Logfile of random's system information tool 1.10 (written by random/random)
Run by Ria at 2015-08-01 15:29:52
Microsoft Windows 7 Home Premium  Service Pack 1
System drive C: has 24 GB (21%) free of 114 GB
Total RAM: 8173 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:29:53, on 1-8-2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17910)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\N360.exe
C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe
C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe
C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39brmon.exe
C:\Program Files (x86)\ABN AMRO e.dentifier2\wss\becwsupa.exe
C:\Program Files (x86)\KPN\Servicetool\KPNServicetool_Launcher.exe
C:\Program Files (x86)\KPN\Servicetool\KPNServicetool_Repair.exe
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files\trend micro\Ria.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kpnvandaag.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {26842a09-ffa8-4e2c-ae12-0c80f01c3295} - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39SrcAs.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Toolbar BHO - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - C:\PROGRA~2\MAPSGA~2\bar\1.bin\39bar.dll
O2 - BHO: QuickShare WidgetEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - mscoree.dll (file missing)
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\IPS\IPSBHO.DLL (file missing)
O2 - BHO: Search Assistant BHO - {71c1d63a-c944-428a-a5bd-ba513190e5d2} - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39SrcAs.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll
O3 - Toolbar: MapsGalaxy - {364ea597-e728-4ce4-bb4a-ed846ef47970} - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39bar.dll
O3 - Toolbar: QuickShare Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - mscoree.dll (file missing)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\coIEPlg.dll
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [MapsGalaxy Search Scope Monitor] "C:\PROGRA~2\MAPSGA~2\bar\1.bin\39srchmn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [MapsGalaxy_39 Browser Plugin Loader] C:\PROGRA~2\MAPSGA~2\bar\1.bin\39brmon.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Becwsupa] "C:\Program Files (x86)\ABN AMRO e.dentifier2\wss\becwsupa.exe"
O4 - HKLM\..\Run: [Servicetool] C:\Program Files (x86)\KPN\Servicetool\KPNServicetool_Launcher.exe /auto
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [BIBLauncher] C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} (CeWe Color AG & Co. OHG Control) - https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game.zylom.com/activex/zylomgamesplayer.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs:  
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: E.dentifier2 Connector Service (becwssvr) - ABN AMRO - C:\Program Files (x86)\ABN AMRO e.dentifier2\wss\becwssvr.exe
O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MapsGalaxyService (MapsGalaxy_39Service) - COMPANYVERS_NAME - C:\PROGRA~2\MAPSGA~2\bar\1.bin\39barsvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\N360.exe
O23 - Service: Norton Identity Safe (NCO) - Symantec Corporation - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Rapport Management Service (RapportMgmtService) - IBM Corp. - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11410 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe"
winlogon.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\ABN AMRO e.dentifier2\wss\becwssvr.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\PROGRA~2\MAPSGA~2\bar\1.bin\39barsvc.exe
"C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\N360.exe" /s "N360" /m "C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\diMaster.dll" /prefetch:1
"C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe" /s "NCO" /m "C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\diMaster.dll" /prefetch:1
"C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe"
