Laptop 'kleine broer'

[compuchrisje]

Mijn beste breurtje had al enige tijd gemeld dat zijn laptop zo sloom was geworden, volgens hem duurde het 20 minuten eer het systeem was opgestart. Vandaag is zijn kleinood hier gearriveerd om te zien wat er schort, en dat is heel wat. De updates van juli zijn nog binnengeraakt, maar die voor deze maand raken langs geen kanten binnen. Internet Explorer laat de hele zaak compleet vastlopen, rare startpagina hebben ze daar.
Het gaat om Windows 7 SP1, met free AVG, dat volledig is bijgewerkt.

Eerste run van mbam is de mist ingegaan, tijdens het exporteren naar txt-bestand, maar ik heb het uit de logboeken kunnen ophalen.
In de tweede run werden nog steeds ongewenste bestanden gevonden.
Logje volgt zodra GMER klaar is met scannen.

[compuchrisje]

Eerste logje Mbam

Malwarebytes Anti-Malware
www.malwarebytes.org

Scandatum: 14-8-2014
Scantijd: 22:19:45
Logbestand: mbam1.txt
Beheerder: Ja

Versie: 2.00.2.1012
Malwaredatabase: v2014.08.14.10
Rootkitdatabase: v2014.08.04.01
Licentie: Proef
Malwarebescherming: Ingeschakeld
Kwaadaardige Website Bescherming: Ingeschakeld
Self-protection: Uitgeschakeld

Besturingssysteem: Windows 7 Service Pack 1
Processor: x64
Bestandssysteem: NTFS
Gebruiker: Wij-Twee

Scantype: Hyperscan
Resultaat: Voltooid
Objecten Gescand: 308994
Verstreken Tijd: 13 m, 45 s

Geheugen: Ingeschakeld
Opstarten: Ingeschakeld
Bestandssysteem: Uitgeschakeld
Archieven: Ingeschakeld
Rootkits: Uitgeschakeld
Heuristics: Ingeschakeld
POP: Ingeschakeld
POA: Ingeschakeld

Processen: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registersleutels: 17
PUP.Optional.DealPly.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS \gaiilaahiahdejapggenmdmafpmbipje, In Quarantaine, [7e041babe09b4cea21586b85aa589a66],
PUP.Optional.DealPly.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\gaiilaahiahdej apggenmdmafpmbipje, In Quarantaine, [09797b4b2b503afc1d5d3db3d52ddb25],
PUP.Optional.Softonic.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantaine, [f88a695d97e46fc7ac9289714fb38d73],
PUP.Optional.DealPly.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\ga iilaahiahdejapggenmdmafpmbipje, In Quarantaine, [770b497d2655c274a4d68e6244beaf51],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\EXPLORER\BROWSER HELPER OBJECTS\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\CLASSES\phpnuke.phpnukeHlpr, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\CLASSES\phpnuke.phpnukeHlpr.1, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\phpnuke.phpnukeH lpr, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\phpnuke.phpnukeH lpr.1, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{DD57C9E1-9315-4F07-8EE6-2282B0312CC6}, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\CLASSES\escort.escortIEPane.1, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\CLASSES\escort.escortIEPane, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\escort.escortIEP ane, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\escort.escortIEP ane.1, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SE TTINGS\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}, In Quarantaine, [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\ST ATS\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}, In Quarantaine, [631f567087f40a2c2129874e08fccb35],

Registerwaardes: 0
(No malicious items detected)

Registerdata: 0
(No malicious items detected)

Mappen: 4
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly, In Quarantaine, [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje, In Quarantaine, [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0, In Quarantaine, [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\images, In Quarantaine, [7d054b7b2c4fdb5b148c437830d2f60a],

