = 195.130.131.130 195.130.130.2

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB

.

- - - - ORPHANS VERWIJDERD - - - -

.

Wow6432Node-HKCU-Run-DriverMax_RESTART - (no file)

.

.

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10p.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2011-06-03 09:23:06

ComboFix-quarantined-files.txt 2011-06-03 07:23

ComboFix2.txt 2011-05-08 11:24

.

Pre-Run: 900.471.267.328 bytes beschikbaar

Post-Run: 900.185.300.992 bytes beschikbaar

.

- - End Of File - - 71C4A4D334C1CF81BB3FAD08E2C8474B

[Cujo]

Ter info ook de boodschap wanneer ik een "Fix It" wil uitvoeren.

[kape]

Combofix-logje geeft geen negatieve aanduidingen. Welke problemen heb je nu nog (enkel die foutmelding bij Fix It of nog anderen) ?

Verwijder Combofix: Start -> Uitvoeren/Zoekopdracht en typ: ComboFix /Uninstall

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

[Cujo]

* de freezes zijn ook nog van de partij (geen regelmaat in te ontdekken)

* Fix It

* Hijack-log kan niet gesaved worden

* afbeeldingen saven en na het saven is er geen bestandsextensie in Windows Explorer gekoppeld (zodat de miniatuurafbeeldingen niet weergegeven worden)

* bericht "de intranetinstellingen zijn standaard uitgeschakeld" in IE9

(ik zal dit lijstje aanvullen als ik mij dingen herinner)

5 juni 2011 aangepast door Cujo
extra info

[Cujo]

Waar moet ik juist Combofix /uninstall uitvoeren ?

Ik heb dit gedaan via Start - onderaan UItvoeren ingetikt en Uitvoeren uit de lijst geslecteerd - ComboFix /uninstall ingegeven

Na uitvoeren is de shortcut op desktop nog steeds aanwezig, en ook C:\Qoobox

Ik wou Qoobox manueel verwijderen, maar krijg de melding dat ik geen Administrator bevoegdheden heb om deze te verwijderen ... terwijl ik met mijn administrator account aangelogd ben...

5 juni 2011 aangepast door Cujo
extra info

[kape]

Bij Start onderaan moet je enkel Combofix /Uninstall inbrengen (niet 'Uitvoeren" dus). Die opdracht zou CF moeten verwijderen (en normaal ook in dezelfde run Qoobox).