"C:\Program Files\CyberLink\Shared files\RichVideo64.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-b3cc9223-05ff-4f37-99f0-f98cc8eed9bc -SystemEventPortName:HostProcess-c191ebe6-d705-4605-958f-dac8c1249aa4 -IoCancelEventPortName:HostProcess-7a52ee20-5d2c-4a1a-92f1-778980fdcb00 -NonStateChangingEventPortName:HostProcess-b9a6e5ef-cf86-4d2a-8a6c-baaa51b90af0 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:8e5bd908-8721-42cb-80e3-7b11e841c4a4 -DeviceGroupId:WpdFsGroup
C:\Windows\system32\wbem\wmiprvse.exe
"taskhost.exe"
"C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\N360.exe" /c /a /s UserSession2
"C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe" /c /a /s UserSession
taskeng.exe {45F33BFB-AABF-4932-B8ED-55919DBE08F7}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.28.1\GoogleCrashHandler64.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\AppIntegrator64.exe" 
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe" 
"C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39brmon.exe" 
"C:\Program Files (x86)\ABN AMRO e.dentifier2\wss\becwsupa.exe" 
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\KPN\Servicetool\KPNServicetool_Launcher.exe" /auto
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files (x86)\KPN\Servicetool\KPNServicetool_Repair.exe" /auto
"C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe" -servicelaunch=true 
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"taskhost.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k swprv
"C:\Windows\system32\GWX\GWX.exe" 
taskeng.exe {8F85C61B-9DE5-4A8F-AC9C-0BE225A97976}
"C:\Program Files\Internet Explorer\iexplore.exe" 
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4956 CREDAT:267521 /prefetch:2
C:\Windows\system32\Macromed\Flash\FlashUtil64_18_0_0_209_ActiveX.exe -Embedding
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4956 CREDAT:595280 /prefetch:2
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 532 536 544 65536 540 
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" 
wmiadap.exe /F /T /R
"C:\Windows\system32\NOTEPAD.EXE" C:\rsit\info.txt
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Ria\Desktop\RSITx64.exe" 

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\Ria\AppData\Roaming\Mozilla\Firefox\Profiles\n01zkiuv.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@ABNAMRO/BECON,version=1.00]
"Description"=ABN AMRO e.dentifier2 Plug-in 1.0 for Mozilla
"Path"=C:\Program Files (x86)\ABN AMRO e.dentifier2\Mozilla\npBECON.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 18.0.0.209 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1214154.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@canon.com/EPPEX]
"Description"=Canon Easy-PhotoPrint EX
"Path"=C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.31.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.31.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 18.0.0.209 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL


C:\Users\Ria\AppData\Roaming\Mozilla\Firefox\Profiles\n01zkiuv.default\extensions\
{594657B4-413A-41D0-8F85-A6D3F35C9BDF}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
QuickShare WidgetEngine - C:\Windows\system32\mscoree.dll [2010-11-21 444752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Norton Identity Protection - C:\Program Files (x86)\Norton 360\Engine64\22.5.2.15\coIEPlg.dll [2015-07-10 1042744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1e91a655-bb4b-4693-a05e-2edebc4c9d89}]
Toolbar BHO - C:\PROGRA~2\MAPSGA~2\bar\1.bin\39bar.dll [2013-05-01 708168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
QuickShare WidgetEngine - C:\Windows\system32\mscoree.dll [2010-11-21 444752]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Norton Identity Protection - C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\coIEPlg.dll [2015-07-10 798008]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Norton Vulnerability Protection - C:\Program Files (x86)\Norton 360\Engine\21.7.0.11\IPS\IPSBHO.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{71c1d63a-c944-428a-a5bd-ba513190e5d2}]
