Archief - Hangen/rebooten - vermoedelijk door internetapplicaties?

Hey

Mijn vriendin heeft problemen met haar computer. Vooral het starten van Chome loopt wel eens vast en ook lijken er op willekeurige momenten programma's die op de achtergrond lopen te crashen.

Daarnet nog kreeg ze de melding:
"Windows moet opnieuw starten omdat de DCOM server process launcher service onverwachts is gestopt" waarna de computer opnieuw opstartte.

De computer loopt algemeen zeer traag en ik heb de indruk dat vooral internetapplicaties problemen veroorzaken.

Toen ik een HijackThis scan startte kreeg ik:
"For some reason your system denied write access to the Hosts file. If any hijacked domains are in this file, HijackThis may NOT be able to fix this."

Dit is de uiteindelijke logfile:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:05:54, on 10/08/2011
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.17037)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Gebruiker\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Users\GEBRUI~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Users\Gebruiker\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! UK
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! UK
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Yahoo! UK
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [beid] "C:\Program Files\Belgium Identity Card\beid35gui.exe" /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SMS Services] "D:\DOCUME~1\smss.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Gebruiker\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Afbeelding verzenden naar &Bluetooth-apparaat... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Pagina verzenden naar &Bluetooth-apparaat... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Onderzoekscentrum - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROProj.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.be/ImageUploader5.cab
O16 - DPF: {6E718D87-6909-4FCE-92D4-EDCB2F725727} (Navigram Control) - http://www.navigram.com/engine/v1026/Navigram.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel� PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: @%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193 (idsvc) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Planner voor Automatische LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Intel� PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 12615 bytes





Alvast bedankt!

Klik met de rechtermuis op het programma Hijackthis en kies voor "Uitvoeren als Administrator"
Kies voor 'Do a system scan only'
Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKCU\..\Run: [SMS Services] "D:\DOCUME~1\smss.exe"

Sluit alle vensters behalve Hijackthis
Klik op 'Fix checked' om de items te verwijderen.


Download ComboFix van één van deze locaties:

Link 1
Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op.
>>Hier<< kunt u lezen hoe u Combofix dient te gebruiken.


1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix.

* (hier of hier staat een handleiding over hoe je deze kan uitschakelen

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.
3. Dubbelklik op "Combofix.exe" om de tool te starten.
4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

* Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion." herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Bedankt! Ik deed wat je zei en ik heb volgend logbestand uit Combofix:


