Logfile of random's system information tool 1.09 (written by random/random) Run by sarah at 2014-02-09 11:21:32 Microsoft Windows 7 Home Premium Service Pack 1 System drive C: has 136 GB (75%) free of 180 GB Total RAM: 3003 MB (57% free) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 11:27:44, on 9/02/2014 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v11.0 (11.00.9600.16428) Boot mode: Normal Running processes: C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Program Files\Trusteer\Rapport\bin\RapportService.exe C:\Windows\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe C:\Program Files\Browny02\Brother\BrStMonW.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\ControlCenter4\BrCtrlCntr.exe C:\Program Files\ControlCenter4\BrCcUxSys.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil32_12_0_0_44_ActiveX.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Users\sarah\Downloads\RSIT.exe C:\Program Files\trend micro\sarah.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=SAMSUNGXHM250JI_S15YJDNQ909111&ts=1373753767 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=SAMSUNGXHM250JI_S15YJDNQ909111&ts=1373753767 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=SAMSUNGXHM250JI_S15YJDNQ909111&ts=1373753767 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Kaspersky Passsword Manager Toolbar - {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\spIEBho.dll O2 - BHO: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll O2 - BHO: ContentBlockerBrowserHelperObject - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll O2 - BHO: VirtualKeyboardBrowserHelperObject - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll O2 - BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\OnlineBanking\online_banking_bho.dll O2 - BHO: Rich Media Downloader - {A7DF592F-6E2A-45C4-9A87-4BD217D714ED} - C:\Users\sarah\AppData\Local\Rich Media Player\BrowserExtensions\IE\RichMediaDownloader.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\UrlAdvisor\klwtbbho.dll O3 - Toolbar: Kaspersky Passsword Manager Toolbar - {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\spIEBho.dll O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe" O4 - HKLM\..\Run: [PPort12reminder] "C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\12\Config\Ereg\Ereg.ini" O4 - HKLM\..\Run: [ControlCenter4] C:\Program Files\ControlCenter4\BrCcBoot.exe /autorun O4 - HKLM\..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE') O8 - Extra context menu item: Toevoegen aan Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\ie_banner_deny.htm O9 - Extra button: Virtueel Toetsenbord - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL O9 - Extra button: Rich Media Downloader - {A7DF592F-6E2A-45C4-9A87-4BD217D714ED} - C:\Users\sarah\AppData\Local\Rich Media Player\BrowserExtensions\IE\RichMediaDownloader.dll (file missing) O9 - Extra button: Controle van URL's - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\UrlAdvisor\klwtbbho.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Kaspersky Anti-Virus-service (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe O23 - Service: BrYNSvc - Brother Industries, Ltd. - C:\Program Files\Browny02\BrYNSvc.exe O23 - Service: CryptoStorage control service (CSObjectsSrv) - Infowatch - C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PDFProFiltSrvPP - Nuance Communications, Inc. - C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- End of file - 8100 bytes ======Scheduled tasks folder====== C:\Windows\tasks\Adobe Flash Player Updater.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{215BA832-75A3-426E-A4FC-7C5B58CE6A10}] Kaspersky Passsword Manager Toolbar - C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\spIEBho.dll [2013-11-13 2396480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{551A852F-39A6-44A7-9C13-AFBEC9185A9D}] PlusIEEventHelper Class - C:\Program Files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06 249856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F}] Content Blocker Plugin - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2013-09-27 536256] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{73455575-E40C-433C-9784-C78DC7761455}] Virtual Keyboard Plugin - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2013-09-27 880320] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-18 462760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E6D0D23-3D72-4A94-AE1F-2D167624E3D9}] Safe Money Plugin - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\OnlineBanking\online_banking_bho.dll [2013-09-27 426176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7DF592F-6E2A-45C4-9A87-4BD217D714ED}] Rich Media Downloader - C:\Users\sarah\AppData\Local\Rich Media Player\BrowserExtensions\IE\RichMediaDownloader.