Search Assistant BHO - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39SrcAs.dll [2013-05-01 62864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24 172968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{ae07101b-46d4-4a98-af68-0333ea26e113} - QuickShare Widget - C:\Windows\system32\mscoree.dll [2010-11-21 444752]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton 360\Engine64\22.5.2.15\coIEPlg.dll [2015-07-10 1042744]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{364ea597-e728-4ce4-bb4a-ed846ef47970} - MapsGalaxy - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39bar.dll [2013-05-01 708168]
{ae07101b-46d4-4a98-af68-0333ea26e113} - QuickShare Widget - C:\Windows\system32\mscoree.dll [2010-11-21 444752]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\coIEPlg.dll [2015-07-10 798008]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-11-19 11613288]
"Logitech Download Assistant"=C:\Windows\System32\LogiLDA.dll [2012-09-20 1832760]
"MapsGalaxy Home Page Guard 64 bit"=C:\PROGRA~2\MAPSGA~2\bar\1.bin\AppIntegrator64.exe [2013-05-01 548936]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe []
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"BIBLauncher"=C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe [2012-02-06 913888]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2014-07-31 43816]
"MapsGalaxy Search Scope Monitor"=C:\PROGRA~2\MAPSGA~2\bar\1.bin\39srchmn.exe [2013-05-01 44784]
"MapsGalaxy_39 Browser Plugin Loader"=C:\PROGRA~2\MAPSGA~2\bar\1.bin\39brmon.exe [2013-05-01 30096]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2013-03-28 642656]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2014-10-02 421888]
"Becwsupa"=C:\Program Files (x86)\ABN AMRO e.dentifier2\wss\becwsupa.exe [2014-11-28 162136]
"Servicetool"=C:\Program Files (x86)\KPN\Servicetool\KPNServicetool_Launcher.exe [2015-04-23 11573840]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-08-01 15:29:00 ----DC---- C:\rsit
2015-08-01 15:29:00 ----DC---- C:\Program Files\trend micro
2015-08-01 09:10:23 ----N---- C:\bootsqm.dat
2015-07-30 21:00:43 ----DC---- C:\Program Files\WinZip Driver Updater
2015-07-28 13:56:23 ----A---- C:\Windows\system32\generaltel.dll
2015-07-28 13:56:23 ----A---- C:\Windows\system32\devinv.dll
2015-07-28 13:56:23 ----A---- C:\Windows\system32\appraiser.dll
2015-07-28 13:56:23 ----A---- C:\Windows\system32\acmigration.dll
2015-07-28 13:56:22 ----A---- C:\Windows\system32\invagent.dll
2015-07-28 13:56:22 ----A---- C:\Windows\system32\CompatTelRunner.exe
2015-07-28 13:56:22 ----A---- C:\Windows\system32\aepdu.dll
2015-07-28 13:56:22 ----A---- C:\Windows\system32\aeinv.dll
2015-07-21 11:06:02 ----A---- C:\Windows\SYSWOW64\lpk.dll
2015-07-21 11:06:02 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2015-07-21 11:06:02 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2015-07-21 11:06:02 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2015-07-21 11:06:02 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2015-07-21 11:06:02 ----A---- C:\Windows\system32\lpk.dll
2015-07-21 11:06:02 ----A---- C:\Windows\system32\fontsub.dll
2015-07-21 11:06:02 ----A---- C:\Windows\system32\dciman32.dll
2015-07-21 11:06:02 ----A---- C:\Windows\system32\atmlib.dll
2015-07-21 11:06:02 ----A---- C:\Windows\system32\atmfd.dll
2015-07-15 10:38:21 ----A---- C:\Windows\SYSWOW64\cewmdm.dll
2015-07-15 10:38:21 ----A---- C:\Windows\system32\cewmdm.dll
2015-07-15 10:38:19 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2015-07-15 10:38:19 ----A---- C:\Windows\SYSWOW64\wups.dll
2015-07-15 10:38:19 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2015-07-15 10:38:19 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2015-07-15 10:38:19 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wuwebv.dll
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wups2.dll
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wups.dll
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wudriver.dll
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wucltux.dll
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wuaueng.dll
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wuauclt.exe
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wuapp.exe
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wuapi.dll
