pandora6040

3 augustus 2011

Hallo Kweezie

Ben terug van zaterdag.

Maar ik kan je het goede n ieuws mededelen dat deze zaak opgelost is door de winkel waar ik mijn nieuwe pc heb gekocht.

Waren er ook niet direct mee klaar, mijn dochter is erzelf om geweest. Kan geen verduidelijking aan je mededelen maar hadden gezegd tegen haar dat gans windows overhoop lag.

Met deze ga ik deze discussie afsluiten en jou en je team een welgemeende dank toewensen.

Grtjs

2 juli 2011

Hallo Kweezi

Heb mijn pc nu pas terug, na mijn laatste bericht ben ik zelf een nieuwe pc (nu ook laptop gaan kopen omdat ik die zou kunnen meenemen op vakantie, zal ongeveer 1 maand weg zijn) Ik ben dus pandora_6039. Ik wilde van de gelegenheid gebruik maken en heb de verkoper gevraagd als service even probleem SP1 kon nazien van pc kleinkind. Ik heb dus tot vanavond moetyen wachten op mijn pc, maar het probleem met mijn kleinkinds pc is groter dat hij ook verwachte zei verkoper (technieker zelf niet meer kunnen spreken)

Gevolg pc staat nu nog 1 maand in die winkel want morgen vertrek ik dus op verlof op. En hopelijk heb ik daar geen problemen nu .Had wel gevraagd dat SP1 moest geinstalleerd zijn.

Hopelijk geraak ik daar op het net, is met kaart hebben ze gezegd maar ik heb daar geen ervaring mee.

Ik heb ook gezien dat er deze avond nog een bericht over het probleem SP1 is binnengekomen en veel info erover is.

Kan dit probleem nog zo lang als onopgelost blijven?

Ik meld je ook zekerlijk moest het probleem door verkoper opgelost zijn!

Alvast vele dank.

30 juni 2011

Hallo Kweezie dit doet hij nog steeds niet.

Starte zeker 6x terug op: conf. voorbereiden tot 40%-fout bij configureren wijzigingen ongedaan maken/2éx-3éx/ gaan slapen want 3éx nog veel langer dan vorige.Deze morgen terug moeten aanmelden en dan scherm zoals ik starte met probleem.Onherstelbare fout: ERROR_INSALL_FAILLURE (0x80070643)

29 juni 2011

qoombo lijkt iedere keer zichzelf te herstellen. Er zaten daar 2 backups van het register in en die heb ik kunnen verwijderen. Ik zal toch het gevraagde uitvoeren en hopelijk met sucses.

29 juni 2011

hallo Kweezie

Voor dat ik de rest doe probeer ik eerst Qoobo te verwijderen via verkenner uitvoeren als administrator. Maar dit lukt niet. het piktogram van de prullebak komt wel even opzetten maar verdwijnt terug. Telkens u moet administratorsmachtigigen hebben om dit uit te voeren. Mag ik de rest al uitvoeren of moet dit eerst gebeuren?

29 juni 2011

Terug vermelding dat pev.cfxxe ontbreekt en dan hersteld alles zich in de vorige toestand zeker?

ComboFix 11-06-27.04 - Eigenaar 29/06/2011 14:42:24.14.4 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.32.1043.18.4023.2505 [GMT 2:00]

Gestart vanuit: c:\users\Eigenaar\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-05-28 to 2011-06-29 ))))))))))))))))))))))))))))))

.

2011-06-29 12:49 . 2011-06-29 12:49 -------- d-----w- c:\users\Gast\AppData\Local\temp

2011-06-29 12:49 . 2011-06-29 12:49 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-06-29 11:35 . 2011-06-29 11:35 -------- d-----w- c:\users\Eigenaar\AppData\Local\{E0185CB9-455B-40AC-A4D5-19092E21B2ED}

2011-06-28 19:40 . 2011-06-28 19:40 388096 ----a-r- c:\users\Eigenaar\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-06-28 19:40 . 2011-06-28 19:40 -------- d-----w- c:\program files (x86)\Trend Micro

2011-06-28 19:24 . 2011-06-28 19:24 -------- d-----w- c:\users\Eigenaar\AppData\Local\{18400348-44C9-43DE-96EC-575FEEAEB638}

2011-06-25 16:50 . 2011-06-25 16:50 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared

2011-06-23 10:01 . 2011-06-23 10:01 -------- d-----w- c:\program files (x86)\Common Files\Java

2011-06-20 20:02 . 2011-06-22 13:49 -------- d-----w- C:\backups

2011-06-20 18:34 . 2011-06-20 16:08 388608 ----a-w- C:\HijackThis.exe

2011-06-20 15:18 . 2011-06-28 20:32 -------- d-----w- c:\program files\CCleaner

2011-06-19 14:49 . 2009-10-10 03:17 14336 ----a-w- c:\windows\system32\drivers\sffp_sd.sys

2011-06-19 14:49 . 2009-10-10 02:41 109056 ----a-w- c:\windows\system32\drivers\sdbus.sys

2011-06-18 11:53 . 2011-06-18 11:53 -------- d-----w- c:\windows\system32\SPReview

2011-06-18 11:04 . 2011-06-18 11:04 -------- d-----w- c:\users\Eigenaar\AppData\Roaming\Malwarebytes

2011-06-18 11:03 . 2011-06-18 11:03 -------- d-----w- c:\programdata\Malwarebytes

2011-06-18 11:03 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-06-18 11:03 . 2011-06-18 11:03 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-06-18 11:03 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-16 14:29 . 2011-06-16 14:29 -------- d-----w- c:\windows\CheckSur

2011-06-16 09:52 . 2011-06-16 09:52 -------- d-----w- c:\windows\system32\EventProviders

2011-06-16 00:58 . 2011-04-23 01:19 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-16 00:58 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-06-16 00:58 . 2011-04-25 16:41 174384 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2011-06-16 00:58 . 2011-04-25 15:29 141104 ----a-w- c:\program files (x86)\Internet Explorer\sqmapi.dll

2011-06-16 00:57 . 2011-04-23 01:29 2303488 ----a-w- c:\windows\system32\jscript9.dll

2011-06-16 00:57 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\SysWow64\jscript9.dll

2011-06-15 22:52 . 2011-06-29 12:51 -------- d-----w- c:\windows\system32\wbem\repository

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-18 13:06 . 2009-07-14 02:36 152064 ----a-w- c:\windows\SysWow64\msclmd.dll

2011-06-18 13:06 . 2009-07-14 02:36 175104 ----a-w- c:\windows\system32\msclmd.dll

2011-06-07 17:10 . 2011-06-28 22:24 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3D184828-1B8D-4CE9-97C8-073601A167BA}\mpengine.dll

2011-06-07 17:10 . 2010-10-12 06:55 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-05-13 16:58 . 2011-05-13 16:58 17720 ----a-w- c:\windows\system32\HPMDPCoInst12.dll

2011-05-13 16:58 . 2009-07-08 12:49 30008 ----a-w- c:\windows\system32\drivers\hpdskflt.sys

2011-05-13 16:58 . 2011-05-13 16:58 30520 ----a-w- c:\windows\system32\hpservice.exe

2011-05-13 16:58 . 2011-05-13 16:58 20792 ----a-w- c:\windows\system32\accelerometerdll.DLL

2011-05-13 16:57 . 2011-05-13 16:57 43320 ----a-w- c:\windows\system32\drivers\Accelerometer.sys

2011-05-13 05:16 . 2011-05-13 05:16 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-05-12 20:00 . 2010-10-03 10:39 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2011-05-12 18:57 . 2010-10-03 10:39 704320 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2011-05-04 02:52 . 2010-04-25 07:22 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2011-04-22 20:18 . 2011-05-25 11:27 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\SysWow64\GPhotos.scr

2011-04-09 06:58 . 2011-05-13 15:49 142336 ----a-w- c:\windows\system32\poqexec.exe

2011-04-09 06:45 . 2011-05-12 18:58 5509504 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-04-09 06:13 . 2011-05-12 18:58 3957632 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2011-04-09 06:13 . 2011-05-12 18:58 3901824 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2011-04-09 05:56 . 2011-05-13 15:49 123904 ----a-w- c:\windows\SysWow64\poqexec.exe

.

((((((((((((((((((((((((((((( SnapShot@2011-06-28_11.02.05 )))))))))))))))))))))))))))))))))))))))))

.

