ComboFix 12-06-23.06 - riekie 24-06-2012 14:38:39.5.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.1023.162 [GMT 2:00] Gestart vanuit: c:\users\riekie\Downloads\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\DealPly c:\program files\DealPly\DealPly.crx . . (((((((((((((((((((( Bestanden Gemaakt van 2012-05-24 to 2012-06-24 )))))))))))))))))))))))))))))) . . 2012-06-24 12:50 . 2012-06-24 12:50 -------- d-----w- c:\users\riekie\AppData\Local\temp 2012-06-24 12:50 . 2012-06-24 12:50 -------- d-----w- c:\users\Public\AppData\Local\temp 2012-06-24 12:50 . 2012-06-24 12:50 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-06-23 14:01 . 2012-03-06 23:04 112984 ----a-w- c:\windows\system32\drivers\aswFW.sys 2012-06-23 13:55 . 2012-03-06 23:03 196440 ----a-w- c:\windows\system32\drivers\aswNdis2.sys 2012-06-23 13:55 . 2012-03-06 22:44 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys 2012-06-23 12:01 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E97B5BB7-D76B-4FA4-B761-C871A41022B6}\mpengine.dll 2012-06-21 17:52 . 2012-03-06 23:02 24408 ----a-w- c:\windows\system32\drivers\aswKbd.sys 2012-06-21 17:33 . 2012-06-21 17:33 -------- d-----w- c:\programdata\RoboForm 2012-06-21 16:10 . 2012-05-17 22:24 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2012-06-21 16:10 . 2012-05-17 23:21 140920 ----a-w- c:\program files\Internet Explorer\sqmapi.dll 2012-06-21 16:10 . 2012-05-17 22:31 194560 ----a-w- c:\program files\Internet Explorer\ieproxy.dll 2012-06-21 16:10 . 2012-05-17 22:31 194048 ----a-w- c:\program files\Internet Explorer\IEShims.dll 2012-06-21 16:10 . 2012-05-17 22:29 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2012-06-21 16:10 . 2012-05-17 22:35 1129472 ----a-w- c:\windows\system32\wininet.dll 2012-06-21 16:10 . 2012-05-17 23:21 748664 ----a-w- c:\program files\Internet Explorer\iexplore.exe 2012-06-21 16:09 . 2012-05-17 22:45 1800192 ----a-w- c:\windows\system32\jscript9.dll 2012-06-21 16:09 . 2012-05-17 22:38 678912 ----a-w- c:\program files\Internet Explorer\iedvtool.dll 2012-06-21 16:09 . 2012-05-17 22:37 387584 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll 2012-06-21 16:09 . 2012-05-17 22:35 1427968 ----a-w- c:\windows\system32\inetcpl.cpl 2012-06-21 15:43 . 2012-04-23 16:00 984064 ----a-w- c:\windows\system32\crypt32.dll 2012-06-21 15:43 . 2012-04-23 16:00 133120 ----a-w- c:\windows\system32\cryptsvc.dll 2012-06-21 15:43 . 2012-04-23 16:00 98304 ----a-w- c:\windows\system32\cryptnet.dll 2012-06-21 15:42 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-21 15:42 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys 2012-06-21 11:23 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll 2012-06-21 11:23 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-21 11:23 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll 2012-06-21 11:23 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-21 11:22 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll 2012-06-21 11:22 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll 2012-06-21 11:22 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll 2012-06-21 11:21 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-21 11:21 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe 2012-05-27 11:18 . 2012-05-27 11:20 -------- d-----w- c:\users\Gast . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-04 13:56 . 2010-11-11 20:17 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-04-03 08:16 . 2012-05-17 12:06 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-03 08:16 . 2012-05-17 12:06 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-03-30 12:39 . 2012-05-17 12:18 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys 2010-04-15 01:20 . 2011-05-04 16:38 61440 ----a-w- c:\program files\uinstrsc.dll 2010-04-15 01:20 . 2011-05-04 16:38 132456 ----a-w- c:\program files\uninst.exe 2010-04-15 01:20 . 2011-05-04 16:36 184320 ----a-w- c:\program files\NPEZFFPI.DLL 2010-04-15 01:20 . 2011-05-04 16:36 308552 ----a-w- c:\program files\CNEZIEPI.DLL 2010-04-15 01:20 . 