Quetzal

Bedankt. in de Mediamarkt zag ik veel merken maar niet wat hier genoemd wordt. Heb Trust gekocht. Werkt momenteel zonder problemen , maar het zit niet zo vast, niet 'als gegoten'.

Hallo, Ik kreeg de laatste maanden geleidelijk steeds meer moeilijkheden met de voeding van mijn Aspire-laptop. Met wat draaien en duwen aan de plug kreeg ik hem wel tot laden, maar nu dus niet meer. De pin van de voeding kwam steeds losser te zitten... Kort: ik moet een nieuwe voeding kopen meen ik. Moet die Acer-specifiek zijn, of kan ik vertrouwen op universele voedingsoplossingen (zoals van Sony)? bedankt

Sorry, ik had het niet zo bekeken dat jullie alles bleven opvolgen, ook wat ver wegzakt. Die melding dat ik binnen 3 dagen moest activeren..na aftellen begonnen weer 3 dagen, dan 14 dagen.. Voor mijn Vista zich 'niet-legitiem' verklaarde is dat ook heel lang zo geweest, dus ik wacht gewoon af. Indien het probleem weer opduikt, ga ik eerst naar de keten waar ik aankocht (factuur is toch boven gekomen). Desnoods zal ik er Windows 7 voor kopen, toestel werkt echt goed. bedankt!

na herinstallatie van de laptop, krijg ik nog steeds de vraag om te activeren. Er staat wel dat er over 2 dagen een automatische activering zal gebeuren, ik wacht nog af wat er dan kan gebeuren. Indien geen resultaat bel ik nog eens naar Acer. En als laatste optie is er dus -onterecht- een nieuwe OS kopen, want ik denk niet dat een upgrade kan lukken als Vista niet geactiveerd is.

Het is ***lig, ik houd mijn papieren altijd bij, maar uitgerekend van dit toestel heb ik niet meer de aankoopfactuur. Ten tweede: na 3 jaar en intens gebruik is de sticker op de behuizing weggeteerd, daar kan ik geen code lezen. De productcode die ik bij gebruik van de pc vind, bevat 'OEM' ipv van nummers. Mijn plan is nu: hem opnieuw proberen in orde te krijgen met de recovery disks (dat lukte enkele weken terug), en dan de (goedkope) upgrade windows 8 kopen.

Ik had een tijd terug al het probleem dat op een dag het OS meldde dat ik geen legitieme versie gebruikte. Is nochtans wel degelijk zo, stond op het toestel zoals ik het kocht in 2009. Door mijn recovery disks op de computer los te laten, leek dit 2 weken geleden opgelost, ik had mijn toestel "nieuw" en leeg terug. Maar nu krijg ik dus weer die melding bij opstarten. Ik kan mijn code niet bevestigen, voor activeren is er slechts spraken van een nieuwe productcode kopen... Kan ik iets doen zonder weer 'de klok terug te draaien'....

Kape, bedankt om dit te blijven opvolgen.. het mirakel is gebeurd. Ik heb mijn zelfgebrande recovery disks gezocht... ik had die (een jaar geleden?) eens geprobeerd toen de Windows problemen begonnen en toen lukte er niets mee. Nu tot mijn grote verrassing... ik zag dat de recovery anders liep dan met fabrieksinstellingen via ALT F10. Na configuratie bleek de reinstall volledig gelukt. Tot mijn verrassing is de D:partitie zoals voordien. Dus: terug normale Windows, geen foutmeldingen, uSB terug normaal

Een update, maar de boel lijkt intussen verder verknoeid. Indien mogelijk, graag toch nog advies: -Windows Upgrade advisor gaf aan dat Windows 7 kon. Ik heb dat geprobeerd , maar zat eindeloos met diverse problemen, steeds opnieuw proberen... - Contact met Windows: 'Logisch als Vista niet koosjer werkt.' Blijkt dat Windows (Vista) geactiveerd moet worden in de BIOS, zij konden me niet helpen, ben verwezen naar Acer. (ik heb geen recoveryschijven) - Na backuppen contacteer ik Acer. Daar gaan ze voor terugzetten naar standaardinstellingen. Ik zie dat eRecovery handelingen voert, partitie, 'herstelling is voltooid'. Na opnieuw opstarten volgt een configuratie, maar uiteindelijk kan de installatie niet voltooid worden. Foutmeldingen wijzen naar problemen met hardware / fysieke schijf vinden. Bij de verschillende pogingen zie ik partition 0, 1 of 2. Uiteindelijk mislukt de configuratie na heropstart: physical HD 0 kan niet aangemaakt worden. DUS wat kan ik nu doen: - toestel vergeten? - Bij Acer binnendoen voor (duur?) nazicht en herstelling? - BS volwaardig , nieuwe installeren? - of kan ik nog iets proberen recht te zetten in de BIOS?

