Scanresultaten van Farbar Recovery Scan Tool (FRST) (x64) Versie: 02-10-2016 Gestart door Dejonckheere (Beheerder) op DEJONCKHEERE-PC (03-10-2016 19:59:47) Gestart vanaf C:\Users\Dejonckheere\Downloads Geladen Profielen: Dejonckheere & postgres (Beschikbare Profielen: Dejonckheere & postgres) Platform: Windows 7 Home Premium Service Pack 1 (X64) Taal: Nederlands (Nederland) Internet Explorer Versie 11 (Standaardbrowser: Chrome) Boot Modus: Normal Handleiding voor Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processen (gefilterd) ================= (Als een item is opgenomen in de fixlist, het proces zal worden gesloten. Het bestand zal niet worden verplaatst.) (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2016\vsserv.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe (IVT Corporation) C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2016\bdagent.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Microsoft Corporation) C:\Windows\System32\CISVC.EXE (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (IVT Corporation) C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (Dropbox, Inc.) C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\Dropbox.exe (Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe (Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe (pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe () C:\Windows\SysWOW64\PnkBstrA.exe (PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe (Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe (Paramount Software UK Ltd) C:\Program Files\Macrium\Reflect\ReflectService.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe (PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2016\updatesrv.exe (Use It Group NV) C:\Program Files (x86)\Bouwsoft\usesocketservice.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2016\bdwtxag.exe (PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2016\antispam32\bdwtxapps.exe (PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe (PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe (PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe (PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe (Use It Group NV) C:\Program Files (x86)\Bouwsoft\usesocketservice.exe (IVT Corporation) C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsHelpCS.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtAvAC.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosHdpProc.exe (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe (Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Register (gefilterd) ==================== (Als een item is opgenomen in de fixlist, het registry item zal worden teruggezet naar de standaardwaarden of verwijderd. Het bestand zal niet worden verplaatst.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13774040 2015-01-22] (Realtek Semiconductor) HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2016\bdagent.exe [1654160 2016-06-28] (Bitdefender) HKLM-x32\...\Run: [BtTray] => C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe [319574 2010-10-25] (IVT Corporation) HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-09-06] (Brother Industries, Ltd.) HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.) HKU\S-1-5-21-1676756398-211950510-2368295547-1001\...\Run: [Dropbox Update] => C:\Users\Dejonckheere\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-18] (Dropbox, Inc.) HKU\S-1-5-21-1676756398-211950510-2368295547-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 HKU\S-1-5-21-1676756398-211950510-2368295547-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-1676756398-211950510-2368295547-1006\...