ComboFix 15-08-06.01 - Ria 07-08-2015 14:19:12.1.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.8173.6098 [GMT 2:00] Gestart vanuit: c:\users\Ria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOADU31O\ComboFix.exe AV: Norton 360 *Disabled/Updated* {53C7D717-52E2-B95E-FA61-6F32ECC805DB} FW: Norton 360 *Disabled* {6BFC5632-188D-B806-D13E-C607121B42A0} SP: Norton 360 *Disabled/Updated* {E8A636F3-74D8-B6D0-C0D1-5440974F4F66} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((( Bestanden Gemaakt van 2015-07-07 to 2015-08-07 )))))))))))))))))))))))))))))) . . 2015-08-07 12:25 . 2015-08-07 12:25 -------- dc----w- c:\users\Default\AppData\Local\temp 2015-08-07 12:25 . 2015-08-07 12:25 -------- d-----w- c:\users\Gebruiker\AppData\Local\temp 2015-08-07 08:05 . 2015-08-07 08:05 -------- dc----w- c:\users\Ria\AppData\Roaming\Oracle 2015-08-07 06:33 . 2015-08-07 06:37 -------- dc----w- C:\AdwCleaner 2015-08-04 14:06 . 2015-08-04 14:06 -------- dc----w- c:\users\Gebruiker\.jagex_cache_32 2015-08-04 12:40 . 2015-08-04 12:40 -------- dc----w- c:\users\Gebruiker\jagexcache1 2015-08-04 12:37 . 2015-08-04 12:37 -------- dc----w- C:\.jagex_cache_32 2015-08-03 08:54 . 2015-08-03 08:54 -------- d-----w- c:\users\Gebruiker\AppData\Local\kpn 2015-08-01 20:23 . 2015-08-01 20:23 -------- dc----w- c:\users\Ria\AppData\Local\kpn 2015-08-01 20:22 . 2015-08-01 19:55 24064 -c--a-w- c:\windows\zoek-delete.exe 2015-08-01 20:22 . 2015-08-07 12:25 -------- dc----w- c:\users\Ria\AppData\Local\Temp 2015-08-01 19:53 . 2015-08-01 20:13 -------- dc----w- C:\zoek_backup 2015-08-01 19:43 . 2015-08-01 19:43 97888 -c--a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2015-08-01 19:43 . 2015-08-01 19:43 -------- dc----w- c:\program files (x86)\Java 2015-08-01 13:29 . 2015-08-01 13:29 -------- dc----w- c:\program files\trend micro 2015-08-01 13:29 . 2015-08-01 13:29 -------- dc----w- C:\rsit 2015-07-28 11:56 . 2015-07-28 20:16 726528 ----a-w- c:\windows\system32\generaltel.dll 2015-07-28 11:56 . 2015-07-28 20:16 67584 ----a-w- c:\windows\system32\acmigration.dll 2015-07-28 11:56 . 2015-07-28 20:16 433664 ----a-w- c:\windows\system32\devinv.dll 2015-07-28 11:56 . 2015-07-28 20:16 1085440 ----a-w- c:\windows\system32\appraiser.dll 2015-07-28 11:56 . 2015-07-28 20:16 765440 ----a-w- c:\windows\system32\invagent.dll 2015-07-28 11:56 . 2015-07-28 20:16 227328 ----a-w- c:\windows\system32\aepdu.dll 2015-07-28 11:56 . 2015-07-28 20:16 17856 ----a-w- c:\windows\system32\CompatTelRunner.exe 2015-07-28 11:56 . 2015-07-28 20:16 1145856 ----a-w- c:\windows\system32\aeinv.dll 2015-07-27 08:32 . 2015-08-06 13:43 -------- dc----w- c:\windows\system32\drivers\N360x64\1605020.00F 2015-07-22 20:14 . 2015-07-22 20:14 -------- dc----w- c:\users\Ria\AppData\Local\ElevatedDiagnostics 2015-07-21 09:06 . 2015-07-21 10:52 70656 ----a-w- c:\windows\SysWow64\fontsub.dll 2015-07-21 09:06 . 2015-07-21 10:52 46080 ----a-w- c:\windows\system32\atmlib.dll 2015-07-21 09:06 . 2015-07-21 10:52 41984 ----a-w- c:\windows\system32\lpk.dll 2015-07-21 09:06 . 2015-07-21 10:52 372224 ----a-w- c:\windows\system32\atmfd.dll 2015-07-21 09:06 . 2015-07-21 10:52 34304 ----a-w- c:\windows\SysWow64\atmlib.dll 2015-07-21 09:06 . 2015-07-21 10:52 299008 ----a-w- c:\windows\SysWow64\atmfd.dll 2015-07-21 09:06 . 2015-07-21 10:52 25600 ----a-w- c:\windows\SysWow64\lpk.dll 2015-07-21 09:06 . 2015-07-21 10:52 14336 ----a-w- c:\windows\system32\dciman32.dll 2015-07-21 09:06 . 2015-07-21 10:52 10240 ----a-w- c:\windows\SysWow64\dciman32.dll 2015-07-21 09:06 . 2015-07-21 10:52 100864 ----a-w- c:\windows\system32\fontsub.dll 2015-07-15 08:36 . 2015-07-15 15:22 77824 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll 2015-07-15 08:35 . 