- 2009-07-14 05:30 . 2011-06-22 10:53 86016 c:\windows\system32\DriverStore\infpub.dat

+ 2009-07-14 05:30 . 2011-06-29 11:56 86016 c:\windows\system32\DriverStore\infpub.dat

+ 2010-01-15 00:30 . 2011-06-28 20:32 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2010-01-15 00:30 . 2011-06-28 06:36 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2010-01-15 00:30 . 2011-06-28 06:36 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2010-01-15 00:30 . 2011-06-28 20:32 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-07-14 04:54 . 2011-06-28 20:32 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-07-14 04:54 . 2011-06-28 06:36 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-07-14 05:30 . 2011-06-29 11:56 143360 c:\windows\system32\DriverStore\infstrng.dat

- 2009-07-14 05:30 . 2011-06-22 10:53 143360 c:\windows\system32\DriverStore\infstrng.dat

- 2009-07-14 05:30 . 2011-06-22 10:53 143360 c:\windows\system32\DriverStore\infstor.dat

+ 2009-07-14 05:30 . 2011-06-29 11:56 143360 c:\windows\system32\DriverStore\infstor.dat

+ 2011-06-28 19:37 . 2011-06-28 19:37 1402880 c:\windows\Installer\71b8bb.msi

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{d1a1c8f1-e3d9-48df-802f-20201061ef61}]

2010-06-13 17:10 2734688 ----a-w- c:\program files (x86)\Messenger_Plus_Live_Belgium\tbMess.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{d1a1c8f1-e3d9-48df-802f-20201061ef61}"= "c:\program files (x86)\Messenger_Plus_Live_Belgium\tbMess.dll" [2010-06-13 2734688]

.

[HKEY_CLASSES_ROOT\clsid\{d1a1c8f1-e3d9-48df-802f-20201061ef61}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Corel File Shell Monitor"="c:\program files (x86)\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2009-08-25 15544]

"HPCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"QuickTime Task"="c:\program files (x86)\QuickTime\qttask.exe" [2006-09-01 282624]

"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-08-20 322104]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464]

"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]

"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 AGCoreService;AG Core Services;c:\program files (x86)\AGI\core\4.2.0.10753\AGCoreService.exe [2010-03-18 20480]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Updateservice (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-15 136176]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-15 136176]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [2009-03-02 89600]

S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-10-14 92216]

S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]

S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [x]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

ezSharedSvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2009-08-20 12:24 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Inhoud van de 'Gedeelde Taken' map

.

2011-06-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-26 20:06]

.

2011-06-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-26 20:06]

.

2011-06-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2696175809-2240157295-830168338-1000Core.job

- c:\users\Eigenaar\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-13 20:00]

.

2011-06-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2696175809-2240157295-830168338-1000UA.job

- c:\users\Eigenaar\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-13 20:00]

.

2011-06-27 c:\windows\Tasks\Norton Security Scan for Eigenaar.job

- c:\program files (x86)\Norton Security Scan\Engine\2.7.6.13\Nss.exe [2011-05-18 00:27]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 16395880]

"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]

"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-08-25 610872]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-11 171520]

"fssui"="c:\program files (x86)\Windows Live\Family Safety\fsui.exe" [2010-09-22 884584]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 2184520]

"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]

"Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-03-23 487424]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"NCInstallQueue"="netman.dll" [2009-07-14 360448]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.be/

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com/ie

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Free YouTube Download - c:\users\Eigenaar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\Eigenaar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

TCP: DhcpNameServer = 195.130.131.5 195.130.130.133

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab

FF - ProfilePath - c:\users\Eigenaar\AppData\Roaming\Mozilla\Firefox\Profiles\77pds0yv.default\

FF - prefs.js: browser.search.defaulturl - hxxp://plasmoo.com/index.htm?SearchMashine=true&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Plasmoo

FF - prefs.js: browser.startup.homepage - hxxp://plasmoo.com

FF - prefs.js: keyword.URL - hxxp://plasmoo.com/index.htm?SearchMashine=true&q=

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS VERWIJDERD - - - -

.

URLSearchHooks-{0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)

WebBrowser-{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - (no file)

WebBrowser-{D1A1C8F1-E3D9-48DF-802F-20201061EF61} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)

WebBrowser-{46735DEE-F862-49D1-876D-6382794DC625} - (no file)

WebBrowser-{3AD798D0-4642-4C55-BC14-CFE7DD19E0D1} - (no file)

WebBrowser-{D1FCE654-5FD1-48AD-B13C-5064736120B7} - (no file)

WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files (x86)\Windows Live\Family Safety\fsssvc.exe

c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE

c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe

c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

c:\program files (x86)\CyberLink\Shared files\RichVideo.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe

c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

.