ComboFix 11-08-11.02 - Gebruiker 11/08/2011 23:10:00.1.2 - x86
MicrosoftÆ Windows Vistaô Home Premium 6.0.6000.0.1252.32.1043.18.2046.1163 [GMT 2:00]
Gestart vanuit: c:\users\Gebruiker\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\windows\hide.exe
c:\windows\IsUn0413.exe
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2011-07-11 to 2011-08-11 ))))))))))))))))))))))))))))))
.
.
2011-08-11 21:18 . 2011-08-11 21:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-11 20:56 . 2011-08-11 20:56 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6B95C913-1739-483E-9153-B8AB74929150}\MpKsl4713e86b.sys
2011-08-11 20:51 . 2011-08-11 20:51 -------- d-----w- C:\found.002
2011-08-11 10:53 . 2011-07-20 07:44 6881616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6B95C913-1739-483E-9153-B8AB74929150}\mpengine.dll
2011-08-11 10:29 . 2011-08-11 10:29 -------- d-----w- C:\found.001
2011-08-09 10:25 . 1999-05-07 10:53 114688 -c--a-w- c:\programdata\Microsoft\Windows\WER\ReportQueue\Report177fd74e\MSOWCWI.DLL
2011-08-08 18:03 . 2011-08-08 18:03 -------- d-----w- c:\users\Public\Roaming
2011-08-08 18:03 . 2011-08-08 18:03 -------- d-----w- c:\users\Gebruiker\Roaming
2011-08-08 18:03 . 2011-08-08 18:03 -------- d-----w- c:\users\Default\AppData\Roaming\Intel
2011-08-08 18:03 . 2011-08-08 18:03 -------- d-----w- c:\users\Default\Roaming
2011-08-08 18:01 . 2011-08-08 18:01 -------- d-----w- c:\program files\Cisco
2011-08-08 18:01 . 2011-08-08 18:01 -------- d-----w- c:\program files\Common Files\Intel
2011-08-08 18:01 . 2011-08-08 18:01 -------- d-----w- c:\programdata\Intel
2011-08-08 18:00 . 2011-07-20 07:44 6881616 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-08 12:15 . 2010-10-19 20:51 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-08-08 12:09 . 2010-11-30 09:43 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D4B9B8AD-21F5-4364-9749-81B8AC864C70}\gapaengine.dll
2011-08-08 12:02 . 2011-08-08 12:03 -------- d-----w- c:\program files\Microsoft Security Client
2011-08-07 18:21 . 2011-08-07 18:21 -------- d-----w- C:\found.000
2011-08-06 12:14 . 2011-08-06 12:14 -------- d-----w- c:\programdata\NVIDIA
2011-08-06 12:08 . 2011-05-21 06:01 66664 ----a-w- c:\windows\system32\nvshext.dll
2011-08-06 12:08 . 2011-05-21 06:01 615528 ----a-w- c:\windows\system32\nvvsvc.exe
2011-08-06 12:08 . 2011-05-21 06:01 2560616 ----a-w- c:\windows\system32\nvsvcr.dll
2011-08-06 12:08 . 2011-05-21 06:01 543336 ----a-w- c:\windows\system32\easyupdatusapiu.dll
2011-08-06 12:06 . 2011-08-06 12:06 -------- d-----w- C:\NVIDIA
2011-08-06 11:15 . 2011-08-06 11:15 0 ---ha-w- c:\users\Gebruiker\AppData\Local\BIT6CF8.tmp
2011-07-18 19:46 . 2011-07-18 19:46 -------- d-----w- c:\program files\Common Files\Java
2011-07-13 14:24 . 2011-07-13 14:24 -------- d-----w- c:\program files\Teach2000
2011-07-13 10:23 . 2011-07-13 10:24 -------- d-----w- c:\users\Gebruiker\.freemind
2011-07-13 10:23 . 2011-07-13 10:23 -------- d-----w- c:\program files\FreeMind
2011-07-13 08:56 . 2011-07-13 08:56 39 ----a-w- c:\windows\OH4WIN.REG
2011-07-13 08:55 . 2011-07-13 08:56 -------- d-----w- c:\program files\Overhoor
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-27 23:15 . 2011-06-27 23:15 0 ---ha-w- c:\users\Gebruiker\AppData\Local\BITC1AF.tmp
2011-05-21 06:01 . 2011-08-06 12:07 12392 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2011-05-21 06:01 . 2007-08-14 05:48 301672 ----a-w- c:\windows\system32\nvhotkey.dll
2011-05-21 06:01 . 2007-08-14 05:48 2557544 ----a-w- c:\windows\system32\nvsvc.dll
2011-05-21 06:01 . 2007-08-14 05:48 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-05-21 06:01 . 2007-08-14 05:47 3693672 ----a-w- c:\windows\system32\nvcpl.dll
2011-05-21 06:01 . 2007-08-14 05:47 2335848 ----a-w- c:\windows\system32\nvapi.dll
2007-03-12 17:59 . 2007-03-12 17:59 299008 ----a-w- c:\program files\navigram_register.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-03-28 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2010-04-16 3872080]
"Facebook Update"="c:\users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-07-14 137536]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-09 865840]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 1286144]