2015-07-15 10:38:19 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2015-07-15 10:38:19 ----A---- C:\Windows\system32\WinSetupUI.dll
2015-07-15 10:38:14 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-15 10:38:14 ----A---- C:\Windows\system32\rdpcorets.dll
2015-07-15 10:38:13 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2015-07-15 10:38:13 ----A---- C:\Windows\system32\win32k.sys
2015-07-15 10:38:13 ----A---- C:\Windows\system32\jscript9diag.dll
2015-07-15 10:38:13 ----A---- C:\Windows\system32\gdi32.dll
2015-07-15 10:38:12 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-07-15 10:38:12 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-07-15 10:38:12 ----A---- C:\Windows\system32\jscript9.dll
2015-07-15 10:38:10 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-07-15 10:38:09 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-07-15 10:38:09 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-07-15 10:38:09 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-07-15 10:38:08 ----A---- C:\Windows\system32\urlmon.dll
2015-07-15 10:38:08 ----A---- C:\Windows\system32\mshtml.dll
2015-07-15 10:38:08 ----A---- C:\Windows\system32\ieui.dll
2015-07-15 10:38:08 ----A---- C:\Windows\system32\ieframe.dll
2015-07-15 10:38:07 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-07-15 10:38:07 ----A---- C:\Windows\system32\iertutil.dll
2015-07-15 10:36:41 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-07-15 10:36:41 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-07-15 10:36:41 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-07-15 10:36:41 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-07-15 10:36:41 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-07-15 10:36:41 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-07-15 10:36:41 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-07-15 10:36:41 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-07-15 10:36:41 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-07-15 10:36:41 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-15 10:36:41 ----A---- C:\Windows\system32\iernonce.dll
2015-07-15 10:36:41 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-07-15 10:36:41 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-07-15 10:36:41 ----A---- C:\Windows\system32\ie4uinit.exe
2015-07-15 10:36:40 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-07-15 10:36:40 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-07-15 10:36:40 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-07-15 10:36:40 ----A---- C:\Windows\system32\iedkcs32.dll
2015-07-15 10:36:39 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-07-15 10:36:39 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-07-15 10:36:39 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-07-15 10:36:39 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-07-15 10:36:39 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-15 10:36:39 ----A---- C:\Windows\system32\msfeeds.dll
2015-07-15 10:36:39 ----A---- C:\Windows\system32\iesetup.dll
2015-07-15 10:36:39 ----A---- C:\Windows\system32\ieapfltr.dll
2015-07-15 10:36:39 ----A---- C:\Windows\system32\dxtrans.dll
2015-07-15 10:36:38 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-07-15 10:36:38 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-07-15 10:36:38 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-07-15 10:36:38 ----A---- C:\Windows\system32\vbscript.dll
2015-07-15 10:36:38 ----A---- C:\Windows\system32\jsproxy.dll
2015-07-15 10:36:38 ----A---- C:\Windows\system32\ieUnatt.exe
2015-07-15 10:36:37 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-07-15 10:36:37 ----A---- C:\Windows\system32\mshtmled.dll
2015-07-15 10:36:37 ----A---- C:\Windows\system32\dxtmsft.dll
2015-07-15 10:36:36 ----A---- C:\Windows\system32\wininet.dll
2015-07-15 10:36:36 ----A---- C:\Windows\system32\msrating.dll
2015-07-15 10:36:36 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-07-15 10:36:36 ----A---- C:\Windows\system32\jscript.dll
2015-07-15 10:35:48 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2015-07-15 10:35:48 ----A---- C:\Windows\system32\wksprt.exe
