start
CreateRestorePoint:
CloseProcesses:
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-19\...\RunOnce: [] => [X]
HKU\S-1-5-20\...\RunOnce: [] => [X]
HKU\S-1-5-18\...\RunOnce: [] => [X]
SearchScopes: HKLM-x32 -> DefaultScope waarde ontbreekt
SearchScopes: HKU\S-1-5-21-131995894-4090845228-1571000866-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-131995894-4090845228-1571000866-1001 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxps://nortonsafe.search.ask.com/web?q={searchTerms}&o=APN11913&l=dis&prt=NS&chn=oem&geo=NL&ver=22.9.0.71&locale=nl_NL&guid=4F026673-8B51-4549-9E1A-07CFF3FBA7F1&doi=2016-12-19&gct=kwd&qsrc=2869
SearchScopes: HKU\S-1-5-21-131995894-4090845228-1571000866-1001 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoHumfA2eDXzyC7zHBin1U4Bvc_7IbnXs_7gu0_cBcwfjQmDgEPUso6ZpbGz2tBjVJj2k2MlpGC_9oaOA75iqmoCOKNQBFjMRSOnnqZV2aD4leuNQS271tv77HR-DDOFF3AXc__Z8HAx5BAiX8TuvtuJ_nxv-YRB8utLeAhNTRA,,&q={searchTerms}
BHO-x32: Geen Naam -> {0EEDB912-C5FA-486F-8334-57288578C627} -> Geen bestand
Toolbar: HKU\S-1-5-21-131995894-4090845228-1571000866-1001 -> Geen Naam - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  Geen bestand
FF Plugin: @microsoft.com/GENUINE -> disabled [Geen bestand]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Geen bestand]
R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.3.1.204\WsAppService.exe [437392 2016-11-16] (Wondershare)
S3 cpuz134; geen ImagePath
2016-08-26 10:12 - 2016-08-26 11:17 - 7065600 _____ () C:\Program Files (x86)\GUT2781.tmp
Task: {0943D426-C45F-4220-ADE0-CA1E990E9D53} - System32\Tasks\{344EB364-364E-41B8-BA54-2739CBBBF77B} => pcalua.exe -a C:\Users\Alain\AppData\Local\Temp\ir_ext_temp_1\AutoPlay\Docs\Setup.exe -d C:\Users\Alain\AppData\Local\Temp\ir_ext_temp_1\ <==== AANDACHT
Task: {5ABEDA44-A2FA-44FD-82D5-60408ACD422A} - System32\Tasks\snp => C:\ProgramData\Quoteex\Quoteex.exe  <==== AANDACHT
C:\ProgramData\Quoteex
Task: {952ECC29-2906-4F75-A8E6-50BBB9B11F67} - System32\Tasks\ParetoLogic Update Version3 Startup Task => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe  <==== AANDACHT
C:\Program Files (x86)\Common Files\ParetoLogic
Task: {D762C411-07E2-4A1C-9AB4-724B62718B84} - System32\Tasks\ParetoLogic Update Version3 => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe  <==== AANDACHT
Task: {D1FF4986-0992-4AB0-8E5E-95D559947009} - System32\Tasks\PPTAssistantNotifyTask_Alain => C:\Users\Alain\AppData\Local\PPTAssist\notify.exe  <==== AANDACHT
C:\Users\Alain\AppData\Local\PPTAssist
Task: {EA5408A3-901A-4143-9DFE-5F56074F6549} - System32\Tasks\PPTAssistantUpdateTask_Alain => C:\Users\Alain\AppData\Local\PPTAssist\assistupdate.exe  <==== AANDACHT
Task: C:\Windows\Tasks\PPTAssistantNotifyTask_Alain.job => C:\Users\Alain\AppData\Local\PPTAssist\notify.exe <==== AANDACHT
Task: C:\Windows\Tasks\PPTAssistantUpdateTask_Alain.job => C:\Users\Alain\AppData\Local\PPTAssist\assistupdate.exe <==== AANDACHT
MSCONFIG\startupreg: Wondershare Helper Compact.exe => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
EmptyTemp:
end