Beschikbaar geheugen.

[Iska]

ComboFix 12-01-18.04 - Freddy 18/01/2012 20:19:57.1.4 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.32.1043.18.3325.2668 [GMT 1:00]

Gestart vanuit: c:\users\Freddy\Desktop\Downloads\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\animbigN.bmp

c:\windows\animsmalN.bmp

c:\windows\IsUn0413.exe

c:\windows\pkunzip.pif

c:\windows\pkzip.pif

c:\windows\system32\drivers\etc\hosts.ics

c:\windows\system32\rnaph.dll

c:\windows\unin0413.exe

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-12-18 to 2012-01-18 ))))))))))))))))))))))))))))))

.

.

2012-01-18 19:27 . 2012-01-18 19:30 -------- d-----w- c:\users\Freddy\AppData\Local\temp

2012-01-18 19:27 . 2012-01-18 19:27 -------- d-----w- c:\users\Josiane\AppData\Local\temp

2012-01-18 19:27 . 2012-01-18 19:27 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-01-18 17:58 . 2012-01-18 17:58 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{739EB1A6-2C21-45C9-A3C7-02EE8B2564F7}\offreg.dll

2012-01-18 17:58 . 2012-01-18 17:58 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{739EB1A6-2C21-45C9-A3C7-02EE8B2564F7}\MpKsl87d5b5bb.sys

2012-01-18 17:56 . 2012-01-05 19:19 6557240 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{739EB1A6-2C21-45C9-A3C7-02EE8B2564F7}\mpengine.dll

2012-01-18 16:20 . 2012-01-18 16:20 388096 ----a-r- c:\users\Freddy\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-01-18 16:20 . 2012-01-18 16:20 -------- d-----w- c:\program files\Trend Micro

2012-01-18 15:23 . 2012-01-18 15:23 -------- d-----w- c:\program files\Speccy

2012-01-18 11:14 . 2012-01-18 11:14 -------- d-----w- c:\program files\ACR38_100_122 PCSC Driver

2012-01-18 11:06 . 2012-01-18 11:06 -------- d-----w- c:\windows\system32\beidpp

2012-01-18 11:06 . 2012-01-18 11:06 -------- d-----w- c:\windows\system32\siscardplugins

2012-01-18 11:06 . 2012-01-18 11:06 -------- d-----w- c:\program files\BeID Minidriver

2012-01-18 11:06 . 2012-01-18 11:06 -------- d-----w- c:\program files\Belgium Identity Card

2012-01-18 10:31 . 2012-01-02 16:15 51144 ----a-w- c:\windows\system32\drivers\Soluto.sys

2012-01-18 10:31 . 2012-01-18 10:31 -------- d-----w- c:\program files\Soluto

2012-01-13 19:04 . 2012-01-13 19:05 -------- d-----w- c:\users\Freddy\AppData\Roaming\Uniblue

2012-01-11 20:22 . 2012-01-11 20:22 -------- d-----w- C:\ATI

2012-01-11 10:18 . 2011-10-14 16:03 189952 ----a-w- c:\windows\system32\winmm.dll

2012-01-11 10:18 . 2011-10-14 16:00 23552 ----a-w- c:\windows\system32\mciseq.dll

2012-01-11 10:18 . 2011-11-18 20:23 1205064 ----a-w- c:\windows\system32\ntdll.dll

2012-01-11 10:18 . 2011-11-18 17:47 66560 ----a-w- c:\windows\system32\packager.dll

2012-01-11 10:18 . 2011-11-25 15:59 376320 ----a-w- c:\windows\system32\winsrv.dll

2012-01-11 10:18 . 2011-10-25 15:58 1314816 ----a-w- c:\windows\system32\quartz.dll

2012-01-11 10:18 . 2011-10-25 15:58 497152 ----a-w- c:\windows\system32\qdvd.dll

2012-01-11 10:18 . 2011-12-01 15:21 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat

2012-01-05 16:00 . 2009-12-14 11:33 53248 ----a-w- c:\windows\system32\CSVer.dll

2012-01-05 15:33 . 2008-04-04 17:34 14208 ----a-w- c:\windows\system32\drivers\disksec.sys

2012-01-05 15:31 . 2012-01-05 15:31 -------- d-----w- c:\program files\Common Files\MAGIX Services

2012-01-03 07:22 . 2012-01-03 07:22 103864 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll

2011-12-28 15:22 . 2011-12-28 15:22 -------- d-----w- c:\users\Freddy\.jnlp-applet

2011-12-27 11:00 . 2011-12-27 11:00 -------- d-----w- c:\users\Freddy\AppData\Local\Xenocode

2011-12-25 09:23 . 2011-10-27 08:01 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-12-25 09:23 . 2011-10-27 08:01 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-12-25 09:23 . 2011-10-14 16:02 429056 ----a-w- c:\windows\system32\EncDec.dll

2011-12-25 09:23 . 2011-11-23 13:37 2043904 ----a-w- c:\windows\system32\win32k.sys

2011-12-25 09:23 . 2011-10-25 15:56 49152 ----a-w- c:\windows\system32\csrsrv.dll

2011-12-25 09:23 . 2011-11-08 14:42 2048 ----a-w- c:\windows\system32\tzres.dll

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-05 19:19 . 2009-12-13 12:41 6557240 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-01-04 12:14 . 2009-03-03 20:10 900 --sha-w- c:\programdata\KGyGaAvL.sys

2011-12-07 15:51 . 2011-12-07 15:51 360448 ----a-w- c:\windows\system32\beid35applayer.dll

2011-12-07 15:50 . 2011-12-07 15:50 94208 ----a-w- c:\windows\system32\Belgium Identity Card PKCS11.dll