"RtHDVCpl"="RtHDVCpl.exe" [2007-09-04 4702208]
"Skytel"="Skytel.exe" [2007-09-04 1826816]
"PLFSet"="c:\windows\PLFSet.dll" [2007-04-25 45056]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
"IaNvSrv"="c:\program files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-03-13 33048]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2007-07-31 707080]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-08-01 151552]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"beid"="c:\program files\Belgium Identity Card\beid35gui.exe" [2009-06-04 2056192]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-06-06 202256]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-08-01 151552]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-3-29 719664]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R1 MpKsl1d411420;MpKsl1d411420;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9BE0B801-173A-45E6-A947-73229A280CC5}\MpKsl1d411420.sys [x]
R1 MpKslf1d0ea21;MpKslf1d0ea21;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{306F620A-E1A5-4AC1-BE97-4EEEA430D956}\MpKslf1d0ea21.sys [x]
R2 gupdate;Google Updateservice (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-02-27 136176]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 179712]
R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-02-27 136176]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S0 iaNvStor;Intel(R) Turbo Memory Technology NAND Controller;c:\windows\system32\DRIVERS\iaNvStor.sys [2007-03-11 210432]
S1 MpKsl4713e86b;MpKsl4713e86b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6B95C913-1739-483E-9153-B8AB74929150}\MpKsl4713e86b.sys [2011-08-11 28752]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 13560]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
S3 winbondcir;Winbond IR Transceiver;c:\windows\system32\DRIVERS\winbondcir.sys [2007-04-19 43008]
.
.
--- Andere Services/Drivers In Geheugen ---
.
*NewlyCreated* - MPKSL4713E86B
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhoud van de 'Gedeelde Taken' map
.
2011-08-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2935671021-2424374710-2581231678-1000Core.job
- c:\users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-11 08:40]
.
2011-08-11 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2935671021-2424374710-2581231678-1000UA.job
- c:\users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-11 08:40]
.
2011-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-13 20:05]
.
2011-08-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-13 20:05]
.
2011-08-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2935671021-2424374710-2581231678-1000Core.job
- c:\users\Gebruiker\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-27 20:05]
.
2011-08-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2935671021-2424374710-2581231678-1000UA.job
- c:\users\Gebruiker\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-27 20:05]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.google.be/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://nl.intl.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*Yahoo! UK
IE: Afbeelding verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Pagina verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.0.1
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game03.zylom.com/activex/zylomgamesplayer.cab
.
- - - - ORPHANS VERWIJDERD - - - -
.
HKLM-Run-Acer Tour - (no file)
HKLM-Run-SetPanel - c:\acer\APanel\APanel.cmd
HKLM-Run-eRecoveryService - (no file)
AddRemove-Je Puis Je - d:\programma's\desinst_jepuisje.exe
AddRemove-Snelzoeker Pocketwoordenboeken Frans - c:\windows\ISUN0413.EXE
AddRemove-Van Dale Grote woordenboeken Frans - c:\windows\ISUN0413.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-08-11 23:19
Windows 6.0.6000 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
scannen van verborgen bestanden ...
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Voltooingstijd: 2011-08-11 23:21:42
ComboFix-quarantined-files.txt 2011-08-11 21:21
.
Pre-Run: 71.061.217.280 bytes beschikbaar
Post-Run: 74.515.361.792 bytes beschikbaar
.
- - End Of File - - ACB50239D020C14290263DA6260D337C