Edit: Deze vraag kan afgesloten worden... in het zoeken naar een oplossing worden de problemen steeds erger.... +++++++++ Hallo, Ik heb een upgrade naar Windows 7 gedownload. Alle compatibiliteitsissues zijn opgeklaard, maar de setup blijft problemen geven, het is eindeloos opnieuw proberen. Ik ben nochtans al enkele keren ver geraakt.... Nu loopt hij onmiddellijk vast: "Set up was unable to determine if BitLocker Drive Encryption is in use". Maar ik heb vastgesteld dat mijn Vista die encryptie niet heeft, ik kan dus niets afvinken of zo.. (CHKDSK leverde niets op)

We kunnen het toestel nog steeds gebruiken, maar de problemen uit de eerste post zijn gebleven. De foutmeldingen bij opstarten zijn er nog, maar het passeert allemaal wel sneller. Firefox werkt bij momenten goed, maar kan ook meteen vast lopen. Ik had gisteren ook contact met iemand van Telenet, omdat de deze week geïnstalleerde Security Pack niet helemaal werkte (scanfuncties doen het niet). De helpdesk nam mijn toestel over om wat te bekijken. Ze menen dat ik in de eerste plaats Windows moet contacteren, ivm. die legitimiteitsproblemen.

bedankt, hier de nieuwe log: ComboFix 12-09-30.01 - Bart 30/09/2012 20:23:42.1.2 - x86 Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.32.1043.18.2814.1794 [GMT 2:00] Gestart vanuit: c:\users\Bart\Desktop\ComboFix.exe gebruikte Opdracht switches :: c:\users\Bart\Desktop\CFScript.txt AV: Telenet Security Pack 9.01 *Disabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17} SP: Telenet Security Pack 9.01 *Disabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\users\Bart\cvquksm6th.exe" "c:\windows\system32\drivers\a2e8a8c6fd497a65.sys" . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\drivers\a2e8a8c6fd497a65.sys . . . . konden niet verwijderd worden . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_a2e8a8c6fd497a65 -------\Service_a2e8a8c6fd497a65 . . (((((((((((((((((((( Bestanden Gemaakt van 2012-08-28 to 2012-09-30 )))))))))))))))))))))))))))))) . . 2012-09-30 18:35 . 2012-09-30 18:37 -------- d-----w- c:\users\Bart\AppData\Local\temp 2012-09-30 13:02 . 2012-09-30 13:02 -------- d-----w- c:\program files\HD Tune 2012-09-29 14:38 . 2012-09-30 12:39 -------- d-----w- c:\users\Bart\AppData\Local\LogMeIn Rescue Applet 2012-09-29 14:06 . 2012-09-29 14:06 -------- d-----w- c:\program files\CCleaner 2012-09-29 13:15 . 2012-09-29 13:15 33408 ----a-w- c:\windows\system32\drivers\fsbts.sys 2012-09-29 13:12 . 2012-09-29 13:46 36792 ----a-w- c:\windows\system32\drivers\fses.sys 2012-09-29 13:11 . 2009-08-05 15:57 71040 ----a-w- c:\windows\system32\drivers\fsdfw.sys 2012-09-29 12:56 . 2012-09-29 12:56 -------- d-----w- c:\users\Bart\AppData\Roaming\f-secure 2012-09-29 11:42 . 2012-09-29 11:42 -------- d-----w- c:\program files\Common Files\Java 2012-09-29 11:41 . 2012-09-29 11:40 477168 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-09-29 11:40 . 2012-09-29 11:40 -------- d-----w- c:\program files\Java 2012-09-29 09:10 . 2012-09-29 09:44 -------- d-----w- c:\program files\RegZooka 2012-09-28 16:52 . 2009-08-05 15:59 572512 ----a-w- c:\windows\system32\msvcp50.dll 2012-09-28 16:51 . 2012-09-29 13:48 -------- d-----w- c:\program files\Telenet Security Pack 2012-09-28 16:49 . 2012-09-29 13:24 -------- d-----w- c:\programdata\fssg 2012-09-28 16:46 . 2012-09-29 13:10 -------- d-----w- c:\programdata\f-secure 2012-09-28 16:43 . 2012-09-06 01:26 73696 ----a-w- c:\program files\Mozilla Firefox\breakpadinjector.dll 2012-09-28 16:43 . 2012-09-06 01:26 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll 2012-09-28 16:43 . 2012-09-06 01:26 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll 2012-09-16 21:43 . 2012-09-20 21:10 -------- d-----w- c:\programdata\MFAData 2012-09-16 21:43 . 2012-09-16 21:43 -------- d--h--w- c:\programdata\Common Files 2012-09-16 21:43 . 2012-09-16 21:43 -------- d-----w- c:\users\Bart\AppData\Local\MFAData 2012-09-16 21:43 . 2012-09-16 21:43 -------- d-----w- c:\users\Bart\AppData\Local\Avg2013 2012-09-16 20:02 . 2012-09-16 20:02 -------- d-----w- c:\programdata\SUPERSetup 2012-09-12 15:18 . 2012-09-12 15:18 -------- d-----w- c:\users\Bart\AppData\Roaming\Polar WebSync 2012-09-12 15:16 . 2012-09-12 15:18 -------- d-----w- c:\program files\Polar . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-09-29 11:40 . 2010-06-08 18:53 473072 ----a-w- c:\windows\system32\deployJava1.dll 2012-09-06 01:27 . 2011-03-28 21:23 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2010-06-08 20:22 . 