ComboFix 14-05-10.01 - Kristof 11/05/2014 20:06:11.1.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.32.1043.18.4095.2705 [GMT 2:00] Gestart vanuit: c:\users\Public\Desktop\ComboFix.exe AV: AVG Internet Security 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} FW: AVG Internet Security 2014 *Disabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2} SP: AVG Internet Security 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Kristof\AppData\Local\Microsoft\Windows\Temporary Internet Files\f42a699f-0376-434b-9b46-0263a80a2ab9.jpg . . (((((((((((((((((((( Bestanden Gemaakt van 2014-04-11 to 2014-05-11 )))))))))))))))))))))))))))))) . . 2014-05-11 18:31 . 2014-05-11 18:31 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-05-09 07:48 . 2014-05-09 07:48 -------- d-----w- c:\program files\Intel 2014-05-09 07:47 . 2014-05-09 07:47 -------- d-----w- c:\programdata\Package Cache 2014-05-09 07:29 . 2014-05-09 07:48 -------- d-----w- c:\programdata\DriverGenius 2014-05-09 07:29 . 2014-05-09 07:29 -------- d-----w- c:\program files (x86)\Driver-Soft 2014-05-08 19:46 . 2010-08-30 06:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll 2014-05-08 19:45 . 2014-05-08 19:48 -------- d-----w- C:\AdwCleaner 2014-05-08 19:44 . 2014-05-08 19:44 1316991 ----a-w- C:\adwcleaner.exe 2014-05-08 12:57 . 2014-05-08 12:57 -------- d-----w- c:\program files\HP Wireless Keyboard 2014-05-08 12:57 . 2006-11-07 08:57 49152 ------w- c:\windows\RunSetup.dll 2014-05-08 10:05 . 2014-05-08 10:05 -------- d-----w- c:\windows\CheckSur 2014-05-08 09:29 . 2014-05-08 09:29 -------- d-----w- C:\Extreme simulateur 2014-05-08 09:23 . 2014-05-08 09:23 -------- d-----w- c:\program files\CPUID 2014-05-08 09:20 . 2014-05-08 09:20 -------- d-----w- c:\programdata\NovaTech Network 2014-05-08 09:18 . 2014-05-08 09:18 -------- d-----w- c:\program files (x86)\Novawave 2014-05-07 18:44 . 2014-05-11 18:31 -------- d-----w- c:\users\Kristof\AppData\Local\Temp 2014-05-07 18:44 . 2014-05-07 18:29 24064 ----a-w- c:\windows\zoek-delete.exe 2014-05-07 18:27 . 2014-05-07 18:38 -------- d-----w- C:\zoek_backup 2014-05-07 08:20 . 2014-04-14 18:13 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2014-05-07 07:28 . 2014-05-09 14:16 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2014-05-07 07:28 . 2014-05-07 07:28 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware 2014-05-07 07:28 . 2014-04-03 07:51 63192 ----a-w- c:\windows\system32\drivers\mwac.sys 2014-05-07 07:28 . 2014-04-03 07:51 88280 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2014-05-07 07:09 . 2014-05-07 07:09 -------- d-----w- C:\rsit 2014-05-07 07:09 . 2014-05-07 07:09 -------- d-----w- c:\program files\trend micro 2014-05-07 07:08 . 2014-05-07 07:08 935175 ----a-w- C:\RSITx64.exe 2014-05-06 10:49 . 2014-04-29 14:01 23547904 ----a-w- c:\windows\system32\mshtml.dll 2014-05-06 10:49 . 2014-04-29 13:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb 2014-05-06 10:49 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb 2014-05-06 10:45 . 2014-05-06 10:45 -------- d-----w- c:\program files (x86)\Intel 2014-05-06 10:45 . 2000-01-01 00:00 53248 ----a-w- c:\windows\SysWow64\CSVer.dll 2014-05-06 10:45 . 2014-05-06 10:45 -------- d-----w- C:\Intel 2014-05-06 10:42 . 2014-05-06 10:42 -------- d-----w- c:\users\Kristof\AppData\Local\NVIDIA Corporation 2014-05-06 10:41 . 