2011-05-04 16:36 278528 ----a-w- c:\program files\CNEZCOPI.DLL 2010-04-15 01:20 . 2011-05-04 16:36 237568 ----a-w- c:\program files\CNIJLPE.DLL 2010-04-15 01:20 . 2011-05-04 16:36 204800 ----a-w- c:\program files\CNPS2LIB.DLL 2010-04-15 01:20 . 2011-05-04 16:36 65536 ----a-w- c:\program files\CNEZHTTP.DLL 2010-04-15 01:20 . 2011-05-04 16:36 643072 ----a-w- c:\program files\CNPS2.DLL 2010-04-15 01:20 . 2011-05-04 16:36 196608 ----a-w- c:\program files\NSRLIB.DLL 2010-04-15 01:20 . 2011-05-04 16:36 184320 ----a-w- c:\program files\MDPWRAP.DLL 2010-04-15 01:20 . 2011-05-04 16:36 69632 ----a-w- c:\program files\CNMLC.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1110016 ----a-w- c:\program files\MCAP.DLL 2010-04-15 01:20 . 2011-05-04 16:36 102400 ----a-w- c:\program files\CNMPU.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1355776 ----a-w- c:\program files\IB.DLL 2010-04-15 01:20 . 2011-05-04 16:36 90112 ----a-w- c:\program files\BJEZDCNR.DLL 2010-04-15 01:20 . 2011-05-04 16:36 225280 ----a-w- c:\program files\CNEZPZ.DLL 2010-04-15 01:20 . 2011-05-04 16:36 180224 ----a-w- c:\program files\CNEZPINF.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1101824 ----a-w- c:\program files\IMAGEFIX.DLL 2010-04-15 01:20 . 2011-05-04 16:36 544768 ----a-w- c:\program files\CNEZIMG.DLL 2010-04-15 01:20 . 2011-05-04 16:36 380928 ----a-w- c:\program files\CNEZCD.DLL 2010-04-15 01:20 . 2011-05-04 16:36 69632 ----a-w- c:\program files\CNEZFLDR.DLL 2010-04-15 01:20 . 2011-05-04 16:36 643072 ----a-w- c:\program files\CNEZPRN.DLL 2010-04-15 01:20 . 2011-05-04 16:36 245760 ----a-w- c:\program files\CNEZCTRL.DLL 2010-04-15 01:20 . 2011-05-04 16:36 20480 ----a-w- c:\program files\CNEZDBAC.DLL 2010-04-15 01:20 . 2011-05-04 16:36 159744 ----a-w- c:\program files\CNEZHLD.DLL 2010-04-15 01:20 . 2011-05-04 16:36 122880 ----a-w- c:\program files\CNEZEPP.DLL 2010-04-15 01:20 . 2011-05-04 16:36 11776 ----a-w- c:\program files\CNEZSMEX.DLL 2010-04-15 01:20 . 2011-05-04 16:36 241664 ----a-w- c:\program files\CNEZPAGE.DLL 2010-04-15 01:20 . 2011-05-04 16:36 167936 ----a-w- c:\program files\CNEZPRNT.DLL 2010-04-15 01:20 . 2011-05-04 16:36 577536 ----a-w- c:\program files\CNEZDRAW.DLL 2010-04-15 01:20 . 2011-05-04 16:36 815104 ----a-w- c:\program files\CNEZDM.DLL 2010-04-15 01:20 . 2011-05-04 16:36 4232536 ----a-w- c:\program files\CNEZMAIN.EXE 2010-04-15 01:20 . 2011-05-04 16:36 67160 ----a-w- c:\program files\CNELMAIN.EXE 2010-04-15 01:20 . 2011-05-04 16:36 15360 ----a-w- c:\program files\CNPS2LG.DLL 2010-04-15 01:20 . 2011-05-04 16:36 45056 ----a-w- c:\program files\MCAPLNG.DLL 2010-04-15 01:20 . 2011-05-04 16:36 40960 ----a-w- c:\program files\IMGLNG.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1970176 ----a-w- c:\program files\CNEZUIRC.DLL 2010-04-15 01:20 . 2011-05-04 16:36 1572864 ----a-w- c:\program files\CNEZRSC.DLL 2010-04-15 01:20 . 2011-05-04 16:36 14848 ----a-w- c:\program files\CNEZDMRC.DLL 2009-07-11 23:56 . 2011-05-04 16:36 69632 ----a-w- c:\program files\mfcm80.dll 2009-07-11 23:55 . 2011-05-04 16:36 632656 ----a-w- c:\program files\msvcr80.dll 2009-07-11 23:55 . 2011-05-04 16:36 554832 ----a-w- c:\program files\msvcp80.dll 2009-07-11 23:55 . 2011-05-04 16:36 479232 ----a-w- c:\program files\msvcm80.dll 2009-07-11 23:55 . 2011-05-04 16:36 57856 ----a-w- c:\program files\mfcm80u.dll 2009-07-11 18:54 . 2011-05-04 16:36 65536 ----a-w- c:\program files\vcomp.dll 2009-07-11 18:46 . 2011-05-04 16:36 65536 ----a-w- c:\program files\mfc80DEU.dll 2009-07-11 18:46 . 2011-05-04 16:36 61440 ----a-w- c:\program files\mfc80ITA.dll 2009-07-11 18:46 . 2011-05-04 16:36 61440 ----a-w- c:\program files\mfc80FRA.dll 2009-07-11 18:46 . 2011-05-04 16:36 61440 ----a-w- c:\program files\mfc80ESP.dll 2009-07-11 18:46 . 2011-05-04 16:36 57344 ----a-w- c:\program files\mfc80ENU.dll 2009-07-11 18:46 . 2011-05-04 16:36 49152 ----a-w- c:\program files\mfc80KOR.dll 2009-07-11 18:46 . 2011-05-04 16:36 49152 ----a-w- c:\program files\mfc80JPN.dll 2009-07-11 18:46 . 