Scanresultaten van Farbar Recovery Scan Tool (FRST) (x64) Versie: 15-03-2017
Gestart door Marcel (Beheerder) op MARCEL-PC (15-04-2017 11:45:55)
Gestart vanaf C:\Users\Marcel\Downloads
Geladen Profielen: Marcel & UpdatusUser (Beschikbare Profielen: Marcel & UpdatusUser & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Taal: Nederlands (Nederland)
Internet Explorer Versie 11 (Standaardbrowser: FF)
Boot Modus: Normal
Handleiding voor Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processen (gefilterd) =================

(Als een item is opgenomen in de fixlist, het proces zal worden gesloten. Het bestand zal niet worden verplaatst.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagenta.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvca.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(Clarus, Inc.) C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFGuage.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(Clarus, Inc.) C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFTimerD.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Clarus, Inc.) C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

==================== Register (gefilterd) ====================

(Als een item is opgenomen in de fixlist, het registry item zal worden teruggezet naar de standaardwaarden of verwijderd. Het bestand zal niet worden verplaatst.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [SmartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [610872 2009-08-25] ()
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-03-23] (IDT, Inc.)
HKLM-x32\...\Run: [HPCam_Menu] => c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [322104 2009-08-20] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [240400 2016-12-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [240400 2016-12-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\Easybits For Kids\ezRecover.exe [163856 2015-11-11] (Easybits)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-2044600135-1690355392-2278222146-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1021736 2016-01-08] (Samsung)
HKU\S-1-5-21-2044600135-1690355392-2278222146-1000\...\Run: [msnmsgr] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4272840 2014-03-31] (Microsoft Corporation)
HKU\S-1-5-21-2044600135-1690355392-2278222146-1000\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKU\S-1-5-21-2044600135-1690355392-2278222146-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-2044600135-1690355392-2278222146-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-2044600135-1690355392-2278222146-1000\...\Policies\Explorer: [NoLogoff] 0
ShellExecuteHooks: Geen Naam - {E54729E8-643D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook64.dll [774160 2015-11-15] ()
ShellExecuteHooks-x32: Geen Naam - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook32.dll [485904 2015-11-15] ()
Startup: C:\Users\Marcel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Schermopname en Snel starten.lnk [2013-11-07]
ShortcutTarget: OneNote 2007 Schermopname en Snel starten.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Marcel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Auto Backup Guage.lnk [2017-04-14]
ShortcutTarget: Samsung Auto Backup Guage.lnk -> C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFGuage.exe (Clarus, Inc.)
Startup: C:\Users\Marcel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Auto Backup Real-Time Daemon.lnk [2017-04-14]
ShortcutTarget: Samsung Auto Backup Real-Time Daemon.lnk -> C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFRealTimeD.exe (Clarus, Inc.)
Startup: C:\Users\Marcel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Auto Backup Scheduler.lnk [2017-04-14]
ShortcutTarget: Samsung Auto Backup Scheduler.lnk -> C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFTimerD.exe (Clarus, Inc.)

==================== Internet (gefilterd) ====================

(Als een item is opgenomen in de fixlist, als het een registry item is wordt verwijderd of hersteld naar de standaard.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{8901A230-79F6-4474-8380-3B1174C19A72}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-2044600135-1690355392-2278222146-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.seniorennet.be/
HKU\S-1-5-21-2044600135-1690355392-2278222146-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/2
HKU\S-1-5-21-2044600135-1690355392-2278222146-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCON/2
HKU\S-1-5-21-2044600135-1690355392-2278222146-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/2
SearchScopes: HKLM -> {5C4527E9-228C-44B5-BA78-28897055568D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {5C4527E9-228C-44B5-BA78-28897055568D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2044600135-1690355392-2278222146-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2044600135-1690355392-2278222146-1000 -> {35BF2E55-B7F6-4579-A804-A7EDC80450C0} URL = hxxp://www.google.be/search?hl=nl&q={searchTerms}&sourceid=ie8&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKU\S-1-5-21-2044600135-1690355392-2278222146-1000 -> {5C4527E9-228C-44B5-BA78-28897055568D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2044600135-1690355392-2278222146-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-07-21] (HP Inc.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-03-29] (Oracle Corporation)
BHO-x32: Aanmeldhulp voor Microsoft-account -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-29] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-07-21] (HP Inc.)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

FireFox:
========
FF ProfilePath: C:\Users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\yl86owi6.default [2017-04-15]
FF Homepage: Mozilla\Firefox\Profiles\yl86owi6.default -> hxxp://www.seniorennet.be/
FF Extension: (Disable Prefetch) - C:\Users\Marcel\AppData\Roaming\Mozilla\Firefox\Profiles\yl86owi6.default\features\{f197958c-b594-48b6-b169-82ac509e096a}\disable-prefetch@mozilla.org.xpi [2017-04-05]
FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\deployment-checker@mozilla.org.xpi [2017-03-28] [ niet getekend]
FF HKLM-x32\...\Firefox\Extensions: [belgiumeid@eid.belgium.be] - C:\Program Files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be => niet gevonden
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll [2017-04-11] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Geen bestand]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-05] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll [2017-04-11] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2009-07-21] (Adobe Systems, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-29] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-29] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Geen bestand]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-05] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2015-12-22] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.)

