ComboFix 15-12-16.01 - Gebruiker 21-12-2015 21:26:26.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.7654.5104 [GMT 1:00] Gestart vanuit: c:\users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7U56G7A6\ComboFix.exe AV: Norton Internet Security *Disabled/Updated* {53C7D717-52E2-B95E-FA61-6F32ECC805DB} FW: Norton Internet Security *Disabled* {6BFC5632-188D-B806-D13E-C607121B42A0} SP: Norton Internet Security *Disabled/Updated* {E8A636F3-74D8-B6D0-C0D1-5440974F4F66} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((( Andere Verwijderingen ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\premieropinion c:\program files (x86)\premieropinion\asmcf.dat c:\program files (x86)\premieropinion\chrome.manifest c:\program files (x86)\premieropinion\components\pmxg.dll c:\program files (x86)\premieropinion\egdcf.dat c:\program files (x86)\premieropinion\firefox\bootstrap.js c:\program files (x86)\premieropinion\firefox\defaults\preferences\prefs.js c:\program files (x86)\premieropinion\firefox\harness-options.json c:\program files (x86)\premieropinion\firefox\install.rdf c:\program files (x86)\premieropinion\firefox\locale\en-GB.json c:\program files (x86)\premieropinion\firefox\locale\eo.json c:\program files (x86)\premieropinion\firefox\locale\fr-FR.json c:\program files (x86)\premieropinion\firefox\locales.json c:\program files (x86)\premieropinion\firefox\pmnx.dll c:\program files (x86)\premieropinion\firefox\resources\addon-kit\lib\page-mod.js c:\program files (x86)\premieropinion\firefox\resources\addon-kit\lib\tabs.js c:\program files (x86)\premieropinion\firefox\resources\addon-kit\lib\windows.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\addon\runner.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\base64.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\console\plain-text.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\console\traceback.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\content\content-proxy.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\content\content-worker.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\content\loader.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\content\thumbnail.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\content\worker.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\core\heritage.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\core\namespace.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\core\promise.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\api-utils.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\cortex.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\errors.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\events.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\events\assembler.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\light-traits.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\list.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\memory.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\observer-service.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\traits.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\traits\core.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\deprecated\window-utils.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\dom\events.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\event\core.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\event\target.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\io\byte-streams.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\io\data.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\io\file.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\io\text-streams.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\l10n\core.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\l10n\html.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\l10n\loader.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\l10n\locale.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\l10n\prefs.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\lang\functional.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\loader\cuddlefish.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\loader\sandbox.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\net\url.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\page-mod.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\page-mod\match-pattern.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\platform\xpcom.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\preferences\service.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\private-browsing.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\private-browsing\utils.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\private-browsing\window\utils.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\self.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\system.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\system\environment.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\system\events.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\system\globals.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\system\runtime.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\system\unload.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\system\xul-app.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\common.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\events.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\helpers.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\namespace.