Geel icoontje bij internettoegang

[anoniem]

Sinds gisteren heb ik een geel icoontje (het lijkt wel een klein zonnetje) bij de internettoegang op mijn taakbalk. Dit nog nooit eerder gezien; vreemd....? Voor de volledigheid meld ik nog even dat de Taakplanner niet werkt; ik heb hier reeds een topic voor gestart in OS Windows maar het probleem is ondanks een aantal aanbevelingen nog niet opgelost. http://forum.computertotaal.nl/phpBB2/viewtopic.php?t=219288&highlight= Voor de zekerheid misschien even een check-up? Alvast een MBAM-log hieronder: Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Databaseversie: v2013.01.25.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Jos H :: LAPTOP [administrator] 25-1-2013 9:17:43 mbam-log-2013-01-25 (09-17-43).txt Scan type: Snelle scan Ingeschakelde scan opties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM Uitgeschakelde scan opties: P2P Objecten gescand: 210711 Verstreken tijd: 3 minuut/minuten, 8 seconde(n) Geheugenprocessen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Geheugenmodulen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registersleutels gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registerwaarden gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Registerdata gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Mappen gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) Bestanden gedetecteerd: 0 (Geen kwaadaardige objecten gedetecteerd) (einde)

[anoniem]

@ Lion: In dit geval was er wel iets aan de hand nl. een nieuwe driver voor de WIFI netwerkkaart. Het gele bolletje is nu weg en dat was niet zo na alleen opnieuw opstarten. Nu heeft Abraham54 de juiste oplossing aangedragen!!! Heb je inhoudelijk nog iets te zeggen over de oplossing voor de niet-werkende Taakplanner?

[anoniem]

Het ging me er alleen om duidelijk te maken dat de oorzaak in bepaalde gevallen ook bij Windows zelf gezocht kan worden... Wat betreft die Taakplanner; misschien is [url=http://social.technet.microsoft.com/Search/nl-NL?query=taakplanner&ac=8]hier[/url] iets zinvols te vinden....?

[anoniem]

@ Lion: Ik heb naar de 8 mogelijke oplossingen gekeken maar niets gevonden wat ik nog niet had uitgevoerd. Dank voor je suggestie. Ik wacht even de reactie van Abraham54 af.

[anoniem]

Jos, Kijk eens of je hiermee verder komt. http://answers.microsoft.com/en-us/windows/forum/windows_vista-desktop/task-scheduler-engine-has-stopped-working-how-do-i/ec8f919d-53da-4f16-b4b4-5335d4f7e087 Vr.gr

[anoniem]

Ik werk niet (meer) met de taakplanner, dus kan niets zinnigs vermelden. Toch levert een "taakplanner functioneert niet" in een Google zoekopdracht een schat van informatie op. Vaak is informatie van Technet (= Microsoft) hierin goed bruikbaar. Succes!

[anoniem]

@ f.ramaekers: Allereerst wederom dank voor je reactie!!! Het artikel betreft Windows Vista; ik heb Windows 7 64-bit geinstalleerd. Ik was zelf erg blij met de komst van Win-7 omdat Vista nogal eens crashte en verdere ongein opleverde. Wat ik nog niet gedaan heb is een repair install uit te voeren (zoals voorgesteld wordt in het artikel). Als ik dit ga doen kleven hier dan nog nadelen aan?

[anoniem]

Ik moet je daar het antwoord schuldig op blijven. Ik heb daar zelf geen ervaring mee. Vr.gr.

[anoniem]

@ Lion: Ik doe niet anders dan zoeken via Google; ook Technet doorzoek ik voortdurend. Tevens SchoonePC, Tweakers.net en verschillende fora waaronder dit forum.

[anoniem]

Jos, Ik kwam dit nog tegen, tekst uit een ander forum. Betrouwbaarheidsgeschiedenis in het onderhoudscentrum werkt weer! [1] In de taakplanner heb ik via Bibliotheek > Microsoft > Windows > RAC > Eigenschappen > Algemeen > Wijzigen > opLocal Service gezet i.p.v. System. Dit had ik ergens op een Amerikaans forum gelezen dat iemand dat gedaan had om zijn grafiek weer aan de gang te krijgen. [2] In het boek van Menno Schoone “Installeren en optimaliseren van Windows 7” wordt geschreven hoe men de machtigingen van bestanden en mappen aan een gebruiker kan wijzigen/verhogen. Dit bracht mij op het idee om dit toe te passen op de map RAC en wel als volgt: via de Verkenner > Organiseren > map- en zoekopties > Weergave > Verborgen bestanden en mappen weergeven > toepassen > ok. Daarna in de verkenner genavigeerd naar C:\ ProgramData > Microsoft > RAC. Hierop rechts geklikt, gekozen voor > eigenschappen > Tabblad > Beveiliging > de groepen’ Iedereen’ en de groep ‘gebruikers’ volledig beheer gegeven. Vr.gr

[anoniem]

@ f. ramaekers: Reeds uitgevoerd echter zonder suc6!