2014-02-05 09:31 1048152 ----a-w- c:\windows\SysWow64\nvspcap.dll 2014-05-06 10:41 . 2014-02-05 09:30 1179576 ----a-w- c:\windows\system32\nvspcap64.dll 2014-05-06 10:41 . 2014-05-08 08:11 -------- d-----w- c:\users\Kristof\AppData\Local\NVIDIA 2014-05-06 10:39 . 2014-03-04 11:32 599840 ----a-w- c:\windows\SysWow64\nvStreaming.exe 2014-05-06 10:16 . 2014-05-06 10:16 -------- d-----w- C:\kristof 2014-05-06 10:15 . 2014-05-06 10:15 -------- d-----w- c:\users\Kristof\AppData\Local\SlimWare Utilities Inc 2014-04-29 18:09 . 2014-04-29 18:09 -------- d-s---w- c:\windows\system32\CompatTel 2014-04-29 18:09 . 2014-04-14 02:24 465408 ----a-w- c:\windows\system32\aepdu.dll 2014-04-29 18:09 . 2014-04-14 02:19 424448 ----a-w- c:\windows\system32\aeinv.dll 2014-04-27 16:45 . 2014-04-27 16:45 -------- d-----w- c:\users\Default\AppData\Roaming\TuneUp Software 2014-04-23 09:21 . 2014-04-23 09:21 3872984 ----a-w- c:\windows\system32\drivers\RTKVHD64.sys 2014-04-23 09:21 . 2014-04-23 09:21 2792152 ----a-w- c:\windows\system32\RtkAPO64.dll 2014-04-23 09:20 . 2014-04-23 09:21 1024216 ----a-w- c:\windows\system32\RtkApi64.dll 2014-04-23 09:20 . 2014-04-23 09:20 624344 ----a-w- c:\windows\system32\RtDataProc64.dll 2014-04-23 09:20 . 2014-04-23 09:20 1286872 ----a-w- c:\windows\system32\RTCOM64.dll 2014-04-23 09:20 . 2014-04-23 09:20 56270848 ----a-w- c:\windows\system32\RCoRes64.dat 2014-04-23 09:20 . 2014-04-23 09:20 946392 ----a-w- c:\windows\system32\RCoInstII64.dll 2014-04-23 09:19 . 2014-04-23 09:19 2770976 ----a-w- c:\windows\system32\FMAPO64.dll 2014-04-23 09:18 . 2014-04-23 09:18 901848 ----a-w- c:\windows\system32\drivers\Rt64win7.sys 2014-04-23 09:18 . 2014-04-23 09:18 73800 ----a-w- c:\windows\system32\RtNicProp64.dll 2014-04-23 09:10 . 2014-04-23 09:10 1516488 ----a-w- c:\windows\system32\nvdispgenco6433523.dll 2014-04-23 09:10 . 2014-04-23 09:10 1885472 ----a-w- c:\windows\system32\nvdispco6433523.dll 2014-04-23 07:15 . 2014-04-23 07:15 -------- d-----w- c:\users\Kristof\AppData\Roaming\AVG2014 2014-04-23 07:14 . 2014-04-23 07:14 -------- d-----w- c:\users\Kristof\AppData\Roaming\TuneUp Software 2014-04-23 07:14 . 2014-04-23 07:14 -------- d-----w- c:\programdata\AVG2014 2014-04-23 07:14 . 2014-04-23 07:14 -------- d-----w- C:\$AVG 2014-04-23 07:13 . 2014-04-23 07:13 -------- d-----w- c:\program files (x86)\AVG 2014-04-23 07:11 . 2014-04-23 08:25 -------- d-----w- c:\users\Kristof\AppData\Local\Avg2014 2014-04-23 07:03 . 2014-04-23 07:03 -------- d-s---w- c:\windows\SysWow64\Microsoft 2014-04-23 07:03 . 2014-04-17 03:31 10651704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6B7D81DC-8FC8-424F-A6B3-96DE9E4AAD48}\mpengine.dll 2014-04-21 14:33 . 2014-04-21 14:33 -------- d-sh--w- c:\users\Kristof\AppData\Local\EmieUserList 2014-04-21 14:33 . 2014-04-21 14:33 -------- d-sh--w- c:\users\Kristof\AppData\Local\EmieSiteList 2014-04-21 08:23 . 2014-03-06 09:19 8011776 ----a-w- c:\program files\Internet Explorer\F12Resources.dll 2014-04-19 13:42 . 2014-04-21 17:54 -------- d-----w- c:\program files\Microsoft Mouse and Keyboard Center 2014-04-18 13:01 . 2014-04-18 13:01 237336 ----a-w- c:\windows\system32\drivers\avgidsdrivera.sys . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-04-29 18:03 . 2012-05-24 11:41 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-04-29 18:03 . 2012-05-24 11:41 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-04-23 09:18 . 