2015-07-15 15:22 7077376 ----a-w- c:\windows\system32\mstscax.dll 2015-07-11 02:33 . 2015-07-11 02:33 4587520 -c--a-w- c:\windows\SysWow64\GPhotos.scr 2015-07-10 16:32 . 2015-07-28 14:17 -------- d-----w- C:\$Windows.~BT . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-07-27 08:32 . 2013-08-17 14:06 111344 -c--a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS 2015-07-15 09:45 . 2012-04-03 11:25 778416 -c--a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2015-07-15 09:45 . 2011-07-11 15:36 142512 -c--a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2015-07-03 06:43 . 2011-07-08 09:23 130333168 -c--a-w- c:\windows\system32\MRT.exe 2015-06-23 23:29 . 2015-06-23 23:29 1217192 -c--a-w- c:\windows\SysWow64\FM20.DLL 2015-06-10 20:49 . 2015-06-10 18:01 14635008 ----a-w- c:\windows\system32\wmp.dll 2015-06-10 20:49 . 2015-06-10 18:01 9728 ----a-w- c:\windows\system32\spwmp.dll 2015-06-10 20:49 . 2015-06-10 18:01 8192 ----a-w- c:\windows\SysWow64\spwmp.dll 2015-06-10 20:49 . 2015-06-10 18:01 5120 ----a-w- c:\windows\system32\msdxm.ocx 2015-06-10 20:49 . 2015-06-10 18:01 5120 ----a-w- c:\windows\system32\dxmasf.dll 2015-06-10 20:49 . 2015-06-10 18:01 4096 ----a-w- c:\windows\SysWow64\msdxm.ocx 2015-06-10 20:49 . 2015-06-10 18:01 4096 ----a-w- c:\windows\SysWow64\dxmasf.dll 2015-06-10 20:49 . 2015-06-10 18:01 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL 2015-06-10 20:49 . 2015-06-10 18:01 12625920 ----a-w- c:\windows\system32\wmploc.DLL 2015-06-10 20:48 . 2015-06-10 18:02 879104 ----a-w- c:\windows\system32\advapi32.dll 2015-06-10 20:48 . 2015-06-10 18:02 641536 ----a-w- c:\windows\SysWow64\advapi32.dll 2015-06-10 20:48 . 2015-06-10 18:02 424960 ----a-w- c:\windows\system32\KernelBase.dll 2015-06-10 20:48 . 2015-06-10 18:02 1255424 ----a-w- c:\windows\system32\diagtrack.dll 2015-06-10 20:48 . 2015-06-10 18:02 1162752 ----a-w- c:\windows\system32\kernel32.dll 2015-06-10 20:48 . 2015-06-10 18:02 879104 ----a-w- c:\windows\system32\tdh.dll 2015-06-10 20:48 . 2015-06-10 18:02 82944 ----a-w- c:\windows\SysWow64\logman.exe 2015-06-10 20:48 . 2015-06-10 18:02 635392 ----a-w- c:\windows\SysWow64\tdh.dll 2015-06-10 20:48 . 2015-06-10 18:02 503808 ----a-w- c:\windows\system32\srcore.dll 2015-06-10 20:48 . 2015-06-10 18:02 404992 ----a-w- c:\windows\system32\tracerpt.exe 2015-06-10 20:48 . 2015-06-10 18:02 364544 ----a-w- c:\windows\SysWow64\tracerpt.exe 2015-06-10 20:48 . 2015-06-10 18:02 338432 ----a-w- c:\windows\system32\conhost.exe 2015-06-10 20:48 . 2015-06-10 18:02 296960 ----a-w- c:\windows\system32\rstrui.exe 2015-06-10 20:48 . 2015-06-10 18:02 243712 ----a-w- c:\windows\system32\wow64.dll 2015-06-10 20:48 . 2015-06-10 18:02 215040 ----a-w- c:\windows\system32\winsrv.dll 2015-06-10 20:48 . 2015-06-10 18:02 104448 ----a-w- c:\windows\system32\logman.exe 2015-06-10 20:48 . 2015-06-10 18:02 92160 ----a-w- c:\windows\SysWow64\sechost.dll 2015-06-10 20:48 . 2015-06-10 18:02 5120 ----a-w- c:\windows\SysWow64\wow32.dll 2015-06-10 20:48 . 2015-06-10 18:02 50176 ----a-w- c:\windows\system32\srclient.dll 2015-06-10 20:48 . 2015-06-10 18:02 47104 ----a-w- c:\windows\system32\typeperf.exe 2015-06-10 20:48 . 2015-06-10 18:02 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2015-06-10 20:48 . 2015-06-10 18:02 43008 ----a-w- c:\windows\system32\relog.exe 2015-06-10 20:48 . 2015-06-10 18:02 40448 ----a-w- c:\windows\SysWow64\typeperf.exe 2015-06-10 20:48 . 2015-06-10 18:02 37888 ----a-w- c:\windows\SysWow64\relog.exe 2015-06-10 20:48 . 2015-06-10 18:02 362496 ----a-w- c:\windows\system32\wow64win.dll 2015-06-10 20:48 . 2015-06-10 18:02 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll 2015-06-10 20:48 . 2015-06-10 18:02 25600 ----a-w- c:\windows\SysWow64\setup16.exe 2015-06-10 20:48 . 