[anoniem]

Jos, Je kunt het eens proberen op het forum van microsoft. http://answers.microsoft.com/nl-nl succes .

[anoniem]

Probeer of het volgende werkt: Download [url=http://kb.eset.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe][b:1023aa85ad]ESET Service Repair[/b:1023aa85ad][/url] naar het bureaublad. Open de service repair tool ([b:1023aa85ad]ServiceRepair.exe[/b:1023aa85ad]). [b:1023aa85ad][color=blue:1023aa85ad]Windows 7 en Vista gebruikers rechtsklik -> uitvoeren als Administrator.[/b:1023aa85ad][/color:1023aa85ad] Wanneer je een beveiligings waarschuwing krijgt klik je op [b:1023aa85ad]doorgaan[/b:1023aa85ad] of [b:1023aa85ad]ja[/b:1023aa85ad] om door te gaan. Wanneer de tool klaar is zal er gevraagd worden om de computer te herstarten, klik op [b:1023aa85ad]ja[/b:1023aa85ad] om te herstarten. Als het goed is zal de tool een log maken deze is nu terug te vinden in de map [b:1023aa85ad]CC Support.[/b:1023aa85ad] Plaats het logje genaamd: [b:1023aa85ad]CC Support\Logs\SvcRepair.txt[/b:1023aa85ad]

[anoniem]

Hierbij het logbestand; overigens is het zonnetje weer terug maar internet werkt prima!! Log Opened: 2013-01-28 @ 22:05:34 22:05:34 - ----------------- 22:05:34 - | Begin Logging | 22:05:34 - ----------------- 22:05:34 - Fix started on a WIN_7 X64 computer 22:05:34 - Prep in progress. Please Wait. 22:05:35 - Prep complete 22:05:35 - Repairing Services Now. Please wait... INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Win7\BFE.sddl' INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\SubLayer> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Provider> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Filter> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime\Filter> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE> SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Win7\BITS.sddl' INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Security> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Performance> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Parameters> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS> SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Win7\iphlpsvc.sddl' INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Teredo> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo\{FA88062C-9A61-4C1E-AC45-7143F8F01AAD}> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap\{8AD2FB26-F91E-44F1-9B24-3C0AE56C9CE0}> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\IPHTTPS> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Interfaces> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\config> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc> SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Win7\MpsSvc.sddl' INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Security> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\Teredo> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\DHCP> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc> SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Win7\SharedAccess.sddl' INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch2> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile\Logging> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile\Logging> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile\Logging> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess> SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Win7\WinDefend.sddl' INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo\0> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Security> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Parameters> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend> SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Win7\wscsvc.sddl' INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Security> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Parameters> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc> SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Win7\wuauserv.sddl' INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Security> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Parameters> INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv> SetACL finished successfully. 22:05:38 - Services Repair Complete. 22:05:54 - Reboot Initiated

[anoniem]

Zonnetje weer terug - maar doet de Taakplanner het weer meteen?

[anoniem]

Nee, taakplanner doet het niet. Alle taken zijn verdwenen zowel in de Taakplanner zelf als in System 32. Alleen de Defrag taak staat nog in System 32.

[anoniem]