Bestanden: 12
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPly.crx, In Quarantaine, [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPly.xpi, In Quarantaine, [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPlyIE.dll, In Quarantaine, [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPlyUpdate.exe, In Quarantaine, [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPlyUpdateRun.exe, In Quarantaine, [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\icon.ico, In Quarantaine, [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\background.js, In Quarantaine, [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\manifest.json, In Quarantaine, [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\images\icon128.png, In Quarantaine, [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\images\icon16.png, In Quarantaine, [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\images\icon48.png, In Quarantaine, [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.PHPNukeTB.A, C:\Program Files (x86)\phpnuke\phpnuke\1.8.8.12\bh\phpnuke.dll, In Quarantaine, [631f567087f40a2c2129874e08fccb35],

Fysieke Sectoren: 0
(No malicious items detected)


(end)

Tweede logje Mbam

Malwarebytes Anti-Malware
www.malwarebytes.org

Scandatum: 14-8-2014
Scantijd: 22:19:45
Logbestand: mbam.txt
Beheerder: Ja

Versie: 2.00.2.1012
Malwaredatabase: v2014.08.14.10
Rootkitdatabase: v2014.08.04.01
Licentie: Proef
Malwarebescherming: Ingeschakeld
Kwaadaardige Website Bescherming: Ingeschakeld
Self-protection: Uitgeschakeld

Besturingssysteem: Windows 7 Service Pack 1
Processor: x64
Bestandssysteem: NTFS
Gebruiker: Wij-Twee

Scantype: Hyperscan
Resultaat: Voltooid
Objecten Gescand: 308994
Verstreken Tijd: 13 m, 45 s

Geheugen: Ingeschakeld
Opstarten: Ingeschakeld
Bestandssysteem: Uitgeschakeld
Archieven: Ingeschakeld
Rootkits: Uitgeschakeld
Heuristics: Ingeschakeld
POP: Ingeschakeld
POA: Ingeschakeld

Processen: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registersleutels: 17
PUP.Optional.DealPly.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS \gaiilaahiahdejapggenmdmafpmbipje, , [7e041babe09b4cea21586b85aa589a66],
PUP.Optional.DealPly.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\gaiilaahiahdej apggenmdmafpmbipje, , [09797b4b2b503afc1d5d3db3d52ddb25],
PUP.Optional.Softonic.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [f88a695d97e46fc7ac9289714fb38d73],
PUP.Optional.DealPly.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\ga iilaahiahdejapggenmdmafpmbipje, , [770b497d2655c274a4d68e6244beaf51],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\EXPLORER\BROWSER HELPER OBJECTS\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\CLASSES\phpnuke.phpnukeHlpr, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\CLASSES\phpnuke.phpnukeHlpr.1, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\phpnuke.phpnukeH lpr, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\phpnuke.phpnukeH lpr.1, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{DD57C9E1-9315-4F07-8EE6-2282B0312CC6}, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\CLASSES\escort.escortIEPane.1, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\CLASSES\escort.escortIEPane, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\escort.escortIEP ane, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\escort.escortIEP ane.1, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SE TTINGS\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}, , [631f567087f40a2c2129874e08fccb35],
PUP.Optional.PHPNukeTB.A, HKU\S-1-5-21-2064762291-2020927636-1381742553-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\ST ATS\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}, , [631f567087f40a2c2129874e08fccb35],

Registerwaardes: 0
(No malicious items detected)

Registerdata: 0
(No malicious items detected)

Mappen: 4
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly, , [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje, , [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0, , [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\images, , [7d054b7b2c4fdb5b148c437830d2f60a],

Bestanden: 12
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPly.crx, , [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPly.xpi, , [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPlyIE.dll, , [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPlyUpdate.exe, , [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\DealPlyUpdateRun.exe, , [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Program Files (x86)\DealPly\icon.ico, , [067c03c3c7b439fdd789b767fb09b749],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\background.js, , [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\manifest.json, , [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\images\icon128.png, , [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\images\icon16.png, , [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.DealPly.A, C:\Users\Wij-Twee\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafp mbipje\3.9.7.9_0\images\icon48.png, , [7d054b7b2c4fdb5b148c437830d2f60a],
PUP.Optional.PHPNukeTB.A, C:\Program Files (x86)\phpnuke\phpnuke\1.8.8.12\bh\phpnuke.dll, , [631f567087f40a2c2129874e08fccb35],