**************************************************************************

.

Voltooingstijd: 2011-06-29 15:05:33 - machine werd herstart

ComboFix-quarantined-files.txt 2011-06-29 13:05

ComboFix2.txt 2011-06-28 17:44

ComboFix3.txt 2011-06-28 11:10

.

Pre-Run: 370.071.113.728 bytes beschikbaar

Post-Run: 369.774.104.576 bytes beschikbaar

.

- - End Of File - - 393519F64138DD5DD21787CC7F8282B7

29 juni 2011

Hallo

Heb de map Conduit

Is dit hetzelfde als coduitEngine

28 juni 2011

Hallo Kweezie

Jammer weggemoeten, maar nu terug.

Ik heb dit terug uitgevoerd als gevraagd, maar denk dat je er terug niet veel zal aan hebben omdat ik vermoed dat het toch het zelfde zal zijn, omdat ik terug zelfde probleem heb maar nu dat ander bestand gemist wordt, nl: pev.cfxxe en ze melding zullen geven als probleem is opgelost. Is dan terug gestart en hieronder het log.

Eronder zal ik ook HT log plaatsen.

Die problemen ondervind ik toch sedert het opnieuw inst; met 2é link of de updates die hij doet.

Meschien toch terug verwijderen en met 1é link werken?

ComboFix 11-06-27.04 - Eigenaar 28/06/2011 19:16:47.13.4 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.32.1043.18.4023.2213 [GMT 2:00]

Gestart vanuit: c:\users\Eigenaar\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Eigenaar\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

.

(((((((((((((((((((( Bestanden Gemaakt van 2011-05-28 to 2011-06-28 ))))))))))))))))))))))))))))))

.

2011-06-28 17:30 . 2011-06-28 17:30 -------- d-----w- c:\users\Gast\AppData\Local\temp

2011-06-28 17:30 . 2011-06-28 17:30 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-06-28 07:23 . 2011-06-28 07:24 -------- d-----w- c:\users\Eigenaar\AppData\Local\{B52487C3-65BB-4A0D-BD05-FAD84C017871}

2011-06-27 19:22 . 2011-06-27 19:23 -------- d-----w- c:\users\Eigenaar\AppData\Local\{F814101D-1356-4A1C-B680-6B6CAED48534}

2011-06-27 07:13 . 2011-06-27 07:13 -------- d-----w- c:\users\Eigenaar\AppData\Local\{68CF0F54-7924-43AD-8494-0813EDC3DC0E}

2011-06-26 19:11 . 2011-06-26 19:12 -------- d-----w- c:\users\Eigenaar\AppData\Local\{DE25DD5D-4B45-4D77-9493-7387871FB6A5}

2011-06-26 07:04 . 2011-06-26 07:04 -------- d-----w- c:\users\Eigenaar\AppData\Local\{4D46885E-4A9B-4147-8116-648A2FFD1999}

2011-06-25 19:04 . 2011-06-25 19:04 -------- d-----w- c:\users\Eigenaar\AppData\Local\{CB94869A-D736-4C56-BA81-D15C7DF44195}

2011-06-25 16:50 . 2011-06-25 16:50 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared

2011-06-25 07:03 . 2011-06-25 07:03 -------- d-----w- c:\users\Eigenaar\AppData\Local\{70C080E4-DAAA-4857-8F5A-4B693EECD0D4}

2011-06-24 19:03 . 2011-06-24 19:03 -------- d-----w- c:\users\Eigenaar\AppData\Local\{9917CE4B-4910-4D22-8F58-8EAEC564C7CE}

2011-06-24 07:01 . 2011-06-24 07:02 -------- d-----w- c:\users\Eigenaar\AppData\Local\{E0A66694-EF23-4FD7-908B-B9E785B4D890}

2011-06-23 10:01 . 2011-06-23 10:01 -------- d-----w- c:\program files (x86)\Common Files\Java

2011-06-23 09:43 . 2011-06-23 09:44 -------- d-----w- c:\users\Eigenaar\AppData\Local\{5B0A638F-741C-47BD-8852-4668B8C07FA4}