Tijd om wat anders te gaan doen: [b:6de4ee04b6]Welk programma[/b:6de4ee04b6]: [color=#008000:6de4ee04b6][b:6de4ee04b6]ComboFix[/b:6de4ee04b6][/color:6de4ee04b6] [b:6de4ee04b6]Waarvoor/waarom[/b:6de4ee04b6]: Zeer specialistische scanner om Windows diepgaand te onderzoeken en op te schonen. [b:6de4ee04b6]Moeilijkheidsgraad[/b:6de4ee04b6]: Min of meer lastige voorbereidingsfase, dus lees alles eerst goed. [b:6de4ee04b6]Downloadlokatie[/b:6de4ee04b6]: Dit programma absoluut naar het bureaublad downloaden! [b:6de4ee04b6]Download ComboFix via één van deze locaties[/b:6de4ee04b6]: [list:6de4ee04b6][*:6de4ee04b6][url=http://download.bleepingcomputer.com/sUBs/ComboFix.exe][b:6de4ee04b6]Bleepingcomputer[/b:6de4ee04b6][/url] [*:6de4ee04b6][url=http://www.forospyware.com/sUBs/ComboFix.exe][b:6de4ee04b6]ForoSpyware[/b:6de4ee04b6][/url] [*:6de4ee04b6][url=http://subs.geekstogo.com/ComboFix.exe][b:6de4ee04b6]Geekstogo[/b:6de4ee04b6][/url][/list:u:6de4ee04b6] [url=http://www.bleepingcomputer.com/combofix/nl/hoe-dient-combofix-gebruikt-te-worden][b:6de4ee04b6][color=#0000FF:6de4ee04b6]Hier[/color:6de4ee04b6][/b:6de4ee04b6][/url] zie je hoe je ComboFix moet gebruiken. Antivirusprogramma en actieve malwarescanners dienen al voor je ComboFix start gedeaktiveert zijn! [url=http://www.hijackthis.nl/forum/viewtopic.php?f=86&t=32608][b:6de4ee04b6][color=#0000FF:6de4ee04b6]Hier[/color:6de4ee04b6][/b:6de4ee04b6][/url] en [url=http://www.hijackthis.nl/forum/viewtopic.php?f=86&t=32607][b:6de4ee04b6][color=#0000FF:6de4ee04b6]hier[/color:6de4ee04b6][/b:6de4ee04b6][/url] vindt je gegevens hoe antivirusprogramma's en spywarescanners te deaktiveren. [b:6de4ee04b6]Opmerkingen[/b:6de4ee04b6]: [list:6de4ee04b6][*:6de4ee04b6] Bij gebruik van Windows XP zal er mogelijk gevraagd worden, om de "Recovery Console" te installeren! Sta dit dan toe (hiervoor is een actieve internet verbinding vereist). [*:6de4ee04b6]Alle openstaande programma's en webpagina's dienen afgesloten te zijn.[/list:u:6de4ee04b6] [b:6de4ee04b6]ComboFix opstarten[/b:6de4ee04b6]: [list:6de4ee04b6][*:6de4ee04b6][b:6de4ee04b6][color=#0000FF:6de4ee04b6]Windows 2000[/color:6de4ee04b6][/b:6de4ee04b6] en [color=#0000FF:6de4ee04b6][b:6de4ee04b6]Windows XP[/b:6de4ee04b6][/color:6de4ee04b6]: dubbelklik op ComboFix.exe. [*:6de4ee04b6][color=#0000FF:6de4ee04b6][b:6de4ee04b6]Windows Vista[/b:6de4ee04b6][/color:6de4ee04b6] en [color=#0000FF:6de4ee04b6][b:6de4ee04b6]Windows 7[/b:6de4ee04b6][/color:6de4ee04b6]: via rechtsklik op ComboFix.exe en kies voor "Als Administrator uitvoeren".[/list:u:6de4ee04b6] [b:6de4ee04b6]ComboFix is opgestart[/b:6de4ee04b6]: [list:6de4ee04b6][*:6de4ee04b6]Niet in het zwarte venster klikken, hierdoor kan ComboFix of zelfs Windows geheel "bevriezen"! [*:6de4ee04b6]Combofix sluit tijdens de scan de internet verbinding – probeer deze tussentijds niet te herstellen! [*:6de4ee04b6]Het kan voorkomen dat de computer meerdere malen opnieuw opgestart moet worden, dit is normaal. [*:6de4ee04b6]Wanneer ComboFix gereed is, zal het het een logbestand voor je maken. [*:6de4ee04b6]Post de inhoud van dit logbestand in je volgende bericht. [*:6de4ee04b6]Indien het log niet opstart, is dit terug tevinden in C:\ComboFix.txt[/list:u:6de4ee04b6] [b:6de4ee04b6]Belangrijke opmerking[/b:6de4ee04b6]: [list:6de4ee04b6][*:6de4ee04b6][b:6de4ee04b6][color=#0000FF:6de4ee04b6]Indien na de scan bij het opstarten van programma's er een error wordt getoond met de melding:[/color:6de4ee04b6][/b:6de4ee04b6] [*:6de4ee04b6][b:6de4ee04b6][color=#FF0000:6de4ee04b6]Er is geprobeerd een ongeldige bewerking uit te voeren op een registersleutel die is gemarkeerd voor verwijdering.[/color:6de4ee04b6][/b:6de4ee04b6] [*:6de4ee04b6][b:6de4ee04b6][color=#008000:6de4ee04b6]Start dan de computer opnieuw op.[/color:6de4ee04b6][/b:6de4ee04b6][/list:u:6de4ee04b6]

[anoniem]

Hoi Abraham54, Ik val om van de slaap dus ga naar bed. Morgen weer met frisse moed met Combofix aan de slag!! Welterusten.

[anoniem]

Welterusten, ik ga ook zo onder de wol.