Als de computer een tijdje aanstaat crasht het ene achtergrondprogramma na het andere, telkens met wat tijd ertussen. Zo zag ik achtereenvolgens volgende meldingen:

Hostproces voor Windows-services werkt niet meer
Google Chrome werkt niet meer
HD Audio Control Panel werkt niet meer
eDataSecurity System Loader (Load and prepare enviroment) werkt niet meer
HP CUE Status werkt niet meer
Event Monitor User Notification Tool werkt niet meer
Bluetooth Tray Application werkt niet meer
Windows sidebar werkt niet meer
Antimalware Service Executable werkt nier meer en is gesloten

...

Voer even het onderstaande uit.

1. Download MBRCheck.exe naar je bureaublad.

• Dubbelklik op MBRCheck.exe om het programma te openen.
• Zo'n soort venster zal geopend worden:
  
  
  
  
  
  
• Als je (zoals hierboven in de afbeelding) een melding krijgt, typ dan op N en druk op Enter.
• Druk nogmaals op Enter.
• Een kladblokbestand genaamd MBRCheck_mm.dd.yy_hh.mm.ss zal op je bureaublad worden opgeslagen. Post de inhoud van dit bestand in je volgende bericht.

2. Download GMER Rootkit Scanner hier of hier.

• Laat de inhoud van het .zip bestand uitpakken op je bureaublad.
• Dubbelklik op GMER.exe.

• Indien je een waarschuwing krijgt over rootkit activiteiten en je gevraagd wordt of je een volledige scan wil doen klik dan op NO.
• In het paneel rechts zal je verschillende items zien die aangevinkt zijn. Zorg ervoor dat de volgende items UITgevinkt zijn:
  • IAT/EAT
  • Schijven/partities buiten de systeempartitie (meestal C:\)
  • Show All

• Klik dan op de [Scan] knop en wacht tot de scan klaar is.
• Wanneer de scan voltooit is, klik op de [Save ...] knop en geef de log de volgende naam: "ark.txt"
• Sla de log op een handige plaats op zoals het bureaublad.

**Opgelet**
Deze scan geeft vaak false positives. Verander niets aan een "<--- ROOKIT" regel!

Kopieer en plak deze log a.u.b. in je volgende post samen met het logje van MBRcheck.

Bedankt.

Hier is alvast de inhoud van de MBRCheck log, GMER Rootkit Scanner werd onderbroken door een BSOD

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: (build 6000), 32-bit
Base Board Manufacturer: Acer, Inc.
BIOS Manufacturer: Acer
System Manufacturer: Acer, inc.
System Product Name: Aspire 5920G
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 167):
0x82400000 \SystemRoot\system32\ntkrnlpa.exe
0x827A1000 \SystemRoot\system32\hal.dll
0x804C6000 \SystemRoot\system32\kdcom.dll
0x80466000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8045D000 \SystemRoot\system32\PSHED.dll
0x80455000 \SystemRoot\system32\BOOTVID.dll
0x8041A000 \SystemRoot\system32\CLFS.SYS
0x8071F000 \SystemRoot\system32\CI.dll
0x806A4000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8040D000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80661000 \SystemRoot\system32\drivers\acpi.sys
0x80404000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80659000 \SystemRoot\system32\drivers\msisadrv.sys
0x80634000 \SystemRoot\system32\drivers\pci.sys
0x80625000 \SystemRoot\system32\drivers\volmgr.sys
0x80401000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8061B000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8060B000 \SystemRoot\System32\drivers\mountmgr.sys
0x80604000 \SystemRoot\system32\drivers\intelide.sys
0x82DF2000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x82DA8000 \SystemRoot\System32\drivers\volmgrx.sys
0x82CEA000 \SystemRoot\system32\drivers\iastor.sys
0x82C4A000 \SystemRoot\system32\drivers\iastorv.sys
0x82C0E000 \SystemRoot\system32\DRIVERS\iaNvStor.sys
0x82C06000 \SystemRoot\system32\drivers\atapi.sys
0x82FE2000 \SystemRoot\system32\drivers\ataport.SYS
0x82FB1000 \SystemRoot\system32\drivers\fltmgr.sys
0x82FA1000 \SystemRoot\system32\drivers\fileinfo.sys
0x82F98000 \SystemRoot\system32\DRIVERS\psdfilter.sys
0x82E94000 \SystemRoot\system32\drivers\ndis.sys
0x82E69000 \SystemRoot\system32\drivers\msrpc.sys
0x82E30000 \SystemRoot\system32\drivers\NETIO.SYS
0x884F8000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8848E000 \SystemRoot\System32\Drivers\ksecdd.sys
0x88458000 \SystemRoot\system32\drivers\volsnap.sys
0x82E28000 \SystemRoot\System32\Drivers\spldr.sys
0x82E16000 \SystemRoot\system32\drivers\psdvdisk.sys
0x82E0D000 \SystemRoot\system32\drivers\PSDNServ.sys
0x88449000 \SystemRoot\System32\drivers\partmgr.sys
0x8843A000 \SystemRoot\System32\Drivers\mup.sys
0x88415000 \SystemRoot\System32\drivers\ecache.sys
0x88404000 \SystemRoot\system32\drivers\disk.sys
0x887DF000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x82E04000 \SystemRoot\system32\drivers\crcdisk.sys
0x8943F000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8864A000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x89024000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8C5D3000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8AF60000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x8BAA5000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8BA98000 \SystemRoot\System32\drivers\watchdog.sys
0x8BA8D000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8BA50000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8BA42000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8BA30000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8C24A000 \SystemRoot\system32\DRIVERS\NETw5v32.sys
0x890E4000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8BA22000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8BA0A000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x8863B000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8C236000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8D1AF000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x8C221000 \SystemRoot\system32\DRIVERS\winbondcir.sys
0x8C20E000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8AE00000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
0x8C203000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8D183000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x895CE000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8D178000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8D160000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x895CA000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
0x8AFD6000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8AF90000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8AEBB000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8D135000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8D0F5000 \SystemRoot\system32\DRIVERS\storport.sys
0x8D0EA000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8D0D3000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8D0C8000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8D0A5000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8D096000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8D083000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8D067000 \SystemRoot\system32\DRIVERS\termdd.sys
0x895B6000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8D03D000 \SystemRoot\system32\DRIVERS\ks.sys
0x8D02F000 \SystemRoot\system32\DRIVERS\circlass.sys
0x8AE0A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8D076000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8D5CC000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x891A4000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8D625000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8D55F000 \SystemRoot\system32\drivers\portcls.sys
0x8D53A000 \SystemRoot\system32\drivers\drmk.sys
0x8D4FD000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8D8FD000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8D448000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8D012000 \SystemRoot\system32\drivers\modem.sys
0x8D007000 \SystemRoot\system32\DRIVERS\hidir.sys
0x89184000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x894A4000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8AECD000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x89564000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x90459000 \SystemRoot\system32\DRIVERS\snp2uvc.sys
0x8E8C2000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0x89481000 \SystemRoot\system32\DRIVERS\sncduvc.SYS
0x8E89B000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0x8AED6000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x894AB000 \SystemRoot\System32\Drivers\Null.SYS
0x894B2000 \SystemRoot\System32\Drivers\Beep.SYS
0x8E84F000 \SystemRoot\System32\drivers\vga.sys
0x8E82E000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8955C000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8956C000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8E803000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8EAF1000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8AEDF000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8EA1C000 \SystemRoot\System32\drivers\tcpip.sys
0x8EA03000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8ECEA000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8ECD6000 \SystemRoot\system32\DRIVERS\smb.sys
0x8EC8F000 \SystemRoot\system32\drivers\afd.sys
0x8EC5D000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8EC47000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8EC39000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8EC26000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8EEC4000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8AE14000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8AFB2000 \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D6CAC195-3E72-4D66-AD83-1C842661522C}\MpKsldca48339.sys
0x8AFB8000 \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D6CAC195-3E72-4D66-AD83-1C842661522C}\MpKsl10fdb824.sys
0x8EC0F000 \SystemRoot\System32\Drivers\dfsc.sys
0x8EE4C000 \SystemRoot\System32\Drivers\fastfat.SYS
0x89404000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8BB42000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x9B800000 \SystemRoot\System32\win32k.sys
0x8AE28000 \SystemRoot\System32\drivers\Dxapi.sys
0x8EE00000 \SystemRoot\system32\DRIVERS\monitor.sys
0x9E600000 \SystemRoot\System32\TSDDD.dll
0x9E610000 \SystemRoot\System32\cdd.dll
0x8FA4F000 \SystemRoot\system32\drivers\luafv.sys
0x9E072000 \SystemRoot\system32\drivers\spsys.sys
0x89124000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9E013000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8AE46000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8FC6C000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA1804000 \SystemRoot\system32\drivers\HTTP.sys
0x90024000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x90400000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9DC07000 \SystemRoot\System32\drivers\mpsdrv.sys
0xA19A0000 \SystemRoot\system32\drivers\mrxdav.sys
0xA2672000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA2639000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9E001000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xA2615000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA2D6F000 \SystemRoot\System32\DRIVERS\srv.sys
0xA2CD9000 \SystemRoot\system32\DRIVERS\cdfs.sys
0xA4E89000 \??\C:\Acer\Empowering Technology\eRecovery\int15.sys
0x9FFE4000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xABA72000 \SystemRoot\system32\drivers\peauth.sys
0x8AE50000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA26A6000 \SystemRoot\System32\drivers\tcpipreg.sys
0x89594000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xA2C72000 \??\C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl
0x8AFE8000 \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D6CAC195-3E72-4D66-AD83-1C842661522C}\MpKsl40b61f34.sys
0xB1C50000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xB1C3B000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0xB1C29000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0x77780000 \Windows\System32\ntdll.dll