2009-12-15 20:06 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-05-14 15:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-10 68856] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2008-05-20 6144000] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-08 30192] "eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-13 1033512] "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-16 821768] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-05-09 397312] "CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-05-12 167936] "PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-05-12 167936] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-17 13552160] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-17 92704] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "F-Secure Manager"="c:\program files\Telenet Security Pack\Common\FSM32.EXE" [2009-08-05 199264] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe" [2011-11-09 247968] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Polar WebSync (polargofit.com).lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Polar WebSync (polargofit.com).lnk backup=c:\windows\pss\Polar WebSync (polargofit.com).lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeDeluxeAgent] 2008-05-12 20:10 147456 ------w- c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB] 2009-08-05 15:57 2349664 ----a-w- c:\program files\Telenet Security Pack\FSGUI\tnbutil.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-09-04 23:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] 2008-01-21 02:33 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe . --- Andere Services/Drivers In Geheugen --- . *NewlyCreated* - A2E8A8C6FD497A65 *Deregistered* - a2e8a8c6fd497a65 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Inhoud van de 'Gedeelde Taken' map . 2012-09-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 17:50] . 2012-09-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 17:50] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.be/ mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0813&s=2&o=vb32&d=0909&m=aspire_7530 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s IE: &Verzenden naar OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 LSP: c:\program files\Telenet Security Pack\FSPS\program\FSLSP.DLL TCP: DhcpNameServer = 195.130.131.5 195.130.130.133 FF - ProfilePath - c:\users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\6xjq0nxm.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.standaard.be/ FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2012-09-30 20:37 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . ? [2792] ? [3600] scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\a2e8a8c6fd497a65] "ImagePath"="\SystemRoot\System32\Drivers\a2e8a8c6fd497a65.sys" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,68,09,c8,8e,12,3a,35,4e,90,66,a5,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,68,09,c8,8e,12,3a,35,4e,90,66,a5,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Geladen Onder Lopende Processen --------------------- . - - - - - - - > 'winlogon.exe'(1328) c:\program files\telenet security pack\hips\fshook32.dll . - - - - - - - > 'lsass.exe'(696) c:\program files\telenet security pack\hips\fshook32.dll . - - - - - - - > 'Explorer.exe'(3952) c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll . ------------------------ Andere Aktieve Processen ------------------------ . c:\windows\system32\nvvsvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe c:\program files\Acer\Empowering Technology\Service\ETService.exe c:\program files\Telenet Security Pack\Common\FSMA32.EXE c:\program files\Common Files\LightScribe\LSSrvc.exe c:\acer\Mobility Center\MobilityService.exe c:\program files\Telenet Security Pack\Common\FSHDLL32.EXE c:\windows\system32\rundll32.exe c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe c:\windows\system32\rundll32.exe c:\program files\Cyberlink\Shared files\RichVideo.exe c:\windows\system32\DRIVERS\xaudio.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\Telenet Security Pack\ORSP Client\fsorsp.exe c:\program files\Telenet Security Pack\Anti-Virus\fsav32.exe c:\program files\Windows Media Player\wmpnscfg.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Voltooingstijd: 2012-09-30 20:46:04 - machine werd herstart ComboFix-quarantined-files.txt 2012-09-30 18:45 ComboFix2.txt 2012-09-30 14:51 . Pre-Run: 37.031.432.192 bytes beschikbaar Post-Run: 39.328.653.312 bytes beschikbaar . - - End Of File - - CAAAB33D839A246E7BB76587AF4A2D98

