Z-Analyse V1.0.0.1 Updated 27-September-2013 Tool run by Eigenaar on do 03-10-2013 at 22:27:11,82. Microsoft® Windows Vista™ Business 6.0.6002 Service Pack 2 x86 Running in: Normal Mode No Internet Access Detected Launched: E:\zoek\Z-Analyse.exe [Deep Scan] ==== System Restore Info ====================== 3-10-2013 22:29:07 Zoek.exe System Restore Point Created Succesfully. ==== Running Processes ====================== C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Windows\system32\SLsvc.exe C:\Windows\System32\spoolsv.exe C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\AVG\AVG2014\avgfws.exe C:\Program Files\AVG\AVG2014\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe C:\Windows\system32\FsUsbExService.Exe C:\Program Files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe C:\Program Files\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files\BrowseFox\updateBrowseFox.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Windows\system32\LogonUI.exe C:\Windows\system32\csrss.exe C:\Windows\system32\winlogon.exe C:\Program Files\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\AVG\AVG2014\avgui.exe C:\Program Files\Movies Toolbar\Datamngr\DatamngrUI.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Real\RealPlayer\Update\realsched.exe C:\Program Files\Samsung\Kies\KiesTrayAgent.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\ControlCenter4\BrCtrlCntr.exe C:\Program Files\Samsung\Kies\Kies.exe C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\Eigenaar\AppData\Roaming\Dropbox\bin\Dropbox.exe C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\ControlCenter4\BrCcUxSys.exe C:\Windows\System32\WUDFHost.exe C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe C:\Program Files\AVG\AVG2014\avgcfgex.exe C:\PROGRA~1\MICROS~1\WksWP.exe C:\PROGRA~1\MICROS~1\WkDStore.exe C:\Windows\system32\wbem\wmiprvse.exe C:\PROGRA~1\MICROS~1\wkgdcach.exe E:\zoek\Z-Analyse.exe C:\Windows\system32\conime.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\vssvc.exe C:\Users\Eigenaar\AppData\Local\temp\NirCmd.exe c:\Program Files\Microsoft Security Client\MpCmdRun.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\System32\svchost.exe -k swprv ==== Deleting Files \ Folders ====================== "C:\Windows\system32\appdata" deleted ==== System Specs (Software) ====================== Anti-Virus: AVG Internet Security 2014 On-access scanning disabled (Outdated) Anti-Virus: Microsoft Security Essentials On-access scanning disabled (Outdated) Anti-Spyware: Windows Defender disabled (Outdated) Anti-Spyware: AVG Internet Security 2014 disabled (Outdated) Anti-Spyware: Microsoft Security Essentials disabled (Outdated) Firewall: AVG Internet Security 2014 disabled Default Browser: Google Chrome 29.0.1547.76 Internet Explorer Version: 9.0.8112.16421 Google Chrome version: 29.0.1547.76 Adobe Reader version: 10.1.6.1 Sun Java version: 1.7.0_25 (32-bit) Flash Player version: 11.8.800.94 Shockwave Player version: 11.5.1r601 ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== 2013-10-03 14:11:24 2701448229AEE43D266C00042EA3CB52 2154 ----a-w- C:\Windows\epplauncher.mif 2013-09-29 07:07:50 0F387E9B30925FBA5F82EDAD3596C1D5 540672 ------r- C:\Windows\RtlExUpd.dll ====== C:\Users\Eigenaar\AppData\Local\Temp ==== 2013-09-25 11:43:23 DF889E7ED7A351394EE66D904E703BED 1488384 ----a-w- C:\Windows\system32\config\systemprofile\AppData\Local\Temp\nspEEF2.tmp\Helper.dll 2013-09-24 16:10:06 953A104142958DB65FB37ADF5453E4C8 61960 ----a-w- C:\Windows\system32\config\systemprofile\AppData\Local\Temp\nspEEF2.tmp\Starter.exe ====== Java Cache ===== ====== C:\Windows\system32 ===== 2013-09-29 07:07:58 E5639080A7FFA5F03642F4D4CDB1E9CE 339968 ----a-w- C:\Windows\System32\SRSTSXT.dll 2013-09-29 07:07:58 E067361E60FCAE24790B88135895F3C8 135168 ----a-w- C:\Windows\System32\SRSWOW.dll 2013-09-29 