laptop valt soms uit

kape · 6 oktober 2013

Download Zoek.zip naar het bureaublad.

Wanneer Internet Explorer of een andere browser of virusscanner melding geeft dat dit bestand onveilig zou zijn kun je negeren, dit is namelijk een onterechte waarschuwing.
Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe (hier en hier) kan je lezen hoe je dat doet.
Klik met de rechtermuisknop op Zoek.zip en klik op de optie "Alles uitpakken".
Dubbelklik op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.

chromelook; 
firefoxlook; 
 AntiVirService;s
 C:\Program Files\Avira;fs
 C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA};fs
 C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA};fs
 [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce];r
 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services];r
 "AntiVirService"=-;r
 "AntiVirSchedulerService"=-;r
  startupall; 
filesrcm;

Klik op de knop "Options" en vink nu de onderstaande opties aan.
Firefox Defaults
Reset Chrome
Reset IE proxy
IE Defaults
Auto Clean
Klik nu op de knop "Run script".
Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.
Post nu de inhoud van het geopende logje in het volgende bericht.

dries V · 6 oktober 2013

Zoek.exe Version 4.0.0.4 Updated 27-September-2013

Tool run by Microsoft User on zo 06/10/2013 at 21:09:22,57.

Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86

Running in: Normal Mode Internet Access Detected

Launched: C:\Documents and Settings\Microsoft User\Bureaublad\zoek.exe [script inserted] [Checkboxes used]

==== System Restore Info ======================

6/10/2013 21:12:31 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\AntiVirService deleted successfully

==== FireFox Fix ======================

Deleted from C:\Documents and Settings\Microsoft User\Application Data\Mozilla\Firefox\Profiles\vn80b503.default\prefs.js:

user_pref("browser.startup.homepage", "http://www.google.be/");

user_pref("browser.search.selectedEngine", "Google");

Added to C:\Documents and Settings\Microsoft User\Application Data\Mozilla\Firefox\Profiles\vn80b503.default\prefs.js:

user_pref("browser.startup.homepage", "http://www.google.com");

user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.newtab.url", "http://www.google.com/");

user_pref("browser.search.defaultengine", "Google");

user_pref("browser.search.defaultenginename", "Google");

user_pref("browser.search.selectedEngine", "Google");

user_pref("browser.search.order.1", "Google");

user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.search.suggest.enabled", true);

user_pref("browser.search.useDBForOrder", true);

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"AntiVirService"=-

"AntiVirSchedulerService"=-

==== Deleting Files \ Folders ======================

"C:\Program Files\Avira" not found

"C:\WINDOWS\002797_.tmp" deleted

"C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}" deleted

"C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}" deleted

"C:\Program Files\TubeSaver" deleted

"C:\Program Files\MyFree Codec" deleted

==== Files Recently Created / Modified ======================

====== C:\WINDOWS ====

====== C:\DOCUME~1\MICROS~1\LOCALS~1\Temp ====

====== Java Cache =====

2013-09-15 17:20:04 86EAEE123BFD25B5C9B66586487CCD6A 400 ----a-w- C:\Documents and Settings\Microsoft User\Local Settings\Application Data\Sun\Java\Deployment\cache\6.0\6\764fb46-7dbeaaa0

2013-09-21 12:58:08 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Documents and Settings\Microsoft User\Local Settings\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\6c34baa0-3a207aa5

====== C:\WINDOWS\system32 =====

====== C:\WINDOWS\system32\drivers =====

====== C:\WINDOWS\Tasks ======

====== C:\WINDOWS\Temp ======

======= C:\Program Files =====

2013-09-15 17:07:46 -------- d-----w- C:\Program Files\Common Files\Java

2013-09-09 18:46:53 -------- d-----w- C:\Program Files\pazera-software

======= C: =====

====== C:\Documents and Settings\Microsoft User\Application Data ======

2013-10-06 19:02:43 -------- d-----w- C:\Documents and Settings\Microsoft User\Menu Start\Programma's\CyberLink PowerDVD

2013-09-11 17:09:27 1698037AAE1E1FA8532063FE762D0DF9 71544 ----a-w- C:\Documents and Settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

====== C:\Documents and Settings\Microsoft User ======

2013-10-05 17:26:58 -------- d-sh--w- C:\Documents and Settings\NetworkService\Cookies