2014-03-23 17:34 107552 ----a-w- c:\windows\system32\RTNUninst64.dll 2014-04-11 08:22 . 2012-05-23 12:23 90655440 ----a-w- c:\windows\system32\MRT.exe 2014-04-03 07:50 . 2013-07-18 09:00 25816 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-03-31 14:20 . 2014-03-31 14:20 274200 ----a-w- c:\windows\system32\drivers\avgtdia.sys 2014-03-31 14:06 . 2014-03-31 14:06 130840 ----a-w- c:\windows\system32\drivers\avgmfx64.sys 2014-03-31 07:35 . 2012-05-22 13:55 270496 ------w- c:\windows\system32\MpSigStub.exe 2014-03-27 20:14 . 2014-03-27 20:14 192792 ----a-w- c:\windows\system32\drivers\avgidsha.sys 2014-03-27 20:14 . 2014-03-27 20:14 153368 ----a-w- c:\windows\system32\drivers\avgdiska.sys 2014-03-27 20:07 . 2014-03-27 20:07 236824 ----a-w- c:\windows\system32\drivers\avgldx64.sys 2014-03-27 20:05 . 2014-03-27 20:05 324376 ----a-w- c:\windows\system32\drivers\avgloga.sys 2014-03-27 20:03 . 2014-03-27 20:03 32536 ----a-w- c:\windows\system32\drivers\avgrkx64.sys 2014-03-23 17:35 . 2014-03-23 17:35 518896 ----a-w- c:\windows\system32\SRSTSX64.dll 2014-03-23 17:35 . 2014-03-23 17:35 211184 ----a-w- c:\windows\system32\SRSTSH64.dll 2014-03-23 17:35 . 2014-03-23 17:35 198896 ----a-w- c:\windows\system32\SRSHP64.dll 2014-03-23 17:35 . 2014-03-23 17:35 155888 ----a-w- c:\windows\system32\SRSWOW64.dll 2014-03-23 17:35 . 2014-03-23 17:35 331880 ----a-w- c:\windows\system32\RtlCPAPI64.dll 2014-03-23 17:35 . 2014-03-23 17:35 2825432 ----a-w- c:\windows\system32\RtPgEx64.dll 2014-03-23 17:35 . 2014-03-23 17:35 1958616 ----a-w- c:\windows\system32\RTSnMg64.cpl 2014-03-23 17:35 . 2014-03-23 17:35 149608 ----a-w- c:\windows\system32\RtkCfg64.dll 2014-03-23 17:35 . 2014-03-23 17:35 14952 ----a-w- c:\windows\system32\RtkCoLDR64.dll 2014-03-23 17:35 . 2014-03-23 17:35 78680 ----a-w- c:\windows\system32\RTEEG64A.dll 2014-03-23 17:35 . 2014-03-23 17:35 375128 ----a-w- c:\windows\system32\RTEEP64A.dll 2014-03-23 17:35 . 2014-03-23 17:35 310104 ----a-w- c:\windows\system32\RP3DHT64.dll 2014-03-23 17:35 . 2014-03-23 17:35 204120 ----a-w- c:\windows\system32\RTEED64A.dll 2014-03-23 17:35 . 2014-03-23 17:35 101208 ----a-w- c:\windows\system32\RTEEL64A.dll 2014-03-23 17:35 . 2014-03-23 17:35 310104 ----a-w- c:\windows\system32\RP3DAA64.dll 2014-03-23 17:35 . 2014-03-23 17:35 209096 ----a-w- c:\windows\system32\AERTAC64.dll 2014-03-23 17:35 . 2014-03-23 17:35 113576 ----a-w- c:\windows\system32\CONEQMSAPOGUILibrary.dll 2014-03-23 17:35 . 2014-03-23 17:35 108640 ----a-w- c:\windows\system32\AERTAR64.dll 2014-03-23 17:32 . 2014-03-23 17:32 1885472 ----a-w- c:\windows\system32\nvdispco6433489.dll 2014-03-23 17:32 . 2014-03-23 17:32 1515296 ----a-w- c:\windows\system32\nvdispgenco6433489.dll 2014-03-23 17:31 . 2014-03-23 17:31 50176 ----a-w- c:\windows\system32\drivers\RtsUCcid.sys 2014-03-23 17:31 . 2014-03-23 17:31 314880 ----a-w- c:\windows\system32\RtsUCcid.dll 2014-03-23 17:27 . 2014-03-23 17:27 9889352 ----a-w- c:\windows\SysWow64\RsCRIcon.dll 2014-03-23 17:27 . 2014-03-23 17:27 271064 ----a-w- c:\windows\system32\drivers\RtsUStor.sys 2014-03-04 14:35 . 2014-03-23 17:32 18302384 ----a-w- c:\windows\system32\nvwgf2umx.dll 2014-03-04 14:35 . 2014-03-23 17:32 14709720 ----a-w- c:\windows\SysWow64\nvd3dum.dll 2014-03-04 14:35 . 2014-03-23 17:32 3093280 ----a-w- c:\windows\system32\nvapi64.dll 2014-03-04 13:06 . 