07:07:58 D175A215DF2ECC0D3B3AFBDFFEAE4087 167936 ----a-w- C:\Windows\System32\SRSHP360.dll 2013-09-29 07:07:58 BA21C4B843B4B1DD787A660E17589F4D 185776 ----a-w- C:\Windows\System32\SRSTSHD.dll 2013-09-29 07:07:58 B7EBCA54F31D7FCC90409C2A09AFAB77 46112 ----a-w- C:\Windows\System32\RtkCoInst.dll 2013-09-29 07:07:58 AEB188663AFE040CFFE0C9CF6A0E1BB9 2525216 ----a-w- C:\Windows\System32\RtkAPO.dll 2013-09-29 07:07:58 160D438A8D833F3D8F91CA99C1133FA2 1003040 ----a-w- C:\Windows\System32\RtkPgExt.dll 2013-09-29 07:07:58 0640026E67033DDD7B841F8A84980147 1777664 ----a-w- C:\Windows\System32\WavesLib.dll 2013-09-29 07:07:58 03EFBB40E72B644E466E9DC19E51481B 326176 ----a-w- C:\Windows\System32\RtkApoApi.dll 2013-09-29 07:07:57 98EA21250308083B9F63705587754C54 282112 ----a-w- C:\Windows\System32\RTPCEE32.dll 2013-09-29 07:07:57 4443B2E42060190C4F32A809AB5C98D4 551456 ----a-w- C:\Windows\System32\RTSndMgr.cpl 2013-09-29 07:07:56 A9E5D24FB8AC7AE548BACD085CB0D583 159744 ----a-w- C:\Windows\System32\MaxxAudioAPO20.dll 2013-09-29 07:07:56 79EE57C454E30BE33C11E65EB9348A00 159232 ----a-w- C:\Windows\System32\FMAPO.dll 2013-09-29 07:07:56 7458B8F9AC005CA29BCD6C133B2E4DF4 1933312 ----a-w- C:\Windows\System32\MaxxAudioEQ.dll 2013-09-29 07:07:56 26AE7FE6953D584D349A91A72849A771 126976 ----a-w- C:\Windows\System32\MaxxAudioAPO.dll 2013-09-29 07:07:55 C5BD92FE507CE7456308148589C1E361 60416 ----a-w- C:\Windows\System32\AERTARen.dll 2013-09-29 07:07:55 06E60BE2BA3EC5FE2EE1A3B4A18A514B 142848 ----a-w- C:\Windows\System32\AERTACap.dll 2013-09-29 07:05:38 B073E39AC258E2AF10D7105DA2125CBC 73728 ----a-w- C:\Windows\System32\RtNicProp32.dll ====== C:\Windows\system32\drivers ===== 2013-10-03 14:09:18 3546C0B6F2D808D4E6294A9D6B25151B 221568 ----a-w- C:\Windows\System32\drivers\netio.sys 2013-09-29 07:07:57 2E4F8AD76CB1203D68DB6E8F02E4AF74 2350624 ----a-w- C:\Windows\System32\drivers\RTKVHDA.sys 2013-09-29 07:05:38 034033F5A921764D8C4BA6698800D95B 163328 ----a-w- C:\Windows\System32\drivers\Rtlh86.sys 2013-09-10 20:11:44 C3828E5C49924969799ED8B1E123A267 22840 ----a-w- C:\Windows\System32\drivers\avgidsshimx.sys 2013-09-09 10:41:46 BB6EDB0257860083193CC1581AC7D485 136904 ----a-w- C:\Windows\System32\drivers\ssadbus.sys 2013-09-09 10:41:46 88BBDA3D977429C6DAB0991EC5339A19 15304 ----a-w- C:\Windows\System32\drivers\ssadwhnt.sys 2013-09-09 10:41:46 88BBDA3D977429C6DAB0991EC5339A19 15304 ----a-w- C:\Windows\System32\drivers\ssadwh.sys 2013-09-09 10:41:46 5BCB68F7B62159C07789D3F405750623 17864 ----a-w- C:\Windows\System32\drivers\ssadmdfl.sys 2013-09-09 10:41:46 370168F1FD1CEF45DA470A44439426CA 15560 ----a-w- C:\Windows\System32\drivers\ssadcmnt.sys 2013-09-09 10:41:46 370168F1FD1CEF45DA470A44439426CA 15560 ----a-w- C:\Windows\System32\drivers\ssadcm.sys 2013-09-09 10:41:46 1588A89F9CD9E68DE9FCC9F60FDB5C08 153672 ----a-w- C:\Windows\System32\drivers\ssadmdm.sys 2013-09-09 10:35:46 E6CE6348A4F6E06925548F62527F0F99 136776 ----a-w- C:\Windows\System32\drivers\sscdbus.sys 2013-09-09 10:35:46 BF6F31B9F5A98400DFB42CDB2C6537E1 130248 ----a-w- C:\Windows\System32\drivers\sscdserd.sys 2013-09-09 10:35:46 96E20FE523F992F96CCA23B2437F5CC7 15304 ----a-w- C:\Windows\System32\drivers\sscdwhnt.sys 2013-09-09 10:35:46 96E20FE523F992F96CCA23B2437F5CC7 15304 ----a-w- C:\Windows\System32\drivers\sscdwh.sys 2013-09-09 10:35:46 8F40A62436A05A8963391DFB1D9F2876 15560 ----a-w- C:\Windows\System32\drivers\sscdcmnt.sys 2013-09-09 10:35:46 8F40A62436A05A8963391DFB1D9F2876 15560 ----a-w- C:\Windows\System32\drivers\sscdcm.sys 2013-09-09 10:35:46 68820F9A67F0D170A6842094EBDCD924 17864 ----a-w- C:\Windows\System32\drivers\sscdmdfl.sys 2013-09-09 10:35:46 0A3B7562002C50F208FCCDEB7380B57B 153672 ----a-w- C:\Windows\System32\drivers\sscdmdm.sys 2013-09-09 10:05:39 6216FD7FD227DE454238A702B218CEC7 20032 ----a-w- C:\Windows\System32\drivers\dgderdrv.sys 2013-09-08 