Fysieke Sectoren: 0
(No malicious items detected)


(end)

[compuchrisje]

GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-08-14 23:01:35
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 FUJITSU_ rev.0040 298,09GB
Running: o66his5r.exe; Driver: C:\Users\Wij-Twee\AppData\Local\Temp\ufrdypod.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLoo kasideList + 528 fffff80002da4000 16 bytes [C1, 03, 0F, 85, 78, FF, FF, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLoo kasideList + 546 fffff80002da4012 5 bytes [05, A9, CA, 22, 00]

---- User code sections - GMER 2.1 ----

.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076b51465 2 bytes [B5, 76]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076b514bb 2 bytes [B5, 76]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[2700] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076b51465 2 bytes [B5, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[2700] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000076b514bb 2 bytes [B5, 76]
.text ... * 2
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076b51465 2 bytes [B5, 76]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076b514bb 2 bytes [B5, 76]
.text ... * 2

---- Threads - GMER 2.1 ----

Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2580:3940] 000007fefb2c2bf8
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2580:3964] 000007fee9f34830
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2580:3672] 000007fee9f34830
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2580:2928] 000007fef8cf5124

---- EOF - GMER 2.1 ----

[compuchrisje]

En tenslotte DDS

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17207
Run by Wij-Twee at 23:13:48 on 2014-08-14
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.3933.2237 [GMT 2:00]
.
AV: AVG Anti-Virus Free *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\TECO\TecoService.exe
C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
C:\Program Files (x86)\AVG\AVG9\avgemc.exe
C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.phpnuke.org/?lang=en&cid=c2a242b1
uWindow Title = Telenet Internet
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEH&bmod=TSEH
mWindow Title = Telenet Internet
mWinlogon: Userinit = userinit.exe,
BHO: Bing Bar Helper: {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Windows Live Aanmelden - Help: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Foxit Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Foxit Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB: Foxit Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB: phpnuke Toolbar: {7B206A1E-933F-4A50-9E60-5167598BDB03} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.8.12\phpnukeTlbr.dll
TB: Bing Bar: {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll
uRun: [Smart Driver Updater] C:\Program Files (x86)\Smart Driver Updater\SDULauncher.exe
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [beid] "C:\Program Files (x86)\Belgium Identity Card\beid35gui.exe" /startup
dRun: [TOSHIBA Online Product Information] C:\Program Files (x86)\TOSHIBA\Toshiba Online Product Information\topi.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
Trusted Zone: belfius.be
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 195.130.130.2 195.130.131.2
TCP: Interfaces\{E856CFCF-D9B4-4A32-9424-78E51B5D46AD} : DHCPNameServer = 195.130.130.2 195.130.131.2
TCP: Interfaces\{FC3C23BE-EE5E-42E0-A8F1-56DA3D1E8144} : DHCPNameServer = 195.130.130.2 195.130.131.2
TCP: Interfaces\{FC3C23BE-EE5E-42E0-A8F1-56DA3D1E8144}\C696E6B6379737 : DHCPNameServer = 195.238.2.22 195.238.2.21
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\Inst aller\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: Bing Bar Helper: {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dl l
x64-BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll
x64-TB: Bing Bar: {eec0f710-38b5-4aba-99bf-ec87564a4e13} -
x64-Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\Windows\System32\drivers\tos_sps64.sys [2010-2-3 482384]
R1 AvgLdx64;AVG Free AVI Loader Driver x64;C:\Windows\System32\drivers\avgldx64.sys [2010-7-30 282976]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;C:\Windows\System32\drivers\avgmfx64.sys [2010-7-30 35664]
R1 AvgTdiA;AVG Free Network Redirector x64;C:\Windows\System32\drivers\avgtdia.sys [2010-7-30 317520]
R2 avg9emc;AVG Free E-mail Scanner;C:\Program Files (x86)\AVG\AVG9\avgemc.exe [2010-7-30 921952]
R2 avg9wd;AVG Free WatchDog;C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [2010-7-30 308136]
R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-8-10 248688]
R2 ConfigFree Gadget Service;ConfigFree Gadget Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2009-7-14 42368]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-8-14 1809720]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-8-14 860472]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2010-4-25 1153368]
R2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [2009-8-6 116104]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2009-8-27 251760]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\Windows\System32\drivers\TVALZFL.sys [2009-6-19 14472]
R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE [2014-3-11 247968]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\dr ivers\mbam.sys [2014-8-14 25816]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\dr ivers\MBAMSwissArmy.sys [2014-8-14 122584]
R3 MBAMWebAccessControl;MBAMWebAccessControl;C:\Windo ws\System32\drivers\mwac.sys [2014-8-14 63704]
R3 PGEffect;Pangu effect driver;C:\Windows\System32\drivers\PGEffect.sys [2010-2-3 35008]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-9-10 215040]