2015-07-15 10:35:48 ----A---- C:\Windows\system32\mstscax.dll
2015-07-15 10:35:47 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2015-07-15 10:35:47 ----A---- C:\Windows\SYSWOW64\rdvidcrl.dll
2015-07-15 10:35:47 ----A---- C:\Windows\system32\tsgqec.dll
2015-07-15 10:35:47 ----A---- C:\Windows\system32\rdvidcrl.dll
2015-07-15 10:35:46 ----A---- C:\Windows\SYSWOW64\ole32.dll
2015-07-15 10:35:46 ----A---- C:\Windows\system32\ole32.dll
2015-07-15 10:35:43 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2015-07-15 10:35:43 ----A---- C:\Windows\SYSWOW64\cryptsvc.dll
2015-07-15 10:35:43 ----A---- C:\Windows\SYSWOW64\cryptnet.dll
2015-07-15 10:35:43 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2015-07-15 10:35:43 ----A---- C:\Windows\system32\wintrust.dll
2015-07-15 10:35:43 ----A---- C:\Windows\system32\cryptsvc.dll
2015-07-15 10:35:43 ----A---- C:\Windows\system32\cryptnet.dll
2015-07-15 10:35:43 ----A---- C:\Windows\system32\crypt32.dll
2015-07-15 10:35:36 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-07-15 10:35:36 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-07-15 10:35:36 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2015-07-15 10:35:36 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-07-15 10:35:36 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-07-15 10:35:36 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-07-15 10:35:36 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2015-07-15 10:35:36 ----A---- C:\Windows\system32\wdigest.dll
2015-07-15 10:35:36 ----A---- C:\Windows\system32\schannel.dll
2015-07-15 10:35:36 ----A---- C:\Windows\system32\rpcrt4.dll
2015-07-15 10:35:36 ----A---- C:\Windows\system32\ncrypt.dll
2015-07-15 10:35:36 ----A---- C:\Windows\system32\msv1_0.dll
2015-07-15 10:35:36 ----A---- C:\Windows\system32\lsasrv.dll
2015-07-15 10:35:36 ----A---- C:\Windows\system32\kerberos.dll
2015-07-15 10:35:36 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2015-07-15 10:35:36 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2015-07-15 10:35:36 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2015-07-15 10:35:36 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-07-15 10:35:36 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-07-15 10:35:36 ----A---- C:\Windows\system32\cryptbase.dll
2015-07-15 10:35:35 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-07-15 10:35:35 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-07-15 10:35:35 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-07-15 10:35:35 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-07-15 10:35:35 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-07-15 10:35:35 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-07-15 10:35:35 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-07-15 10:35:35 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-07-15 10:35:35 ----A---- C:\Windows\system32\TSpkg.dll
2015-07-15 10:35:35 ----A---- C:\Windows\system32\sspisrv.dll
2015-07-15 10:35:35 ----A---- C:\Windows\system32\sspicli.dll
2015-07-15 10:35:35 ----A---- C:\Windows\system32\secur32.dll
2015-07-15 10:35:35 ----A---- C:\Windows\system32\msobjs.dll
2015-07-15 10:35:35 ----A---- C:\Windows\system32\msaudite.dll
2015-07-15 10:35:35 ----A---- C:\Windows\system32\lsass.exe
2015-07-15 10:35:35 ----A---- C:\Windows\system32\credssp.dll
2015-07-15 10:35:35 ----A---- C:\Windows\system32\auditpol.exe
2015-07-15 10:35:35 ----A---- C:\Windows\system32\adtschema.dll
2015-07-15 10:35:28 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2015-07-15 10:35:28 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2015-07-15 10:35:28 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2015-07-15 10:35:28 ----A---- C:\Windows\SYSWOW64\msi.dll
2015-07-15 10:35:28 ----A---- C:\Windows\SYSWOW64\authui.dll
2015-07-15 10:35:28 ----A---- C:\Windows\system32\msimsg.dll
2015-07-15 10:35:28 ----A---- C:\Windows\system32\msihnd.dll
2015-07-15 10:35:28 ----A---- C:\Windows\system32\msiexec.exe
2015-07-15 10:35:28 ----A---- C:\Windows\system32\msi.dll
2015-07-15 10:35:28 ----A---- C:\Windows\system32\consent.exe
2015-07-15 10:35:28 ----A---- C:\Windows\system32\authui.dll