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\observer.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\tab-fennec.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\tab-firefox.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\tab.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\tabs-firefox.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\tabs.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\utils.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\tabs\worker.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\timers.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\url.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\util\array.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\util\deprecate.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\util\list.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\util\object.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\util\registry.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\util\uuid.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\window\browser.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\window\namespace.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\window\utils.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\windows.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\windows\dom.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\windows\fennec.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\windows\firefox.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\windows\loader.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\windows\observer.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\windows\tabs-fennec.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\sdk\windows\tabs-firefox.js c:\program files (x86)\premieropinion\firefox\resources\addon-sdk\lib\toolkit\loader.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\data\content-proxy.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\data\test-content-symbiont.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\data\test-message-manager.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\data\test-trusted-document.html c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\api-utils.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\byte-streams.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\channel.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\collection.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\content.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\content\loader.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\content\symbiont.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\content\worker.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\cortex.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\cuddlefish.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\dom\events.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\environment.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\errors.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\events.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\events\assembler.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\file.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\globals!.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\hidden-frame.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\light-traits.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\list.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\match-pattern.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\memory.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\message-manager.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\namespace.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\observer-service.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\plain-text-console.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\process.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\runtime.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\sandbox.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\self!.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\system.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\tabs\events.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\tabs\observer.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\tabs\tab.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\tabs\utils.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\text-streams.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\timer.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\traceback.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\traits.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\traits\core.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\unload.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\url.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\utils\data.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\utils\function.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\utils\object.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\utils\registry.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\utils\thumbnail.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\window-utils.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\windows\dom.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\windows\loader.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\windows\observer.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\windows\tabs.