R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\Windows\System32\drivers\rtl8192se.sys [2010-2-3 942080]
S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.EXE [2014-3-11 193696]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework6 4\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S3 cleanhlp;cleanhlp;G:\Emsisoft Emergency Kit\Run\cleanhlp64.sys [2014-6-28 57024]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-7-11 111616]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-2-3 222208]
S3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-2-3 51512]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-8-3 137560]
S3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-8-4 826224]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUs bFlt.sys [2011-6-10 59392]
S3 WatAdminSvc;Windows Activation Technologies-service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-7-30 1255736]
.
=============== Created Last 30 ================
.
2014-08-14 19:37:48 122584 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-08-14 19:37:02 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2014-08-14 19:37:02 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
2014-08-14 19:37:02 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-08-14 19:37:02 -------- d-----w- C:\ProgramData\Malwarebytes
2014-08-14 19:37:02 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-14 19:36:40 -------- d-----w- C:\Users\Wij-Twee\AppData\Local\Programs
2014-08-14 17:46:13 -------- d-----w- C:\Program Files\CCleaner
2014-08-13 15:55:50 -------- d-sh--w- C:\Users\Wij-Twee\AppData\Local\EmieUserList
2014-08-13 15:55:50 -------- d-sh--w- C:\Users\Wij-Twee\AppData\Local\EmieSiteList
.
==================== Find3M ====================
.
2014-07-25 11:40:40 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-25 11:40:40 699056 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-06-19 01:06:55 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2014-06-19 01:06:24 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2014-06-19 00:42:57 548352 ----a-w- C:\Windows\System32\vbscript.dll
2014-06-19 00:42:49 66048 ----a-w- C:\Windows\System32\iesetup.dll
2014-06-19 00:41:52 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2014-06-19 00:41:16 83968 ----a-w- C:\Windows\System32\MshtmlDac.dll
2014-06-19 00:24:30 139264 ----a-w- C:\Windows\System32\ieUnatt.exe
2014-06-19 00:24:12 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe
2014-06-19 00:23:53 752640 ----a-w- C:\Windows\System32\jscript9diag.dll
2014-06-19 00:14:28 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2014-06-18 23:59:04 38400 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-06-18 23:56:37 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2014-06-18 23:51:38 5721088 ----a-w- C:\Windows\System32\jscript9.dll
2014-06-18 23:38:40 455168 ----a-w- C:\Windows\SysWow64\vbscript.dll
2014-06-18 23:37:23 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll
2014-06-18 23:36:35 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2014-06-18 23:35:55 62464 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
2014-06-18 23:27:45 1249280 ----a-w- C:\Windows\System32\mshtmlmedia.dll
2014-06-18 23:27:07 2040832 ----a-w- C:\Windows\System32\inetcpl.cpl
2014-06-18 23:23:27 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2014-06-18 23:22:40 592896 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2014-06-18 23:06:10 32256 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2014-06-18 22:58:27 2266112 ----a-w- C:\Windows\System32\wininet.dll
2014-06-18 22:52:18 4254720 ----a-w- C:\Windows\SysWow64\jscript9.dll
2014-06-18 22:46:23 1068032 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
2014-06-18 22:45:59 1964544 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2014-06-18 22:13:59 1791488 ----a-w- C:\Windows\SysWow64\wininet.dll
2014-06-18 02:18:30 692736 ----a-w- C:\Windows\System32\osk.exe
2014-06-18 01:51:32 646144 ----a-w- C:\Windows\SysWow64\osk.exe
2014-06-18 01:10:36 3157504 ----a-w- C:\Windows\System32\win32k.sys
2014-06-06 10:10:34 624128 ----a-w- C:\Windows\System32\qedit.dll
2014-06-06 09:44:17 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
2014-06-05 14:45:15 1460736 ----a-w- C:\Windows\System32\lsasrv.dll
2014-06-05 14:26:58 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2014-06-05 14:25:49 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2014-05-30 08:08:52 210944 ----a-w- C:\Windows\System32\wdigest.dll
2014-05-30 08:08:49 86528 ----a-w- C:\Windows\System32\TSpkg.dll
2014-05-30 08:08:47 340992 ----a-w- C:\Windows\System32\schannel.dll
2014-05-30 08:08:41 314880 ----a-w- C:\Windows\System32\msv1_0.dll
2014-05-30 08:08:41 307200 ----a-w- C:\Windows\System32\ncrypt.dll
2014-05-30 08:08:36 728064 ----a-w- C:\Windows\System32\kerberos.dll
2014-05-30 08:08:31 22016 ----a-w- C:\Windows\System32\credssp.dll
2014-05-30 07:52:51 172032 ----a-w- C:\Windows\SysWow64\wdigest.dll
2014-05-30 07:52:49 65536 ----a-w- C:\Windows\SysWow64\TSpkg.dll
2014-05-30 07:52:45 247808 ----a-w- C:\Windows\SysWow64\schannel.dll
2014-05-30 07:52:41 220160 ----a-w- C:\Windows\SysWow64\ncrypt.dll
2014-05-30 07:52:40 259584 ----a-w- C:\Windows\SysWow64\msv1_0.dll
2014-05-30 07:52:36 550912 ----a-w- C:\Windows\SysWow64\kerberos.dll
2014-05-30 07:52:30 17408 ----a-w- C:\Windows\SysWow64\credssp.dll
2014-05-30 06:45:52 497152 ----a-w- C:\Windows\System32\drivers\afd.sys
2014-02-28 17:04:13 49940480 ----a-w- C:\Program Files (x86)\GUTA16D.tmp
2013-10-18 05:46:46 50053120 ----a-w- C:\Program Files (x86)\GUTAF9.tmp
2013-07-20 23:28:43 4188160 ----a-w- C:\Program Files (x86)\GUTE688.tmp
.
============= FINISH: 23:14:25,08 ===============


