ComboFix 12-05-08.01 - riekie 08-05-2012 13:56:16.5.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.1023.321 [GMT 2:00] Gestart vanuit: c:\users\riekie\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((( Bestanden Gemaakt van 2012-04-08 to 2012-05-08 )))))))))))))))))))))))))))))) . . 2012-05-08 12:09 . 2012-05-08 12:09 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-05-08 10:09 . 2012-04-13 07:36 6734704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6C4ADFC1-5647-471B-B6F7-428F6C1B0152}\mpengine.dll 2012-05-07 13:05 . 2012-04-24 15:13 51144 ----a-w- c:\windows\system32\drivers\Soluto.sys 2012-05-07 13:05 . 2012-05-07 13:05 -------- d-----w- c:\program files\Soluto 2012-05-07 13:00 . 2012-05-07 13:22 -------- d-----w- c:\programdata\Soluto 2012-05-07 08:08 . 2012-05-07 08:08 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2012-05-06 10:35 . 2012-05-06 10:35 887888 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2012-05-05 09:17 . 2012-05-05 09:18 -------- d-----r- c:\users\Public\recorded tv 2012-04-11 15:43 . 2012-02-29 15:11 5120 ----a-w- c:\windows\system32\wmi.dll 2012-04-11 15:43 . 2012-02-29 15:11 172032 ----a-w- c:\windows\system32\wintrust.dll 2012-04-11 15:43 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll 2012-04-11 15:43 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys 2012-04-11 15:43 . 2012-03-06 06:39 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-04-11 15:43 . 2012-03-06 06:39 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-11 06:55 . 2012-03-01 11:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-04 13:56 . 2010-11-11 20:17 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-03-06 23:15 . 2011-07-08 17:28 41184 ----a-w- c:\windows\avastSS.scr 2012-03-06 23:15 . 2011-07-08 17:28 201352 ----a-w- c:\windows\system32\aswBoot.exe 2012-03-06 23:03 . 2011-07-08 17:29 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2012-03-06 23:03 . 2011-07-08 17:29 337880 ----a-w- c:\windows\system32\drivers\aswSP.sys 2012-03-06 23:02 . 2011-07-08 17:29 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2012-03-06 23:01 . 2011-07-08 17:29 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2012-03-06 23:01 . 2011-07-08 17:29 57688 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2012-03-06 23:01 . 2011-07-08 17:29 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2012-02-23 08:18 . 2009-10-03 13:40 237072 ------w- c:\windows\system32\MpSigStub.exe 2012-02-14 15:45 . 2012-03-19 10:46 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2012-02-14 15:45 . 2012-03-19 10:46 160768 ----a-w- c:\windows\system32\d3d10_1.dll 2012-02-13 14:12 . 2012-03-19 10:46 1172480 ----a-w- c:\windows\system32\d3d10warp.dll 2012-02-13 13:47 . 2012-03-19 10:46 683008 ----a-w- c:\windows\system32\d2d1.dll 2012-02-13 13:44 . 2012-03-19 10:46 1068544 ----a-w- c:\windows\system32\DWrite.dll 2010-04-15 01:20 . 2011-05-04 16:38 61440 ----a-w- c:\program files\uinstrsc.dll 2010-04-15 01:20 . 2011-05-04 16:38 132456 ----a-w- c:\program files\uninst.exe 2010-04-15 01:20 . 2011-05-04 16:36 184320 ----a-w- c:\program files\NPEZFFPI.DLL 2010-04-15 01:20 . 2011-05-04 16:36 308552 ----a-w- c:\program files\CNEZIEPI.DLL 2010-04-15 01:20 . 2011-05-04 16:36 278528 ----a-w- c:\program files\CNEZCOPI.DLL 2010-04-15 01:20 . 2011-05-04 16:36 237568 ----a-w- c:\program files\CNIJLPE.DLL 2010-04-15 01:20 . 2011-05-04 16:36 204800 ----a-w- c:\program files\CNPS2LIB.DLL 2010-04-15 01:20 . 2011-05-04 16:36 65536 ----a-w- c:\program files\CNEZHTTP.DLL 2010-04-15 01:20 . 2011-05-04 16:36 643072 ----a-w- c:\program files\CNPS2.DLL 2010-04-15 01:20 . 2011-05-04 16:36 196608 ----a-w- c:\program files\NSRLIB.DLL 2010-04-15 01:20 . 2011-05-04 16:36 184320 ----a-w- c:\program files\MDPWRAP.DLL 2010-04-15 01:20 . 