Processes (total 86):
0 System Idle Process
4 System
464 C:\Windows\System32\smss.exe
596 csrss.exe
648 C:\Windows\System32\wininit.exe
656 csrss.exe
696 C:\Windows\System32\services.exe
708 C:\Windows\System32\lsass.exe
716 C:\Windows\System32\lsm.exe
816 C:\Windows\System32\winlogon.exe
900 C:\Windows\System32\svchost.exe
940 C:\Windows\System32\nvvsvc.exe
968 C:\Windows\System32\svchost.exe
1000 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
1104 C:\Windows\System32\svchost.exe
1128 C:\Windows\System32\svchost.exe
1140 C:\Windows\System32\svchost.exe
1284 C:\Windows\System32\audiodg.exe
1364 C:\Windows\System32\SLsvc.exe
1412 C:\Windows\System32\svchost.exe
1500 C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
1512 C:\Windows\System32\nvvsvc.exe
1640 C:\Windows\System32\svchost.exe
1856 C:\Windows\System32\spoolsv.exe
1944 C:\Windows\System32\svchost.exe
1984 C:\Windows\System32\wlanext.exe
1216 C:\Windows\System32\dwm.exe
1484 C:\Windows\System32\taskeng.exe
2064 C:\Windows\explorer.exe
2092 C:\Program Files\Google\Update\GoogleUpdate.exe
2136 C:\Windows\System32\taskeng.exe
2844 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2880 C:\Program Files\Bonjour\mDNSResponder.exe
2900 C:\Windows\System32\svchost.exe
3028 C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
3044 C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
3116 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
3144 C:\Windows\System32\svchost.exe
3176 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3260 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
3312 C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
3328 C:\Acer\Mobility Center\MobilityService.exe
3360 C:\Windows\System32\svchost.exe
3408 C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
3468 C:\Windows\System32\svchost.exe
3488 C:\Windows\System32\svchost.exe
3540 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
3564 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
3592 C:\Windows\System32\svchost.exe
3624 C:\Windows\System32\svchost.exe
3656 C:\Windows\System32\SearchIndexer.exe
3748 C:\Windows\System32\drivers\XAudio.exe
3760 C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
3876 C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
3976 C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
4092 WmiPrvSE.exe
1056 WmiPrvSE.exe
1336 unsecapp.exe
1692 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
1184 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
3232 C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
2072 C:\Acer\Empowering Technology\eAudio\eAudio.exe
3396 C:\Windows\RtHDVCpl.exe
3608 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
1084 C:\Program Files\Launch Manager\QtZgAcer.EXE
1048 C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
2400 C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
1848 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
3112 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
2672 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2820 C:\Program Files\Microsoft Security Client\msseces.exe
3940 C:\Program Files\Windows Sidebar\sidebar.exe
3384 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
2032 C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe
2700 C:\Program Files\Windows Media Player\wmpnscfg.exe
2156 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
4076 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
3616 C:\Program Files\Windows Media Player\wmpnetwk.exe
4248 C:\Users\GEBRUI~1\AppData\Local\Temp\RtkBtMnt.exe
4912 C:\Windows\System32\mobsync.exe
4944 WUDFHost.exe
5696 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
1328 dllhost.exe
2520 dllhost.exe
2236 C:\Users\Gebruiker\Desktop\MBRCheck.exe
3704 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`70a00000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000001e`5ce00000 (NTFS)

PhysicalDrive0 Model Number: WDCWD2500BEVS-22UST0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 31171527C24A94682C92F34EB1E387CDC8AD21FC


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Download ComboFix van één van deze locaties:

Link 1
Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op.
>>Hier<< kunt u lezen hoe u Combofix dient te gebruiken.


1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix.

* (hier of hier staat een handleiding over hoe je deze kan uitschakelen

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.
3. Dubbelklik op "Combofix.exe" om de tool te starten.
4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

* Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion." herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.