Mededeling

**Juisterr** · 05-11-14, 18:08

Schakel eerst de Antivirussoftware uit voordat je zoek.exe download of uitvoert.
Schakel je antivirus- en antispywareprogramma's tijdelijk uit, deze kunnen namelijk de werking van Zoek.exe nadelig beïnvloeden.
(hier en hier) kan je lezen hoe je dat doet.

Download Zoek.exe naar het bureaublad (klik hier voor meer informatie over hoe zoek.exe te gebruiken)

Wanneer Internet Explorer of een andere browser of virusscanner melding geeft dat dit bestand onveilig zou zijn kan je dat negeren, het is namelijk een onterechte waarschuwing.

Dubbelklik vervolgens op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze Computer, gebruik dit dan ook niet op andere computers met een gelijkwaardig probleem.
Code:
```
emptyclsid;
emptyfolderscheck;
firefoxlook; 
Chromelook; 
CHRdefaults;
autoclean; 
iedefaults; 
filesrcm;  
startupall;
```
Klik nu op de knop "Run script".
Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
Mocht er geen logje verschijnen, start zoek.exe dan opnieuw en klik op de knop zoek-results.log, de log verschijnt dan alsnog.
Post het geopende logje in het volgende bericht als bijlage.

**hendricus** · 06-11-14, 00:52

hier het zoek log

Zoek.exe v5.0.0.0 Updated 05-November-2014
Tool run by Gebruiker on do 06-11-2014 at 0:55:18,80.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: D:\documenten\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

6-11-2014 0:57:25 Zoek.exe System Restore Point Created Succesfully.

==== Empty Folders Check ======================

C:\Program Files\CyberLink
C:\Program Files\Futuremark
C:\Program Files\Java
C:\PROGRA~2\CanonEPP
C:\PROGRA~2\CanonIJEPPEX2
C:\Users\Gebruiker\AppData\Roaming\Malwarebytes
C:\Users\Gebruiker\AppData\Roaming\Media Player Classic
C:\Users\Gebruiker\AppData\Local\Screentime
C:\Users\Gebruiker\AppData\Local\Secunia PSI
C:\Users\Gebruiker\AppData\Local\Torrents Downloader
C:\Users\Gebruiker\AppData\Local\uTorrent

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1278309641-2164528218-3882550065-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DEF6F6BA-47AD-4862-A307-A5A140EF1F5B} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Deleting Files \ Folders ======================