20:12:16 9745AD34365318593909EDDEDAE66B9A 27448 ----a-w- C:\Windows\System32\drivers\avgrkx86.sys ====== C:\Windows\Tasks ====== 2013-09-26 16:56:38 65972C3D4A3E3E1C39930B10A7A6BB86 3340 ----a-w- C:\Windows\system32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2310077886-2185433429-3398584410-1000 ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2013-10-03 15:21:48 -------- d-----w- C:\Program Files\trend micro 2013-09-28 12:27:06 -------- d-----w- C:\Program Files\MSBuild 2013-09-11 14:01:02 -------- d-----w- C:\Program Files\Idols TALENTBOX 2013-09-09 16:14:26 -------- d-----w- C:\Program Files\iLivid 2013-09-09 16:13:19 -------- d-----w- C:\Program Files\Movies Toolbar 2013-09-09 10:06:46 -------- d-----w- C:\Program Files\MyFree Codec 2013-09-09 09:45:56 -------- d-----w- C:\Program Files\BrowseFox 2013-09-05 07:49:08 -------- d-----w- C:\Program Files\RealNetworks 2013-09-05 07:48:54 -------- d-----w- C:\Program Files\Common Files\xing shared 2013-09-05 07:48:15 -------- d-----w- C:\Program Files\Real 2013-09-05 07:29:29 -------- d-----w- C:\Program Files\iPod 2013-09-05 07:29:23 -------- d-----w- C:\Program Files\iTunes ======= C: ===== 2013-09-30 13:25:59 E9C056089F1D87BD90888EBC90CF9DC9 3831 ----a-w- C:\ipconfig.txt ====== C:\Users\Eigenaar\AppData\Roaming ====== 2013-09-28 13:48:45 -------- d-----w- C:\Users\Jeremy\AppData\Roaming\RealNetworks 2013-09-28 13:12:41 -------- d-----w- C:\Users\Jeremy\AppData\Roaming\TuneUp Software 2013-09-28 12:54:20 -------- d-----w- C:\Users\Jeremy\AppData\Roaming\AVG2014 2013-09-28 12:54:07 -------- d-----w- C:\Users\Jeremy\AppData\Local\Avg2014 2013-09-28 11:37:47 -------- d-----w- C:\Users\Eigenaar\AppData\Roaming\AVG2014 2013-09-28 11:34:10 -------- d-----w- C:\Windows\system32\config\systemprofile\AppData\Roaming\AVG2014 2013-09-28 11:27:55 -------- d-----w- C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014 2013-09-28 11:23:42 -------- d-----w- C:\Users\Eigenaar\AppData\Local\Avg2014 2013-09-15 13:18:30 -------- d-----w- C:\Users\Jeremy\AppData\Locallow\DataMngr 2013-09-10 18:59:12 -------- d-----w- C:\Users\Jeremy\AppData\Locallow\ilividmoviestoolbarha 2013-09-10 15:49:24 -------- d-----w- C:\Users\Noah Jaira\AppData\Locallow\ilividmoviestoolbarha 2013-09-10 15:49:22 -------- d-----w- C:\Users\Noah Jaira\AppData\Roaming\Real 2013-09-09 16:13:41 -------- d-----w- C:\Users\Eigenaar\AppData\Local\ilividmoviestoolbarha 2013-09-09 16:13:31 -------- d-----w- C:\Users\Eigenaar\AppData\Locallow\ilividmoviestoolbarha 2013-09-09 16:12:53 -------- d-----w- C:\Users\Eigenaar\AppData\Local\iLivid 2013-09-09 13:12:42 CD67FFDE4BB3DD4BCBDC2FBACDA14CF2 474392 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\WPFFontCache_v0400-S-1-5-21-2310077886-2185433429-3398584410-1000-8192.dat 2013-09-09 13:12:40 23628F6BD56C3D089613CEA7BFCB03DA 424564 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\WPFFontCache_v0400-S-1-5-21-2310077886-2185433429-3398584410-1000-12288.dat 2013-09-09 10:12:36 -------- d-----w- C:\Users\Eigenaar\AppData\Local\Samsung 2013-09-05 13:57:33 -------- d-----w- C:\Users\Jeremy\AppData\Roaming\Real 2013-09-05 07:50:13 -------- d-----w- C:\Users\Eigenaar\AppData\Roaming\RealNetworks 2013-09-05 07:47:47 -------- d-----w- C:\Users\Eigenaar\AppData\Roaming\Real ====== C:\Users\Eigenaar ====== 2013-09-28 11:28:39 -------- d-----w- C:\ProgramData\AVG2014 2013-09-26 17:06:11 25CC048EF0A0FFB7F811695E121BC17A 24419 ----a-w- C:\Users\Eigenaar\brief tienerplusgroep 2013-2014.docx 2013-09-25 11:43:29 -------- d-----w- C:\ProgramData\Datamngr 2013-09-25 11:43:23 -------- d-----r- C:\Windows\system32\config\systemprofile\Desktop 2013-09-16 16:56:57 BA58D2487FDE0BF7D78ED196278DAECB 57344 ----a-w- C:\Users\Eigenaar\2013177 WNE uitnodiging informatieavond havo 3.doc 2013-09-13 07:14:46 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2013-09-11 