2011-06-22 21:43 . 2011-06-22 21:43 -------- d-----w- c:\users\Eigenaar\AppData\Local\{BCB00099-C6AE-4C2A-A4AA-05BEEDD1D3F2}

2011-06-22 21:37 . 2011-06-22 21:37 -------- d-----w- c:\users\Eigenaar\AppData\Local\{BC485C62-5B90-4AF4-8022-A869F5BBA0D9}

2011-06-22 07:45 . 2011-06-22 07:45 -------- d-----w- c:\users\Eigenaar\AppData\Local\{90A83CF9-6867-44D9-ADDD-ED69092EFF25}

2011-06-21 19:44 . 2011-06-21 19:44 -------- d-----w- c:\users\Eigenaar\AppData\Local\{295024DE-282A-4397-A49E-8511D2CC3E84}

2011-06-21 10:48 . 2011-06-21 10:48 -------- d-----w- c:\users\Eigenaar\AppData\Local\{242CC70E-AE49-43AA-9533-69C1A8B0CDD3}

2011-06-20 22:52 . 2011-06-20 22:52 -------- d-----w- c:\users\Eigenaar\AppData\Local\{96525F85-8084-46D7-AFDD-63218454AFBD}

2011-06-20 22:48 . 2011-06-20 22:48 -------- d-----w- c:\users\Eigenaar\AppData\Local\{C21C4CF0-A5AC-4F5C-B0D1-D3720D1816EA}

2011-06-20 20:02 . 2011-06-22 13:49 -------- d-----w- C:\backups

2011-06-20 18:34 . 2011-06-20 16:08 388608 ----a-w- C:\HijackThis.exe

2011-06-20 15:18 . 2011-06-20 15:18 -------- d-----w- c:\program files\CCleaner

2011-06-20 10:48 . 2011-06-20 10:48 -------- d-----w- c:\users\Eigenaar\AppData\Local\{DB6D856F-74CF-4C13-BCAF-A2E11EA51340}

2011-06-19 22:47 . 2011-06-19 22:47 -------- d-----w- c:\users\Eigenaar\AppData\Local\{514555E4-EF1A-4825-A7BA-1C04F3F369E7}

2011-06-19 14:49 . 2009-10-10 03:17 14336 ----a-w- c:\windows\system32\drivers\sffp_sd.sys

2011-06-19 14:49 . 2009-10-10 02:41 109056 ----a-w- c:\windows\system32\drivers\sdbus.sys

2011-06-19 10:46 . 2011-06-19 10:47 -------- d-----w- c:\users\Eigenaar\AppData\Local\{AA448307-6D7E-4537-8AAF-669985540453}

2011-06-18 17:50 . 2011-06-18 17:50 -------- d-----w- c:\users\Eigenaar\AppData\Local\{4512965C-6F16-43E3-962F-E2EFE4613904}

2011-06-18 11:53 . 2011-06-18 11:53 -------- d-----w- c:\windows\system32\SPReview

2011-06-18 11:04 . 2011-06-18 11:04 -------- d-----w- c:\users\Eigenaar\AppData\Roaming\Malwarebytes

2011-06-18 11:03 . 2011-06-18 11:03 -------- d-----w- c:\programdata\Malwarebytes

2011-06-18 11:03 . 2010-12-20 16:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-06-18 11:03 . 2011-06-18 11:03 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-06-18 11:03 . 2010-12-20 16:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-18 05:48 . 2011-06-18 05:49 -------- d-----w- c:\users\Eigenaar\AppData\Local\{CFCB4094-B2A3-4930-B7FB-DE1AFAE4286C}

2011-06-17 02:10 . 2011-06-17 14:10 -------- d-----w- c:\users\Eigenaar\AppData\Local\{3D5EE115-D78C-4B8F-B388-16DFC6BC213D}

2011-06-16 14:29 . 2011-06-16 14:29 -------- d-----w- c:\windows\CheckSur

2011-06-16 14:10 . 2011-06-16 14:10 -------- d-----w- c:\users\Eigenaar\AppData\Local\{878106AD-0210-4036-B1D3-F1F99B927DEB}

2011-06-16 09:52 . 2011-06-16 09:52 -------- d-----w- c:\windows\system32\EventProviders

2011-06-16 00:58 . 2011-04-23 01:19 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-06-16 00:58 . 2011-04-22 23:25 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-06-16 00:58 . 2011-04-25 16:41 174384 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2011-06-16 00:58 . 2011-04-25 15:29 141104 ----a-w- c:\program files (x86)\Internet Explorer\sqmapi.dll