\RunOnce: [ScrSav] => C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2009-12-16] () HKU\S-1-5-21-1676756398-211950510-2368295547-1006\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Acer.scr [453152 2009-12-16] () ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\DropboxExt64.65536.dll [2016-09-30] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\DropboxExt64.65536.dll [2016-09-30] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\DropboxExt64.65536.dll [2016-09-30] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\DropboxExt64.65536.dll [2016-09-30] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll [2016-09-30] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll [2016-09-30] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll [2016-09-30] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll [2016-09-30] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk [2015-06-26] ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.) Startup: C:\Users\Dejonckheere\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-10-01] ShortcutTarget: Dropbox.lnk -> C:\Users\Dejonckheere\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) BootExecute: autocheck autochk * ｆో錀畍瑬卩牴湩彧潂瑯硅捥瑵䭥祥1 ==================== Internet (gefilterd) ==================== (Als een item is opgenomen in de fixlist, als het een registry item is wordt verwijderd of hersteld naar de standaard.) Tcpip\Parameters: [DhcpNameServer] 195.130.131.5 195.130.130.5 Tcpip\..\Interfaces\{B2FEEE41-DD6B-4699-927C-C5B59F04A6A6}: [DhcpNameServer] 195.130.131.5 195.130.130.5 Internet Explorer: ================== HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restrictie <======= AANDACHT HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = www.ddejonckheere.be HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.ddejonckheere.be HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = www.ddejonckheere.be HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.ddejonckheere.be HKU\S-1-5-21-1676756398-211950510-2368295547-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-1676756398-211950510-2368295547-1006\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\.DEFAULT -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKU\.DEFAULT -> {2F0149B9-28EA-40B4-9523-541F101B026C} URL = hxxp://www.scanquery.com/?prt=SCANQUERY145&keywords={searchTerms} SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1676756398-211950510-2368295547-1001 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}&rlz=1I7ACAW_nlBE533BE377 SearchScopes: HKU\S-1-5-21-1676756398-211950510-2368295547-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-1676756398-211950510-2368295547-1001 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}&rlz=1I7ACAW_nlBE533BE377 BHO: Bitdefender Wallet -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender 2016\pmbxie.dll [2016-06-28] (Bitdefender) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Bitdefender Wallet -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender 2016\Antispam32\pmbxie.dll [2016-06-28] (Bitdefender) BHO-x32: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll [2013-04-08] (pdfforge GmbH) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) Toolbar: HKLM - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2016\pmbxie.dll [2016-06-28] (Bitdefender) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.) Toolbar: HKLM-x32 - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2016\Antispam32\pmbxie.dll [2016-06-28] (Bitdefender) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.) Toolbar: HKU\S-1-5-21-1676756398-211950510-2368295547-1001 -> Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2016\pmbxie.dll [2016-06-28] (Bitdefender) DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: linkscanner - Geen CLSID Waarde Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWOW64\skype4com.dll [2007-08-27] (Skype Technologies) StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\Dejonckheere\AppData\Roaming\Mozilla\Firefox\Profiles\y48hc4sg.default-1425317072247 [2016-05-19] FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\y48hc4sg.default-1425317072247 -> Google FF Homepage: Mozilla\Firefox\Profiles\y48hc4sg.default-1425317072247 -> www.ddejonckheere.be FF Extension: (Geen Naam) - C:\Users\Dejonckheere\AppData\Roaming\Mozilla\Firefox\Profiles\y48hc4sg.default-1425317072247\extensions\adremoveext@adremoveext.net [niet gevonden] FF Extension: (Geen Naam) - C:\Users\Dejonckheere\AppData\Roaming\Mozilla\Firefox\Profiles\y48hc4sg.default-1425317072247\extensions\iobitascsurfingprotection@iobit.com [niet gevonden] FF HKLM\...