====== C: exe-files ==

2013-10-06 12:42:07 69CA82A7482A00D8EE063D2B97FC4338 781383 ----a-w- C:\Documents and Settings\Microsoft User\Mijn documenten\Downloads\RSIT(1).exe

2013-10-05 08:08:15 60CEFABAC2C573B266B567534CE7567E 1178424 ----a-w- C:\Documents and Settings\Microsoft User\Bureaublad\mbar\mbar.exe

2013-10-05 08:08:15 373A0226FCB397B0C4031AD27FC429EE 757048 ----a-w- C:\Documents and Settings\Microsoft User\Bureaublad\mbar\Plugins\fixdamage.exe

2013-10-05 08:07:59 E6F3BBBCD31AB4CE97782C66551903FB 12907592 ----a-w- C:\Documents and Settings\Microsoft User\Mijn documenten\Downloads\mbar-1.07.0.1005.exe

2013-10-05 08:04:50 5611140E8CC5927D371C27EA1F9E71A6 1045226 ----a-w- C:\Documents and Settings\Microsoft User\Mijn documenten\Downloads\adwcleaner.exe

2013-10-04 17:29:39 A0E9A27B051ACEB918F7DBB88BBF3DB3 5552488 ----a-w- C:\Documents and Settings\Microsoft User\Mijn documenten\Downloads\spsetup123.exe

=== C: other files ==

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-21-220523388-790525478-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run]

"GBMLite8AgentLaCie"="C:\Program Files\Genie-Soft\GBALite8LaCie\GBMAgent.exe"

"KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload"

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="C:\WINDOWS\ehome\ehtray.exe"

"RTHDCPL"="RTHDCPL.EXE"

"AGRSMMSG"="AGRSMMSG.exe"

"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"

"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe runtime -Delay"

"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE"

"LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe /automation"

"LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE"

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot"

"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"

"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"

"PPort11reminder"="C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe -r C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"

"BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN"

"ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun"

"GBMLite8AgentLaCie"="C:\Program Files\Genie-Soft\GBALite8LaCie\GBMAgent.exe"

"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE -startup"

"APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe -atboottime"

"KiesTrayAgent"="C:\Program Files\Samsung\Kies\KiesTrayAgent.exe"

"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"GBMLite8AgentLaCie"="C:\Program Files\Genie-Soft\GBALite8LaCie\GBMAgent.exe"

"KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload"

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="iTunesHelper"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechCameraAssistant]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="CameraAssistant"

"hkey"="HKLM"

"command"="C:\\Program Files\\Acer\\OrbiCam\\CameraAssistant.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechVideo[inspector]]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="InstallHelper"

"hkey"="HKLM"

"command"="C:\\Program Files\\Acer\\OrbiCam\\InstallHelper.exe /inspect"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^Citrix XenApp.lnk]

"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\Citrix XenApp.lnk"

"backup"="C:\\WINDOWS\\pss\\Citrix XenApp.lnkCommon Startup"

"command"="C:\\WINDOWS\\Installer\\{388C130B-0079-46B4-A0D5-DC2DD7A89A7B}\\pnaico.exe.20FBBF0A_A7E5_4BDE_9798_9811C3D135AC.exe "

"item"="Citrix XenApp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programma's^Opstarten^McAfee Security Scan Plus.lnk]

"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programma's\\Opstarten\\McAfee Security Scan Plus.lnk"

"backup"="C:\\WINDOWS\\pss\\McAfee Security Scan Plus.lnkCommon Startup"

"command"="C:\\PROGRA~1\\MCAFEE~1\\30D80A~1.285\\SSSCHE~1.EXE "

"item"="McAfee Security Scan Plus"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services]

==== Task Scheduler Jobs ======================

C:\WINDOWS\tasks\Adobe Flash Player Updater.job --a------ C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [21/09/2013 09:55]

==== Firefox Extensions ======================

ProfilePath: C:\Documents and Settings\Microsoft User\Application Data\Mozilla\Firefox\Profiles\vn80b503.default

- Garmin Communicator - %ProfilePath%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

- Microsoft .NET Framework Assistant - %ProfilePath%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