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-18 171944] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E33CF602-D945-461A-83F0-819F76A199F8}] URL Advisor Plugin - C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\UrlAdvisor\klwtbbho.dll [2013-09-27 485568] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - Kaspersky Passsword Manager Toolbar - C:\PROGRA~1\KASPER~1\KASPER~1.0\KASPER~2\spIEBho.dll [2013-11-13 2396480] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-03-28 1045800] "IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-02-11 137752] "HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-02-11 171032] "Persistence"=C:\Windows\system32\igfxpers.exe [2011-02-11 172568] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904] "AVP"=C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe [2013-10-16 356128] "PPort12reminder"=C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe [2010-02-09 328992] "ControlCenter4"=C:\Program Files\ControlCenter4\BrCcBoot.exe [2011-04-20 139264] "BrStsMon00"=C:\Program Files\Browny02\Brother\BrStMonW.exe [2010-06-10 2621440] "SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ISUSPM"=C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [2009-05-05 222496] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch] C:\Program Files\Nuance\PaperPort\IndexSearch.exe [2010-03-08 46368] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD] C:\Program Files\Nuance\PaperPort\pptd40nt.exe [2010-03-08 29984] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF5 Registry Controller] C:\Program Files\Nuance\PDF Viewer Plus\RegistryController.exe [2010-03-05 62752] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFHook] C:\Program Files\Nuance\PDF Viewer Plus\pdfpro5hook.exe [2010-03-05 636192] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\Windows\system32\igfxdev.dll [2011-02-11 228864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"=credssp.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "ConsentPromptBehaviorAdmin"=5 "ConsentPromptBehaviorUser"=3 "EnableUIADesktopToggle"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=28 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] "vidc.mrle"=msrle32.dll "vidc.msvc"=msvidc32.dll "msacm.imaadpcm"=imaadp32.acm "msacm.msg711"=msg711.acm "msacm.msgsm610"=msgsm32.acm "msacm.msadpcm"=msadp32.acm "midimapper"=midimap.dll "wavemapper"=msacm32.drv "VIDC.UYVY"=msyuv.dll "VIDC.YUY2"=msyuv.dll "VIDC.YVYU"=msyuv.dll "VIDC.IYUV"=iyuv_32.dll "vidc.i420"=iyuv_32.dll "VIDC.YVU9"=tsbyuv.dll "msacm.l3acm"=C:\Windows\System32\l3codeca.acm "vidc.cvid"=iccvid.dll "wave1"=wdmaud.drv "midi1"=wdmaud.drv "mixer1"=wdmaud.drv "aux1"=wdmaud.drv "MSVideo8"=VfWWDM32.dll "wave"=wdmaud.drv "midi"=wdmaud.drv "mixer"=wdmaud.drv "aux"=wdmaud.drv ======File associations====== .js - edit - C:\Windows\System32\Notepad.exe %1 .js - open - C:\Windows\System32\WScript.exe "%1" %* ======List of files/folders created in the last 3 months====== 2014-02-09 11:21:39 ----D---- C:\Program Files\trend micro 2014-02-09 11:21:32 ----D---- C:\rsit 2014-01-25 22:00:17 ----D---- C:\Windows\Migration 2014-01-20 19:20:59 ----A---- C:\Windows\system32\javaws.exe 2014-01-20 19:20:44 ----A---- C:\Windows\system32\WindowsAccessBridge.dll 2014-01-20 19:20:44 ----A---- C:\Windows\system32\javaw.exe 2014-01-20 19:20:44 ----A---- C:\Windows\system32\java.exe 2014-01-15 08:09:27 ----A---- C:\Windows\system32\win32k.sys 2014-01-15 08:09:25 ----A---- C:\Windows\system32\drivers\netio.sys 2014-01-15 08:09:22 ----A---- C:\Windows\system32\drivers\usbuhci.sys 2014-01-15 08:09:22 ----A---- C:\Windows\system32\drivers\usbport.sys 2014-01-15 08:09:22 ----A---- C:\Windows\system32\drivers\usbohci.sys 2014-01-15 08:09:22 ----A---- C:\Windows\system32\drivers\usbhub.sys 2014-01-15 08:09:22 ----A---- C:\Windows\system32\drivers\usbehci.sys 2014-01-15 08:09:22 ----A---- C:\Windows\system32\drivers\usbd.sys 2014-01-15 08:09:22 ----A---- C:\Windows\system32\drivers\usbccgp.sys 2013-12-25 14:43:35 ----D---- C:\Users\sarah\AppData\Roaming\AVG 2013-12-25 14:42:27 ----D---- C:\ProgramData\AVG 2013-12-25 14:42:21 ----SHD---- C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308} 2013-12-25 14:41:45 ----D---- C:\Users\sarah\AppData\Roaming\FreeFileSync 2013-12-25 13:45:28 ----D---- C:\Users\sarah\AppData\Roaming\2BrightSparks 2013-12-25 13:41:07 ----D---- C:\Program Files\FileSync 2013-12-25 13:17:46 ----D---- C:\Program Files\Windows Device Stage 2013-12-21 22:56:32 ----A---- C:\Windows\system32\drivers\RapportKELL.sys 2013-12-17 18:52:42 ----RD---- C:\Users\sarah\AppData\Roaming\Brother 2013-12-14 21:41:26 ----A---- C:\ProgramData\ntuser.dat 2013-12-11 11:20:23 ----A---- C:\Windows\system32\ie4uinit.exe 2013-12-11 11:20:21 ----A---- C:\Windows\system32\jsproxy.dll 2013-12-11 11:20:20 ----A---- C:\Windows\system32\ieui.dll 2013-12-11 11:20:19 ----A---- C:\Windows\system32\ieetwcollectorres.dll 2013-12-11 11:20:18 ----A---- C:\Windows\system32\ieapfltr.dll 2013-12-11 11:20:17 ----A---- C:\Windows\system32\iesetup.dll 2013-12-11 11:20:17 ----A---- C:\Windows\system32\iernonce.dll 2013-12-11 11:20:16 ----A---- C:\Windows\system32\jscript9diag.dll 2013-12-11 11:20:16 ----A---- C:\Windows\system32\ieUnatt.exe 2013-12-11 11:20:16 ----A---- C:\Windows\system32\ieetwproxystub.dll 2013-12-11 11:20:15 ----A---- C:\Windows\system32\ieetwcollector.exe 2013-12-11 11:20:13 ----A---- C:\Windows\system32\wininet.dll 2013-12-11 11:20:11 ----A---- C:\Windows\system32\urlmon.dll 2013-12-11 11:20:11 ----A---- C:\Windows\system32\iertutil.dll 2013-12-11 11:20:08 ----A---- C:\Windows\system32\ieframe.dll 2013-12-11 11:20:06 ----A---- C:\Windows\system32\mshtml.dll 2013-12-11 11:20:05 ----A---- C:\Windows\system32\jscript9.dll 2013-12-11 11:14:55 ----A---- C:\Windows\system32\wmp.dll 2013-12-11 11:14:53 ----A---- C:\Windows\system32\wmploc.DLL 2013-12-11 07:36:52 ----A---- C:\Windows\system32\msieftp.dll 2013-12-11 07:36:50 ----A---- C:\Windows\system32\imagehlp.dll 2013-12-11 07:36:49 ----A---- C:\Windows\system32\wscript.exe 2013-12-11 07:36:49 ----A---- C:\Windows\system32\scrrun.dll 2013-12-11 07:36:49 ----A---- C:\Windows\system32\cscript.exe 2013-12-11 07:36:47 ----A---- C:\Windows\system32\WMPhoto.dll 2013-12-11 07:36:43 ----A---- C:\Windows\system32\tzres.dll 2013-12-11 07:36:35 ----A---- C:\Windows\system32\drivers\portcls.sys 2013-12-11 07:36:35 ----A---- C:\Windows\system32\drivers\drmk.sys 2013-12-03 15:19:36 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe 2013-12-03 15:19:36 ----A---- C:\Windows\system32\elshyph.dll 2013-12-03 15:19:35 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe 2013-12-03 15:19:35 ----A---- C:\Windows\system32\msrating.dll 2013-12-03 15:19:35 ----A---- C:\Windows\system32\msls31.dll 2013-12-03 15:19:35 ----A---- C:\Windows\system32\jsIntl.dll 2013-12-03 15:19:35 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll 2013-12-03 15:19:35 ----A---- C:\Windows\system32\dxtrans.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\wextract.exe 2013-12-03 15:19:34 ----A---- C:\Windows\system32\webcheck.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\vbscript.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\url.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\mshtmlmedia.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\mshtmled.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\msfeeds.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\licmgr10.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\inseng.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\iexpress.exe 2013-12-03 15:19:34 ----A---- C:\Windows\system32\iedkcs32.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\ieapfltr.dat 2013-12-03 15:19:34 ----A---- C:\Windows\system32\icardie.dll 2013-12-03 15:19:34 ----A---- C:\Windows\system32\dxtmsft.dll 2013-12-03 15:19:33 ----A---- C:\Windows\system32\pngfilt.dll 2013-12-03 15:19:33 ----A---- C:\Windows\system32\occache.dll 2013-12-03 15:19:33 ----A---- C:\Windows\system32\MshtmlDac.dll 2013-12-03 15:19:33 ----A---- C:\Windows\system32\mshta.exe 2013-12-03 15:19:33 ----A---- C:\Windows\system32\msfeedssync.exe 2013-12-03 15:19:33 ----A---- C:\Windows\system32\msfeedsbs.dll 2013-12-03 15:19:33 ----A---- C:\Windows\system32\jscript.dll 2013-12-03 15:19:33 ----A---- C:\Windows\system32\imgutil.dll 2013-12-03 15:19:33 ----A---- C:\Windows\system32\iepeers.dll 2013-12-03 15:19:33 ----A---- C:\Windows\system32\IEAdvpack.dll 2013-12-03 15:19:32 ----A---- C:\Windows\system32\SetIEInstalledDate.exe 2013-12-03 15:19:32 ----A---- C:\Windows\system32\mshtmler.dll 2013-12-03 