2011-06-16 00:57 . 2011-04-23 01:29 2303488 ----a-w- c:\windows\system32\jscript9.dll

2011-06-16 00:57 . 2011-04-22 23:35 1797632 ----a-w- c:\windows\SysWow64\jscript9.dll

2011-06-16 00:11 . 2011-06-16 00:13 -------- d-----w- c:\users\Eigenaar\AppData\Local\{F20B115B-6EAE-4252-88B8-953A78EB94CB}

2011-06-15 22:52 . 2011-06-28 17:32 -------- d-----w- c:\windows\system32\wbem\repository

2011-06-14 16:04 . 2011-06-14 16:04 -------- d-----w- c:\users\Eigenaar\AppData\Local\{83E662ED-690E-45B5-87A8-A22ADD58DCFD}

2011-06-13 07:57 . 2011-06-13 08:11 -------- d-----w- c:\users\Eigenaar\AppData\Local\{535700F7-39E4-4A7A-A47D-A56255190172}

2011-06-12 12:11 . 2011-06-12 12:21 -------- d-----w- c:\users\Eigenaar\AppData\Local\{3B14A23A-45FC-4D8C-9385-CBE5CE07C661}

2011-06-12 09:01 . 2011-06-12 09:01 -------- d-----w- c:\users\Eigenaar\AppData\Local\{D393EE50-2B6A-45A3-8AD8-177382FE84D7}

2011-06-11 11:32 . 2011-06-11 11:32 -------- d-----w- c:\users\Eigenaar\AppData\Local\{FC34AD28-525E-4E39-AFFD-63285F49CBAD}

2011-06-10 19:04 . 2011-06-10 19:09 -------- d-----w- c:\users\Eigenaar\AppData\Local\{2177E62F-C202-44C4-88F7-FCCCA3F381F6}

2011-06-10 07:00 . 2011-06-10 07:01 -------- d-----w- c:\users\Eigenaar\AppData\Local\{466ECE7F-7AC7-419F-AD31-9C4B1222CC4E}

2011-06-09 15:40 . 2011-06-09 15:40 -------- d-----w- c:\users\Eigenaar\AppData\Local\{EB8E160A-D526-4EE7-9274-79C78C61BBB2}

2011-06-08 10:51 . 2011-06-08 10:52 -------- d-----w- c:\users\Eigenaar\AppData\Local\{E837E523-918D-4A7D-A080-FEF289FC1F33}

2011-06-07 15:17 . 2011-06-07 15:17 -------- d-----w- c:\users\Eigenaar\AppData\Local\{42F4808E-245E-43A5-BADB-D0054A4977B5}

2011-06-06 14:31 . 2011-06-06 14:32 -------- d-----w- c:\users\Eigenaar\AppData\Local\{2EC24D65-12B9-4FA2-BA40-58E7D1121530}

2011-06-05 10:19 . 2011-06-05 10:20 -------- d-----w- c:\users\Eigenaar\AppData\Local\{D3A4B2CF-4EFD-47E4-BE0F-3B03DBFDB686}

2011-06-04 18:48 . 2011-06-04 18:50 -------- d-----w- c:\users\Eigenaar\AppData\Local\{839BED9D-1302-49FA-A26C-857A3D2485EC}

2011-06-01 05:36 . 2011-06-01 05:36 -------- d-----w- c:\users\Eigenaar\AppData\Local\{2A88517A-4744-4687-93C7-90C759C34213}

2011-05-31 15:14 . 2011-05-31 15:16 -------- d-----w- c:\users\Eigenaar\AppData\Local\{5DFB41B8-41FF-4DB6-BF46-D8682B065C74}

2011-05-29 20:35 . 2011-05-30 15:13 -------- d-----w- c:\users\Eigenaar\AppData\Local\{221651DD-9948-474A-9364-CF312D23F0C0}

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-18 13:06 . 2009-07-14 02:36 152064 ----a-w- c:\windows\SysWow64\msclmd.dll

2011-06-18 13:06 . 2009-07-14 02:36 175104 ----a-w- c:\windows\system32\msclmd.dll

2011-06-07 17:10 . 2011-06-27 19:32 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7D9D5C38-67B5-431C-BAA9-2A7D8F28EA32}\mpengine.dll