2012-06-27 17:24 6714312 ----a-w- c:\windows\system32\nvcpl.dll 2014-03-04 13:06 . 2012-06-27 17:24 3497816 ----a-w- c:\windows\system32\nvsvc64.dll 2014-03-04 13:05 . 2012-06-27 17:24 922968 ----a-w- c:\windows\system32\nvvsvc.exe 2014-03-04 13:05 . 2012-06-27 17:24 64968 ----a-w- c:\windows\system32\nvshext.dll 2014-03-04 13:05 . 2012-06-27 17:24 2558808 ----a-w- c:\windows\system32\nvsvcr.dll 2014-03-04 13:05 . 2012-06-27 17:24 386336 ----a-w- c:\windows\system32\nvmctray.dll 2014-03-04 09:44 . 2014-04-10 07:02 362496 ----a-w- c:\windows\system32\wow64win.dll 2014-03-04 09:44 . 2014-04-10 07:02 243712 ----a-w- c:\windows\system32\wow64.dll 2014-03-04 09:44 . 2014-04-10 07:02 13312 ----a-w- c:\windows\system32\wow64cpu.dll 2014-03-04 09:44 . 2014-04-10 07:02 16384 ----a-w- c:\windows\system32\ntvdm64.dll 2014-03-04 09:44 . 2014-04-10 07:02 1163264 ----a-w- c:\windows\system32\kernel32.dll 2014-03-04 09:17 . 2014-04-10 07:02 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll 2014-03-04 09:17 . 2014-04-10 07:02 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2014-03-04 09:16 . 2014-04-10 07:02 25600 ----a-w- c:\windows\SysWow64\setup16.exe 2014-03-04 09:16 . 2014-04-10 07:02 5120 ----a-w- c:\windows\SysWow64\wow32.dll 2014-03-04 08:09 . 2014-04-10 07:02 7680 ----a-w- c:\windows\SysWow64\instnm.exe 2014-03-04 08:09 . 2014-04-10 07:02 2048 ----a-w- c:\windows\SysWow64\user.exe . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Kristof\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Kristof\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Kristof\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 130736 ----a-w- c:\users\Kristof\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-11-22 2736128] "DAEMON Tools Ultra Agent"="c:\program files (x86)\DAEMON Tools Ultra\DTAgent.exe" [2013-05-23 3123744] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] "AVG_UI"="c:\program files (x86)\AVG\AVG2014\avgui.exe" [2014-04-06 5180432] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 0 (0x0) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0bootdelete . R2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG2014\avgfws.exe;c:\program files (x86)\AVG\AVG2014\avgfws.exe [x] R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x] R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x] S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x] S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x] S0 waemu;waemu;c:\windows\system32\Drivers\waemu.sys;c:\windows\SYSNATIVE\Drivers\waemu.sys [x] S1 Avgdiska;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiska.sys;c:\windows\SYSNATIVE\DRIVERS\avgdiska.sys [x] S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys;c:\windows\SYSNATIVE\DRIVERS\avgfwd6a.sys [x] S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe [x] S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [x] S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x] S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x] S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [x] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x] S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x] S2 WinArchiver Service;WinArchiver Service;c:\program files (x86)\WinArchiver\WAService.exe;c:\program files (x86)\WinArchiver\WAService.exe [x] S3 Disc Soft Bus Service;Disc Soft Bus