\Firefox\Extensions: [bdwteffv20@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2016\antispam32\bdwteff FF Extension: (Bitdefender Wallet) - C:\Program Files\Bitdefender\Bitdefender 2016\antispam32\bdwteff [2016-03-16] FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2016\bdtbext FF Extension: (Bitdefender Antispam Toolbar) - C:\Program Files\Bitdefender\Bitdefender 2016\bdtbext [2016-03-16] [ niet getekend] FF HKLM-x32\...\Firefox\Extensions: [bdwteffv20@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2016\antispam32\bdwteff FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2016\bdtbext FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-30] () FF Plugin: @microsoft.com/GENUINE -> disabled [Geen bestand] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-30] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll [2015-01-09] (Adobe Systems, Inc.) FF Plugin-x32: @esn/esnlaunch,version=1.122.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll [Geen bestand] FF Plugin-x32: @esn/esnlaunch,version=1.138.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.138.0\npesnlaunch.dll [Geen bestand] FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Geen bestand] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll [2013-03-26] (Nitro PDF) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-08] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-08] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1676756398-211950510-2368295547-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Dejonckheere\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-17] (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-1676756398-211950510-2368295547-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2012-07-02] (Ubisoft) Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.be/","hxxp://google%20agenda/" CHR Profile: C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default [2016-10-03] CHR Extension: (Google Presentaties) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-23] CHR Extension: (Google Documenten) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-23] CHR Extension: (Google Drive) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22] CHR Extension: (YouTube) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-28] CHR Extension: (Google Search) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27] CHR Extension: (Bitdefender Wallet) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhejlifdlcgcmogbggeomfodgklfaem [2016-03-20] CHR Extension: (Google Spreadsheets) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-23] CHR Extension: (Offline Documenten) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-19] CHR Extension: (Betalingen via Chrome Web Store) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-05] CHR Extension: (Gmail) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-23] CHR Extension: (Chrome Media Router) - C:\Users\Dejonckheere\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-09-24] CHR HKLM-x32\...\Chrome\Extension: [dhhejlifdlcgcmogbggeomfodgklfaem] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - CHR HKLM-x32\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - CHR HKLM-x32\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - CHR HKLM-x32\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - ==================== Services (gefilterd) ==================== (Als een item is opgenomen in de fixlist, wordt uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.) S4 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.) R2 BlueSoleilCS; C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [1765484 2010-10-26] (IVT Corporation) [Bestand niet getekend] R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [Bestand niet getekend] R3 BsHelpCS; C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsHelpCS.exe [192000 2010-10-25] (IVT Corporation) [Bestand niet getekend] R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [Bestand niet