ik krijg rode lijnen op m'n scherm

nine · 13 december 2016

hallo,

al de tekst die op de werkbalk staat als op het bureaublad maar ook op uitwerkingen van forums kleurt rood, evenals gezichten...ik heb daarstraks een scan gedaan, niks helpt...

ik doe er printscreen bij...

ScreenShot009.bmp

Passer · 13 december 2016

Nine,

welkom op PCH

alleen: je plaatje lijkt me een doodgewoon plaatje, zonder enige overdreven vorm van rood...

Dus vermoed ik dat het aan je scherm zal liggen. Alleen ben ik geen hardwarekenner

dus... hardwarekenners: zien jullie er licht in ?

nine · 13 december 2016

thx voor je reactie Passer, ik wacht wel even tot iemand zich aandient die er iets van weet, ik weet het ook niet...fijne avond nog

nine · 13 december 2016

mijn logje...

2016-12-13 11:33:19   Modify driver or service   [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\SERVICES\P1481625159AM\[Start]
Content: 1
Process: C:\Users\louisa-jeaninne\AppData\Local\Temp\bk52CE.tmp\p1481625159.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-12-13 11:32:47   Modify driver or service   [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\SERVICES\P1481625159AM\[Type]
Content: 1
Process: C:\Users\louisa-jeaninne\AppData\Local\Temp\bk52CE.tmp\p1481625159.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-12-13 11:32:33   Modify pending file operation   [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsi1E21.tmp\ClearLog.dll

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-12-13 11:32:33 Modify pending file operation [Auto-blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsi1E21.tmp