- lucky leap - %ProfilePath%\extensions\firefox@luckyleap.net.xpi

- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files\Mozilla Firefox

- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}

==== Firefox Plugins ======================

Profilepath: C:\Documents and Settings\Microsoft User\Application Data\Mozilla\Firefox\Profiles\vn80b503.default

CA0E1DFBE480CF0BE13A0883BEB378B6 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll - Java Platform SE 7 U40

AF661355EBAB898EB92D5454AEF93CE0 - C:\WINDOWS\system32\npdeployJava1.dll - Java Deployment Toolkit 7.0.400.43

E5AF72B7353FF8D431A7C463A4229524 - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll - Shockwave Flash

148727EBD947CBC168C42A227D56DAB0 - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat

9B4D431459A9B935FB117F4EDDA236E8 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat

F045DF7AF127DC4BCC53421850114E15 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll - Silverlight Plug-In

75300E5ED4CD5B4363C3DBBB2D03269C - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMSS.dll - McAfee Security Scanner +

AF87C7A3D391F5F5534167546D7DDE30 - C:\Program Files\QuickTime\Plugins\npqtplugin7.dll - QuickTime Plug-in 7.7.3

2034E977759F4EB2226914BFC58F2758 - C:\Program Files\QuickTime\Plugins\npqtplugin6.dll - QuickTime Plug-in 7.7.3

B14417814FCA3A5D4AB170E1823D5484 - C:\Program Files\QuickTime\Plugins\npqtplugin5.dll - QuickTime Plug-in 7.7.3

3EFF190EC0E333DFBD2F5499858044B6 - C:\Program Files\QuickTime\Plugins\npqtplugin4.dll - QuickTime Plug-in 7.7.3

C4EB1B18B39BD2F76A64F75D01DEAB61 - C:\Program Files\QuickTime\Plugins\npqtplugin3.dll - QuickTime Plug-in 7.7.3

45CC6EFE643FCB97D986BBE2D21E2491 - C:\Program Files\QuickTime\Plugins\npqtplugin2.dll - QuickTime Plug-in 7.7.3

9FCA15CC38F2E2C6F5E722ED0E1A9E7A - C:\Program Files\QuickTime\Plugins\npqtplugin.dll - QuickTime Plug-in 7.7.3

C1680C34DE8A405C8829AB93236576FD - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll - iTunes Application Detector

AB87EEFFD18F2BAAFC274E7075EA6C67 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation

7A75CCAA7E3CE0B14F7428F1731CF4C9 - C:\WINDOWS\system32\Npindeo.dll - Intel Indeo® video 5.1 PD Plug-In

3EA079023D32054BFD73D08E77C72609 - C:\WINDOWS\system32\npptools.dll - Besturingssysteem Microsoft® Windows®

7D28153B7D586330678AD522B71D89CB - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrlui.dll - Microsoft® Silverlight

==== Deleting Files \ Folders ======================

"C:\Documents and Settings\Microsoft User\Application Data\Mozilla\Firefox\Profiles\vn80b503.default\extensions\firefox@luckyleap.net.xpi" deleted

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

ojcdnngpmbenohhjlickdajclhbcaada - C:\Program Files\TubeSaver\133.crx[]

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.google.be/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="http://www.google.com"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.google.be/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="res://ieframe.dll/tabswelcome.htm"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{51818293-706D-4738-B3DF-034E626DBA3A}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} @ieframe.dll,-12512 Url="http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC"

{51818293-706D-4738-B3DF-034E626DBA3A} Google Url="http://www.google.be/search?hl=nl&source=hp&q={searchTerms}&meta=&aq=f&oq="

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

Nothing found to reset

==== Reset IE Proxy ======================

Value(s) before fix:

"ProxyEnable"=dword:00000000

Value(s) after fix:

"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\ojcdnngpmbenohhjlickdajclhbcaada deleted successfully

==== Empty IE Cache ======================

C:\Documents and Settings\Microsoft User\Local Settings\temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5 emptied successfully

C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

C:\Documents and Settings\Microsoft User\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Documents and Settings\Microsoft User\Local Settings\Application Data\Mozilla\Firefox\Profiles\vn80b503.default\Cache emptied successfully

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied

C:\DOCUME~1\MICROS~1\LOCALS~1\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat" not found

"C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat" not found

"C:\Documents and Settings\Microsoft User\Local Settings\Temporary Internet Files\Content.IE5\index.dat" not found

==== EOF on zo 06/10/2013 at 21:25:46,28 ======================

- - - Updated - - -

het probleem met de teksten die verschijnen als ik op een link sta is weg.

maar als ik combofix terug start krijg ik terug de melding dat avira nog aan staat

kape · 6 oktober 2013

Download AdwCleaner by Xplode naar je bureaublad.