2011-05-04 16:36 69632 ----a-w- c:\program files\CNMLC.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1110016 ----a-w- c:\program files\MCAP.DLL 2010-04-15 01:20 . 2011-05-04 16:36 102400 ----a-w- c:\program files\CNMPU.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1355776 ----a-w- c:\program files\IB.DLL 2010-04-15 01:20 . 2011-05-04 16:36 90112 ----a-w- c:\program files\BJEZDCNR.DLL 2010-04-15 01:20 . 2011-05-04 16:36 225280 ----a-w- c:\program files\CNEZPZ.DLL 2010-04-15 01:20 . 2011-05-04 16:36 180224 ----a-w- c:\program files\CNEZPINF.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1101824 ----a-w- c:\program files\IMAGEFIX.DLL 2010-04-15 01:20 . 2011-05-04 16:36 544768 ----a-w- c:\program files\CNEZIMG.DLL 2010-04-15 01:20 . 2011-05-04 16:36 380928 ----a-w- c:\program files\CNEZCD.DLL 2010-04-15 01:20 . 2011-05-04 16:36 69632 ----a-w- c:\program files\CNEZFLDR.DLL 2010-04-15 01:20 . 2011-05-04 16:36 643072 ----a-w- c:\program files\CNEZPRN.DLL 2010-04-15 01:20 . 2011-05-04 16:36 245760 ----a-w- c:\program files\CNEZCTRL.DLL 2010-04-15 01:20 . 2011-05-04 16:36 20480 ----a-w- c:\program files\CNEZDBAC.DLL 2010-04-15 01:20 . 2011-05-04 16:36 159744 ----a-w- c:\program files\CNEZHLD.DLL 2010-04-15 01:20 . 2011-05-04 16:36 122880 ----a-w- c:\program files\CNEZEPP.DLL 2010-04-15 01:20 . 2011-05-04 16:36 11776 ----a-w- c:\program files\CNEZSMEX.DLL 2010-04-15 01:20 . 2011-05-04 16:36 241664 ----a-w- c:\program files\CNEZPAGE.DLL 2010-04-15 01:20 . 2011-05-04 16:36 167936 ----a-w- c:\program files\CNEZPRNT.DLL 2010-04-15 01:20 . 2011-05-04 16:36 577536 ----a-w- c:\program files\CNEZDRAW.DLL 2010-04-15 01:20 . 2011-05-04 16:36 815104 ----a-w- c:\program files\CNEZDM.DLL 2010-04-15 01:20 . 2011-05-04 16:36 4232536 ----a-w- c:\program files\CNEZMAIN.EXE 2010-04-15 01:20 . 2011-05-04 16:36 67160 ----a-w- c:\program files\CNELMAIN.EXE 2010-04-15 01:20 . 2011-05-04 16:36 15360 ----a-w- c:\program files\CNPS2LG.DLL 2010-04-15 01:20 . 2011-05-04 16:36 45056 ----a-w- c:\program files\MCAPLNG.DLL 2010-04-15 01:20 . 2011-05-04 16:36 40960 ----a-w- c:\program files\IMGLNG.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1970176 ----a-w- c:\program files\CNEZUIRC.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1572864 ----a-w- c:\program files\CNEZRSC.DLL 2010-04-15 01:20 . 2011-05-04 16:36 14848 ----a-w- c:\program files\CNEZDMRC.DLL 2009-07-11 23:56 . 2011-05-04 16:36 69632 ----a-w- c:\program files\mfcm80.dll 2009-07-11 23:55 . 2011-05-04 16:36 632656 ----a-w- c:\program files\msvcr80.dll 2009-07-11 23:55 . 2011-05-04 16:36 554832 ----a-w- c:\program files\msvcp80.dll 2009-07-11 23:55 . 2011-05-04 16:36 479232 ----a-w- c:\program files\msvcm80.dll 2009-07-11 23:55 . 2011-05-04 16:36 57856 ----a-w- c:\program files\mfcm80u.dll 2009-07-11 18:54 . 2011-05-04 16:36 65536 ----a-w- c:\program files\vcomp.dll 2009-07-11 18:46 . 2011-05-04 16:36 65536 ----a-w- c:\program files\mfc80DEU.dll 2009-07-11 18:46 . 2011-05-04 16:36 61440 ----a-w- c:\program files\mfc80ITA.dll 2009-07-11 18:46 . 2011-05-04 16:36 61440 ----a-w- c:\program files\mfc80FRA.dll 2009-07-11 18:46 . 2011-05-04 16:36 61440 ----a-w- c:\program files\mfc80ESP.dll 2009-07-11 18:46 . 2011-05-04 16:36 57344 ----a-w- c:\program files\mfc80ENU.dll 2009-07-11 18:46 . 2011-05-04 16:36 49152 ----a-w- c:\program files\mfc80KOR.dll 2009-07-11 18:46 . 2011-05-04 16:36 49152 ----a-w- c:\program files\mfc80JPN.dll 2009-07-11 18:46 . 2011-05-04 16:36 45056 ----a-w- c:\program files\mfc80CHT.dll 2009-07-11 18:46 . 2011-05-04 16:36 40960 ----a-w- c:\program files\mfc80CHS.dll 2009-07-11 18:46 . 2011-05-04 16:36 1105920 ----a-w- c:\program files\mfc80.dll 2009-07-11 18:46 . 2011-05-04 16:36 1093120 ----a-w- c:\program files\mfc80u.dll 2009-07-11 17:10 . 