2011-05-04 16:36 45056 ----a-w- c:\program files\mfc80CHT.dll 2009-07-11 18:46 . 2011-05-04 16:36 40960 ----a-w- c:\program files\mfc80CHS.dll 2009-07-11 18:46 . 2011-05-04 16:36 1105920 ----a-w- c:\program files\mfc80.dll 2009-07-11 18:46 . 2011-05-04 16:36 1093120 ----a-w- c:\program files\mfc80u.dll 2009-07-11 17:10 . 2011-05-04 16:36 97280 ----a-w- c:\program files\atl80.dll 2008-11-05 10:00 . 2011-05-04 16:36 20832 ----a-w- c:\program files\Lttmb15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 128352 ----a-w- c:\program files\Lfpng15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 501088 ----a-w- c:\program files\Ltkrn15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 447840 ----a-w- c:\program files\Ltimgsfx15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 40800 ----a-w- c:\program files\Ltimgopt15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 206176 ----a-w- c:\program files\Ltimgefx15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 144736 ----a-w- c:\program files\Ltimgutl15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 357728 ----a-w- c:\program files\Ltimgcor15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 267616 ----a-w- c:\program files\Ltdis15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 259424 ----a-w- c:\program files\Ltefx15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 218464 ----a-w- c:\program files\Ltimgclr15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 189792 ----a-w- c:\program files\Ltfil15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 66912 ----a-w- c:\program files\Lfpct15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 398688 ----a-w- c:\program files\Lfcmp15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 34656 ----a-w- c:\program files\Lfgif15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 30560 ----a-w- c:\program files\Lfbmp15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 1717600 ----a-w- c:\program files\Ltclr15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 161120 ----a-w- c:\program files\Lftif15u.dll 2008-11-05 10:00 . 2011-05-04 16:36 107872 ----a-w- c:\program files\Lffax15u.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2012-03-06 23:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-08 68856] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk /p \??\k:\0autocheck autochk *\0bootdelete . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^$McRebootA5E6DEAA56$.lnk] backup=c:\windows\pss\$McRebootA5E6DEAA56$.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup backupExtension=.CommonStartup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2012-01-02 09:07 843712 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2012-03-27 12:41 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter] 2007-04-03 16:50 1603152 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu] 2007-04-03 16:00 644696 ----a-w- c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeApp] 2011-01-02 11:30 814496 ----a-w- c:\program files\FreeApps\FreeApps.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box] 2011-03-01 16:33 126976 ----a-w- c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2008-06-18 19:01 166424 ----a-w- c:\windows\System32\hkcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler] 2007-05-24 11:13 71176 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2011-05-10 00:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv] 2007-04-18 15:01 65536 ----a-w- c:\hp\support\hpsysdrv.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2008-06-18 19:01 141848 ----a-w- c:\windows\System32\igfxtray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD] 2006-12-08 14:16 65536 ----a-w- c:\hp\KBD\KbdStub.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPN] 2008-06-06 15:08 198184 ----a-w- c:\program files\KPN\bin\sprtcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPNAssistentUpdater] 2010-12-22 14:49 1964928 ----a-w- c:\program files\KPN\KPN Update\KPNAssistentUpdater.