15:19:32 ----A---- C:\Windows\system32\iesysprep.dll 2013-11-13 17:00:27 ----A---- C:\Windows\system32\authui.dll 2013-11-13 17:00:26 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll 2013-11-13 17:00:26 ----A---- C:\Windows\system32\credui.dll 2013-11-13 17:00:14 ----A---- C:\Windows\system32\sspicli.dll 2013-11-13 17:00:14 ----A---- C:\Windows\system32\schannel.dll 2013-11-13 17:00:14 ----A---- C:\Windows\system32\ncrypt.dll 2013-11-13 17:00:14 ----A---- C:\Windows\system32\lsass.exe 2013-11-13 17:00:14 ----A---- C:\Windows\system32\lsasrv.dll 2013-11-13 17:00:14 ----A---- C:\Windows\system32\drivers\ksecpkg.sys 2013-11-13 17:00:14 ----A---- C:\Windows\system32\drivers\ksecdd.sys 2013-11-13 17:00:14 ----A---- C:\Windows\system32\drivers\cng.sys 2013-11-13 17:00:13 ----A---- C:\Windows\system32\sspisrv.dll 2013-11-13 17:00:13 ----A---- C:\Windows\system32\secur32.dll 2013-11-13 17:00:08 ----A---- C:\Windows\system32\gdi32.dll 2013-11-13 17:00:05 ----A---- C:\Windows\system32\IKEEXT.DLL 2013-11-13 17:00:05 ----A---- C:\Windows\system32\FWPUCLNT.DLL 2013-11-13 17:00:04 ----A---- C:\Windows\system32\nshwfp.dll 2013-11-13 16:59:59 ----A---- C:\Windows\system32\crypt32.dll ======List of files/folders modified in the last 3 months====== 2014-02-09 11:22:02 ----D---- C:\Windows\Prefetch 2014-02-09 11:22:00 ----D---- C:\Windows\Temp 2014-02-09 11:21:39 ----D---- C:\Program Files 2014-02-09 11:10:28 ----D---- C:\ProgramData\Kaspersky Lab 2014-02-09 10:31:27 ----D---- C:\Windows\System32 2014-02-09 10:31:27 ----D---- C:\Windows\inf 2014-02-09 10:31:27 ----A---- C:\Windows\system32\PerfStringBackup.INI 2014-02-09 08:54:58 ----D---- C:\Windows\system32\config 2014-02-07 22:19:13 ----SD---- C:\Users\sarah\AppData\Roaming\Microsoft 2014-02-07 07:35:43 ----D---- C:\Windows\system32\catroot2 2014-02-05 20:28:05 ----A---- C:\Windows\system32\FlashPlayerApp.exe 2014-02-04 07:51:38 ----SHD---- C:\System Volume Information 2014-02-01 18:58:02 ----D---- C:\Users\sarah\AppData\Roaming\Skype 2014-01-31 22:18:04 ----D---- C:\Windows\system32\Tasks 2014-01-31 22:18:03 ----SHD---- C:\Windows\Installer 2014-01-31 22:18:03 ----D---- C:\Windows\Tasks 2014-01-31 22:18:02 ----HD---- C:\Config.Msi 2014-01-26 08:14:00 ----D---- C:\Windows\Microsoft.NET 2014-01-25 22:08:52 ----RSD---- C:\Windows\assembly 2014-01-25 22:00:56 ----D---- C:\Windows\system32\en-US 2014-01-25 22:00:17 ----SD---- C:\ProgramData\Microsoft 2014-01-25 22:00:17 ----D---- C:\Windows 2014-01-20 19:21:22 ----D---- C:\ProgramData\Oracle 2014-01-20 19:20:44 ----D---- C:\Program Files\Java 2014-01-19 08:28:45 ----D---- C:\Windows\winsxs 2014-01-19 08:28:38 ----D---- C:\Windows\system32\catroot 2014-01-15 09:34:13 ----D---- C:\Windows\system32\drivers 2014-01-15 09:34:12 ----D---- C:\Windows\system32\DriverStore 2014-01-15 09:30:40 ----D---- C:\ProgramData\Microsoft Help 2014-01-15 09:29:40 ----D---- C:\Windows\system32\MRT 2014-01-15 09:27:05 ----A---- C:\Windows\system32\MRT.exe 2013-12-25 14:42:27 ----HD---- C:\ProgramData 2013-12-25 14:41:10 ----D---- C:\Users\sarah\AppData\Roaming\OpenCandy 2013-12-18 06:13:56 ----N---- C:\Windows\system32\MpSigStub.exe 2013-12-11 22:01:00 ----D---- C:\Windows\rescache 2013-12-11 19:14:36 ----D---- C:\Program Files\Internet Explorer 2013-12-11 19:14:33 ----D---- C:\Windows\system32\nl-NL 2013-12-11 19:14:32 ----D---- C:\Program Files\Windows Media Player 2013-12-03 19:22:40 ----D---- C:\Windows\system32\migration 2013-12-03 19:22:40 ----D---- C:\Windows\PolicyDefinitions 2013-12-03 15:23:45 ----D---- C:\Windows\Logs 2013-12-01 08:59:44 ----D---- C:\ProgramData\Skype 2013-12-01 08:59:39 ----RD---- C:\Program Files\Skype 2013-11-23 16:55:36 ----D---- C:\Program Files\MyTomTom 3 2013-11-18 19:48:46 ----D---- C:\Program Files\Brother 2013-11-14 21:35:40 ----D---- C:\Program Files\Google 2013-11-13 15:44:17 ----D---- C:\Windows\ELAMBKUP ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R0 CSCrySec;InfoWatch Encrypt Sector Library driver; C:\Windows\system32\DRIVERS\CSCrySec.sys [2011-06-02 88632] R0 kl1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2013-10-16 135776] R0 RapportKELL;RapportKELL; C:\Windows\System32\Drivers\RapportKELL.sys [2013-12-21 107256] R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440] R1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver; C:\Windows\system32\DRIVERS\CSVirtualDiskDrv.sys [2011-06-02 39736] R1 KLIF;Kaspersky Lab Driver; C:\Windows\system32\DRIVERS\klif.sys [2013-10-16 595552] R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:\Windows\system32\DRIVERS\klim6.sys [2012-08-02 24408] R1 kltdi;kltdi; C:\Windows\system32\DRIVERS\kltdi.sys [2013-09-27 44000] R1 kneps;kneps; C:\Windows\system32\DRIVERS\kneps.sys [2013-09-27 145040] R1 RapportCerberus_59849;RapportCerberus_59849; \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_59849.sys [2013-12-12 340432] R1 RapportEI;RapportEI; \??