2011-05-04 16:36 97280 ----a-w- c:\program files\atl80.dll 2008-11-05 10:00 . 2011-05-04 16:36 20832 ----a-w- c:\program files\Lttmb15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 128352 ----a-w- c:\program files\Lfpng15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 501088 ----a-w- c:\program files\Ltkrn15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 447840 ----a-w- c:\program files\Ltimgsfx15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 40800 ----a-w- c:\program files\Ltimgopt15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 206176 ----a-w- c:\program files\Ltimgefx15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 144736 ----a-w- c:\program files\Ltimgutl15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 357728 ----a-w- c:\program files\Ltimgcor15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 267616 ----a-w- c:\program files\Ltdis15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 259424 ----a-w- c:\program files\Ltefx15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 218464 ----a-w- c:\program files\Ltimgclr15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 189792 ----a-w- c:\program files\Ltfil15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 66912 ----a-w- c:\program files\Lfpct15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 398688 ----a-w- c:\program files\Lfcmp15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 34656 ----a-w- c:\program files\Lfgif15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 30560 ----a-w- c:\program files\Lfbmp15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 1717600 ----a-w- c:\program files\Ltclr15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 161120 ----a-w- c:\program files\Lftif15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 107872 ----a-w- c:\program files\Lffax15u.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-03-06 23:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-03-06 574296] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-08 68856] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] "Anti-phishing Domain Advisor"="c:\programdata\Anti-phishing Domain Advisor\visicom_antiphishing.exe" [2011-12-21 206504] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk /p \??\k:\0autocheck autochk *\0bootdelete . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^$McRebootA5E6DEAA56$.lnk] backup=c:\windows\pss\$McRebootA5E6DEAA56$.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-01-02 09:07 843712 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2012-03-27 12:41 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter] 2007-04-03 16:50 1603152 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu] 2007-04-03 16:00 644696 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeApp] 2011-01-02 11:30 814496 ----a-w- c:\program files\FreeApps\FreeApps.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box] 2011-03-01 16:33 126976 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2008-06-18 19:01 166424 ----a-w- c:\windows\System32\hkcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler] 2007-05-24 11:13 71176 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2011-05-10 00:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv] 2007-04-18 15:01 65536 ----a-w- c:\hp\support\hpsysdrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2008-06-18 19:01 141848 ----a-w- c:\windows\System32\igfxtray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD] 2006-12-08 14:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPN] 2008-06-06 15:08 198184 ----a-w- c:\program files\KPN\bin\sprtcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPNAssistentUpdater] 2010-12-22 14:49 1964928 ----a-w- c:\program files\KPN\KPN Update\KPNAssistentUpdater.