C:\Users\Gebruiker\AppData\Roaming\WB.CFG deleted
C:\Users\Gebruiker\AppData\Roaming\sparta111 deleted
C:\PROGRA~2\ProductData deleted
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Application Updater deleted
C:\Windows\system32\tasks\0814avUpdateInfo deleted
C:\Windows\system32\config\systemprofile\Searches deleted
C:\Windows\System32\AI_RecycleBin deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====
====== C:\Users\GEBRUI~1\AppData\Local\Temp ====
2014-11-05 12:44:20 C17103AE9072A06DA581DEC998343FC1 11264 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\nsc282A.tmp\System.dll
2014-11-05 12:44:20 7579ADE7AE1747A31960A228CE02E666 4096 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\nsc282A.tmp\UserInfo.dll
====== Java Cache =====
====== C:\Windows\system32 =====
2014-11-05 12:48:25 0DC5AF80D059DEC792B665ED598C6567 536576 ----a-w- C:\Windows\System32\sqlite3.dll
====== C:\Windows\system32\drivers =====
2014-10-26 00:29:32 8E2E9CCD873ABF180F48BCAEEEBE347D 114904 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-10-26 00:28:16 E89B115E1DD297DCB694B22CFA90BF61 75480 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2014-10-26 00:28:16 D2DED3C333A5D9CB3F4C244B0F0DD877 23256 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-10-26 00:28:16 7A6526C8BD114DB7CA8930AB22D52A0B 51928 ----a-w- C:\Windows\System32\drivers\mwac.sys
2014-10-17 01:49:10 344D1FA0438A967F1A2BAA42C86D6E19 593920 ----a-w- C:\Windows\System32\drivers\PEAuth.sys
2014-10-17 01:49:04 E499E422412EF37576092A52648DB2B4 50176 ----a-w- C:\Windows\System32\drivers\appid.sys
2014-10-16 22:58:36 CD9214A6AE17D188D17C3CF8CB9CC693 184320 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2014-10-16 22:58:36 6C5139E4283249518F7743D7043775B3 31232 ----a-w- C:\Windows\System32\drivers\tssecsrv.sys
2014-10-10 13:13:58 5A22A7A67BFB67D3223B7A339FC97780 200984 ----a-w- C:\Windows\System32\drivers\avgtdix.sys
2014-10-07 19:39:28 0530FFFE9162A3637A0404ECCCB7E739 213272 ----a-w- C:\Windows\System32\drivers\avgidsdriverx.sys
====== C:\Windows\Tasks ======
====== C:\Windows\Temp ======
======= C:\Program Files =====
2014-10-31 15:54:40 -------- d-----w- C:\Program Files\SpywareBlaster
======= C: =====
====== C:\Users\Gebruiker\AppData\Roaming ======
2014-10-28 12:52:01 -------- d-----w- C:\Users\Gebruiker\AppData\Local\Ebtion
2014-10-28 12:45:25 -------- d-----w- C:\Users\Gebruiker\AppData\Local\Ummedia
2014-10-26 00:26:16 -------- d-----w- C:\Users\Gebruiker\AppData\Roaming\AVG2015
2014-10-26 00:26:06 -------- d-----w- C:\Windows\system32\config\systemprofile\AppData\Roaming\AVG2015
2014-10-26 00:24:19 -------- d-----w- C:\Windows\system32\config\systemprofile\AppData\Local\Avg2015
2014-10-26 00:19:56 -------- d-----w- C:\Users\Gebruiker\AppData\Local\Avg2015
2014-10-19 01:03:13 -------- d-----w- C:\Windows\system32\config\systemprofile\AppData\Local\Avg
====== C:\Users\Gebruiker ======
2014-11-05 10:46:23 F7C5B5C74D69EEA3549E3C6A8FD859B0 20 ----a-w- C:\Users\Gebruiker\defogger_reenable
2014-10-31 15:54:45 -------- d-----w- C:\ProgramData\Licenses
2014-10-31 15:54:41 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2014-10-31 11:41:22 -------- d-----w- C:\Users\Gebruiker\Start Menu
2014-10-26 00:25:39 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-10-26 00:24:53 -------- d-----w- C:\ProgramData\AVG2015

====== C: exe-files ==
2014-10-31 15:54:40 BE2EE9C219B016AEC95F604FBFFEE171 2115192 ----a-w- C:\Program Files\SpywareBlaster\sbautoupdate.exe
2014-10-31 15:54:40 AE13FB6BD8086465217F6A063EC3FCC3 715038 ----a-w- C:\Program Files\SpywareBlaster\unins000.exe
2014-10-31 15:54:40 1BE8001D5C4EEE56A97980CD6987EB40 2557544 ----a-w- C:\Program Files\SpywareBlaster\spywareblaster.exe
2014-10-31 15:54:40 0EED9CD892F88435BFD1AE41EF6ED60D 119976 ----a-w- C:\Program Files\SpywareBlaster\sburlhelper.exe
2014-10-31 00:52:45 697D1E5E6452171F0B9FE3849889BC90 1385808 ----a-w- C:\Users\Gebruiker\AppData\Roaming\uTorrent\updates\3.4.2_34944.exe
=== C: other files ==

==== Startup Registry Enabled ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI"="C:\Program Files\AVG\AVG2015\avgui.exe /TRAYONLY"

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TomTomHOME.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TomTomHOME.exe"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\TomTom HOME 2\\TomTomHOMERunner.exe\""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]
"ConnectionCenter"="\"C:\\Program Files\\Citrix\\ICA Client\\concentr.exe\" /startup"

==== Startup Folders ======================

2013-09-05 21:05:55 824 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [08-03-2013 02:16]
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [08-03-2013 02:16]