Sluit alle openstaande vensters.
Dubbelklik op AdwCleaner om hem te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren,
Door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Klik vervolgens op Scan.
Klik vervolgens op Clean als er items zijn gevonden.
Klik bij Herstarten Noodzakelijk op OK

Nadat de PC opnieuw is opgestart, opent meestal een logfile.

Anders is het hier terug te vinden C:\AdwCleaner\AdwCleaner[R1].txt.

En gebruik dan deze Removal Tool van Avira.

Post aansluitend de inhoud van dit log in je volgende bericht.

6 oktober 2013 aangepast door kape

dries V · 6 oktober 2013

# AdwCleaner v3.006 - Report created 06/10/2013 at 22:32:05

# Updated 01/10/2013 by Xplode

# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

# Username : Microsoft User - K314

# Running from : C:\Documents and Settings\Microsoft User\Mijn documenten\Downloads\adwcleaner(1).exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

File Deleted : C:\Documents and Settings\Microsoft User\Application Data\Mozilla\Firefox\Profiles\vn80b503.default\user.js

***** [ Shortcuts ] *****

***** [ Registry ] *****

Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [Tubesaver@istqt.co]

Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr

Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\YahooPartnerToolbar

Key Deleted : HKCU\Software\AppDataLow\Software\smartbar

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tubesaver@istqt.co

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\lucky leap

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Tubesaver@istqt.co

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

-\\ Mozilla Firefox v24.0 (nl)

[ File : C:\Documents and Settings\Microsoft User\Application Data\Mozilla\Firefox\Profiles\vn80b503.default\prefs.js ]

*************************

AdwCleaner[R0].txt - [4285 octets] - [05/10/2013 10:05:04]

AdwCleaner[R1].txt - [4156 octets] - [06/10/2013 22:31:19]

AdwCleaner[s0].txt - [4155 octets] - [06/10/2013 22:32:05]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [4215 octets] ##########

kape · 6 oktober 2013

En krijg je - na gebruik van de Removal Tool - nog aanduidingen van Avira in Combofix ?

dries V · 7 oktober 2013

ja,

ik krijg nog altijd de melding

Removal Tool for:

Sober.J/P/Y

TR/Spy.Banker.AATZ/Banker.AATZ.1/Banker.AATZ.2/Banker.AATZ.3

W32/Stanit.A

Worm/NetSky.P

Version: 3.0.1.16, May 28 2008 15:11:17

Use /? to list all available command line options

- Saving results to logfile "tool_en.log".

- Host: "K314", IP: 192.168.0.213

Scanning memory... done

No malware found in memory

Scanning drive C: ...

No malware found on hard drives

scan results:

scanned directories: 15193

kape · 8 oktober 2013

Dubbelklik op Zoek.exe om de tool te starten.

Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.

  AntiVirService;s
 C:\Program Files\Avira;fs
 c:\program files\pazera-software;fs
 avkmgr;s
 C:\Qoobox;fs

Klik op de knop "Options" en vink nu de onderstaande opties aan.
Auto Clean
Klik nu op de knop "Run script".
Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.
Post nu de inhoud van het geopende logje in het volgende bericht.

dries V · 8 oktober 2013

Zoek.exe Version 4.0.0.4 Updated 07-October-2013

Tool run by Microsoft User on di 08/10/2013 at 12:58:19,04.

Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86

Running in: Normal Mode Internet Access Detected

Launched: C:\Documents and Settings\Microsoft User\Bureaublad\zoek.exe [script inserted] [Checkboxes used]

==== Older Logs ======================

C:\zoek-results2013-10-06-192546.log 16277 bytes

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\AntiVirService deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\avkmgr deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\System\avkmgr deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\avkmgr deleted successfully

==== Deleting Files \ Folders ======================

"C:\Program Files\Avira" not found

"c:\program files\pazera-software" deleted

"C:\Qoobox" deleted