Service;c:\program files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe;c:\program files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe [x] S3 dtscsibus;DAEMON Tools Virtual SCSI Bus;c:\windows\system32\DRIVERS\dtscsibus.sys;c:\windows\SYSNATIVE\DRIVERS\dtscsibus.sys [x] S3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys;c:\windows\SYSNATIVE\drivers\HCW85BDA.sys [x] S3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x] S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x] S3 RSUSBCCID;Realtek Smartcard Reader Driver;c:\windows\system32\DRIVERS\RtsUCcid.sys;c:\windows\SYSNATIVE\DRIVERS\RtsUCcid.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] . . --- Andere Services/Drivers In Geheugen --- . *Deregistered* - MBAMWebAccessControl . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2010-11-22 12:18 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-04-25 08:17 1078088 ----a-w- c:\program files (x86)\Google\Chrome\Application\34.0.1847.131\Installer\chrmstp.exe . Inhoud van de 'Gedeelde Taken' map . 2014-05-11 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-24 18:03] . 2014-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-11 13:54] . 2014-05-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-11 13:54] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 ----a-w- c:\users\Kristof\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 ----a-w- c:\users\Kristof\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 ----a-w- c:\users\Kristof\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-05-25 00:36 164016 ----a-w- c:\users\Kristof\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2014-04-23 13667032] "NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-02-05 2234144] "ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-02-05 1179576] "BtcMaestro"="c:\program files\HP Wireless Keyboard\KMaestro64.exe" [2007-11-15 385536] . ------- Bijkomende Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = https://www.google.be/ mLocal Page = c:\windows\SysWOW64\blank.htm TCP: DhcpNameServer = 195.130.131.133 195.130.130.5 . - - - - ORPHANS VERWIJDERD - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-Wondershare Helper Compact.exe - c:\program files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe Toolbar-Locked - (no file) ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file) AddRemove-AVS Update Manager_is1 - c:\program files (x86)\AVS4YOU\AVSUpdateManager\unins000.exe AddRemove-AVS4YOU Software Navigator_is1 - c:\program files (x86)\AVS4YOU\AVSSoftwareNavigator\unins000.exe AddRemove-AVS4YOU Video Converter 7_is1 - c:\program files (x86)\AVS4YOU\AVSVideoConverter\unins000.exe AddRemove-Works for Digital Cameras_is1 - c:\program files (x86)\BWorks\unins000.exe AddRemove-Future Dance Simulatie - c:\program files (x86)\Future Dance Simulatie\Uninstal.exe AddRemove-Wondershare DVD Slideshow Builder Deluxe_is1 - c:\program files (x86)\Wondershare\DVD Slideshow Builder Deluxe\unins000.exe . . . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.13" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Voltooingstijd: 2014-05-11 20:33:45 ComboFix-quarantined-files.txt 2014-05-11 18:33 . Pre-Run: 103.060.508.672 bytes beschikbaar Post-Run: 102.841.253.888 bytes beschikbaar . - - End Of File - - 041C6899AD7255D8C79EF4363054A3DD F8FC7085AD2C026823BF51A6EA0125EA