2015-07-15 10:35:28 ----A---- C:\Windows\system32\appinfo.dll
2015-07-11 04:33:46 ----AC---- C:\Windows\SYSWOW64\GPhotos.scr
2015-07-10 18:32:02 ----HD---- C:\$Windows.~BT
2015-07-07 11:54:24 ----DC---- C:\Program Files (x86)\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2015-08-01 15:29:49 ----DC---- C:\Windows\Temp
2015-08-01 15:29:49 ----DC---- C:\Windows\System32
2015-08-01 15:29:49 ----AC---- C:\Windows\system32\PerfStringBackup.INI
2015-08-01 15:29:00 ----DC---- C:\Program Files
2015-08-01 15:26:47 ----A---- C:\Windows\SYSWOW64\log.txt
2015-08-01 15:07:59 ----DC---- C:\Windows\Prefetch
2015-08-01 14:55:58 ----DC---- C:\Windows\Microsoft.NET
2015-08-01 14:54:52 ----RSDC---- C:\Windows\assembly
2015-08-01 14:15:42 ----DC---- C:\Windows\system32\Tasks
2015-08-01 14:11:32 ----SHD---- C:\System Volume Information
2015-08-01 11:52:29 ----DC---- C:\Windows\system32\config
2015-08-01 10:41:08 ----DC---- C:\Program Files\Recuva
2015-08-01 08:52:42 ----SHDC---- C:\Windows\Installer
2015-07-31 08:49:06 ----DC---- C:\Windows\SysWOW64
2015-07-31 08:35:36 ----HDC---- C:\ProgramData
2015-07-31 08:35:35 ----DC---- C:\Windows\Tasks
2015-07-30 20:51:52 ----RDC---- C:\Program Files (x86)
2015-07-29 22:43:16 ----DC---- C:\Users\Ria\AppData\Roaming\Corel
2015-07-28 22:16:25 ----SDC---- C:\Windows\system32\CompatTel
2015-07-28 16:00:53 ----DC---- C:\Windows\Panther
2015-07-28 14:02:04 ----DC---- C:\Windows\Logs
2015-07-28 13:52:06 ----DC---- C:\Windows\system32\catroot2
2015-07-28 13:52:06 ----D---- C:\Windows\winsxs
2015-07-28 13:52:03 ----DC---- C:\Windows\SoftwareDistribution
2015-07-28 13:49:08 ----DC---- C:\Windows\system32\drivers\N360x64
2015-07-27 10:14:06 ----SDC---- C:\Windows\system32\GWX
2015-07-23 12:35:47 ----DC---- C:\Program Files\Pixum
2015-07-23 12:33:58 ----DC---- C:\ProgramData\tmp
2015-07-22 10:58:13 ----DC---- C:\Program Files (x86)\Google
2015-07-20 12:39:14 ----DC---- C:\Program Files (x86)\Internet Explorer
2015-07-18 14:37:40 ----SDC---- C:\Users\Ria\AppData\Roaming\Microsoft
2015-07-16 16:35:21 ----SDC---- C:\Windows\SYSWOW64\GWX
2015-07-15 22:14:33 ----D---- C:\Windows\rescache
2015-07-15 19:15:11 ----DC---- C:\Windows\SYSWOW64\nl-NL
2015-07-15 19:15:11 ----DC---- C:\Windows\system32\nl-NL
2015-07-15 19:15:11 ----DC---- C:\Windows\PolicyDefinitions
2015-07-15 19:15:10 ----DC---- C:\Windows\SYSWOW64\en-US
2015-07-15 19:15:10 ----DC---- C:\Windows\system32\en-US
2015-07-15 19:15:10 ----DC---- C:\Program Files\Internet Explorer
2015-07-15 19:15:08 ----DC---- C:\Windows\system32\drivers
2015-07-15 19:15:07 ----DC---- C:\Windows\system32\wbem
2015-07-15 19:15:07 ----DC---- C:\Windows\system32\appraiser
2015-07-15 19:15:07 ----DC---- C:\Windows\AppPatch
2015-07-15 17:21:46 ----DC---- C:\ProgramData\Microsoft Help
2015-07-15 17:18:03 ----DC---- C:\Windows\system32\MRT
2015-07-15 11:45:28 ----AC---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-07-13 16:52:38 ----DC---- C:\Program Files\Common Files\Symantec Shared
2015-07-13 16:52:04 ----DC---- C:\ProgramData\Norton
2015-07-07 19:47:29 ----DC---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-03 08:43:04 ----AC---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 RapportHades64;RapportHades64; C:\Windows\System32\Drivers\RapportHades64.sys [2015-06-02 121432]
R0 RapportKE64;RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [2015-06-02 376184]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 SymEFASI;Symantec Extended File Attributes (SI); C:\Windows\system32\drivers\N360x64\1605020.00F\SYMEFASI64.SYS [2015-07-11 1620720]
R1 BHDrvx64;BHDrvx64; \??\C:\Program Files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\BASHDefs\20150728.001\BHDrvx64.sys [2015-07-23 1650936]
R1 ccSet_N360;N360 Settings Manager; C:\Windows\system32\drivers\N360x64\1605020.00F\ccSetx64.sys [2015-07-11 173808]
R1 ccSet_NST;Norton Identity Safe Settings Manager; C:\Windows\system32\drivers\NSTx64\7DD04000.00A\ccSetx64.sys [2013-04-16 169048]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2015-07-28 498512]
R1 IDSVia64;IDSVia64; \??\C:\Program Files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\IPSDefs\20150731.001\IDSvia64.sys [2015-07-12 692984]