En hierna ging het licht uit, toen ik op het windows logo klikte. BSOD...

[compuchrisje]

En het licht ging ook terug weer aan. Bij het opstarten kwam MBam op de proppen met de melding dat er nog een 12-tal problemen waren, die in quarantaine zijn gezet.
Heb me daarna nog bezig gehouden met het updaten van Java, Ccleaner had ik vooraf al geïnstalleerd (dacht ik). Windows Defender werkte terug en bij het afsluiten begonnen opeens de Windows updates zich te installeren.
Internet Explorer heb ik opnieuw naar de standaardinstellingen gezet, de startpagina aangepast en de phpnuke-toolbar eruit gegooid.
Zowel MBam als AVG geven groen. Ik veronderstel dus dat de acties hun werk hebben gedaan?
Nu nog schijfopruiming en defragmentatie en het machientje kan terug naar zijn baasje. Broerlief is al geïnformeerd dat ie geen software meer via derden mag downloaden (Softone)

[Rosty]

[QUOTE=compuchrisje;598801Zowel MBam als AVG geven groen. Ik veronderstel dus dat de acties hun werk hebben gedaan?
Nu nog schijfopruiming en defragmentatie en het machientje kan terug naar zijn baasje. Broerlief is al geïnformeerd dat ie geen software meer via derden mag downloaden (Softone)[/QUOTE]

Broerlief moet luisteren naar zusje lief!! Dat heb je geod gedaan, CC'ke.