Dank u. Hierbij de 2 logs zoals u vroeg. Tijdens de run van combofix viel op: "failed to get data from EnableLVA" en een melding over besmetting van het systeem. ComboFix 12-09-30.01 - Bart 30/09/2012 16:35:45.1.2 - x86 Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.32.1043.18.2814.1724 [GMT 2:00] Gestart vanuit: c:\users\Bart\Desktop\ComboFix.exe AV: Telenet Security Pack 9.01 *Disabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17} SP: Telenet Security Pack 9.01 *Disabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA} SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\dsgsdgdsgdsgw.pad c:\users\Bart\Documents\~WRL0003.tmp c:\users\Bart\Documents\~WRL0005.tmp c:\users\Bart\Documents\~WRL0006.tmp c:\windows\IsUn0413.exe c:\windows\system32\SETC32.tmp c:\windows\system32\SETE85.tmp c:\windows\system32\URTTemp c:\windows\system32\URTTemp\regtlib.exe c:\users\Bart\cvquksm6th.exe . . . . konden niet verwijderd worden c:\windows\system32\drivers\a2e8a8c6fd497a65.sys . . . . konden niet verwijderd worden . Besmet exemplaar van c:\windows\System32\winload.exe werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.0.6002.18005_none_6b24103689ec6965\winload.exe Besmet exemplaar van c:\windows\system32\drivers\cdrom.sys werd aangetroffen en gedesinfecteerd Hersteld exemplaar van - c:\windows\System32\DriverStore\FileRepository\cdrom.inf_c949a5b6\cdrom.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_a2e8a8c6fd497a65 -------\Service_a2e8a8c6fd497a65 . . (((((((((((((((((((( Bestanden Gemaakt van 2012-08-28 to 2012-09-30 )))))))))))))))))))))))))))))) . . 2012-09-30 14:43 . 2012-09-30 14:43 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-09-30 13:02 . 2012-09-30 13:02 -------- d-----w- c:\program files\HD Tune 2012-09-29 14:38 . 2012-09-30 12:39 -------- d-----w- c:\users\Bart\AppData\Local\LogMeIn Rescue Applet 2012-09-29 14:06 . 2012-09-29 14:06 -------- d-----w- c:\program files\CCleaner 2012-09-29 13:15 . 2012-09-29 13:15 33408 ----a-w- c:\windows\system32\drivers\fsbts.sys 2012-09-29 13:12 . 2012-09-29 13:46 36792 ----a-w- c:\windows\system32\drivers\fses.sys 2012-09-29 13:11 . 2009-08-05 15:57 71040 ----a-w- c:\windows\system32\drivers\fsdfw.sys 2012-09-29 12:56 . 2012-09-29 12:56 -------- d-----w- c:\users\Bart\AppData\Roaming\f-secure 2012-09-29 11:42 . 2012-09-29 11:42 -------- d-----w- c:\program files\Common Files\Java 2012-09-29 11:41 . 2012-09-29 11:40 477168 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-09-29 11:40 . 2012-09-29 11:40 -------- d-----w- c:\program files\Java 2012-09-29 09:10 . 2012-09-29 09:44 -------- d-----w- c:\program files\RegZooka 2012-09-28 16:52 . 2009-08-05 15:59 572512 ----a-w- c:\windows\system32\msvcp50.dll 2012-09-28 16:51 . 2012-09-29 13:48 -------- d-----w- c:\program files\Telenet Security Pack 2012-09-28 16:49 . 2012-09-29 13:24 -------- d-----w- c:\programdata\fssg 2012-09-28 16:46 . 2012-09-29 13:10 -------- d-----w- c:\programdata\f-secure 2012-09-28 16:43 . 2012-09-06 01:26 73696 ----a-w- c:\program files\Mozilla Firefox\breakpadinjector.dll 2012-09-28 16:43 . 2012-09-06 01:26 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll 2012-09-28 16:43 . 2012-09-06 01:26 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll 2012-09-16 21:43 . 2012-09-20 21:10 -------- d-----w- c:\programdata\MFAData 2012-09-16 21:43 . 2012-09-16 21:43 -------- d--h--w- c:\programdata\Common Files 2012-09-16 21:43 . 2012-09-16 21:43 -------- d-----w- c:\users\Bart\AppData\Local\MFAData 2012-09-16 21:43 . 2012-09-16 21:43 -------- d-----w- c:\users\Bart\AppData\Local\Avg2013 2012-09-16 20:02 . 2012-09-16 20:02 -------- d-----w- c:\programdata\SUPERSetup 2012-09-12 15:18 . 2012-09-12 15:18 -------- d-----w- c:\users\Bart\AppData\Roaming\Polar WebSync 2012-09-12 15:16 . 2012-09-12 15:18 -------- d-----w- c:\program files\Polar . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-09-29 11:40 . 2010-06-08 18:53 473072 ----a-w- c:\windows\system32\deployJava1.dll 2012-09-06 01:27 . 2011-03-28 21:23 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll 2010-06-08 20:22 . 2009-12-15 20:06 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-05-14 15:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-10 68856] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2008-05-20 6144000] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-08 30192] "eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-13 1033512] "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-16 821768] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-05-09 397312] "CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-05-12 167936] "PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-05-12 167936] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-17 13552160] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-17 92704] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "F-Secure Manager"="c:\program files\Telenet Security Pack\Common\FSM32.EXE" [2009-08-05 199264] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe" [2011-11-09 247968] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Polar WebSync (polargofit.com).lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Polar WebSync (polargofit.com).lnk backup=c:\windows\pss\Polar WebSync (polargofit.com).lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeDeluxeAgent] 2008-05-12 20:10 147456 ------w- c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB] 2009-08-05 15:57 2349664 ----a-w- c:\program files\Telenet Security Pack\FSGUI\tnbutil.