[anoniem]

Goedemorgen, hierbij het logbestand van Combofix: ComboFix 13-01-28.03 - Jos H 29-01-2013 6:58.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.3070.1640 [GMT 1:00] Gestart vanuit: c:\users\Jos H\Desktop\ComboFix.exe AV: G Data InternetSecurity 2013 COMPUTER!TOTAAL Edition *Disabled/Updated* {39B780B4-63C2-05B0-3B40-8F7A21E4F496} FW: G Data Personal Firewall *Disabled* {018C0191-29AD-04E8-101F-264FDF37B3ED} SP: G Data InternetSecurity 2013 COMPUTER!TOTAAL Edition *Disabled/Updated* {82D66150-45F8-0A3E-01F0-B4085A63BE2B} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\SysinternalsSuite\adrestore.exe c:\users\SysinternalsSuite\Cacheset.exe c:\users\SysinternalsSuite\ctrl2cap.exe c:\users\SysinternalsSuite\DMON.SYS c:\users\SysinternalsSuite\efsdump.exe c:\users\SysinternalsSuite\hex2dec.exe c:\users\SysinternalsSuite\ldmdump.exe c:\users\SysinternalsSuite\LoadOrd.exe c:\users\SysinternalsSuite\movefile.exe c:\users\SysinternalsSuite\ntfsinfo.exe c:\users\SysinternalsSuite\pipelist.exe c:\users\SysinternalsSuite\ShareEnum.exe c:\users\SysinternalsSuite\Tcpvcon.exe c:\users\SysinternalsSuite\Volumeid.exe . . (((((((((((((((((((( Bestanden Gemaakt van 2012-12-28 to 2013-01-29 )))))))))))))))))))))))))))))) . . 2013-01-29 06:10 . 2013-01-29 06:10 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-01-29 05:56 . 2013-01-29 05:56 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{60EC14E2-7FE6-4478-93ED-C67089AB9B56}\offreg.dll 2013-01-29 04:25 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{60EC14E2-7FE6-4478-93ED-C67089AB9B56}\mpengine.dll 2013-01-28 12:45 . 2013-01-28 12:45 -------- d-----w- c:\program files\DIFX 2013-01-27 18:00 . 2013-01-27 18:00 -------- d-----w- c:\program files (x86)\Intel 2013-01-27 18:00 . 2011-02-28 07:09 53248 ----a-w- c:\windows\SysWow64\CSVer.dll 2013-01-27 18:00 . 2013-01-27 18:00 -------- d-----w- C:\Intel 2013-01-27 17:47 . 2013-01-27 17:47 -------- d-----w- c:\program files (x86)\SystemRequirementsLab 2013-01-27 17:47 . 2013-01-27 17:47 -------- d-----w- c:\users\Jos H\AppData\Roaming\SystemRequirementsLab 2013-01-27 17:42 . 2013-01-27 17:42 859552 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-01-27 17:42 . 2013-01-27 17:42 780192 ----a-w- c:\windows\SysWow64\deployJava1.dll 2013-01-23 13:00 . 2013-01-23 13:00 -------- d-----w- c:\users\Jos H\AppData\Roaming\ParetoLogic 2013-01-23 13:00 . 2013-01-23 13:00 -------- d-----w- c:\users\Jos H\AppData\Roaming\DriverCure 2013-01-23 13:00 . 2013-01-23 13:04 -------- d-----w- c:\programdata\ParetoLogic 2013-01-22 13:42 . 2013-01-22 13:42 -------- d-----w- C:\ATISupport 2013-01-09 13:36 . 2013-01-09 13:36 -------- d-----w- c:\windows\SysWow64\Adobe 2013-01-09 09:21 . 2012-11-01 05:43 2002432 ----a-w- c:\windows\system32\msxml6.dll 2013-01-09 09:21 . 2012-11-01 05:43 1882624 ----a-w- c:\windows\system32\msxml3.dll 2013-01-09 09:21 . 2012-11-01 04:47 1389568 ----a-w- c:\windows\SysWow64\msxml6.dll 2013-01-09 09:21 . 2012-11-01 04:47 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll 2013-01-09 09:21 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll 2013-01-09 09:21 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll 2013-01-09 09:21 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll 2013-01-09 09:21 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll 2013-01-09 09:21 . 2012-11-20 05:48 307200 ----a-w- c:\windows\system32\ncrypt.dll 2013-01-09 09:21 . 2012-11-20 04:51 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll 2013-01-09 09:21 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe 2013-01-09 09:20 . 2012-11-23 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys 2013-01-07 08:19 . 2013-01-07 08:19 -------- d-----w- c:\users\Jos H\AppData\Local\O&O . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-01-18 12:25 . 2012-11-19 13:09 74248 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-01-18 12:25 . 2012-11-19 13:09 697864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-01-09 09:35 . 2012-11-19 09:10 67599240 ----a-w- c:\windows\system32\MRT.exe 2012-12-29 07:57 . 2012-12-14 09:11 181064 ----a-w- c:\windows\PSEXESVC.EXE 2012-12-23 05:54 . 2012-12-23 05:54 14794312 ----a-w- c:\program files (x86)\Common Files\lpuninstall.exe 2012-12-16 17:11 . 2012-12-21 02:00 46080 ----a-w- c:\windows\system32\atmlib.dll 2012-12-16 14:45 . 2012-12-21 02:00 367616 ----a-w- c:\windows\system32\atmfd.dll 2012-12-16 14:13 . 2012-12-21 02:00 295424 ----a-w- c:\windows\SysWow64\atmfd.dll 2012-12-16 14:13 . 