2015-06-10 18:02 19456 ----a-w- c:\windows\system32\diskperf.exe 2015-06-10 20:48 . 2015-06-10 18:02 17408 ----a-w- c:\windows\SysWow64\diskperf.exe 2015-06-10 20:48 . 2015-06-10 18:02 16384 ----a-w- c:\windows\system32\ntvdm64.dll 2015-06-10 20:48 . 2015-06-10 18:02 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll 2015-06-10 20:48 . 2015-06-10 18:02 13312 ----a-w- c:\windows\system32\wow64cpu.dll 2015-06-10 20:48 . 2015-06-10 18:02 7680 ----a-w- c:\windows\SysWow64\instnm.exe 2015-06-10 20:48 . 2015-06-10 18:02 6144 ---ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2015-06-10 20:48 . 2015-06-10 18:02 36864 ----a-w- c:\windows\system32\UtcResources.dll 2015-06-10 20:48 . 2015-06-10 18:02 2048 ----a-w- c:\windows\SysWow64\user.exe . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] "BIBLauncher"="c:\program files (x86)\Business-in-a-Box\BIBLauncher.exe" [2012-02-06 913888] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-07-31 43816] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-03-28 642656] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888] "Becwsupa"="c:\program files (x86)\ABN AMRO e.dentifier2\wss\becwsupa.exe" [2014-11-28 162136] "Servicetool"="c:\program files (x86)\KPN\Servicetool\KPNServicetool_Launcher.exe" [2015-04-23 11573840] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R3 e.dentifier2;SmartCard Reader ABN AMRO e.dentifier2;c:\windows\system32\DRIVERS\aabed2.sys;c:\windows\SYSNATIVE\DRIVERS\aabed2.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S0 RapportHades64;RapportHades64;c:\windows\System32\Drivers\RapportHades64.sys;c:\windows\SYSNATIVE\Drivers\RapportHades64.sys [x] S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys;c:\windows\SYSNATIVE\Drivers\RapportKE64.sys [x] S0 SymEFASI;Symantec Extended File Attributes (SI);c:\windows\system32\drivers\N360x64\1605020.00F\SYMEFASI64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1605020.00F\SYMEFASI64.SYS [x] S1 BHDrvx64;BHDrvx64;c:\program files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\BASHDefs\20150728.001\BHDrvx64.sys;c:\program files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\BASHDefs\20150728.001\BHDrvx64.sys [x] S1 ccSet_N360;N360 Settings Manager;c:\windows\system32\drivers\N360x64\1605020.00F\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\N360x64\1605020.00F\ccSetx64.sys [x] S1 ccSet_NST;Norton Identity Safe Settings Manager;c:\windows\system32\drivers\NSTx64\7DD04000.00A\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NSTx64\7DD04000.00A\ccSetx64.sys [x] S1 IDSVia64;IDSVia64;c:\program files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\IPSDefs\20150806.001\IDSvia64.sys;c:\program files (x86)\Norton 360\NortonData\22.5.0.124\Definitions\IPSDefs\20150806.001\IDSvia64.sys [x] S1 RapportCerberus_1412112;RapportCerberus_1412112;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1412112.sys;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1412112.sys [x] S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [x] S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [x] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1605020.00F\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1605020.00F\Ironx64.SYS [x] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1605020.00F\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\N360x64\1605020.00F\SYMNETS.SYS [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 becwssvr;E.dentifier2 Connector Service;c:\program files (x86)\ABN AMRO e.dentifier2\wss\becwssvr.exe;c:\program files (x86)\ABN AMRO e.dentifier2\wss\becwssvr.exe [x] S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x] S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\22.5.2.15\N360.exe;c:\program