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (0)
2016-12-11 21:46:51   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: Dropbox
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process: , (0)
2016-12-11 21:46:51   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: dropbox-NamespaceExtensionRole.Personal
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process: , (0)
2016-12-11 18:39:30   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\ANIMATIONSHOP3.WORKSPACEFILE\SHELL\OPEN\COMMAND\[]
Content: C:\Program Files (x86)\Jasc Software Inc\Animation Shop 3\Anim.exe "%1"
Process: C:\Program Files (x86)\Jasc Software Inc\Animation Shop 3\Anim.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-12-11 18:13:36   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MSK_AUTO_FILE\SHELL\OPEN\COMMAND\[]
Content: "C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\Corel Paint Shop Pro Photo.exe" /dde
Process: C:\WINDOWS\Sysnative\OpenWith.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-12-11 18:11:41   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2DB46B4D-4BAB-497E-9EC1-466982BBA2A7}\LOCALSERVER32\[]
Content: C:\PROGRA~2\Corel\CORELP~1\CORELP~1.EXE
Process: C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\Corel Paint Shop Pro Photo.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-12-09 19:58:45   Modify pending file operation   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_12e2eb5912c0f66f\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-12-09 19:58:44 Modify pending file operation [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\drivers\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-12-09 19:29:36   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\AUDIO/X-MS-WMA\[Extension]
Content: .wma
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-09 19:29:36   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\AUDIO/WAV\[Extension]
Content: .wav
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-09 19:28:52   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\VIDEO/3GPP\[Extension]
Content: .3gp
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-09 19:28:52   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\VIDEO/X-MS-WMV\[Extension]
Content: .wmv
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-09 19:28:52   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\VIDEO/MP4\[Extension]
Content: .mp4
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-09 19:28:52   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\VIDEO/X-MATROSKA\[Extension]
Content: .mkv
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-09 19:28:52   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\VIDEO/X-M4V\[Extension]
Content: .m4v
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-09 19:28:52   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\VIDEO/3GPP\[Extension]
Content: .3gpp
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-09 19:28:52   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\VIDEO/3GPP2\[Extension]
Content: .3gp2
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-09 19:28:52   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\VIDEO/3GPP2\[Extension]
Content: .3g2
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-08 17:34:02   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\TEXT/VCARD\[Extension]
Content: .vcf
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process: , (0)
2016-12-06 20:30:21   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\LOCALSERVER32\[]
Content: "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE"
Process: C:\WINDOWS\Sysnative\msiexec.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-12-06 20:30:14   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\BOOTSTRAP.VSTO.1\SHELL\OPEN\COMMAND\[]
Content: rundll32.exe "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll",InstallVstoSolution %1
Process: C:\WINDOWS\Sysnative\msiexec.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-12-06 20:29:04   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\APPLICATION/VND.MS-VISIO.VIEWER\[Extension]
Content: .vdx
Process: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe
Parent Process:C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe , (0)
2016-12-06 20:29:04   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\APPLICATION/VND.MS-VISIO.VIEWER\[Extension]
Content: .vsd
Process: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe
Parent Process:C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe , (0)
2016-12-06 20:29:02   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.MSG.15\SHELL\PRINT\COMMAND\[]
Content: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /p "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.OFT.15\SHELL\NEW\COMMAND\[]
Content: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /t "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.OFT.15\SHELL\OPEN\COMMAND\[]
Content: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /t "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.OFT.15\SHELL\PRINT\COMMAND\[]
Content: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /p "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.PST.15\SHELL\OPEN\COMMAND\[]
Content: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /pst "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.VCF.15\SHELL\OPEN\COMMAND\[]
Content: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /v "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020D09-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F005-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F006-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F020-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F01E-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F01F-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F023-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F024-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F011-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:02   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F030-0000-0000-C000-000000000046}\LOCALSERVER32\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:01   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.EML.15\SHELL\OPEN\COMMAND\[]
Content: C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE /eml "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:01   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.HOL.15\SHELL\OPEN\COMMAND\[]
Content: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /hol "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:01   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.ICS.15\SHELL\OPEN\COMMAND\[]
Content: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /ical "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:29:01   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\OUTLOOK.FILE.MSG.15\SHELL\OPEN\COMMAND\[]
Content: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /f "%1"
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F063-0000-0000-C000-000000000046}\TREATAS\[]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00020910-0000-0000-C000-000000000046}\TYPELIB\[]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00020910-0000-0000-C000-000000000046}\TYPELIB\[Version]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00020911-0000-0000-C000-000000000046}\PROXYSTUBCLSID32\[]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00020911-0000-0000-C000-000000000046}\TYPELIB\[]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00020911-0000-0000-C000-000000000046}\TYPELIB\[Version]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00020910-0000-0000-C000-000000000046}\PROXYSTUBCLSID32\[]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:58   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\APPLICATION/MSACCESS.FTEMPLATE\[Extension]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:58   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\MIME\DATABASE\CONTENT TYPE\TEXT/CALENDAR\[Extension]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 20:28:58   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0006F033-0000-0000-C000-000000000046}\TREATAS\[]
Content:
Process: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
Parent Process: , (0)
2016-12-06 19:00:35   Detected Trojan: Win32/Application.0fd   [Removed]
Details:
Trojan name: Win32/Application.0fd
Path: C:\WINDOWS\TEMP\nsi725F.tmp\update.dll-201612061623.dll.exe
2016-12-06 19:00:22   Process Creation   [Auto-blocked]
Details:
Process: C:\Program Files (x86)\walalala co\aMuleCustom\ed2k.exe
Action: Process creation
Path: C:\Windows\SysWOW64\rundll32.exe
2016-12-02 11:16:49   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: Dropbox
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process: , (0)
2016-12-02 11:16:49   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: dropbox-NamespaceExtensionRole.Personal
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process: , (0)
2016-12-01 21:58:24   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: dropbox-NamespaceExtensionRole.Personal
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process:C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe , (0)
2016-12-01 21:58:24   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: Dropbox
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process:C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe , (0)
2016-12-01 15:33:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\AUDIO/X-MS-WMA\[Extension]
Content: .wma
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-12-01 15:33:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\AUDIO/WAV\[Extension]
Content: .wav
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-12-01 15:33:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\AUDIO/MP3\[Extension]
Content: .mp3
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-12-01 15:33:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\AUDIO/X-M4R\[Extension]
Content: .m4r
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-12-01 15:33:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\AUDIO/X-M4A\[Extension]
Content: .m4a
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-12-01 15:33:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\AUDIO/AAC\[Extension]
Content: .aac
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-12-01 15:33:59   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\AUDIO/AMR\[Extension]
Content: .amr
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-11-30 21:46:15   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2DB46B4D-4BAB-497E-9EC1-466982BBA2A7}\LOCALSERVER32\[]
Content: C:\PROGRA~2\Corel\CORELP~1\CORELP~1.EXE
Process: C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\Corel Paint Shop Pro Photo.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-11-29 20:49:18   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\ANIMATIONSHOP3.WORKSPACEFILE\SHELL\OPEN\COMMAND\[]
Content: C:\Program Files (x86)\Jasc Software Inc\Animation Shop 3\Anim.exe "%1"
Process: C:\Program Files (x86)\Jasc Software Inc\Animation Shop 3\Anim.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-11-29 18:05:22   Modify driver or service   [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\SERVICES\THEMES\[DependOnService]
Content:
iThemes5
Process: C:\Windows\Temp\nsi68A5.tmp\de_svr.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-11-29 18:05:15   Modify pending file operation   [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsi68A5.tmp\Lancer.dll