getekend] S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.) R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-03-26] (Nitro PDF Software) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH) S4 pgsql-8.2; C:\Program Files (x86)\PostgreSQL\8.2\bin\pg_ctl.exe [94376 2008-09-19] (PostgreSQL Global Development Group) [Bestand niet getekend] R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-09-21] () R2 postgresql-8.4; C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe [66048 2014-07-22] (PostgreSQL Global Development Group) [Bestand niet getekend] R2 ProductAgentService; C:\Program Files\Bitdefender Agent\ProductAgentService.exe [1088944 2016-09-13] (Bitdefender) R2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [3476432 2015-10-12] (Paramount Software UK Ltd) R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2011-10-25] (Acer Incorporated) [Bestand niet getekend] R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2016\updatesrv.exe [156016 2016-06-28] (Bitdefender) R2 UseSocketService; C:\Program Files (x86)\Bouwsoft\UseSocketService.exe [298616 2015-03-26] (Use It Group NV) R2 vsserv; C:\Program Files\Bitdefender\Bitdefender 2016\vsserv.exe [1693104 2016-06-28] (Bitdefender) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ===================== Drivers (gefilterd) ====================== (Als een item is opgenomen in de fixlist, wordt uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.) S3 ampa; C:\Windows\system32\ampa.sys [19568 2015-11-10] () [Bestand niet getekend] S3 ampa; C:\Windows\SysWOW64\ampa.sys [19568 2015-11-10] () [Bestand niet getekend] R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1603264 2016-08-22] (BitDefender) R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [850464 2016-08-22] (BitDefender) R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [119696 2016-06-28] (BitDefender LLC) R1 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [87912 2015-12-04] (BitDefender) S3 BlueletAudio; C:\Windows\System32\DRIVERS\blueletaudio.sys [36360 2009-06-17] (IVT Corporation.) S3 BlueletAudio; C:\Windows\SysWOW64\DRIVERS\blueletaudio.sys [36360 2009-06-17] (IVT Corporation.) R3 BT; C:\Windows\System32\DRIVERS\btnetdrv.sys [20488 2010-08-18] (IVT Corporation.) R3 BTCOM; C:\Windows\System32\DRIVERS\btcomport.sys [29448 2010-08-26] (IVT Corporation.) R3 BTCOMBUS; C:\Windows\System32\Drivers\btcombus.sys [25352 2010-08-26] (IVT Corporation.) R3 Btcsrusb; C:\Windows\System32\Drivers\btcusb.sys [42888 2010-06-24] (IVT Corporation.) R0 BtHidBus; C:\Windows\System32\Drivers\BtHidBus.sys [23944 2010-04-06] (IVT Corporation.) R3 btnetBUs; C:\Windows\System32\Drivers\btnetBus.sys [30088 2010-04-06] () S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-10-02] () R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [182936 2016-04-27] (BitDefender LLC) R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-05-19] (REALiX(tm)) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2014-11-19] (Intel Corporation) R0 ignis; C:\Windows\System32\DRIVERS\ignis.sys [299816 2016-06-28] (Bitdefender) R3 IvtBtBUs; C:\Windows\System32\Drivers\IvtBtBus.sys [27016 2010-04-06] (IVT Corporation.) R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.) R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit) R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [34544 2014-11-19] (Synaptics Incorporated) R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [520032 2016-06-28] (BitDefender S.R.L.) R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] () S3 WinRing0_1_2_0; geen ImagePath S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X] ==================== NetSvcs (gefilterd) =================== (Als een item is opgenomen in de fixlist, wordt uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.) ==================== Een Maand Aangemaakt bestanden en mappen ======== (Als een item is opgenomen in de fixlist, het bestand/map wordt verplaatst.) 2016-10-03 19:59 - 2016-10-03 20:00 - 00026643 _____ C:\Users\Dejonckheere\Downloads\FRST.txt 2016-10-03 19:26 - 2016-10-03 19:59 - 00000000 ____D C:\FRST 2016-10-03 19:25 - 2016-10-03 19:25 - 02404864 _____ (Farbar) C:\Users\Dejonckheere\Downloads\FRST64.exe 2016-10-02 12:33 - 2016-10-02 12:33 - 03516080 _____ (Enigma Software Group USA, LLC.) C:\Users\Dejonckheere\Downloads\SpyHunter-Installer.exe 2016-10-02 12:33 - 2016-10-02 12:33 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys 2016-10-01 12:23 - 2016-10-01 12:23 - 00000000 ____D C:\Users\Dejonckheere\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2016-09-21 21:49 - 2016-09-21 21:49 - 00026844 _____ C:\ProgramData\agent.1474487305.bdinstall.bin 2016-09-16 20:14 - 2016-09-16 20:14 - 00009794 _____ C:\Users\Dejonckheere\Desktop\_344_HELP_instructions.html 2016-09-16 20:06 - 2016-09-16 20:06 - 00009794 _____ C:\Users\Dejonckheere\Downloads\_27_HELP_instructions.html 2016-09-15 21:29 - 2016-09-15 21:29 - 00905075 _____ C:\Users\Dejonckheere\Downloads\Glascapsule_R_M09152016_212541.pdf 2016-09-12 22:36 - 2016-09-12 22:36 - 00000000 ____D C:\Users\Dejonckheere\AppData\Local\Chromium 2016-09-12 18:22 - 2015-02-10 18:17 - 00000000 ____D C:\Users\Dejonckheere\Documents\Rockstar Games 2016-09-11 13:07 - 2016-09-14 22:36 - 00000837 _____ C:\Users\Dejonckheere\Desktop\visit www.nosteam.ro.lnk 2016-09-11 13:07 - 2016-09-12 18:22 - 00000870 _____ C:\Users\Dejonckheere\Desktop\Play Max Payne 3.lnk 2016-09-11 13:07 - 2016-09-12 18:22 - 00000000 ____D C:\Users\Dejonckheere\My Documents 2016-09-10 20:38 - 2016-09-10 20:38 - 00003268 _____ C:\Windows\System32\Tasks\AutoShutdown 2016-09-10 20:04 - 2016-09-10 20:09 - 53684055 _____ C:\Users\Dejonckheere\Downloads\MaxPayne3.exe ==================== Een Maand Gewijzigd bestanden en mappen ======== (Als een item is opgenomen in de fixlist, het bestand/map wordt verplaatst.) 2016-10-03 19:59 - 2013-04-06 16:18 - 00000000 ___RD C:\Users\Dejonckheere\Dropbox 2016-10-03 19:58 - 2015-07-11 14:25 - 00005099 _____ C:\Windows\SysWOW64\LOCALSERVICE.INI 2016-10-03 19:58 - 2015-07-11 14:25 - 00000107 _____ C:\Windows\SysWOW64\LOCALDEVICE.INI 2016-10-03 19:58 - 2010-10-26 11:04 - 00001093 _____ C:\Windows\SysWOW64\bscs.ini 2016-10-03 19:57 - 2016-03-20 11:15 - 00000000 ____D C:\Program Files\Bitdefender Agent 2016-10-03 19:57 - 2010-04-26 14:24 - 00000157 _____ C:\usslog.txt 2016-10-03 19:57 - 2010-04-08 10:37 - 00001052 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2016-10-03 19:56 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-10-03 19:54 - 2016-03-20 11:51 - 00150876 _____ C:\bdlog.txt 2016-10-03 19:54 - 2012-05-26 10:56 - 00000000 ____D C:\Users\Dejonckheere\Documents\Outlook-bestanden 2016-10-03 19:48 - 2010-04-08 10:37 - 00001056 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2016-10-03 19:46 - 2010-04-26 23:54 - 00000000 ____D C:\BVBA 2016-10-03 19:44 - 2010-04-26 14:23 - 00000000 ____D C:\Program Files (x86)\Bouwsoft 2016-10-03 19:34 - 2010-02-21 08:53 - 00749464 _____ C:\Windows\system32\perfh013.dat 2016-10-03 19:34 - 2010-02-21 08:53 - 00155344 _____ C:\Windows\system32\perfc013.dat 2016-10-03 19:34 - 2009-07-14 07:13 - 01681402 _____ C:\Windows\system32\PerfStringBackup.INI 2016-10-03 19:34 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf 2016-10-03 19:20 - 2015-06-18 21:10 - 00001052 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1676756398-211950510-2368295547-1001UA.job 2016-10-03 13:20 - 2015-06-18 21:10 - 00001000 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1676756398-211950510-2368295547-1001Core.job 2016-10-03 09:53 - 2009-07-14 06:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-10-03 09:53 - 2009-07-14 06:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-10-03 09:44 - 2009-07-14 07:08 - 00032532 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2016-10-01 18:40 - 2010-02-21 09:10 - 00000000 ____D C:\Windows\Minidump 2016-10-01 12:23 - 2015-06-18 21:10 - 00000000 ____D C:\Users\Dejonckheere\AppData\Local\Dropbox 2016-10-01 12:23 - 2013-04-06 16:15 - 00000000 ____D C:\Users\Dejonckheere\AppData\Roaming\Dropbox 2016-10-01 11:57 - 2015-07-13 22:37 - 00000000 ____D C:\Users\Dejonckheere\AppData\Roaming\postgresql 