==== Other Scheduled Tasks ======================

"C:\Windows\system32\tasks\Ad-Aware Antivirus Scheduled Scan" [C:\PROGRA~1\AD-AWA~1\AdAwareLauncher.exe]
"C:\Windows\system32\tasks\Ad-Aware Update (Weekly)" [C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe]
"C:\Windows\system32\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"]
"C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe]
"C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe]
"C:\Windows\system32\tasks\Real Player-online actualiseringsprogramma" [c:\program files\real\realplayer\Update\realsched.exe]
"C:\Windows\system32\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1278309641-2164528218-3882550065-1000" [C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe]
"C:\Windows\system32\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1278309641-2164528218-3882550065-1000" [C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe]
"C:\Windows\system32\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1278309641-2164528218-3882550065-1000" [C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe]
"C:\Windows\system32\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1278309641-2164528218-3882550065-1000" [C:\Program Files\Real\RealUpgrade\RealUpgrade.exe]
"C:\Windows\system32\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1278309641-2164528218-3882550065-1000" [C:\Program Files\Real\RealUpgrade\RealUpgrade.exe]
"C:\Windows\system32\tasks\RealUpgradeLogonTaskS-1-5-21-1278309641-2164528218-3882550065-1000" [C:\Program Files\Real\RealUpgrade\RealUpgrade.exe]
"C:\Windows\system32\tasks\RealUpgradeScheduledTaskS-1-5-21-1278309641-2164528218-3882550065-1000" [C:\Program Files\Real\RealUpgrade\RealUpgrade.exe]
"C:\Windows\system32\tasks\SidebarExecute" [C:\Program Files\Windows Sidebar\sidebar.exe]
"C:\Windows\system32\tasks\{13BBD8F6-0EA0-4B56-A58D-BCD6F1F04801}" [C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.0.4555.0\AdAwareDesktop.exe]
"C:\Windows\system32\tasks\{22F3B14C-937B-490C-8893-ED761AFA8AC1}" [C:\Program Files\AppieSoft\AsKlaver\AsKlaver.EXE]
"C:\Windows\system32\tasks\{3042EC54-3CF7-4E19-B6AE-233C9F5C5CBD}" [C:\Program Files\MRU-Blaster\mrublaster.exe]
"C:\Windows\system32\tasks\{9D38323C-9EF3-4FDA-A250-846FFB5FBA60}" [C:\Program Files\MRU-Blaster\mrublaster.exe]
"C:\Windows\system32\tasks\NCH Swift Sound\switchShakeIcon" [C:\Program Files\NCH Swift Sound\Switch\Switch.exe]
"C:\Windows\system32\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc]

==== Firefox Extensions ======================

ProfilePath: C:\Users\GEBRUI~1\AppData\Roaming\TomTom\HOME\Profiles\ccsnpc22.default
- Map status indicator - C:\Program Files\TomTom HOME 2\xul\extensions\[email protected]
- TomTom HOME default theme - C:\Program Files\TomTom HOME 2\xul\extensions\[email protected]
- Emulator - %ProfilePath%\extensions\[email protected]
- Emulator - %ProfilePath%\extensions\[email protected]

==== Firefox Plugins ======================

==== Chromium Look ======================

HTTPS Everywhere - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp
Google Wallet - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startInde x={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Policies\Google deleted successfully

==== Empty IE Cache ======================

C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=8 folders=12 19205 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Gebruiker\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\GEBRUI~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on do 06-11-2014 at 1:36:53,70 ======================

Dit is volgens mij niet als bijlage, maar waar vind ik die knop?

**Juisterr** · 06-11-14, 18:53

Dan moet je op de antwoord knop drukken geavanceerd, dan krijg je opties.

Vertel even hoe het nu gaat.

**hendricus** · 06-11-14, 23:28

AVG 2015 vond Unknown c\program data\microsoft\secure\icons\temp\tmp 62A2.exe

Ben MBAM aan het draaien maar dat duurt nogal lang

**hendricus** · 07-11-14, 01:20

MBAM is schoon ( 1 uur en 48 minuten voor de aangepaste scan).
Ik sluit de sessie af en draai morgen na het opstarten (lees: straks) nogmaals MBAM...het gaat de goeie kant op

**Juisterr** · 07-11-14, 10:47

prima.

**hendricus** · 07-11-14, 14:46

Na het opstarten vanmiddag MBAM opnieuw gedraaid (aangepaste scan), nog altijd schoon.
In elk geval dank je Juisterr.

**Juisterr** · 08-11-14, 10:33

Graag gedaan.

Mededeling

trojan.simda

trojan.simda

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment