ComboFix 11-11-30.01 - Dennis 30-11-2011 16:25:51.4.4 - x64 MINIMAL Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.4086.3497 [GMT 1:00] Gestart vanuit: c:\users\Dennis\Desktop\ComboFix.exe AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Nieuw herstelpunt werd aangemaakt . . (((((((((((((((((((( Bestanden Gemaakt van 2011-10-28 to 2011-11-30 )))))))))))))))))))))))))))))) . . 2011-11-30 15:31 . 2011-11-30 15:31 -------- d-----w- c:\users\Public\AppData\Local\temp 2011-11-30 15:31 . 2011-11-30 15:31 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-11-30 13:36 . 2011-11-30 13:36 -------- d-----w- c:\users\Dennis\AppData\Local\splash damage 2011-11-30 13:08 . 2011-11-30 13:08 -------- d-----w- c:\program files (x86)\NirSoft 2011-11-27 18:33 . 2011-11-27 18:33 -------- d-----w- c:\programdata\ATI 2011-11-27 18:33 . 2011-11-27 18:33 -------- d-----w- c:\program files (x86)\AMD APP 2011-11-27 18:29 . 2011-10-07 04:16 8570192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C5A238B9-003C-481A-A526-77B8E4C9E9AB}\mpengine.dll 2011-11-23 19:51 . 2011-11-23 19:52 -------- d-----w- c:\program files (x86)\Google 2011-11-23 19:51 . 2011-11-23 19:51 -------- d-----w- c:\users\Dennis\AppData\Local\Google 2011-11-23 16:36 . 2011-11-23 16:36 -------- d-----w- c:\programdata\regid.1986-12.com.adobe 2011-11-23 16:32 . 2011-11-23 16:33 -------- d-----w- c:\program files\Common Files\Adobe 2011-11-23 16:32 . 2011-11-23 16:32 -------- d-----w- c:\program files (x86)\Adobe Media Player 2011-11-23 16:30 . 2011-11-23 16:30 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR 2011-11-21 23:02 . 2011-11-28 10:15 -------- d-----w- c:\users\Dennis\AppData\Local\SKIDROW 2011-11-21 22:55 . 2011-11-28 21:12 -------- d-----w- c:\program files (x86)\Bethesda Softworks 2011-11-21 19:30 . 2011-11-21 19:30 -------- d-----w- c:\program files (x86)\WinAVIVideoConverter 2011-11-21 18:30 . 2011-11-21 18:30 -------- d-----w- c:\users\Dennis\AppData\Roaming\Ashampoo 2011-11-21 18:30 . 2011-11-21 18:30 -------- d-----w- c:\users\Dennis\AppData\Local\ashampoo 2011-11-21 18:30 . 2011-11-21 18:30 -------- d-----w- c:\programdata\ashampoo 2011-11-21 18:30 . 2011-11-21 18:30 -------- d-----w- c:\program files (x86)\Ashampoo 2011-11-20 22:39 . 2011-11-20 22:39 -------- d-----w- c:\users\Dennis\AppData\Local\Skyrim 2011-11-20 22:33 . 2006-11-29 12:06 469264 ----a-w- c:\windows\system32\d3dx10.dll 2011-11-20 22:30 . 2011-11-20 22:36 -------- d-----w- c:\program files (x86)\The Elder Scrolls V Skyrim 2011-11-20 19:02 . 2011-11-21 17:50 270240 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2011-11-20 19:02 . 2011-11-20 19:02 -------- d-----w- c:\users\Dennis\AppData\Local\PunkBuster 2011-11-20 16:54 . 2011-11-21 17:50 270240 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2011-11-20 16:54 . 2011-11-20 21:26 270240 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0 2011-11-20 16:54 . 2011-11-20 16:54 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe 2011-11-20 16:22 . 2011-11-20 16:22 -------- d-----w- c:\program files (x86)\EA Games 2011-11-20 12:16 . 2011-11-20 12:16 -------- dc----w- c:\programdata\{265257EF-2201-4ED0-B2B4-4C59ECF5104D} 2011-11-20 12:15 . 2011-11-20 12:15 -------- d-----w- c:\users\Dennis\AppData\Local\PackageAware 2011-11-19 22:59 . 2011-11-20 00:30 -------- d-----w- c:\program files (x86)\PKR 2011-11-19 20:13 . 2011-11-19 20:13 -------- d-----w- c:\program files\Gpotato 2011-11-16 20:47 . 2011-11-16 20:47 -------- d-----w- c:\windows\PCHEALTH 2011-11-16 20:42 . 2011-11-16 20:48 -------- d-----w- c:\programdata\WindowsLiveInstaller 2011-11-16 20:42 . 2011-11-16 20:53 -------- d-----w- c:\program files (x86)\Windows Live 2011-11-16 20:42 . 2011-11-16 20:42 -------- d-----w- c:\programdata\WLInstaller 2011-11-16 20:03 . 2011-11-16 21:13 -------- d-----w- c:\programdata\RegCure 2011-11-14 20:24 . 2011-11-14 20:24 -------- d-----w- c:\program files\Microsoft LifeCam 2011-11-14 20:24 . 2011-11-14 20:24 -------- d-----w- c:\program files (x86)\Microsoft LifeCam 2011-11-14 20:24 . 2009-09-04 16:29 1974616 ----a-w- c:\windows\SysWow64\D3DCompiler_42.dll 2011-11-14 20:24 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\SysWow64\D3DX9_42.dll 2011-11-13 22:06 . 2011-11-13 22:06 -------- d-----w- c:\program files\Recuva 2011-11-09 11:59 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll 2011-11-09 11:59 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll 2011-11-09 11:59 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys 2011-11-09 11:59 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys 2011-11-07 17:16 . 2011-11-07 17:17 -------- d-----w- c:\users\Dennis\AppData\Roaming\SecondLife 2011-11-07 17:16 . 2011-11-07 20:37 -------- d-----w- c:\users\Dennis\AppData\Local\SecondLife 2011-11-06 12:21 . 2011-11-06 19:52 -------- d-----w- c:\users\Dennis\AppData\Roaming\.minecraft 2011-11-01 13:59 . 2011-11-01 13:59 -------- d-----w- c:\users\Dennis\AppData\Local\FalloutNV . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-11-16 20:51 . 2011-03-28 17:36 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-16 12:28 . 2011-08-13 17:07 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-10-26 03:05 . 2011-10-26 03:05 10496512 ----a-w- c:\windows\system32\drivers\atikmdag.sys 2011-10-26 02:16 . 2011-10-26 02:16 24866816 ----a-w- c:\windows\system32\atio6axx.dll 2011-10-26 02:06 . 2011-10-26 02:06 159744 ----a-w- c:\windows\system32\atiapfxx.exe 2011-10-26 02:05 . 2011-08-29 20:39 748544 ----a-w- c:\windows\SysWow64\aticfx32.dll 2011-10-26 02:04 . 2011-07-08 03:28 892416 ----a-w- c:\windows\system32\aticfx64.dll 2011-10-26 02:01 . 2011-10-26 02:01 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll 2011-10-26 02:01 . 2011-10-26 02:01 517120 ----a-w- c:\windows\system32\atieclxx.exe 2011-10-26 02:00 . 2011-10-26 02:00 204288 ----a-w- c:\windows\system32\atiesrxx.exe 2011-10-26 01:59 . 2011-10-26 01:59 18757120 ----a-w- c:\windows\SysWow64\atioglxx.dll 2011-10-26 01:59 . 2011-10-26 01:59 120320 ----a-w- c:\windows\system32\atitmm64.dll 2011-10-26 01:59 . 2011-10-26 01:59 423424 ----a-w- c:\windows\system32\atipdl64.dll 2011-10-26 01:59 . 2011-10-26 01:59 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll 2011-10-26 01:59 . 2011-10-26 01:59 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll 2011-10-26 01:58 . 2011-10-26 01:58 21504 ----a-w- c:\windows\system32\atimuixx.dll 2011-10-26 01:58 . 2011-10-26 01:58 59392 ----a-w- c:\windows\system32\atiedu64.dll 2011-10-26 01:58 . 2011-10-26 01:58 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll 2011-10-26 01:55 . 2011-08-29 20:54 4292096 ----a-w- c:\windows\SysWow64\atidxx32.dll 2011-10-26 01:46 . 2011-07-08 03:10 5041664 ----a-w- c:\windows\system32\atidxx64.dll 2011-10-26 01:43 . 2011-10-26 01:43 1113088 ----a-w- c:\windows\system32\atiumd6v.dll 2011-10-26 01:43 . 2011-10-26 01:43 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll 2011-10-26 01:43 . 2011-10-26 01:43 4044288 ----a-w- c:\windows\system32\atiumd6a.dll 2011-10-26 01:38 . 2011-10-26 01:38 51200 ----a-w- c:\windows\system32\aticalrt64.dll 2011-10-26 01:38 . 2011-10-26 01:38 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll 2011-10-26 01:38 . 2011-10-26 01:38 44544 ----a-w- c:\windows\system32\aticalcl64.dll 2011-10-26 01:38 . 2011-10-26 01:38 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll 2011-10-26 01:38 . 2011-10-26 01:38 9978880 ----a-w- c:\windows\system32\aticaldd64.dll 2011-10-26 01:35 . 2011-08-29 20:54 4353536 ----a-w- c:\windows\SysWow64\atiumdag.dll 2011-10-26 01:34 . 2011-10-26 01:34 8449024 ----a-w- c:\windows\SysWow64\aticaldd.dll 2011-10-26 01:32 . 2011-08-29 20:54 4189184 ----a-w- c:\windows\SysWow64\atiumdva.dll 2011-10-26 01:29 . 2011-10-26 01:29 5510144 ----a-w- c:\windows\system32\atiumd64.dll 2011-10-26 01:29 . 2011-07-08 02:54 58880 ----a-w- c:\windows\system32\coinst.dll 2011-10-26 01:22 . 2011-10-26 01:22 486912 ----a-w- c:\windows\system32\atiadlxx.dll 2011-10-26 01:22 . 2011-10-26 01:22 339968 ----a-w- c:\windows\SysWow64\atiadlxy.dll 2011-10-26 01:22 . 2011-10-26 01:22 17408 ----a-w- c:\windows\system32\atig6pxx.dll 2011-10-26 01:22 . 2011-10-26 01:22 14336 ----a-w- c:\windows\SysWow64\atiglpxx.dll 2011-10-26 01:22 . 2011-10-26 01:22 14336 ----a-w- c:\windows\system32\atiglpxx.dll 2011-10-26 01:22 . 2011-10-26 01:22 39936 ----a-w- c:\windows\system32\atig6txx.dll 2011-10-26 01:22 . 2011-10-26 01:22 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll 2011-10-26 01:21 . 2011-10-26 01:21 326656 ----a-w- c:\windows\system32\drivers\atikmpag.sys 2011-10-26 01:21 . 2011-07-08 02:46 40960 ----a-w- c:\windows\system32\atiuxp64.dll 2011-10-26 01:21 . 2011-08-29 20:43 31744 ----a-w- c:\windows\SysWow64\atiuxpag.dll 2011-10-26 01:21 . 2011-10-26 01:21 38912 ----a-w- c:\windows\system32\atiu9p64.dll 2011-10-26 01:20 . 2011-07-08 02:45 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll 2011-10-26 01:20 . 2011-10-26 01:20 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll 2011-10-26 01:16 . 2011-10-26 01:16 54784 ----a-w- c:\windows\system32\atimpc64.dll 2011-10-26 01:16 . 2011-10-26 01:16 54784 ----a-w- c:\windows\system32\amdpcom64.dll 2011-10-26 01:15 . 2011-10-26 01:15 53760 ----a-w- c:\windows\SysWow64\atimpc32.dll 2011-10-26 01:15 . 2011-10-26 01:15 53760 ----a-w- c:\windows\SysWow64\amdpcom32.dll 2011-10-25 20:21 . 2011-10-25 20:21 66560 ----a-w- c:\windows\system32\OpenVideo64.dll 2011-10-25 20:21 . 2011-10-25 20:21 56832 ----a-w- c:\windows\SysWow64\OpenVideo.dll 2011-10-25 20:21 . 2011-10-25 20:21 66560 ----a-w- c:\windows\system32\OVDecoder64.dll 2011-10-25 20:21 . 2011-10-25 20:21 56832 ----a-w- c:\windows\SysWow64\OVDecoder.dll 2011-10-25 20:21 . 2011-10-25 20:21 16991744 ----a-w- c:\windows\system32\amdocl64.dll 2011-10-25 20:20 . 2011-10-25 20:20 13950464 ----a-w- c:\windows\SysWow64\amdocl.dll 2011-10-23 20:47 . 2011-10-23 20:47 1060864 ----a-w- c:\windows\SysWow64\mfc71.dll 2011-10-03 16:03 . 2011-10-03 16:03 526392 ----a-w- c:\windows\system32\drivers\sptd.sys 2011-10-01 03:25 . 2011-10-12 12:26 1638912 ----a-w- c:\windows\system32\mshtml.tlb 2011-10-01 02:42 . 2011-10-12 12:26 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb 2011-09-14 09:47 . 2011-09-14 09:47 60416 ----a-w- c:\windows\system32\OVDecode64.dll 2011-09-14 09:47 . 2011-09-14 09:47 53760 ----a-w- c:\windows\SysWow64\OVDecode.dll 2011-09-14 09:38 . 2011-09-14 09:38 44032 ----a-w- c:\windows\system32\amdoclcl64.dll 2011-09-14 09:38 . 2011-09-14 09:38 37376 ----a-w- c:\windows\SysWow64\amdoclcl.dll 2011-09-06 20:45 . 2011-09-04 20:06 41184 ----a-w- c:\windows\avastSS.scr 2011-09-06 20:45 . 2011-09-04 20:06 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe 2011-09-06 20:45 . 2011-09-04 20:06 254400 ----a-w- c:\windows\system32\aswBoot.exe 2011-09-06 20:38 . 2011-09-04 20:06 601944 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2011-09-06 20:38 . 2011-09-04 20:06 301912 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-09-06 20:36 . 2011-09-04 20:06 42328 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-09-06 20:36 . 2011-09-04 20:06 58200 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-09-06 20:36 . 2011-09-04 20:06 65368 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2011-09-06 20:36 . 2011-09-04 20:06 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-09-05 17:33 . 2011-09-05 17:33 466456 ----a-w- c:\windows\system32\wrap_oal.dll 2011-09-05 17:33 . 2011-09-05 17:33 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll 2011-09-05 17:33 . 2011-09-05 17:33 122904 ----a-w- c:\windows\system32\OpenAL32.dll 2011-09-05 17:33 . 2011-09-05 17:33 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll . . ((((((((((((((((((((((((((((( SnapShot_2011-11-30_13.28.40 ))))))))))))))))))))))))))))))))))))))))) . + 2011-11-30 15:31 . 2011-11-30 15:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-11-30 13:28 . 2011-11-30 13:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-07-14 09:16 . 2011-11-30 13:03 701326 c:\windows\system32\perfh013.dat + 2009-07-14 09:16 . 2011-11-30 15:27 701326 c:\windows\system32\perfh013.dat - 2009-07-14 02:36 . 2011-11-30 13:03 615810 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2011-11-30 15:27 615810 c:\windows\system32\perfh009.dat + 2009-07-14 09:16 . 2011-11-30 15:27 133358 c:\windows\system32\perfc013.dat - 2009-07-14 09:16 . 2011-11-30 13:03 133358 c:\windows\system32\perfc013.dat + 2009-07-14 02:36 . 2011-11-30 15:27 106190 c:\windows\system32\perfc009.dat - 2009-07-14 02:36 . 2011-11-30 13:03 106190 c:\windows\system32\perfc009.dat . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304] "ccleaner"="c:\program files\CCleaner\CCleaner64.exe" [2011-10-21 4499264] "Facebook Update"="c:\users\Dennis\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-10-19 137536] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-25 343168] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bitmeter2.lnk - c:\program files (x86)\Codebox\BitMeter\BitMeter2.exe [2011-4-17 1462272] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer2"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x] R1 aswSnx;aswSnx; [x] R1 aswSP;aswSP; [x] R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] R2 aswFsBlk;aswFsBlk; [x] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update-service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-23 136176] R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] R3 dump_wmimmc;dump_wmimmc;c:\program files\Gpotato\Flyff\GameGuard\dump_wmimmc.sys [x] R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-23 136176] R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [x] R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [x] S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x] . . Inhoud van de 'Gedeelde Taken' map . 2011-11-28 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1262260926-975316484-2412950947-1000Core.job - c:\users\Dennis\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-19 19:14] . 2011-11-28 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1262260926-975316484-2412950947-1000UA.job - c:\users\Dennis\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-19 19:14] . 2011-11-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-23 19:51] . 2011-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-23 19:51] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-09-06 20:45 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-04-27 7743008] "Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-04-27 1833504] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] . ------- Bijkomende Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.be/ mLocal Page = c:\windows\SYSTEM32\blank.htm IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\wqocecwz.default\ . - - - - ORPHANS VERWIJDERD - - - - . WebBrowser-{F999A48B-1950-4D81-9971-79018F807B4B} - (no file) . . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*] "Licence0"="REMOVED" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Voltooingstijd: 2011-11-30 16:35:04 - machine werd herstart ComboFix-quarantined-files.txt 2011-11-30 15:35 ComboFix2.txt 2011-11-30 13:31 . Pre-Run: 873.360.797.696 bytes beschikbaar Post-Run: 873.268.187.136 bytes beschikbaar . - - End Of File - - 21715C49A4ADA91519971E093F2C28C3