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-11-29 18:05:05 Modify pending file operation [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsi68A5.tmp\ClearLog.dll

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-11-29 18:05:05 Modify pending file operation [Auto-blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsiE314.tmp\waitlist.dat

\??\C:\Windows.old\windows\System32\drivers\IntcDAud.sys

\??\C:\Windows.old\windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_12e2eb5912c0f66f\IntcDAud.sys

\??\C:\Windows.old\windows\System32\drivers\IntcDAud.sys

\??\C:\Windows.old\windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_12e2eb5912c0f66f\IntcDAud.sys

\??\C:\Windows.old\windows\System32\drivers\IntcDAud.sys

\??\C:\Windows.old\windows\System32\DriverStore\FileReposi
Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (0)
2016-11-29 17:47:15   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 3B 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-29 17:47:15   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 3A 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-28 23:18:15   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 36 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-28 23:18:15   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 37 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-28 19:04:51   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 34 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-28 19:04:51   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 35 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-28 08:49:13   Modify pending file operation   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\drivers\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-28 08:49:13 Modify pending file operation [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_12e2eb5912c0f66f\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-27 20:58:51   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\ANIMATIONSHOP3.WORKSPACEFILE\SHELL\OPEN\COMMAND\[]
Content: C:\Program Files (x86)\Jasc Software Inc\Animation Shop 3\Anim.exe "%1"
Process: C:\Program Files (x86)\Jasc Software Inc\Animation Shop 3\Anim.exe
Parent Process:C:\WINDOWS\Sysnative\OpenWith.exe , (0)
2016-11-27 20:53:13   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\JGD_AUTO_FILE\SHELL\OPEN\COMMAND\[]
Content: "C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\Corel Paint Shop Pro Photo.exe" /dde
Process: C:\WINDOWS\Sysnative\OpenWith.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-24 21:05:34   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 1C 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-24 21:05:34   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 1D 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-24 10:34:22   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 18 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-24 10:34:22   Modify key settings   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SAM\SAM\DOMAINS\ACCOUNT\[F]
Content: 02 00 01 00 00 00 00 00 73 A9 92 88 98 15 D1 01 19 00 00 00 00 00 00 00 00 80 A6 0A FF DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EA 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 38 00 00 00 B7 B0 4E E4 E4 C8 71 23 8F 0C 02 9C 03 7A 76 A8 F3 E7 3F F5 40 92 94 E8 8B 4A 0F BA AD AC DF 6E F8 11 A7 1E 43 1D B7 10 7B 52 4B 71 05 B7 33 FD 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 38 00 00 00 9B 6D 09 A9 8B 28 FF 06 C3 EE B6 5F 16 8A 34 B1 F1 C9 8B D6 14 4C 49 89 3D BC 0D 13 E6 BC 69 A7 5C 92 73 04 34 0B F7 C6 A7 BA D0 25 08 E9 DA 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00
Process: C:\WINDOWS\Sysnative\lsass.exe
Parent Process: , (0)
2016-11-22 11:23:53   Modify key COM component   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\MIME\DATABASE\CONTENT TYPE\APPLICATION/X-COMPRESSED\[Extension]
Content: .solitairetheme8
Process: C:\WINDOWS\Sysnative\svchost.exe
Parent Process:C:\WINDOWS\Sysnative\services.exe , (0)
2016-11-21 11:20:50   Modify pending file operation   [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsiE314.tmp\AG64.dll

Process: C:\WINDOWS\Sysnative\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-11-21 11:20:50 Modify pending file operation [Auto-blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsiE314.tmp\ClearLog.dll

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (0)
2016-11-21 11:20:40 Modify pending file operation [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsiE314.tmp\AG.dll

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-11-21 11:20:40 Modify pending file operation [Auto-blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsiE314.tmp\AG64.dll

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (0)
2016-11-21 11:20:40 Modify pending file operation [Auto-blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsiE314.tmp\Lancer.dll

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (0)
2016-11-21 11:20:06 Modify pending file operation [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsiE314.tmp\Aa.dll

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-17 19:59:23 Modify pending file operation [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_12e2eb5912c0f66f\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-13 10:57:38 Modify pending file operation [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_12e2eb5912c0f66f\IntcDAud.sys

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-11-11 10:55:30 Modify pending file operation [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsi861A.tmp\ClearLog.dll

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-11-11 10:55:30 Modify pending file operation [Auto-blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\WINDOWS\TEMP\nsi861A.tmp\waitlist.dat

Process: C:\Windows\SysWOW64\rundll32.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (0)
2016-11-09 18:02:56 Modify pending file operation [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\drivers\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-09 18:02:56 Modify pending file operation [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_12e2eb5912c0f66f\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-09 09:23:49   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: dropbox-NamespaceExtensionRole.Personal
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process: , (0)
2016-11-09 09:23:49   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: Dropbox
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process: , (0)
2016-11-08 21:28:52   Modify file association   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\ANIMATIONSHOP3.WORKSPACEFILE\SHELL\OPEN\COMMAND\[]
Content: C:\Program Files (x86)\Jasc Software Inc\Animation Shop 3\Anim.exe "%1"
Process: C:\Program Files (x86)\Jasc Software Inc\Animation Shop 3\Anim.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-11-08 20:59:59   Modify sensitive system setting   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2DB46B4D-4BAB-497E-9EC1-466982BBA2A7}\LOCALSERVER32\[]
Content: C:\PROGRA~2\Corel\CORELP~1\CORELP~1.EXE
Process: C:\Program Files (x86)\Corel\Corel Paint Shop Pro Photo X2\Corel Paint Shop Pro Photo.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-11-08 11:33:25   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: dropbox-NamespaceExtensionRole.Personal
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-08 11:33:25   Modify SHELL namespace   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\[]
Content: Dropbox
Process: C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-08 08:45:43   Modify pending file operation   [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\drivers\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-11-08 08:45:43 Modify pending file operation [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_12e2eb5912c0f66f\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-10-27 14:50:59 Modify pending file operation [Auto-allowed]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CONTROL\SESSION MANAGER\[PendingFileRenameOperations]
Content:
\??\C:\Windows.old\windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_12e2eb5912c0f66f\IntcDAud.sys

Process: C:\WINDOWS\Sysnative\taskhostw.exe
Parent Process:C:\WINDOWS\Sysnative\svchost.exe , (0)
2016-10-26 11:39:09   Modify default browser   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\SHELL\ASSOCIATIONS\URLASSOCIATIONS\HTTP\USERCHOICE\[Hash]
Content: fTzROqo8x+U=
Process: C:\Program Files (x86)\Nolarry\Application\chrome.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-10-26 11:39:09   Modify default browser   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\SHELL\ASSOCIATIONS\URLASSOCIATIONS\HTTP\USERCHOICE\[ProgId]
Content: AppXq0fevzme2pys62n3e0fbqa7peapykr8v
Process: C:\Program Files (x86)\Nolarry\Application\chrome.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-10-26 11:39:09   Modify default browser   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\SHELL\ASSOCIATIONS\URLASSOCIATIONS\HTTPS\USERCHOICE\[Hash]
Content: 22q9GIhyELI=
Process: C:\Program Files (x86)\Nolarry\Application\chrome.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-10-26 11:39:09   Modify default browser   [Auto-allowed]
Detailed description:
Registry: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\SHELL\ASSOCIATIONS\URLASSOCIATIONS\HTTPS\USERCHOICE\[ProgId]
Content: AppX90nv6nhay5n6a98fnetv7tpk64pp35es
Process: C:\Program Files (x86)\Nolarry\Application\chrome.exe
Parent Process:C:\Windows\explorer.exe , (0)
2016-10-26 11:38:21   Modify default browser   [Blocked]
Detailed description:
Registry: HKEY_CURRENT_USER\Software\Classes\HTTPS\SHELL\OPEN\COMMAND\[]
Content: "C:\Program Files (x86)\Nolarry\Application\chrome.exe" "%1"
Process: C:\Windows\Temp\nsiF190.tmp\ttff.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)
2016-10-26 11:38:11   Modify driver or service   [Blocked]
Detailed description:
Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\SERVICES\ILS\PARAMETERS\[ServiceDll]
Content: C:\ProgramData\Tencent\QQ\qmdr\dr.dll
Process: C:\Windows\Temp\nsiF190.tmp\ttff.exe
Parent Process:C:\Windows\SysWOW64\rundll32.exe , (103)

nine · 14 december 2016

hallo,

ik krijg rode lijntjes in m'n tekst maar ook op gezichten enzo, ik doe beelbewerking, dus knap lastig..

enig idee hoe dit komt?

ik doe er een printscreen bij...