R1 RapportCerberus_1412112;RapportCerberus_1412112; \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1412112.sys [2015-06-22 917112]
R1 RapportEI64;RapportEI64; \??\C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2015-06-02 485368]
R1 RapportPG64;RapportPG64; \??\C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2015-06-02 480440]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\Windows\system32\drivers\N360x64\1605020.00F\SRTSPX64.SYS [2015-07-11 50936]
R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\N360x64\1605020.00F\Ironx64.SYS [2015-07-11 297720]
R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\System32\Drivers\N360x64\1605020.00F\SYMNETS.SYS [2015-07-11 576248]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2013-03-29 11658752]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2013-03-29 581120]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2011-01-27 125416]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2011-01-27 385512]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2013-02-14 96768]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2015-07-28 153936]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 34152]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-11-23 2565736]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 NAVENG;NAVENG; \??\C:\Program Files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\VirusDefs\20150731.017\ENG64.SYS [2015-05-20 138488]
R3 NAVEX15;NAVEX15; \??\C:\Program Files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\VirusDefs\20150731.017\EX64.SYS [2015-05-20 2146040]
R3 RapportIaso;RapportIaso; \??\c:\programdata\trusteer\rapport\store\exts\rapportms\baseline\rapportiaso64.sys [2015-06-22 266328]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
R3 SRTSP;Symantec Real Time Storage Protection x64; C:\Windows\System32\Drivers\N360x64\1605020.00F\SRTSP64.SYS [2015-07-11 926448]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [2015-07-27 111344]
S3 e.dentifier2;SmartCard Reader ABN AMRO e.dentifier2; C:\Windows\system32\DRIVERS\aabed2.sys [2008-03-20 28672]
S3 MarvinBus;Pinnacle Marvin Bus 64; C:\Windows\system32\DRIVERS\MarvinBus64.sys [2005-09-24 261120]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2014-03-10 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 usbscan;Stuurprogramma voor USB-scanner; C:\Windows\system32\drivers\usbscan.sys [2013-07-03 42496]
S3 WinUsb;WinUsb; C:\Windows\system32\drivers\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-07-07 82128]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2013-03-29 241152]
R2 becwssvr;E.dentifier2 Connector Service; C:\Program Files (x86)\ABN AMRO e.dentifier2\wss\becwssvr.exe [2014-11-28 1758552]
R2 Bonjour Service;Bonjour-service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2010-12-20 325656]
R2 MapsGalaxy_39Service;MapsGalaxyService; C:\PROGRA~2\MAPSGA~2\bar\1.bin\39barsvc.exe [2013-05-01 42504]
R2 N360;Norton 360; C:\Program Files (x86)\Norton 360\Engine\22.5.2.15\N360.exe [2015-07-16 282016]
R2 NCO;Norton Identity Safe; C:\Program Files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe [2013-05-21 144368]
R2 RapportMgmtService;Rapport Management Service; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2015-06-02 2222360]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [2010-08-19 247152]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2010-08-19 386344]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 gupdate;Google Update-service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-26 107912]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-15 268976]
S3 aspnet_state;ASP.NET-statusservice; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S3 gupdatem;Google Update-service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-26 107912]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-07-15 114688]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-07-07 148136]
S3 ose;Office  Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-07-08 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------