14:01:07 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\idols talentbox 2013-09-09 10:06:47 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyFree Codec 2013-09-09 10:06:16 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung 2013-09-05 07:49:04 -------- d-----w- C:\ProgramData\RealNetworks 2013-09-05 07:48:27 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks 2013-09-05 07:46:53 -------- d-----w- C:\ProgramData\Real 2013-09-05 07:30:36 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2013-09-05 07:29:23 -------- d-----w- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 ====== C: exe-files == 2013-09-29 07:09:31 F333CE126E2144A9F04F760533AA331A 1206816 ------r- C:\Program Files\Realtek\Audio\InstallShield\Rtkupd.exe 2013-09-29 07:07:59 F333CE126E2144A9F04F760533AA331A 1206816 ------w- C:\Program Files\Realtek\Audio\Drivers\RtlUpd.exe 2013-09-29 07:07:59 33318CC6885A70D17886F3672EBD7AAB 297504 ------w- C:\Program Files\Realtek\Audio\HDA\vncutil.exe 2013-09-29 07:07:58 F333CE126E2144A9F04F760533AA331A 1206816 ------w- C:\Program Files\Realtek\Audio\HDA\RtlUpd.exe 2013-09-29 07:07:58 C4479E62594E5F3D41DE9C509D2487A2 1833504 ------w- C:\Program Files\Realtek\Audio\HDA\SkyTel.exe 2013-09-29 07:07:58 8C2D4E6FAEC6C249105208ED5973CBE3 129568 ------w- C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe 2013-09-29 07:07:57 C8BB9FD980C413AFCAD221940D6B0A95 7289376 ------w- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe 2013-09-29 07:07:55 973F07C81F3B90C44C9BEAE261F7C93D 81920 ------w- C:\Program Files\Realtek\Audio\HDA\AERTSrv.exe 2013-09-29 07:07:54 49B3D2077199C44C1F3BBB16B4094AE6 121064 ----a-w- C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe 2013-09-28 11:29:10 4D7FB9493EBE8B9210DA9D9F3FD0B4E8 253488 ----a-w- C:\Program Files\AVG\AVG2014\avgndisx.exe === C: other files == 2013-10-03 14:09:18 3546C0B6F2D808D4E6294A9D6B25151B 221568 ----a-w- C:\Windows\System32\drivers\netio.sys 2013-09-29 07:43:51 62F534791AE488A475A3E508D92AF4CC 2307072 ------w- C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_96f85a81\igdkmd32.sys 2013-09-29 07:07:57 2E4F8AD76CB1203D68DB6E8F02E4AF74 2350624 ----a-w- C:\Windows\System32\DriverStore\FileRepository\hdart.inf_e638cfa1\RTKVHDA.sys 2013-09-29 07:07:57 2E4F8AD76CB1203D68DB6E8F02E4AF74 2350624 ----a-w- C:\Windows\System32\drivers\RTKVHDA.sys 2013-09-29 07:05:38 034033F5A921764D8C4BA6698800D95B 163328 ----a-w- C:\Windows\System32\drivers\Rtlh86.sys 2013-09-29 07:05:38 034033F5A921764D8C4BA6698800D95B 163328 ------w- C:\Windows\System32\DriverStore\FileRepository\netrtx32.inf_64278fa1\Rtlh86.sys 2013-09-28 11:29:07 58D7FAF5C81ECEFFD2EDEDA9C2619D82 20912 ----a-w- C:\Program Files\AVG\AVG2014\Drivers\avgboota.sys 2013-09-28 11:29:07 455AF0D7724A08061EAD66E506A130F5 18352 ----a-w- C:\Program Files\AVG\AVG2014\Drivers\avgbootx.sys ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1001\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "Spybot-S&D Cleaning"="C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe /autoclean" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "Akamai NetSession Interface"="C:\Users\Jeremy\AppData\Local\Akamai\netsession_win.exe" "Spybot-S&D Cleaning"="C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe /autoclean" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "Softonic for Windows"="C:\Users\Jeremy\AppData\Local\Softonic\Softonic.exe -minimize" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Windows\system32\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "Spybot-S&D Cleaning"="C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe /autoclean" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C) -http://www.underdog.be/games/bio-racer-xl/bio-racer1.dcr" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce] "avg_spchecker"="C:\Program