2011-12-07 15:50 . 2011-12-07 15:50 94208 ----a-w- c:\windows\system32\beidpkcs11.dll

2011-12-07 15:50 . 2011-12-07 15:50 200704 ----a-w- c:\windows\system32\beid35cardlayer.dll

2011-12-07 15:50 . 2011-12-07 15:50 200704 ----a-w- c:\windows\system32\eidlib.dll

2011-12-07 15:50 . 2011-12-07 15:50 200704 ----a-w- c:\windows\system32\beidlib.dll

2011-12-07 15:50 . 2011-12-07 15:50 266240 ----a-w- c:\windows\system32\beid35DlgsWin32.dll

2011-12-07 15:49 . 2011-12-07 15:49 126976 ----a-w- c:\windows\system32\beid35common.dll

2011-12-06 15:18 . 2011-12-06 15:18 116224 ----a-w- c:\windows\system32\beidmdrv32.dll

2011-11-19 12:09 . 2011-05-17 17:51 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-06 17:54 . 2011-11-06 17:54 81936 ----a-w- c:\windows\system32\drivers\AtihdLH3.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sticky Pad"="c:\program files\StickyPad\StickyPad.exe" [2007-04-23 528441]

"PowerSuite"="c:\progra~1\Uniblue\POWERS~1\launcher.exe" [2011-11-01 67448]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]

.

c:\users\Josiane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-23 1295656]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-9-23 1295656]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]

2009-02-22 15:52 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SolutoService]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PDFCreator.lnk]

backup=c:\windows\pss\PDFCreator.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^Users^Freddy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Schermopname en Snel starten.lnk]

backup=c:\windows\pss\OneNote 2007 Schermopname en Snel starten.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

2008-01-22 09:13 152872 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel File Shell Monitor]

2008-08-08 16:30 16712 ----a-r- c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]

2008-08-08 16:30 532808 ----a-r- c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]

2008-12-04 11:24 665424 ------w- c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2008-05-28 06:27 570664 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrayServer]

2008-01-30 12:07 90112 ----a-w- c:\progra~1\MAGIX\FILM_O~1\Trayserver.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

.

S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSrv.exe [2010-04-22 87968]

S3 ACSSCR;ACR38 Smart Card Reader;c:\windows\system32\DRIVERS\a38usb.sys [2009-12-15 37632]

.

.

--- Andere Services/Drivers In Geheugen ---

.

*NewlyCreated* - MPKSL87D5B5BB

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2007-06-20 11:47 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhoud van de 'Gedeelde Taken' map

.

2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-02 20:09]

.

2012-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-02 20:09]

.

2011-12-25 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job

- c:\program files\Dell Support Center\uaclauncher.exe [2011-12-14 04:09]

.

2012-01-18 c:\windows\Tasks\SystemToolsDailyTest.job

- c:\program files\Dell Support Center\uaclauncher.exe [2011-12-14 04:09]

.

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.zita.be/

mStart Page = hxxp://www.telenet.be

mWindow Title = Telenet Internet

uInternet Settings,ProxyOverride = *.local

IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1 195.130.131.5 195.130.130.133

.

.

------- Bestandsassociaties -------

.

.txt=

.

- - - - ORPHANS VERWIJDERD - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-beid - c:\program files\Belgium Identity Card\beid35gui.exe

MSConfigStartUp-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe

MSConfigStartUp-HP Update 3400C - c:\sj652\hpupdate.exe

AddRemove-_{707EB912-C597-49D8-9460-46CC9AB03EBE} - c:\program files\Corel\Corel Painter Photo Essentials 4\MSILauncher {707EB912-C597-49D8-9460-46CC9AB03EBE}

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-01-18 20:30

Windows 6.0.6002 Service Pack 2 NTFS

.

scannen van verborgen processen ...

.

scannen van verborgen autostart items ...

.

scannen van verborgen bestanden ...

.

Scan succesvol afgerond

verborgen bestanden: 0

.

**************************************************************************

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8d,db,47,d9,c5,9e,a6,45,a0,03,ff,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8d,db,47,d9,c5,9e,a6,45,a0,03,ff,\

.

Voltooingstijd: 2012-01-18 20:31:48

ComboFix-quarantined-files.txt 2012-01-18 19:31

.

Pre-Run: 117.752.492.032 bytes beschikbaar

Post-Run: 118.044.839.936 bytes beschikbaar

.

- - End Of File - - 98B46A3CB8118BBC6C74BF6C530698CE

---------- Post toegevoegd om 19:47 ---------- Vorige post was om 19:43 ----------

Heb vandaag de service superfetch afgevinkt, daarna werdt het cache niet meer volgestouwd en bleef er geheugen vrij.

Daarna heb ik ook volgend commando doorgevoerd "BCDedit /set PAE forceenable".

Blijkbaar help dit alles want ik heb ruim 1h30 met Phase One gewerkt zonder enig probleem.

Blijkbaar geen last van ongewenste software maar een basis service die de verkeerde kant uitgroeide.

[kape]

Problemen van de baan, dan is het tijd voor de “grote schoonmaak” : verwijderen van gebruikte programma’s en een cleaning.

Verwijder Combofix: Start -> Uitvoeren/Zoekopdracht en typ: ComboFix /Uninstall

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

Download CCleaner.

Klik op “Download Latest Version” en dan start de download van CCleaner automatisch en gratis op.

Installeer het en start CCleaner op. Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Schoonmaken'. Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft. Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”. Sluit hierna CCleaner terug af.

Wil je dit uitgebreid in beeld bekijken, klik dan hier voor de handleiding.

Vermits je zelf de oplossing gevonden hebt van je basisprobleem én als deze opruiming achter de rug is, mag je hieronder op "markeer als opgelost" tokkelen !