2016-10-01 11:57 - 2010-04-26 14:27 - 00000000 ____D C:\Users\Dejonckheere\AppData\Local\Bouwsoft 2016-09-28 20:42 - 2016-03-20 12:15 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2016-09-26 17:58 - 2014-09-01 07:24 - 00000000 ____D C:\Users\Dejonckheere\AppData\Local\Adobe 2016-09-26 17:55 - 2012-04-04 21:50 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2016-09-26 17:55 - 2012-02-26 11:59 - 00000000 ____D C:\Windows\system32\Macromed 2016-09-26 17:55 - 2011-08-04 23:43 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2016-09-26 17:55 - 2009-11-05 02:39 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2016-09-24 17:36 - 2015-07-11 14:25 - 00000258 _____ C:\Windows\SysWOW64\REMOTEDEVICE.INI 2016-09-20 22:00 - 2010-02-21 09:07 - 00000000 ____D C:\ProgramData\Temp 2016-09-17 13:22 - 2015-07-23 10:16 - 00002219 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-09-17 13:22 - 2015-07-23 10:16 - 00002207 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2016-09-16 20:05 - 2013-10-15 22:18 - 00000000 ____D C:\ProgramData\HitmanPro 2016-09-11 13:07 - 2010-04-24 16:41 - 00000000 ____D C:\Users\Dejonckheere 2016-09-03 17:30 - 2015-05-11 15:13 - 00000000 ____D C:\Users\Dejonckheere\AppData\Local\Popcorn-Time ==================== Bestanden in de root van sommige mappen ======= 2009-11-05 05:32 - 2009-02-10 22:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico 2012-08-14 21:53 - 2012-08-14 21:53 - 0000037 ___SH () C:\Users\Dejonckheere\AppData\Roaming\9961660784cc2937229a742.95731288 2014-03-14 23:07 - 2014-05-02 18:27 - 0000137 _____ () C:\Users\Dejonckheere\AppData\Roaming\mbam.context.scan 2010-09-27 21:58 - 2014-01-15 09:43 - 0000266 _____ () C:\Users\Dejonckheere\AppData\Roaming\wklnhst.dat 2012-08-26 11:45 - 2012-08-26 11:45 - 0027520 _____ () C:\Users\Dejonckheere\AppData\Local\dt.dat 2013-11-26 21:21 - 2013-11-26 21:21 - 0003393 _____ () C:\Users\Dejonckheere\AppData\Local\recently-used.xbel 2014-02-27 23:58 - 2014-02-27 23:58 - 0007625 _____ () C:\Users\Dejonckheere\AppData\Local\Resmon.ResmonCfg 2016-03-20 11:33 - 2016-03-20 11:33 - 0429591 _____ () C:\ProgramData\1458465905.bdinstall.bin 2016-03-24 22:25 - 2016-03-24 22:25 - 0025985 _____ () C:\ProgramData\1458851104.bdinstall.bin 2016-04-01 09:50 - 2016-04-01 09:50 - 0025985 _____ () C:\ProgramData\1459496939.bdinstall.bin 2016-06-15 13:23 - 2016-06-15 13:23 - 0026786 _____ () C:\ProgramData\1465989741.bdinstall.bin 2016-09-21 21:49 - 2016-09-21 21:49 - 0026844 _____ () C:\ProgramData\agent.1474487305.bdinstall.bin 2010-02-21 09:07 - 2010-02-21 09:13 - 0008276 _____ () C:\ProgramData\ArcadeDeluxe3.log 2013-11-23 15:59 - 2013-11-23 15:59 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2009-11-05 05:33 - 2009-07-18 04:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe 2010-05-16 14:56 - 2010-05-16 14:56 - 0000000 _____ () C:\ProgramData\leverage.drm.log 2013-06-22 09:51 - 2013-06-22 09:52 - 0000091 _____ () C:\ProgramData\PS.log ==================== Bamital & volsnap ====================== (Er is geen automatische fix voor bestanden die de verificatie niet doorkomen.) C:\Windows\system32\winlogon.exe => Bestand is getekend C:\Windows\system32\wininit.exe => Bestand is getekend C:\Windows\SysWOW64\wininit.exe => Bestand is getekend C:\Windows\explorer.exe => Bestand is getekend C:\Windows\SysWOW64\explorer.exe => Bestand is getekend C:\Windows\system32\svchost.exe => Bestand is getekend C:\Windows\SysWOW64\svchost.exe => Bestand is getekend C:\Windows\system32\services.exe => Bestand is getekend C:\Windows\system32\User32.dll => Bestand is getekend C:\Windows\SysWOW64\User32.dll => Bestand is getekend C:\Windows\system32\userinit.exe => Bestand is getekend C:\Windows\SysWOW64\userinit.exe => Bestand is getekend C:\Windows\system32\rpcss.dll => Bestand is getekend C:\Windows\system32\dnsapi.dll => Bestand is getekend C:\Windows\SysWOW64\dnsapi.dll => Bestand is getekend C:\Windows\system32\Drivers\volsnap.sys => Bestand is getekend LastRegBack: 2016-09-25 12:40 ==================== Eind van FRST.txt ============================