Files\AVG\AVG8\Notification\SPChecker.exe /start" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) -http://blip.se/games/tv4.se/lattjo/kojan/bilbana.dcr" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C) -http://static.funnygames.nl/games/8/2768/2768.dcr" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\runonce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C) -http://www.underdog.be/games/bio-racer-xl/bio-racer1.dcr" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6.5; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) -http://static.tibaco.nl/games/4/454/454.html" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" "APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" "ControlCenter4"="C:\Program Files\ControlCenter4\BrCcBoot.exe /autorun" "BrStsMon00"="C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN" "AVG_UI"="C:\Program Files\AVG\AVG2014\avgui.exe /TRAYONLY" "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe -atboottime" "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "TkBellExe"="C:\Program Files\Real\RealPlayer\Update\realsched.exe -osboot" "KiesTrayAgent"="C:\Program Files\Samsung\Kies\KiesTrayAgent.exe" "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe" "Skytel"="C:\Program Files\Realtek\Audio\HDA\Skytel.exe" "IgfxTray"="C:\Windows\system32\igfxtray.exe" "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" "Persistence"="C:\Windows\system32\igfxpers.exe" "MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C) -http://www.underdog.be/games/bio-racer-xl/bio-racer1.dcr" ==== Startup Registry Disabled ====================== [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run-] "MobileDocuments"="C:\\Program Files\\Common Files\\Apple\\Internet Services\\ubd.exe" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-] "NPSStartup"="" "aaservice"="\"C:\\Program Files/Timeslot/servicets.exe\"" "Adobe ARM"="\"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "SunJavaUpdateSched"="\"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\"" ==== Startup Folders ====================== 2013-01-10 16:07:47 954 ----a-w- C:\Users\Eigenaar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk 2013-08-15 17:45:46 2117 ----a-w- C:\Users\Eigenaar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediacontrole Picture Motion Browser.lnk ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job --a------ [Undetermined Task] C:\Windows\tasks\DSite.job --a------ C:\Users\Eigenaar\AppData\Roaming\DSite\UPDATE1\UPDATE1.exe [] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [13-10-2010 13:46] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [13-10-2010 13:46] C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job --a------ C:\Program Files\Spybot - Search Destroy 2\SDImmunize.exe [] C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job --a------ C:\Program Files\Spybot - Search Destroy 2\SDScan.exe [] ==== Chrome Look ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions aaaaabcbmongicmdegkmmfgdickgnnob - C:\Users\Eigenaar\AppData\Local\ilividmoviestoolbarha\GC\toolbar.crx[20-08-2013 07:55] clbfjfbnelcflpgpklppgplejolacbej - C:\Program Files\BrowserCompanion\blabbers-ch.crx[] eghepdicbhhbhegihkllkmgjggcjpkma - C:\Users\Eigenaar\AppData\Local\CRE\eghepdicbhhbhegihkllkmgjggcjpkma.crx[11-03-2013 12:51] idhngdhcfkoamngbedgpaokgjbnpdiji - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[14-08-2013 15:24] kiplfnciaokpcennlkldkdaeaaomamof - C:\Users\Eigenaar\AppData\Local\Torch\Plugins\TorchPlugin.crx[03-01-2013 15:24] lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx[] niapdbllcanepiiimjjndipklodoedlc - C:\Users\Eigenaar\AppData\Local\Temp\YontooLayers.crx[] ppdjnkblmcjfnlogjjhpigpdgpcgdpll - C:\Program Files\BrowseFox\ppdjnkblmcjfnlogjjhpigpdgpcgdpll.crx[30-08-2013 03:57] HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions eghepdicbhhbhegihkllkmgjggcjpkma - C:\Users\Eigenaar\AppData\Local\CRE\eghepdicbhhbhegihkllkmgjggcjpkma.crx[11-03-2013 12:51] Movies Toolbar - Eigenaar - Default\Extensions\aaaaabcbmongicmdegkmmfgdickgnnob Google Docs - Eigenaar - Default\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - Eigenaar - Default\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - Eigenaar - Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - Eigenaar - Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf RealDownloader - Eigenaar - Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji Torch Share - Eigenaar - Default\Extensions\kiplfnciaokpcennlkldkdaeaaomamof Chrome In-App Payments service - Eigenaar - Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Gmail - Eigenaar - Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia BrowseFox - Eigenaar - Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll Ginyas Browser Companions - Gast - Default\Extensions\bpgoohpbdddibhlhdkenenmmlfofjfkh Skype Extension - Gast - Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl Funmoods - Jeremy - Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh RealDownloader - Jeremy - Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji Chrome In-App Payments service - Jeremy - Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda BrowseFox - Jeremy - Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll RealDownloader - Noah Jaira - Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji Card number - Noah Jaira - Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda BrowseFox - Noah Jaira - Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll ==== IE Start and Search Settings ====================== [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{1082BD64-3516-47EB-9477-108D7E8132F4}" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes {1082BD64-3516-47EB-9477-108D7E8132F4} Ask Search Url="http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=nl_NL&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^NL&apn_uid=1D957529-3B5F-42EB-8DE5-CC6E70A1F980&apn_sauid=8E7B7B1F-BD12-40E7-AF3A-C481460F9AC1" {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Ask.com Url="http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=484&systemid=406&v=r9178-100&apn_uid=7463932855234515&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}" ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_CLASSES_ROOT\CLSID\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_CLASSES_ROOT\CLSID\{B5A7F190-DDA6-4420-B3BA-52453494E6CD} deleted successfully HKEY_CLASSES_ROOT\CLSID\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Internet Explorer\Approved Extensions\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Internet Explorer\Approved Extensions\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Internet Explorer\Approved Extensions\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Internet Explorer\Approved Extensions\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{3d86a75b-cb6b-4764-885d-ca6336f04ba2} deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B5A7F190-DDA6-4420-B3BA-52453494E6CD} deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{B5A7F190-DDA6-4420-B3BA-52453494E6CD} deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} deleted successfully ==== HijackThis Entries ====================== O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: BrowseFox - {b9507101-e464-4b3b-a4cb-291aaedd94f2} - C:\Program Files\BrowseFox\BrowseFoxbho.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [ControlCenter4] C:\Program Files\ControlCenter4\BrCcBoot.exe /autorun O4 - HKLM\..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2014\avgui.exe" /TRAYONLY O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\Update\realsched.exe" -osboot O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun O4 - HKCU\..