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-09-04 23:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] 2008-01-21 02:33 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe . --- Andere Services/Drivers In Geheugen --- . *NewlyCreated* - A2E8A8C6FD497A65 *NewlyCreated* - WS2IFSL *Deregistered* - a2e8a8c6fd497a65 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Inhoud van de 'Gedeelde Taken' map . 2012-09-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 17:50] . 2012-09-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-09 17:50] . . ------- Bijkomende Scan ------- . uStart Page = hxxp://www.google.be/ mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0813&s=2&o=vb32&d=0909&m=aspire_7530 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s IE: &Verzenden naar OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 LSP: c:\program files\Telenet Security Pack\FSPS\program\FSLSP.DLL TCP: DhcpNameServer = 195.130.131.5 195.130.130.133 FF - ProfilePath - c:\users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\6xjq0nxm.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.standaard.be/ FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false . - - - - ORPHANS VERWIJDERD - - - - . HKLM-Run-eRecoveryService - (no file) ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file) SafeBoot-mcmscsvc SafeBoot-MCODS . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2012-09-30 16:45 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . ? [3220] ? [4000] scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}] "ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\a2e8a8c6fd497a65] "ImagePath"="\SystemRoot\System32\Drivers\a2e8a8c6fd497a65.sys" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,68,09,c8,8e,12,3a,35,4e,90,66,a5,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,68,09,c8,8e,12,3a,35,4e,90,66,a5,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- DLLs Geladen Onder Lopende Processen --------------------- . - - - - - - - > 'winlogon.exe'(1332) c:\program files\telenet security pack\hips\fshook32.dll . - - - - - - - > 'lsass.exe'(700) c:\program files\telenet security pack\hips\fshook32.dll . - - - - - - - > 'Explorer.exe'(5152) c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll . ------------------------ Andere Aktieve Processen ------------------------ . c:\windows\system32\nvvsvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe c:\program files\Acer\Empowering Technology\Service\ETService.exe c:\program files\Telenet Security Pack\Common\FSMA32.EXE c:\program files\Common Files\LightScribe\LSSrvc.exe c:\acer\Mobility Center\MobilityService.exe c:\windows\system32\rundll32.exe c:\program files\Telenet Security Pack\Common\FSHDLL32.EXE c:\windows\system32\rundll32.exe c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe c:\program files\Polar\Daemon\polard.exe c:\program files\Cyberlink\Shared files\RichVideo.exe c:\windows\system32\DRIVERS\xaudio.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\Telenet Security Pack\ORSP Client\fsorsp.exe c:\windows\system32\conime.exe c:\windows\system32\SLUI.exe c:\\?\c:\windows\system32\wbem\WMIADAP.EXE c:\program files\Telenet Security Pack\Anti-Virus\fsav32.exe c:\program files\Windows Media Player\wmpnscfg.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Voltooingstijd: 2012-09-30 16:51:44 - machine werd herstart ComboFix-quarantined-files.txt 2012-09-30 14:51 . Pre-Run: 36.747.558.912 bytes beschikbaar Post-Run: 37.085.982.720 bytes beschikbaar . - - End Of File - - 05C9273090AABC9C29BEE28A95A04145 Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 17:16:56, on 30/09/2012 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.19190) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Telenet Security Pack\Common\FSM32.EXE C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\Bart\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Bart\Downloads\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\Telenet Security Pack\NRS\iescript\baselitmus.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\Telenet Security Pack\NRS\iescript\baselitmus.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe" O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe O4 - HKLM\..\Run: [bkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE Systemboot O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Telenet Security Pack\Common\FSM32.EXE" /splash O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe -update activex (User 'SYSTEEM') O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe -update activex (User 'Default user') O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\Telenet Security Pack\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Telenet Security Pack\FWES\Program\fsdfwd.exe O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Telenet Security Pack\Common\FSMA32.EXE O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\Telenet Security Pack\ORSP Client\fsorsp.exe O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: Polar Daemon - Unknown owner - C:\Program Files\Polar\Daemon\polard.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 9994 bytes

