Archief - PC loopt regelmatig vast.

Mijn pc loopt regelmatig vast. Het scherm freezed. Gebeurt eigenlijk vanuit het niets. En zeker wel 6 keer op een dag. Ik hoop dat je mij er mee kunt helpen.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:17:56, on 31-10-2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\FTDv3.8\FTDv3.exe
C:\Users\Ta en jls\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ta en jls\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ta en jls\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ta en jls\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Ta en jls\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, nieuws en entertainment vind je op MSN.nl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN | Hotmail | Messenger | Nieuws, sport, entertainment, video, lifestyle, auto en nog veel meer, dat is MSN !
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN | Hotmail | Messenger | Nieuws, sport, entertainment, video, lifestyle, auto en nog veel meer, dat is MSN !
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [jswtrayutil] "C:\Program Files\NETGEAR\WN111v2\jswtrayutil.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Ta en jls\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: NETGEAR WN111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe

--
End of file - 3790 bytes

Download ComboFix van één van deze locaties:

Link 1
Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

• Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:
  Klik hier
  
  Als het je niet lukt om ze uit te schakelen, ga dan gewoon door naar de volgende stap.
• Dubbelklik op ComboFix.exe en volg de meldingen op het scherm.
• ComboFix zal controleren of dat de Microsoft Windows Recovery Console reeds is geïnstalleerd.
  
  **Let op: Als de Microsoft Windows Recovery Console al is geïnstalleerd, dan krijg je de volgende schermen niet te zien en zal ComboFix automatisch verder gaan met het scannen naar malware.
• Volg de meldingen op het scherm om ComboFix de Microsoft Windows Recovery Console te laten downloaden en installeren.

Je krijgt de volgende melding te zien wanneer ComboFix de Microsoft Windows Recovery Console succesvol heeft geïnstalleerd:



Klik op Ja om verder te gaan met het scannen naar malware.

Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Indien je problemen hebt bij het uitvoeren van ComboFix, gelieve dit te melden.

ComboFix 10-11-02.01 - Ta en jls 02-11-2010 21:01:35.1.3 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.31.1043.18.1791.988 [GMT 1:00]
Gestart vanuit: c:\users\Ta en jls\Downloads\ComboFix.exe
* Nieuw herstelpunt werd aangemaakt
.

(((((((((((((((((((( Bestanden Gemaakt van 2010-10-02 to 2010-11-02 ))))))))))))))))))))))))))))))
.