\Run: [KPeerNexonEU] C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe O4 - HKCU\..\Run: [COMMUNICATOR] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" /silentRetrials /background O4 - HKCU\..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe /preload O4 - HKCU\..\Run: [KiesAirMessage] C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup O4 - HKCU\..\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C)" -"http://www.underdog.be/games/bio-racer-xl/bio-racer1.dcr" O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1001\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1001\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User '?') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1001\..\RunOnce: [avg_spchecker] "C:\Program Files\AVG\AVG8\Notification\SPChecker.exe" /start (User '?') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\Run: [Spybot-S&D Cleaning] "C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\Run: [KPeerNexonEU] C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\Run: [COMMUNICATOR] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" /silentRetrials /background (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe /preload (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\Run: [KiesAirMessage] C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1002\..\RunOnce: [Shockwave Updater] C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" -"http://blip.se/games/tv4.se/lattjo/kojan/bilbana.dcr" (User 'Noah Jaira') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1003\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Jeremy') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-1003\..\RunOnce: [Shockwave Updater] C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C)" -"http://static.funnygames.nl/games/8/2768/2768.dcr" (User 'Jeremy') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-500\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (User 'Administrator') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-500\..\RunOnce: [Shockwave Updater] C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C)" -"http://www.underdog.be/games/bio-racer-xl/bio-racer1.dcr" (User 'Administrator') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-501\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Gast') O4 - HKUS\S-1-5-21-2310077886-2185433429-3398584410-501\..\RunOnce: [Shockwave Updater] C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6.5; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" -"http://static.tibaco.nl/games/4/454/454.html" (User 'Gast') O4 - Startup: Dropbox.lnk = C:\Users\Eigenaar\AppData\Roaming\Dropbox\bin\Dropbox.exe O4 - Startup: Mediacontrole Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - (no file) O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - (no file) O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - http://verkopen.marktplaats.nl/js/widgets/imageUploader/aurigma/5_7_24_0/ImageUploader5.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll O20 - AppInit_DLLs: C:\PROGRA~2\Wincert\WIN32C~1.DLL C:\PROGRA~1\MOVIES~1\Datamngr\mgrldr.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2014\avgfws.exe O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2014\avgidsagent.exe O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2014\avgwdsvc.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Datamngr Coordinator (DatamngrCoordinator) - Bandoo Media Inc. - C:\Program Files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe O23 - Service: Common Client Job Manager Service (PCCUJobMgr) - Symantec Corporation - C:\Program Files\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe O23 - Service: Update BrowseFox - BrowseFox - C:\Program Files\BrowseFox\updateBrowseFox.exe ==== EOF on do 03-10-2013 at 22:43:42,21 ======================