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\xpcom.js c:\program files (x86)\premieropinion\firefox\resources\api-utils\lib\xul-app.js c:\program files (x86)\premieropinion\firefox\resources\chrome.manifest c:\program files (x86)\premieropinion\firefox\resources\dpjs\data\content.js c:\program files (x86)\premieropinion\firefox\resources\dpjs\lib\dompilot.js c:\program files (x86)\premieropinion\firefox\resources\dpjs\lib\dputil.js c:\program files (x86)\premieropinion\firefox\resources\dpjs\lib\main.js c:\program files (x86)\premieropinion\install.rdf c:\program files (x86)\premieropinion\nscf.dat c:\program files (x86)\premieropinion\pmcm.crx c:\program files (x86)\premieropinion\pmcm.txt c:\program files (x86)\premieropinion\pmls.dll c:\program files (x86)\premieropinion\pmls64.dll c:\program files (x86)\premieropinion\pmoci.bin c:\program files (x86)\premieropinion\pmph.dll c:\program files (x86)\premieropinion\pmropn.exe c:\program files (x86)\premieropinion\pmropn32.exe c:\program files (x86)\premieropinion\pmropn64.exe c:\program files (x86)\premieropinion\pmservice.exe c:\program files (x86)\premieropinion\pmxf.dll c:\program files (x86)\premieropinion\readme.txt c:\programdata\Microsoft\Windows\Start Menu\Programs\PremierOpinion c:\programdata\Microsoft\Windows\Start Menu\Programs\PremierOpinion\About PremierOpinion.lnk c:\programdata\Microsoft\Windows\Start Menu\Programs\PremierOpinion\Member of GRID - Goodware Repository Information Database.lnk c:\programdata\Microsoft\Windows\Start Menu\Programs\PremierOpinion\Privacy Policy and User License Agreement.lnk c:\programdata\Microsoft\Windows\Start Menu\Programs\PremierOpinion\Support.lnk c:\programdata\Microsoft\Windows\Start Menu\Programs\PremierOpinion\Uninstall Instructions.lnk . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_PremierOpinion -------\Service_PremierOpinion . . (((((((((((((((((((( Bestanden Gemaakt van 2015-11-21 to 2015-12-21 )))))))))))))))))))))))))))))) . . 2015-12-21 20:38 . 2015-12-21 20:38 -------- d-----w- c:\users\Default\AppData\Local\temp 2015-12-21 20:13 . 2015-12-21 20:24 -------- d-----w- C:\rsit 2015-12-21 20:13 . 2015-12-21 20:20 -------- d-----w- c:\program files\trend micro 2015-12-10 09:31 . 2015-11-05 19:02 2048 ----a-w- c:\windows\system32\tzres.dll 2015-12-10 09:31 . 2015-11-05 19:00 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2015-12-10 09:29 . 2015-11-03 19:04 241664 ----a-w- c:\windows\system32\els.dll 2015-12-10 09:29 . 2015-11-03 18:55 179712 ----a-w- c:\windows\SysWow64\els.dll 2015-12-10 08:50 . 2015-12-10 08:50 8879808 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2015-12-01 08:22 . 2015-12-21 19:59 -------- d-----w- c:\windows\system32\drivers\NISx64\1605050.00F . . . ((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-12-10 08:50 . 2013-01-15 18:25 796864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2015-12-10 08:50 . 2011-11-02 21:18 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2015-10-29 17:50 . 2015-11-13 07:42 6656 ----a-w- c:\windows\system32\shimeng.dll 2015-10-29 17:50 . 2015-11-13 07:42 342016 ----a-w- c:\windows\system32\apphelp.dll 2015-10-29 17:50 . 2015-11-13 07:42 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2015-10-29 17:50 . 2015-11-13 07:42 72192 ----a-w- c:\windows\system32\aelupsvc.dll 2015-10-29 17:50 . 2015-11-13 07:42 309248 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2015-10-29 17:50 . 2015-11-13 07:42 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2015-10-29 17:50 . 2015-11-13 07:42 103424 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2015-10-29 17:50 . 2015-11-13 07:42 5120 ----a-w- c:\windows\SysWow64\shimeng.dll 2015-10-29 17:50 . 2015-11-13 07:42 23552 ----a-w- c:\windows\system32\sdbinst.exe 2015-10-29 17:49 . 2015-11-13 07:42 295936 ----a-w- c:\windows\SysWow64\apphelp.dll 2015-10-29 17:49 . 2015-11-13 07:42 562176 ----a-w- c:\windows\apppatch\AcLayers.dll 2015-10-29 17:49 . 2015-11-13 07:42 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll 2015-10-29 17:49 . 2015-11-13 07:42 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll 2015-10-29 17:49 . 2015-11-13 07:42 211968 ----a-w- c:\windows\apppatch\AcXtrnal.dll 2015-10-29 17:49 . 2015-11-13 07:42 20992 ----a-w- c:\windows\SysWow64\sdbinst.exe 2015-10-29 17:39 . 2015-11-13 07:42 2560 ----a-w- c:\windows\apppatch\AcRes.dll 2015-10-20 01:12 . 2015-11-13 07:42 5570496 ----a-w- c:\windows\system32\ntoskrnl.exe 2015-10-20 01:12 . 2015-11-13 07:42 154560 ----a-w- c:\windows\system32\drivers\ksecpkg.sys 2015-10-20 01:12 . 2015-11-13 07:42 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2015-10-20 01:09 . 2015-11-13 07:42 1730496 ----a-w- c:\windows\system32\ntdll.dll 2015-10-20 01:06 . 2015-11-13 07:42 243712 ----a-w- c:\windows\system32\wow64.dll 2015-10-20 01:06 . 2015-11-13 07:42 215040 ----a-w- c:\windows\system32\winsrv.dll 2015-10-20 01:06 . 2015-11-13 07:42 362496 ----a-w- c:\windows\system32\wow64win.dll 2015-10-20 01:06 . 2015-11-13 07:42 13312 ----a-w- c:\windows\system32\wow64cpu.dll 2015-10-20 01:05 . 2015-11-13 07:42 210944 ----a-w- c:\windows\system32\wdigest.dll 2015-10-20 01:05 . 2015-11-13 07:42 86528 ----a-w- c:\windows\system32\TSpkg.dll 2015-10-20 01:05 . 2015-11-13 07:42 503808 ----a-w- c:\windows\system32\srcore.dll 2015-10-20 01:05 . 2015-11-13 07:42 136192 ----a-w- c:\windows\system32\sspicli.dll 2015-10-20 01:05 . 2015-11-13 07:42 50176 ----a-w- c:\windows\system32\srclient.dll 2015-10-20 01:05 . 2015-11-13 07:42 29184 ----a-w- c:\windows\system32\sspisrv.dll 2015-10-20 01:05 . 2015-11-13 07:42 28160 ----a-w- c:\windows\system32\secur32.dll 2015-10-20 01:05 . 