\C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys [2013-12-21 155704] R1 RapportPG;RapportPG; \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys [2013-12-21 228888] R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128] R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-17 12672] R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\XAudio32.sys [2009-04-29 8704] R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-10-09 1096704] R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT32.sys [2008-10-03 222208] R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2009-02-12 980992] R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2009-02-12 207360] R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2011-02-11 9036800] R3 klkbdflt;Kaspersky Lab KLKBDFLT; C:\Windows\system32\DRIVERS\klkbdflt.sys [2013-10-16 25696] R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\Windows\system32\DRIVERS\klmouflt.sys [2013-10-16 25696] R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776] R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-03-28 199472] R3 usbscan;Stuurprogramma voor USB-scanner; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 36352] R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336] R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2009-02-12 661504] S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704] S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720] S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888] S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 131072] S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2010-11-20 16384] S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 36864] S3 esgiguard;esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [] S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848] S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304] S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-10-27 121064] S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-10-27 12776] S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-10-27 136808] S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 49664] S3 usb_rndisx;USB RNDIS-adapter; C:\Windows\system32\drivers\usb8023x.sys [2013-02-12 15872] S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328] S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736] S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432] R2 AVP;Kaspersky Anti-Virus-service; C:\Program Files\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe [2013-10-16 356128] R2 CSObjectsSrv;CryptoStorage control service; C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [2012-12-21 819040] R2 HsfXAudioService;HsfXAudioService; C:\Windows\system32\svchost.exe [2009-07-14 20992] R2 PDFProFiltSrvPP;PDFProFiltSrvPP; C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe [2010-03-08 144672] R2 RapportMgmtService;Rapport Management Service; C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe [2013-12-21 1444120] R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2013-08-27 93072] R3 BrYNSvc;BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [2010-01-25 245760] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144] S2 hpqddsvc;HP CUE DeviceDiscovery-service; C:\Windows\system32\svchost.exe [2009-07-14 20992] S2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992] S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 20992] S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-09-05 171680] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-05 257928] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-02-08 136120] S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2013-11-26 108032] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-10-06 1343400] S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688] S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856] S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856] S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856] -----------------EOF-----------------