2010-11-02 20:04 . 2010-11-02 20:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-31 21:29 . 2010-10-31 21:46 -------- d-----w- c:\program files\Microsoft Silverlight
2010-10-31 21:12 . 2010-10-31 21:12 -------- d-----w- c:\program files\Trend Micro
2010-10-29 17:28 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-29 17:28 . 2010-10-29 17:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-29 17:28 . 2010-10-29 17:28 -------- d-----w- c:\programdata\Malwarebytes
2010-10-29 17:28 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-25 20:21 . 2010-10-25 20:21 -------- d-----w- c:\programdata\Blizzard Entertainment
2010-10-25 18:25 . 2010-10-25 21:14 -------- d-----w- c:\program files\FTDv3.8
2010-10-25 18:21 . 2010-10-25 18:21 -------- d-----w- c:\program files\GrabIt
2010-10-25 18:21 . 2010-10-25 17:38 -------- d-----w- c:\windows\Panther
2010-10-25 18:20 . 2010-10-25 18:20 -------- d-----w- C:\Boot
2010-10-25 18:09 . 2010-10-25 18:09 -------- d-----r- c:\program files\Skype
2010-10-25 18:09 . 2010-10-25 18:09 -------- d-----w- c:\program files\Common Files\Skype
2010-10-25 18:09 . 2010-10-25 18:09 -------- d-----w- c:\programdata\Skype
2010-10-25 18:07 . 2010-10-25 18:07 -------- d-----w- c:\program files\VideoLAN
2010-10-25 18:07 . 2010-10-18 07:41 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{084DFEAA-C1AD-46F6-A9F8-A2C43B5CFCA8}\mpengine.dll
2010-10-25 18:00 . 2010-10-25 18:00 -------- d-----w- c:\program files\installshield installation information
2010-10-25 18:00 . 2010-10-25 18:00 -------- d-----w- c:\program files\NETGEAR
2010-10-25 18:00 . 2010-10-25 18:00 -------- d-----w- c:\programdata\NETGEAR
2010-10-25 18:00 . 2010-10-25 18:00 -------- d-----w- c:\windows\Downloaded Installations
2010-10-25 17:44 . 2010-11-02 20:03 -------- d-----w- c:\windows\system32\wbem\Performance
2010-10-25 17:40 . 2010-10-25 17:40 -------- d-----w- c:\program files\Common Files\Adobe
2010-10-25 17:40 . 2010-10-25 17:40 -------- d-----w- c:\program files\Common Files\Java
2010-10-25 17:39 . 2010-10-25 17:39 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-25 17:39 . 2010-10-25 17:39 -------- d-----w- c:\program files\Java
2010-10-25 17:39 . 2010-10-31 21:31 -------- d-sh--w- c:\windows\Installer
2010-10-25 17:39 . 2010-10-25 17:40 -------- d-----w- c:\users\Ta en jls
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\users\Default\Sjablonen
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\users\Default\Netwerkprinteromgeving
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\users\Default\Mijn documenten
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\users\Default\Menu Start
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\users\Default\AppData\Local\Geschiedenis
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\programdata\Sjablonen
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\programdata\Menu Start
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\programdata\Favorieten
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\programdata\Documenten
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-sh--we c:\programdata\Bureaublad
2010-10-25 17:37 . 2010-10-25 17:37 -------- d-----w- C:\Recovery
2010-10-25 17:24 . 2010-10-25 17:24 0 ----a-w- c:\windows\ativpsrm.bin
2010-10-25 17:23 . 2009-01-19 20:30 68608 ----a-r- c:\windows\system32\ViaMicArrayPropPageExt.dll
2010-10-25 17:23 . 2009-07-10 12:48 856064 ----a-r- c:\windows\system32\VIAPropPageExt.dll
2010-10-25 17:23 . 2009-07-06 08:58 491008 ----a-r- c:\windows\system32\VIASysFx.dll
2010-10-25 17:23 . 2009-06-01 09:10 211456 ----a-r- c:\windows\system32\Dts2APO.dll
2010-10-25 17:23 . 2009-03-04 15:42 75776 ----a-r- c:\windows\system32\Dts2PropPageExt.dll
2010-10-25 17:23 . 2009-01-19 20:29 181248 ----a-r- c:\windows\system32\ViaMicArrayAPO.dll
2010-10-25 17:23 . 2007-12-04 10:28 76288 ----a-r- c:\windows\system32\nQPropPageExt.dll
2010-10-25 17:23 . 2007-12-04 10:28 71680 ----a-r- c:\windows\system32\nQAPO.dll

.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-25 17:38 . 2009-07-13 23:40 409088 ----a-w- c:\windows\system32\systemcpl.dll
2010-10-25 17:38 . 2009-07-13 23:36 13824 ----a-w- c:\windows\system32\slwga.dll
2010-10-25 17:38 . 2010-06-18 09:03 811520 ----a-w- c:\windows\system32\user32.dll
.

------- Sigcheck -------

[-] 2010-10-25 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2010-06-18 . C7B21BEF09EC7249556BEE19F9D314CB . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16400_none_cd604238ce73b38f\user32.dll
[7] 2010-06-18 . AE2B4D47934D3798C984D51B1694A490 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.20496_none_cd8e8f8de7d4e9b5\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\users\Ta en jls\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-10-25 136176]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-10-11 14940040]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111v2.exe [2009-10-10 1728512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoDevMgrUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv

R0 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [2008-10-09 15200]
R3 2310_00;2310_00;c:\windows\system32\DRIVERS\2310_00.sys [2009-06-12 135200]
R3 arcm_x86;arcm_x86;c:\windows\system32\DRIVERS\arcm_x86.sys [2009-11-09 43552]
R3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\DNIMp50.sys [2006-11-16 21504]
R3 hptiop;hptiop;c:\windows\system32\DRIVERS\hptiop.sys [2009-04-28 15008]
R3 hptmv;hptmv;c:\windows\system32\DRIVERS\hptmv.sys [2006-09-27 71968]
R3 hptmv6;hptmv6;c:\windows\system32\DRIVERS\hptmv6.sys [2007-11-01 120352]
R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 132480]
R3 ioatdma1;ioatdma1;c:\windows\System32\Drivers\qd16032.sys [2009-11-16 36552]
R3 ioatdma2;Intel(R) QuickData Technology device ver.2;c:\windows\System32\Drivers\qd26032.sys [2009-11-16 37576]
R3 iSSetup;iSSetup;c:\windows\system32\DRIVERS\iSSetup.sys [2007-06-19 75672]
R3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [2008-02-29 942080]
R3 m5287;m5287;c:\windows\system32\DRIVERS\m5287.sys [2006-07-20 104320]
R3 m5288;m5288;c:\windows\system32\DRIVERS\m5288.sys [2006-07-19 211072]
R3 m5289;m5289;c:\windows\system32\DRIVERS\m5289.sys [2005-07-04 52480]
R3 MegaSR1;MegaSR1;c:\windows\system32\DRIVERS\MegaSR1.sys [2008-06-26 397632]
R3 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [2007-05-25 137728]
R3 NBv834x;Killer Xeno Gaming Adapter Service;c:\windows\system32\DRIVERS\Xeno7x86.sys [2009-11-01 104992]
R3 nvamacpi;nvamacpi;c:\windows\system32\DRIVERS\NVAMACPI.sys [2009-07-17 24608]
R3 rr172x;rr172x;c:\windows\system32\DRIVERS\rr172x.sys [2007-11-01 101920]
R3 rr174x;rr174x;c:\windows\system32\DRIVERS\rr174x.sys [2007-11-01 126496]
R3 rr2210;rr2210;c:\windows\system32\DRIVERS\rr2210.sys [2007-11-01 122400]
R3 rr232x;rr232x;c:\windows\system32\DRIVERS\rr232x.sys [2008-05-05 120352]
R3 rr2340;rr2340;c:\windows\system32\DRIVERS\rr2340.sys [2009-12-31 128608]
R3 rr2522;rr2522;c:\windows\system32\DRIVERS\rr2522.sys [2009-12-31 132704]
R3 rr62x;rr62x;c:\windows\system32\DRIVERS\rr62x.sys [2009-12-21 122464]
R3 SI3112r;SI3112r;c:\windows\system32\DRIVERS\SI3112r.sys [2007-02-01 110128]
R3 SI3114;SI3114;c:\windows\system32\DRIVERS\SI3114.sys [2006-11-10 68912]
R3 SI3124;SI3124;c:\windows\system32\DRIVERS\SI3124.sys [2006-11-02 76208]
R3 Si3124r5;Si3124r5;c:\windows\system32\DRIVERS\Si3124r5.sys [2006-09-20 207152]
R3 TTP7;Flash Update for TerraTec PHASE 26 USB;c:\windows\system32\DRIVERS\ttp7up.sys [2005-11-09 12928]
R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-25 1343400]
S0 ioatdma;Intel(R) QuickData Technology Device;c:\windows\System32\Drivers\ioatdma.sys [2009-11-16 36552]
S1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\DRIVERS\jswpslwf.sys [2008-10-01 20384]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-03-03 172032]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-03-03 5340160]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-03-03 152064]
S3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\system32\Drivers\DNISp50.sys [2006-11-16 20480]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-03-04 277536]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-07-10 1067008]
S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\DRIVERS\WN111v2w7.sys [2010-04-27 624128]

.
Inhoud van de 'Gedeelde Taken' map

2010-11-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1230443889-2078982740-3743476485-1000Core.job
- c:\users\Ta en jls\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 18:04]

2010-11-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1230443889-2078982740-3743476485-1000UA.job
- c:\users\Ta en jls\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-25 18:04]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.msn.nl
.
- - - - ORPHANS VERWIJDERD - - - -

HKLM-Run-jswtrayutil - c:\program files\NETGEAR\WN111v2\jswtrayutil.exe


.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Voltooingstijd: 2010-11-02 21:05:35
ComboFix-quarantined-files.txt 2010-11-02 20:05

Pre-Run: 34.475.642.880 bytes beschikbaar
Post-Run: 35.914.940.416 bytes beschikbaar

- - End Of File - - A109C95EDD03D7771A6C87173C45B60F

Gestart vanuit: c:\users\Ta en jls\Downloads\ComboFix.exe

Verplaats combofix naar het bureaublad aub voor de juiste werking!!

Wat is uw actieve antivirus ?