2015-11-13 07:42 344064 ----a-w- c:\windows\system32\schannel.dll 2015-10-20 01:05 . 2015-11-13 07:42 1216512 ----a-w- c:\windows\system32\rpcrt4.dll 2015-10-20 01:05 . 2015-11-13 07:42 312320 ----a-w- c:\windows\system32\ncrypt.dll 2015-10-20 01:05 . 2015-11-13 07:42 16384 ----a-w- c:\windows\system32\ntvdm64.dll 2015-10-20 01:05 . 2015-11-13 07:42 315392 ----a-w- c:\windows\system32\msv1_0.dll 2015-10-20 01:05 . 2015-11-13 07:42 729600 ----a-w- c:\windows\system32\kerberos.dll 2015-10-20 01:05 . 2015-11-13 07:42 424960 ----a-w- c:\windows\system32\KernelBase.dll 2015-10-20 01:05 . 2015-11-13 07:42 1461760 ----a-w- c:\windows\system32\lsasrv.dll 2015-10-20 01:05 . 2015-11-13 07:42 1164800 ----a-w- c:\windows\system32\kernel32.dll 2015-10-20 01:05 . 2015-11-13 07:42 44032 ----a-w- c:\windows\system32\cryptbase.dll 2015-10-20 01:05 . 2015-11-13 07:42 43520 ----a-w- c:\windows\system32\csrsrv.dll 2015-10-20 01:05 . 2015-11-13 07:42 22016 ----a-w- c:\windows\system32\credssp.dll 2015-10-20 01:05 . 2015-11-13 07:42 112640 ----a-w- c:\windows\system32\smss.exe 2015-10-20 01:05 . 2015-11-13 07:42 296960 ----a-w- c:\windows\system32\rstrui.exe 2015-10-20 01:04 . 2015-11-13 07:42 31232 ----a-w- c:\windows\system32\lsass.exe 2015-10-20 01:04 . 2015-11-13 07:42 338432 ----a-w- c:\windows\system32\conhost.exe 2015-10-20 01:04 . 2015-11-13 07:42 64000 ----a-w- c:\windows\system32\auditpol.exe 2015-10-20 01:00 . 2015-11-13 07:42 60416 ----a-w- c:\windows\system32\msobjs.dll 2015-10-20 00:59 . 2015-11-13 07:42 146432 ----a-w- c:\windows\system32\msaudite.dll 2015-10-20 00:53 . 2015-11-13 07:42 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 6656 ----a-w- c:\windows\system32\apisetschema.dll 2015-10-20 00:53 . 2015-11-13 07:42 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2015-10-20 00:53 . 2015-11-13 07:42 686080 ----a-w- c:\windows\system32\adtschema.dll 2015-10-20 00:53 . 2015-11-13 07:42 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2015-10-20 00:52 . 2015-11-13 07:42 3991488 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2015-10-20 00:52 . 2015-11-13 07:42 3935680 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2015-10-20 00:48 . 2015-11-13 07:42 1311768 ----a-w- c:\windows\SysWow64\ntdll.dll 2015-10-20 00:45 . 2015-11-13 07:42 172032 ----a-w- c:\windows\SysWow64\wdigest.dll 2015-10-20 00:45 . 2015-11-13 07:42 65536 ----a-w- c:\windows\SysWow64\TSpkg.dll 2015-10-20 00:45 . 2015-11-13 07:42 43008 ----a-w- c:\windows\SysWow64\srclient.dll 2015-10-20 00:45 . 2015-11-13 07:42 251392 ----a-w- c:\windows\SysWow64\schannel.dll 2015-10-20 00:45 . 2015-11-13 07:42 22016 ----a-w- c:\windows\SysWow64\secur32.dll 2015-10-20 00:45 . 2015-11-13 07:42 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll 2015-10-20 00:45 . 2015-11-13 07:42 223232 ----a-w- c:\windows\SysWow64\ncrypt.dll 2015-10-20 00:45 . 2015-11-13 07:42 259584 ----a-w- c:\windows\SysWow64\msv1_0.dll 2015-10-20 00:45 . 2015-11-13 07:42 552960 ----a-w- c:\windows\SysWow64\kerberos.dll 2015-10-20 00:45 . 2015-11-13 07:42 36864 ----a-w- c:\windows\SysWow64\cryptbase.dll 2015-10-20 00:45 . 2015-11-13 07:42 17408 ----a-w- c:\windows\SysWow64\credssp.dll 2015-10-20 00:45 . 2015-11-13 07:42 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2015-10-20 00:45 . 2015-11-13 07:42 25600 ----a-w- c:\windows\SysWow64\setup16.exe 2015-10-20 00:44 . 2015-11-13 07:42 50176 ----a-w- c:\windows\SysWow64\auditpol.exe 2015-10-20 00:44 . 2015-11-13 07:42 5120 ----a-w- c:\windows\SysWow64\wow32.dll . . ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten ))))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="c:\program files (x86)\Steam\Steam.exe" [2015-12-14 3013712] "Spotify"="c:\users\Gebruiker\AppData\Roaming\Spotify\Spotify.exe" [2013-02-06 4480040] "Spotify Web Helper"="c:\users\Gebruiker\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-02-06 1104424] "iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2015-04-26 43816] "ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2015-04-26 43816] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928] "BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2011-04-24 297280] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-12 343168] "Dolby Advanced Audio v2"="c:\dolby pcee4\pcee4.exe" [2011-06-01 506712] "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-03-15 1081424] "ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-10-27 177448] "SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2011-09-20 341360] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2015-08-06 421888] "ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2015-09-13 518456] "Redirector"="c:\program files (x86)\Citrix\ICA Client\redirector.exe" [2015-09-13 231736] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "IsMyWinLockerReboot"="msiexec.exe" [2015-06-15 73216] "iCloud"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloud.exe" [2015-04-26 43816] . c:\users\Gebruiker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Citrix Receiver.lnk - c:\program files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe [2015-9-13 134960] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x] S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x] S0 SymEFASI;Symantec Extended File Attributes (SI);c:\windows\system32\drivers\NISx64\1605050.00F\SYMEFASI64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1605050.00F\SYMEFASI64.SYS [x] S1 BHDrvx64;BHDrvx64;c:\program files (x86)\Norton Internet Security\NortonData\22.5.2.15\Definitions\BASHDefs\20151218.001\BHDrvx64.sys;c:\program files (x86)\Norton Internet