files (x86)\Norton 360\Engine\22.5.2.15\N360.exe [x] S2 NCO;Norton Identity Safe;c:\program files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe;c:\program files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe [x] S2 RapportMgmtService;Rapport Management Service;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [x] S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x] S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2015-08-07 06:39 995144 -c--a-w- c:\program files (x86)\Google\Chrome\Application\44.0.2403.130\Installer\chrmstp.exe . Inhoud van de 'Gedeelde Taken' map . 2015-08-07 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 09:45] . 2015-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-01-26 09:44] . 2015-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-01-26 09:44] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288] "Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760] . ------- Bijkomende Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.kpnvandaag.nl/ mLocal Page = c:\windows\SysWOW64\blank.htm IE: &Verzenden naar OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.254 DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game.zylom.com/activex/zylomgamesplayer.cab FF - ProfilePath - c:\users\Ria\AppData\Roaming\Mozilla\Firefox\Profiles\n01zkiuv.default\ . - - - - ORPHANS VERWIJDERD - - - - . Wow6432Node-HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe Wow6432Node-HKLM-Run-SunJavaUpdateSched - c:\program files (x86)\Common Files\Java\Java Update\jusched.exe HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start AddRemove-Radiotracker_is1 - c:\program files (x86)\Radiotracker\unins000.exe AddRemove-VDC_is1 - c:\program files (x86)\Video Download Converter\unins000.exe AddRemove-{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} - c:\programdata\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe AddRemove-{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} - c:\programdata\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360] "ImagePath"="\"c:\program files (x86)\Norton 360\Engine\22.5.2.15\N360.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\22.5.2.15\diMaster.dll\" /prefetch:1" -- . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\NCO] "ImagePath"="\"c:\program files (x86)\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe\" /s \"NCO\" /m \"c:\program files (x86)\Norton Identity Safe\Engine\2013.4.0.10\diMaster.dll\" /prefetch:1" "ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z [\]^_‘\00\00‘\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~‘\00\00‘\00\00\00\00y\00\00\00\00\00\00\00\00‘’“" . "ImagePath"="\SystemRoot\System32\Drivers\N360x64\1605020.00F\SYMNETS.SYS" "TrustedImagePaths"="c:\program files (x86)\Norton 360\Engine\22.5.2.15;c:\program files (x86)\Norton 360\Engine64\22.5.2.15" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_209_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_209_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_209_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_209_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_209.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.18" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_209.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_209.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_209.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Voltooingstijd: 2015-08-07 14:29:46 ComboFix-quarantined-files.txt 2015-08-07 12:29 . Pre-Run: 25.593.851.904 bytes beschikbaar Post-Run: 25.289.875.456 bytes beschikbaar . - - End Of File - - B4604021F3530BDAE4643F9B9DDB9FDF A36C5E4F47E84449FF07ED3517B43A31