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2012-04-04 13:56 462408 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4] 2007-02-04 11:02 79400 ----a-w- c:\program files\ScanSoft\OmniPageSE4\OpWareSE4.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro] 2007-02-15 11:59 118784 ----a-w- c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] 2008-06-18 19:01 133656 ----a-w- c:\windows\System32\igfxpers.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] 2006-10-25 08:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg] 2008-02-22 02:25 54672 ----a-w- c:\windows\System32\jureg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2010-10-29 13:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2008-01-08 15:58 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] 2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center] 2007-05-31 07:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1753990348-677674000-2389129793-1000] "EnableNotificationsRef"=dword:00000001 . R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [2012-03-14 913752] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] ipripsvc REG_MULTI_SZ iprip LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr . Inhoud van de 'Gedeelde Taken' map . 2012-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-26 16:06] . 2012-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-05-26 16:06] . 2012-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1753990348-677674000-2389129793-1000Core.job - c:\users\riekie\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-08 14:32] . 2012-06-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1753990348-677674000-2389129793-1000UA.job - c:\users\riekie\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-08 14:32] . . ------- Bijkomende Scan ------- . mStart Page = hxxp://www.msn.com uSearchAssistant = hxxp://www.google.com/ie IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: DhcpNameServer = 212.54.40.25 212.54.35.25 . - - - - ORPHANS VERWIJDERD - - - - . WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file) . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-06-24 14:50 Windows 6.0.6002 Service Pack 2 NTFS . scannen van verborgen processen ... . [0] 0x07EBFFFF . scannen van verborgen autostart items ... . scannen van verborgen bestanden ... . . C:\avast! sandbox . Scan succesvol afgerond verborgen bestanden: 1 . ************************************************************************** . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}"=hex:51,66,7a,6c,4c,1d,38,12,3a,25,4d, 8a,1f,e3,d1,0d,d3,3b,92,3f,05,d7,c9,12 "{30F9B915-B755-4826-820B-08FBA6BD249D}"=hex:51,66,7a,6c,4c,1d,38,12,7b,ba,ea, 34,67,f9,48,0d,fd,1d,4b,bb,a3,e3,60,89 "{EEE6C35B-6118-11DC-9C72-001320C79847}"=hex:51,66,7a,6c,4c,1d,38,12,35,c0,f5, ea,2a,2f,b2,54,e3,64,43,53,25,99,dc,53 "{26C9E18C-3717-4BE1-A225-04E4471F5B6E}"=hex:51,66,7a,6c,4c,1d,38,12,e2,e2,da, 22,25,79,8f,0e,dd,33,47,a4,42,41,1f,7a "{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b, 27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7 "{20A0BE68-8FD9-4539-8712-CE3D1C1FDFC6}"=hex:51,66,7a,6c,4c,1d,38,12,06,bd,b3, 24,eb,c1,57,00,f8,04,8d,7d,19,41,9b,d2 "{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23, 94,30,02,d1,0f,f1,da,12,24,73,56,27,d2 "{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce, 9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d "{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b, ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3 "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{EEE6C35C-6118-11DC-9C72-001320C79847}"=hex:51,66,7a,6c,4c,1d,38,12,32,c0,f5, ea,2a,2f,b2,54,e3,64,43,53,25,99,dc,53 . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:f2,a1,b5,d4,ac,06,cd,01 . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="FirefoxHTML" . Voltooingstijd: 2012-06-24 14:55:59 ComboFix-quarantined-files.txt 2012-06-24 12:55 . Pre-Run: 94.737.801.216 bytes beschikbaar Post-Run: 94.685.376.512 bytes beschikbaar . - - End Of File - - EA6832CE90539BAC5AA40AEB27D3FC80