ScreenShot007.bmp

ScreenShot009.bmp

falstring · 14 december 2016

tja, die printscreens zien er absoluut normaal uit, zoals passer ook al vaststelde. bekijk ze zelf maar eens op een andere pc...

daaruit mag je concluderen: wat de videoprocessor naar het scherm stuurt is in orde, en vervolgens: het scherm zelf faalt.

je kan e.e.a. zelf nog eens checken door een ander beeldscherm eraan te hangen, maar ik denk dat de conclusie al duidelijk is, en je zoektocht in de software lijkt me dus overbodig.

LouisePorkolt · 14 december 2016

4 uren geleden, nine zei:

hallo,

ik krijg rode lijntjes in m'n tekst maar ook op gezichten enzo, ik doe beelbewerking, dus knap lastig..

enig idee hoe dit komt?

ik doe er een printscreen bij...

ScreenShot007.bmp

ScreenShot009.bmp

Hoi,

kan je er een foto van trekken ? omdat het hardware is kan de PC deze lijnen niet zien en maakt een screenshot van het scherm zoals hij het projecteert !

Het kan zijn dat (zoals bij vele pc's) de grafische chip problemen geeft ! Als daar één van de honderden connecties (bolletjes) tussen de grafische chip (GPU) en het Mobo (moederbord) loszit en de GPU warmt op, warmen de bolletjes eronder ook op die zetten uit en diegene die loszitten verbreken contact. (dit gebeurt soms onmiddellijk of soms na een kwartiertje) en afhankelijk van de bolletjes die losokmen geeft het een andere fout (zwart scherm, strepen over het scherm of andere...)

Mijn oplossing is niet zo complex maar neemt een paar uurtjes in beslag.

Laptop uit elkaar, Mobo eruit, grafische chip opwarmen met professioneel materiaal tot een 200°C en weer in elkaar steken (is mij zondag weer eens gelukt op een laptop van Compaq) dan weer in elkaar steken en klaar is kees.

Ofwel Grafische kaart uit de pc halen, alle losse onderdelen eraf vijzen, zelfde procedure met de grafische chip als hierboven, weer in elkaar vijzen en inbouwen in de PC.

Indien daar help bij nodig is wil ik daar graag mee helpen. Heb hier al een 20tal PC's mee gerepareerd !

Laat maar weten,

Groetjes, Louise.

nine · 14 december 2016

hallo Louisa, fijn dat je reageert, eerst..het is geen laptop maar een nieuwe desktop...alleen het scherm is al 10 jaar oud...ik dacht eerst dat het daaraan zou kunnen liggen, de pc zelf is zo'n maand of 3 oude...

ScreenShot010.bmp

ScreenShot009.bmp

nine · 14 december 2016

7 uren geleden, falstring zei:

tja, die printscreens zien er absoluut normaal uit, zoals passer ook al vaststelde. bekijk ze zelf maar eens op een andere pc...

daaruit mag je concluderen: wat de videoprocessor naar het scherm stuurt is in orde, en vervolgens: het scherm zelf faalt.

je kan e.e.a. zelf nog eens checken door een ander beeldscherm eraan te hangen, maar ik denk dat de conclusie al duidelijk is, en je zoektocht in de software lijkt me dus overbodig.

falstring, bedoel je dat het m'n beeldscherm is? zou best kunnen, is al zo'n 10 jaar oud, m'n pc 3 maanden...als het dat is zal het snel opgelost zijn...bedankt voor je reactie Falstring, ben ik blij mee

14 december 2016

8 uren geleden, LouisePorkolt zei:

kan je er een foto van trekken ?

Dus een foto maken met je fototoestel en die foto in bijlage toevoegen. Dus geen screenshot!

Liefst een jpg of png bestand in plaats van een BMP.

Inloggen

ik krijg rode lijnen op m'n scherm

Aanbevolen berichten

Link naar reactie

Delen op andere sites

Link naar reactie

Delen op andere sites

Link naar reactie

Delen op andere sites

Link naar reactie

Delen op andere sites

Link naar reactie

Delen op andere sites

Link naar reactie

Delen op andere sites

Link naar reactie

Delen op andere sites

Link naar reactie

Delen op andere sites

Link naar reactie

Delen op andere sites

Gast

Link naar reactie

Delen op andere sites

Welkom op PC Helpforum

Leden statistieken

OVER ONS

SITEMAP

Belangrijke informatie