Ik heb verschillende 'fenomenen' bij het opstarten. - Er wordt een controle gestart. Sprake van problemen bij 128... maar het loopt vast. ik annuleer die controle steeds. - Timeout rundll32.exe - Geen legitieme versie (is niet waar). Op basis van instructies in andere thread, deed ik een systeemscan. Hopelijk zit de bijlage er bij... [ATTACH]21537[/ATTACH] sfcdetails.txt

Hallo, ik kwam op dit forum door op te zoeken ivm het ukash virus. Op basis van threads hier heb ik met hijackthis iets gefixt en dan MAMB nog eens laten werken (4 infecties gevonden). De blokkering blijft nu al enige tijd weg, dus ik mag hopen dat dit van de baan is Omdat er verschillende andere problemen zijn met de laptop, post ik nu graag nog een nieuw hijack log. Problemen: - er gebeurt bij opstart een schijfcontrole (elementen 128 en " " beschadigd), die blijft duren als ik hem laat begaan. dus ik annuleer die telkens. - ik krijg de melding dat ik geen legitieme Windows gebruik (sinds 1 jaar). Kocht toestel in legitieme keten 3 j. geleden met Windows Vista (tja) geïnstalleerd nochtans. ik geraak verder door "later activeren". - melding ivm timeout rundll32.exe (?) - USB poorten werken niet (ook al lang een probleem). Alvast hartelijk dank! Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 11:25:19, on 29/09/2012 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.19190) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Telenet Security Pack\Common\FSM32.EXE C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Program Files\Polar\WebSync\WebSync.exe C:\Windows\system32\wbem\unsecapp.exe C:\Users\Bart\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Bart\Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\Telenet Security Pack\NRS\iescript\baselitmus.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\Telenet Security Pack\NRS\iescript\baselitmus.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe" O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe O4 - HKLM\..\Run: [bkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE Systemboot O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Telenet Security Pack\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Telenet Security Pack\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe -update activex (User 'SYSTEEM') O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe -update activex (User 'Default user') O4 - Global Startup: McAfee Security Scan Plus.lnk = ? O4 - Global Startup: Polar WebSync (polargofit.com).lnk = C:\Program Files\Polar\WebSync\WebSync.exe O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (file missing) O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Mobiel Apple apparaat (Apple Mobile Device) - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\Telenet Security Pack\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Telenet Security Pack\FWES\Program\fsdfwd.exe O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Telenet Security Pack\Common\FSMA32.EXE O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\Telenet Security Pack\ORSP Client\fsorsp.exe O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: Polar Daemon - Unknown owner - C:\Program Files\Polar\Daemon\polard.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 12206 bytes