Security\NortonData\22.5.2.15\Definitions\BASHDefs\20151218.001\BHDrvx64.sys [x] S1 ccSet_NIS;NIS Settings Manager;c:\windows\system32\drivers\NISx64\1605050.00F\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1605050.00F\ccSetx64.sys [x] S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x] S1 IDSVia64;IDSVia64;c:\program files (x86)\Norton Internet Security\NortonData\22.5.2.15\Definitions\IPSDefs\20151218.001\IDSvia64.sys;c:\program files (x86)\Norton Internet Security\NortonData\22.5.2.15\Definitions\IPSDefs\20151218.001\IDSvia64.sys [x] S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x] S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x] S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1605050.00F\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1605050.00F\Ironx64.SYS [x] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1605050.00F\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1605050.00F\SYMNETS.SYS [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x] S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x] S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x] S2 ePowerSvc;ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x] S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x] S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files (x86)\McAfee\SiteAdvisor\McSACore.exe;c:\program files (x86)\McAfee\SiteAdvisor\McSACore.exe [x] S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\22.5.5.15\NIS.exe;c:\program files (x86)\Norton Internet Security\Engine\22.5.5.15\NIS.exe [x] S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x] S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x] S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x] S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\system32\DRIVERS\b57xdbd.sys;c:\windows\SYSNATIVE\DRIVERS\b57xdbd.sys [x] S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\system32\DRIVERS\b57xdmp.sys;c:\windows\SYSNATIVE\DRIVERS\b57xdmp.sys [x] S3 bScsiMSa;bScsiMSa;c:\windows\system32\DRIVERS\bScsiMSa.sys;c:\windows\SYSNATIVE\DRIVERS\bScsiMSa.sys [x] S3 bScsiSDa;bScsiSDa;c:\windows\system32\DRIVERS\bScsiSDa.sys;c:\windows\SYSNATIVE\DRIVERS\bScsiSDa.sys [x] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x] S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x] S3 mfesapsn;McAfee Process Start Notification Service;c:\program files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys;c:\program files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x] . . --- Andere Services/Drivers In Geheugen --- . *NewlyCreated* - WS2IFSL . Inhoud van de 'Gedeelde Taken' map . 2015-12-21 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-15 08:50] . 2015-12-21 c:\windows\Tasks\G2MUpdateTask-S-1-5-21-170397309-1221119410-2078053831-1000.job - c:\users\Gebruiker\AppData\Local\Citrix\GoToMeeting\4099\g2mupdate.exe [2015-12-18 09:26] . 2015-12-21 c:\windows\Tasks\G2MUploadTask-S-1-5-21-170397309-1221119410-2078053831-1000.job - c:\users\Gebruiker\AppData\Local\Citrix\GoToMeeting\4099\g2mupload.exe [2015-12-18 09:26] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-25 13320808] "RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-10-20 2278504] "Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-08-02 1831016] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2015-09-23 170256] . ------- Bijkomende Scan ------- . uStart Page = hxxp://google.nl/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local uSearchAssistant = IE: &Verzenden naar OneNote - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105 IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 192.168.1.1 . - - - - ORPHANS VERWIJDERD - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-Browser Infrastructure Helper - c:\users\Gebruiker\AppData\Local\Smartbar\Application\SnapDo.exe HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\adobe\SHOCKW~1\UNWISE.EXE AddRemove-{eeb86aef-4a5d-4b75-9d74-f16d438fc286} - c:\program files (x86)\PremierOpinion\pmropn.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\22.5.5.15\NIS.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\22.5.5.15\diMaster.dll\" /prefetch:1" "ImagePath"="\SystemRoot\System32\Drivers\NISx64\1605050.00F\SYMNETS.SYS" "TrustedImagePaths"="c:\program files (x86)\Norton Internet Security\Engine\22.5.5.15;c:\program files (x86)\Norton Internet Security\Engine64\22.5.5.15" . --------------------- VERGRENDELDE REGISTER SLEUTELS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_228_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_20_0_0_228_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_20_0_0_228_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_228.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.20" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_228.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_228.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_228.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Andere Aktieve Processen ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Launch Manager\LMworker.exe c:\program files (x86)\Launch Manager\LMutilps32.exe c:\program files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe c:\program files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe . ************************************************************************** . Voltooingstijd: 2015-12-21 21:48:50 - machine werd herstart ComboFix-quarantined-files.txt 2015-12-21 20:48 . Pre-Run: 611.964.633.088 bytes beschikbaar Post-Run: 614.080.532.480 bytes beschikbaar . - - End Of File - - 8D3EDA8DCDC8D2D94BE36D17A49715E7 A36C5E4F47E84449FF07ED3517B43A31