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2012-04-04 13:56 462408 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4] 2007-02-04 11:02 79400 ----a-w- c:\program files\ScanSoft\OmniPageSE4\OpWareSE4.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro] 2007-02-15 11:59 118784 ----a-w- c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] 2008-06-18 19:01 133656 ----a-w- c:\windows\System32\igfxpers.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] 2006-10-25 08:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg] 2008-02-22 02:25 54672 ----a-w- c:\windows\System32\jureg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-10-29 13:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2008-01-08 15:58 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] 2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center] 2007-05-31 07:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1753990348-677674000-2389129793-1000] "EnableNotificationsRef"=dword:00000001 . S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [2012-03-14 913752] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] ipripsvc REG_MULTI_SZ iprip LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr . Inhoud van de 'Gedeelde Taken' map . 2012-05-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-26 16:06] . 2012-05-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-26 16:06] . 2012-05-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1753990348-677674000-2389129793-1000Core.job - c:\users\riekie\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-08 14:32] . 2012-05-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1753990348-677674000-2389129793-1000UA.job - c:\users\riekie\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-08 14:32] . . ------- Bijkomende Scan ------- . mStart Page = hxxp://www.msn.com uSearchAssistant = hxxp://www.google.com/ie IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: DhcpNameServer = 212.54.40.25 212.54.35.25 . - - - - ORPHANS VERWIJDERD - - - - . Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file) AddRemove-blekkotb - c:\program files\blekkotb\uninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-05-08 14:09 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . Scan succesvol afgerond verborgen bestanden: 0 . ************************************************************************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}"=hex:51,66,7a,6c,4c,1d,38,12,3a,25,4d, 8a,1f,e3,d1,0d,d3,3b,92,3f,05,d7,c9,12 "{30F9B915-B755-4826-820B-08FBA6BD249D}"=hex:51,66,7a,6c,4c,1d,38,12,7b,ba,ea, 34,67,f9,48,0d,fd,1d,4b,bb,a3,e3,60,89 "{EEE6C35B-6118-11DC-9C72-001320C79847}"=hex:51,66,7a,6c,4c,1d,38,12,35,c0,f5, ea,2a,2f,b2,54,e3,64,43,53,25,99,dc,53 "{26C9E18C-3717-4BE1-A225-04E4471F5B6E}"=hex:51,66,7a,6c,4c,1d,38,12,e2,e2,da, 22,25,79,8f,0e,dd,33,47,a4,42,41,1f,7a "{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b, 27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7 "{20A0BE68-8FD9-4539-8712-CE3D1C1FDFC6}"=hex:51,66,7a,6c,4c,1d,38,12,06,bd,b3, 24,eb,c1,57,00,f8,04,8d,7d,19,41,9b,d2 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce, 9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d "{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b, ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3 "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{EEE6C35C-6118-11DC-9C72-001320C79847}"=hex:51,66,7a,6c,4c,1d,38,12,32,c0,f5, ea,2a,2f,b2,54,e3,64,43,53,25,99,dc,53 . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:f2,a1,b5,d4,ac,06,cd,01 . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . Voltooingstijd: 2012-05-08 14:15:07 ComboFix-quarantined-files.txt 2012-05-08 12:15 . Pre-Run: 96.833.630.208 bytes beschikbaar Post-Run: 96.779.935.744 bytes beschikbaar . - - End Of File - - 1A8EB0F97D0E27417AA7D101B8C9ACCD