2012-12-21 02:00 34304 ----a-w- c:\windows\SysWow64\atmlib.dll 2012-12-14 15:49 . 2012-12-03 16:30 24176 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-12-12 21:37 . 2012-12-12 21:37 4472832 ----a-w- c:\windows\SysWow64\GPhotos.scr 2012-12-12 09:24 . 2012-11-22 17:41 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys 2012-12-06 15:29 . 2012-12-06 15:29 16504 ----a-w- c:\windows\system32\drivers\GdPhyMem.sys 2012-12-06 15:29 . 2012-12-06 15:29 106648 ----a-w- c:\windows\system32\drivers\GRD.sys 2012-12-05 13:08 . 2012-12-05 13:08 64376 ----a-w- c:\windows\system32\drivers\HookCentre.sys 2012-12-05 13:08 . 2012-12-05 13:08 126880 ----a-w- c:\windows\system32\drivers\MiniIcpt.sys 2012-12-05 13:08 . 2012-12-05 13:08 54176 ----a-w- c:\windows\system32\drivers\GDBehave.sys 2012-12-05 13:08 . 2012-12-05 13:08 64416 ----a-w- c:\windows\system32\drivers\gdwfpcd64.sys 2012-12-05 11:51 . 2012-12-05 11:51 60320 ----a-w- c:\windows\system32\drivers\PktIcpt.sys 2012-11-30 11:07 . 2012-11-30 11:07 10792 ----a-w- c:\windows\SysWow64\GdScrSv.nl.dll 2012-11-30 04:45 . 2013-01-09 09:22 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2012-11-26 02:25 . 2012-11-26 02:25 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll 2012-11-26 02:25 . 2012-11-26 02:25 856712 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2012-11-21 07:30 . 2012-11-21 07:30 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll 2012-11-21 07:30 . 2012-11-21 07:30 856712 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2012-11-20 16:28 . 2012-10-02 13:03 167048 ----a-w- c:\users\SysinternalsSuite\psping.exe 2012-11-20 16:28 . 2012-07-17 22:59 568440 ----a-w- c:\users\SysinternalsSuite\ZoomIt.exe 2012-11-20 16:28 . 2012-07-17 22:59 294520 ----a-w- c:\users\SysinternalsSuite\ZoomIt64.exe 2012-11-20 16:28 . 2011-02-14 11:37 729464 ----a-w- c:\users\SysinternalsSuite\Winobj.exe 2012-11-20 16:28 . 2012-10-17 17:28 144984 ----a-w- c:\users\SysinternalsSuite\whois.exe 2012-11-20 16:28 . 2012-09-10 08:16 1056392 ----a-w- c:\users\SysinternalsSuite\vmmap.exe 2012-11-20 16:28 . 2011-07-25 11:40 300832 ----a-w- c:\users\SysinternalsSuite\Tcpview.exe 2012-11-20 16:28 . 2012-05-09 10:08 136312 ----a-w- c:\users\SysinternalsSuite\strings.exe 2012-11-20 16:28 . 2006-11-01 13:05 150328 ----a-w- c:\users\SysinternalsSuite\sync.exe 2012-11-20 16:28 . 2012-10-02 13:03 231048 ----a-w- c:\users\SysinternalsSuite\sigcheck.exe 2012-11-20 16:28 . 2008-02-27 17:51 103464 ----a-w- c:\users\SysinternalsSuite\ShellRunas.exe 2012-11-20 16:28 . 2007-04-27 09:17 87424 ----a-w- c:\users\SysinternalsSuite\streams.exe 2012-11-20 16:28 . 2011-08-31 14:16 155936 ----a-w- c:\users\SysinternalsSuite\sdelete.exe 2012-11-20 16:28 . 2006-11-01 13:07 334720 ----a-w- c:\users\SysinternalsSuite\RootkitRevealer.exe 2012-11-20 16:28 . 2006-11-01 13:05 150328 ----a-w- c:\users\SysinternalsSuite\regjump.exe 2012-11-20 16:28 . 2012-07-11 16:35 581744 ----a-w- c:\users\SysinternalsSuite\RAMMap.exe 2012-11-20 16:28 . 2006-11-01 13:06 162616 ----a-w- c:\users\SysinternalsSuite\RegDelNull.exe 2012-11-20 16:28 . 2012-10-17 17:28 171608 ----a-w- c:\users\SysinternalsSuite\pspasswd.exe 2012-11-20 16:28 . 2010-04-27 10:04 169848 ----a-w- c:\users\SysinternalsSuite\PsService.exe 2012-11-20 16:28 . 2006-12-04 16:53 207664 ----a-w- c:\users\SysinternalsSuite\psshutdown.exe 2012-11-20 16:28 . 2006-12-04 16:53 187184 ----a-w- c:\users\SysinternalsSuite\pssuspend.exe 2012-11-20 16:28 . 2012-06-21 22:34 468592 ----a-w- c:\users\SysinternalsSuite\pskill.exe 2012-11-20 16:28 . 2012-03-22 14:53 232232 ----a-w- c:\users\SysinternalsSuite\pslist.exe 2012-11-20 16:28 . 2010-04-27 10:04 178040 ----a-w- c:\users\SysinternalsSuite\psloglist.exe 2012-11-20 16:28 . 2010-04-27 10:04 183160 ----a-w- c:\users\SysinternalsSuite\PsLoggedon.exe 2012-11-20 16:28 . 2010-04-27 10:04 333176 ----a-w- c:\users\SysinternalsSuite\PsGetsid.exe 2012-11-20 16:28 . 2010-04-27 10:04 390520 ----a-w- c:\users\SysinternalsSuite\PsInfo.exe 2012-11-20 16:28 . 2012-07-11 16:45 2474608 ----a-w- c:\users\SysinternalsSuite\Procmon.exe 2012-11-20 16:28 . 2010-04-27 10:04 381816 ----a-w- c:\users\SysinternalsSuite\PsExec.exe 2012-11-20 16:28 . 2006-12-04 16:53 105264 ----a-w- c:\users\SysinternalsSuite\psfile.exe 2012-11-20 16:28 . 2012-10-02 13:03 2712200 ----a-w- c:\users\SysinternalsSuite\procexp.exe 2012-11-20 16:28 . 2012-11-14 13:47 462424 ----a-w- c:\users\SysinternalsSuite\procdump.exe 2012-11-20 16:28 . 2012-01-13 16:35 451392 ----a-w- c:\users\SysinternalsSuite\portmon.exe 2012-11-20 16:28 . 2006-11-01 13:06 215928 ----a-w- c:\users\SysinternalsSuite\pagedfrg.exe 2012-11-20 16:28 . 2006-11-01 13:05 150328 ----a-w- c:\users\SysinternalsSuite\pendmoves.exe 2012-11-20 16:28 . 2010-04-30 10:43 261496 ----a-w- c:\users\SysinternalsSuite\logonsessions.exe 2012-11-20 16:28 . 2012-10-17 17:28 539736 ----a-w- c:\users\SysinternalsSuite\livekd.exe 2012-11-20 16:28 . 2011-07-07 12:28 520496 ----a-w- c:\users\SysinternalsSuite\Listdlls.exe 2012-11-20 16:28 . 2010-09-07 14:39 150392 ----a-w- c:\users\SysinternalsSuite\junction.exe 2012-11-20 16:28 . 2012-07-11 16:41 462456 ----a-w- c:\users\SysinternalsSuite\handle.exe 2012-11-20 16:28 . 2011-07-07 12:28 103216 ----a-w- c:\users\SysinternalsSuite\FindLinks.exe 2012-11-20 16:28 . 2011-12-02 12:15 222520 ----a-w- c:\users\SysinternalsSuite\du.exe 2012-11-20 16:28 . 2010-03-24 13:00 580984 ----a-w- c:\users\SysinternalsSuite\DiskView.exe 2012-11-20 16:28 . 2010-10-12 11:56 1766264 ----a-w- c:\users\SysinternalsSuite\disk2vhd.exe 2012-11-20 16:28 . 2007-05-14 07:42 87424 ----a-w- c:\users\SysinternalsSuite\diskext.exe 2012-11-20 16:28 . 2006-11-01 13:06 224056 ----a-w- c:\users\SysinternalsSuite\Diskmon.exe 2012-11-20 16:28 . 2012-10-17 17:28 116824 ----a-w- c:\users\SysinternalsSuite\Desktops.exe 2012-11-20 16:28 . 2012-10-02 13:03 468104 ----a-w- c:\users\SysinternalsSuite\Dbgview.exe 2012-11-20 16:28 . 1999-11-21 18:46 2832 ----a-w- c:\users\SysinternalsSuite\ctrl2cap.nt5.sys 2012-11-20 16:28 . 2012-11-14 09:22 1479256 ----a-w- c:\users\SysinternalsSuite\Coreinfo.exe 2012-11-20 16:28 . 2006-09-27 17:04 10104 ----a-w- c:\users\SysinternalsSuite\ctrl2cap.amd.sys 2012-11-20 16:28 . 1999-11-21 17:20 2864 ----a-w- c:\users\SysinternalsSuite\ctrl2cap.nt4.sys 2012-11-20 16:28 . 2012-11-14 09:22 207960 ----a-w- c:\users\SysinternalsSuite\Contig.exe 2012-11-20 16:28 . 2009-06-03 21:36 151936 ----a-w- c:\users\SysinternalsSuite\Clockres.exe 2012-11-20 16:28 . 2012-09-10 08:16 567944 ----a-w- c:\users\SysinternalsSuite\autorunsc.exe 2012-11-20 16:28 . 2009-09-30 00:31 844648 ----a-w- c:\users\SysinternalsSuite\Bginfo.exe 2012-11-20 16:28 . 2012-09-10 08:16 649864 ----a-w- c:\users\SysinternalsSuite\autoruns.exe 2012-11-20 16:28 . 2011-02-22 14:18 148856 ----a-w- c:\users\SysinternalsSuite\Autologon.exe 2012-11-20 16:28 . 2007-11-20 12:25 1049640 ----a-w- c:\users\SysinternalsSuite\ADInsight.exe 2012-11-20 16:28 . 2012-11-14 09:22 479832 ----a-w- c:\users\SysinternalsSuite\ADExplorer.exe 2012-11-20 16:28 . 2006-11-01 13:06 174968 ----a-w- c:\users\SysinternalsSuite\AccessEnum.exe 2012-11-20 16:28 . 2012-08-01 12:27 331888 ----a-w- c:\users\SysinternalsSuite\accesschk.exe 2012-11-19 16:24 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll 2012-11-19 16:24 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll 2012-11-19 11:24 . 2012-11-19 11:27 594472 ----a-w- c:\windows\system32\drivers\btwampfl.sys 2012-11-19 11:24 . 2012-11-19 11:25 39976 ----a-w- c:\windows\system32\drivers\btwl2cap.sys 2012-11-19 11:24 . 2012-11-19 11:25 21544 ----a-w- c:\windows\system32\drivers\btwrchid.sys 2012-11-19 11:24 . 2012-11-19 11:25 210984 ----a-w- c:\windows\system32\drivers\btwavdt.sys 2012-11-19 11:24 . 2012-11-19 11:25 184872 ----a-w- c:\windows\system32\drivers\btwaudio.sys 2012-11-19 09:18 . 2012-11-19 09:18 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll 2012-11-19 09:18 . 2012-11-19 09:18 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2012-11-19 09:18 . 2012-11-19 09:18 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2012-11-19 09:18 . 2012-11-19 09:18 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2012-11-19 09:18 . 2012-11-19 09:18 161792 ----a-w- c:\windows\SysWow64\msls31.dll 2012-11-19 09:18 . 2012-11-19 09:18 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "G Data AntiVirus Tray Application"="c:\program files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe" [2012-09-17 995352] "GDFirewallTray"="c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe" [2012-01-27 1470968] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2012-4-1 1390368] Install LastPass FF RunOnce.lnk - c:\program files (x86)\Common Files\lpuninstall.exe [2012-12-23 14794312] Install LastPass IE RunOnce.lnk - c:\program files (x86)\Common Files\lpuninstall.exe [2012-12-23 14794312] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 EtmTempSense;EtmTempSense;c:\windows\system32\DRIVERS\EtmTempSense.sys [2007-12-11 21504] R3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [2010-01-23 132608] R3 netw5v64;Stuurprogramma voor Intel(R) Wireless WiFi Link 5000 Series-adapter voor 64-bits Windows Vista;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368] R3 NETwLx64; Intel(R) Wireless WiFi Link 5000 Series adapter stuurprogramma onder Windows XP 64 Bit;c:\windows\system32\DRIVERS\NETwLx64.sys [2010-08-16 7442432] R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2011-12-16 17976] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456] R3 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-09-24 1328736] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856] R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-11-19 1255736] S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2012-12-05 54176] S0 MxEFUF;Matrox Extio Upper Function Filter;c:\windows\system32\DRIVERS\MxEFUF64.sys [2011-10-20 157696] S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2012-12-05 126880] S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys [2012-12-05 64416] S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2012-12-06 106648] S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2012-12-05 64376] S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2012-08-23 1542680] S2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [2012-01-27 468472] S2 AVKWCtl;G Data Bestandssysteembewaker;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2012-08-30 2011568] S2 GDFwSvc;G Data Personal Firewall;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2012-06-04 1766464] S2 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [2012-03-29 470008] S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-09-24 656480] S3 ATSwpWDF;AuthenTec TruePrint WBF Driver;c:\windows\system32\DRIVERS\ATSwpWDF.sys [2012-08-30 1109296] S3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys [2012-11-19 594472] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2012-11-19 39976] S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [2012-12-05 60320] S3 NETwLv64; Intel(R) Wireless WiFi Link 5000 Series adapter stuurprogramma onder Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETwLv64.sys [2010-10-07 7533568] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-10-06 766096] S3 TridVidx64;Trident TVMaster TM6000 Analog plus Digital Video Service x64;c:\windows\system32\DRIVERS\TridVidx64.sys [2007-07-31 207488] . . Inhoud van de 'Gedeelde Taken' map . 2013-01-29 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-19 12:25] . . --------- X64 Entries ----------- . . ------- Bijkomende Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: &Verzenden naar OneNote - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105 IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000 IE: LastPass - file://c:\users\Jos H\AppData\LocalLow\LastPass\context.html?cmd=lastpass IE: LastPass Invulformulieren - file://c:\users\Jos H\AppData\LocalLow\LastPass\context.html?cmd=fillforms TCP: DhcpNameServer = 213.197.28.3 213.197.30.28 FF - ProfilePath - c:\users\Jos H\AppData\Roaming\Mozilla\Firefox\Profiles\vx95oueb.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.nl/ig?hl=nl FF - ExtSQL: 2012-12-05 12:51; {906305f7-aafc-45e9-8bbd-941950a84dad}; c:\program files (x86)\Mozilla Firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad} FF - ExtSQL: 2012-12-15 05:46; smarterwiki@wikiatic.com; c:\users\Jos H\AppData\Roaming\Mozilla\Firefox\Profiles\vx95oueb.default\extensions\smarterwiki@wikiatic.com.xpi FF - ExtSQL: 2012-12-16 10:51; 2020Player_IKEA@2020Technologies.com; c:\users\Jos H\AppData\Roaming\Mozilla\Firefox\Profiles\vx95oueb.default\extensions\2020Player_IKEA@2020Technologies.com FF - ExtSQL: 2012-12-23 06:54; support@lastpass.com; c:\users\Jos H\AppData\Roaming\Mozilla\Firefox\Profiles\vx95oueb.default\extensions\support@lastpass.com FF - ExtSQL: 2012-12-23 16:53; https-everywhere@eff.org; c:\users\Jos H\AppData\Roaming\Mozilla\Firefox\Profiles\vx95oueb.default\extensions\https-everywhere@eff.org . - - - - ORPHANS VERWIJDERD - - - - . Wow6432Node-HKLM-Run-<NO NAME> - (no file) AddRemove-{C5089197-5B15-44AD-B0FC-2E94EE9ECB63} - c:\programdata\{4E78170A-6049-4586-A083-3AECE1A687E4}\wsc_x1.exe . . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Voltooingstijd: 2013-01-29 07:14:48 ComboFix-quarantined-files.txt 2013-01-29 06:14 . Pre-Run: 60.966.817.792 bytes beschikbaar Post-Run: 60.582.305.792 bytes beschikbaar . - - End Of File - - F1F2A1248BAC06CD7D7CEEFF41A338D4

[anoniem]

Open een nieuw kladblok (of anders: notepad) bestand, via "Start\Alle programma’s\Bureau-accessoires\[b:896a2437c4]Kladblok (of Notepad)[/b:896a2437c4]". Kopieer en plak de volgende (vetgedrukte, blauwe tekst) in het lege kladblokvenstervenster [b:896a2437c4][color=#0000FF:896a2437c4]ClearJavaCache:: Folder:: c:\users\Jos H\AppData\Roaming\ParetoLogic c:\users\Jos H\AppData\Roaming\DriverCure c:\programdata\ParetoLogic[/color:896a2437c4][/b:896a2437c4] Sla dit kladblokbestand op je bureaublad op als [b:896a2437c4]CFScript.txt[/b:896a2437c4]. [b:896a2437c4][color=#FF0000:896a2437c4]Nu eerst de antivirus en eventuele spywarescanners deaktiveren![/color:896a2437c4][/b:896a2437c4] [color=#008000:896a2437c4][b:896a2437c4]Zorg ook ervoor dat alle andere openstaande vensters gesloten zijn, ook de webbrowser.[/b:896a2437c4][/color:896a2437c4] Sleep CFScript.txt in ComboFix.exe [img:896a2437c4]http://crew.nucia.eu/smeenk/CFScript.gif[/img:896a2437c4] Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt. Post het Combofix-log dat na het opnieuw starten wordt getoond. Ingeval Combofix je computer opnieuw heeft opgestart (of jij dat hebt gedaan), vindt je het log ook in [b:896a2437c4]C:\Combofix.txt[/b:896a2437c4] [b:896a2437c4]Belangrijke opmerking[/b:896a2437c4]: [list:896a2437c4][*:896a2437c4][b:896a2437c4][color=#0000FF:896a2437c4]Indien na de scan bij het opstarten van programma's er een error wordt getoond met de melding:[/color:896a2437c4][/b:896a2437c4] [*:896a2437c4][b:896a2437c4][color=#FF0000:896a2437c4]Er is geprobeerd een ongeldige bewerking uit te voeren op een registersleutel die is gemarkeerd voor verwijdering.[/color:896a2437c4][/b:896a2437c4] [*:896a2437c4][b:896a2437c4][color=#008000:896a2437c4]Start dan de computer opnieuw op.[/color:896a2437c4][/b:896a2437c4][/list:u:896a2437c4]