==================== Services (gefilterd) ====================

(Als een item is opgenomen in de fixlist, wordt uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [1002552 2017-03-23] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [5334432 2017-03-23] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1146128 2016-12-06] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [729048 2017-03-23] (AVG Technologies CZ, s.r.o.)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [Bestand niet getekend]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [349728 2015-12-22] (WildTangent)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [31776 2016-12-07] (HP Inc.)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-08-20] (Hewlett-Packard Company) [Bestand niet getekend]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-07-22] (DEVGURU Co., LTD.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\STacSV64.exe [247808 2010-03-23] (IDT, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (gefilterd) ======================

(Als een item is opgenomen in de fixlist, wordt uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)

S3 ACSSCR; C:\Windows\System32\DRIVERS\a38usb.sys [44672 2012-12-05] (Advanced Card Systems Ltd)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [163072 2016-05-13] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [313088 2017-02-20] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [267008 2016-10-05] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [298240 2016-11-30] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [360736 2016-02-16] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [254208 2016-09-26] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [52992 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [299264 2016-07-27] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [46368 2013-11-10] (AVG Technologies)
R0 Avguniva; C:\Windows\System32\DRIVERS\avguniva.sys [77056 2016-06-20] (AVG Technologies CZ, s.r.o.)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [130688 2016-07-22] (Samsung Electronics Co., Ltd.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-04-18] () [Bestand niet getekend]
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [164992 2016-07-22] (Samsung Electronics Co., Ltd.)

==================== NetSvcs (gefilterd) ===================

(Als een item is opgenomen in de fixlist, wordt uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)


==================== Een Maand Aangemaakt bestanden en mappen ========

(Als een item is opgenomen in de fixlist, het bestand/map wordt verplaatst.)

2017-04-15 11:45 - 2017-04-15 11:46 - 00018571 _____ C:\Users\Marcel\Downloads\FRST.txt
2017-04-15 11:45 - 2017-04-15 11:45 - 00000000 ____D C:\FRST
2017-04-15 11:44 - 2017-04-15 11:44 - 02424832 _____ (Farbar) C:\Users\Marcel\Downloads\FRST64.exe
2017-04-14 20:45 - 2017-04-14 20:45 - 00001780 _____ C:\Users\Marcel\Desktop\Samsung Auto Backup.lnk
2017-04-14 20:45 - 2017-04-14 20:45 - 00000000 ____D C:\Users\Marcel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Samsung
2017-04-14 20:45 - 2017-04-14 20:45 - 00000000 ____D C:\Program Files (x86)\Clarus
2017-04-07 14:21 - 2017-04-07 14:21 - 00869112 _____ C:\Users\Marcel\Downloads\236568.pdf
2017-04-07 11:49 - 2016-07-22 09:21 - 00164992 _____ (Samsung Electronics Co., Ltd.) C:\Windows\system32\Drivers\ssudmdm.sys
2017-04-07 11:49 - 2016-07-22 09:21 - 00130688 _____ (Samsung Electronics Co., Ltd.) C:\Windows\system32\Drivers\ssudbus.sys
2017-03-21 17:33 - 2017-03-21 17:34 - 00030825 _____ C:\Users\Marcel\Downloads\Attest_Medische-Uitgaven_581578420170321043317.pdf

==================== Een Maand Gewijzigd bestanden en mappen ========

(Als een item is opgenomen in de fixlist, het bestand/map wordt verplaatst.)

2017-04-15 11:45 - 2016-11-18 09:44 - 00000000 ____D C:\Users\Marcel\AppData\LocalLow\Mozilla
2017-04-15 00:58 - 2014-11-08 20:55 - 00000000 ____D C:\ProgramData\MFAData
2017-04-15 00:39 - 2016-09-20 20:37 - 00003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task
2017-04-14 21:34 - 2012-11-12 13:12 - 00000000 ____D C:\Users\Marcel\AppData\Local\CrashDumps
2017-04-14 21:05 - 2012-11-03 18:06 - 00002244 _____ C:\Users\Marcel\AppData\Roaming\wklnhst.dat
2017-04-14 21:05 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2017-04-14 21:01 - 2009-07-14 06:45 - 00026192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-04-14 21:01 - 2009-07-14 06:45 - 00026192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-04-14 20:53 - 2009-12-12 11:06 - 00746014 _____ C:\Windows\system32\perfh013.dat
2017-04-14 20:53 - 2009-12-12 11:06 - 00153934 _____ C:\Windows\system32\perfc013.dat
2017-04-14 20:53 - 2009-07-14 07:13 - 01670960 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-14 20:53 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2017-04-14 20:48 - 2012-11-05 17:42 - 00000000 ____D C:\Users\Marcel\Tracing
2017-04-14 20:47 - 2016-11-11 12:13 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForMarcel.job
2017-04-14 20:47 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-14 20:45 - 2009-12-12 02:27 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-04-14 15:22 - 2016-11-11 12:13 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForMarcel
2017-04-13 22:59 - 2014-12-26 03:02 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-04-13 22:58 - 2015-11-08 14:55 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-04-11 20:36 - 2012-11-04 22:27 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-04-11 20:36 - 2012-11-04 22:27 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-04-11 20:36 - 2012-11-04 22:27 - 00004422 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-04-11 20:36 - 2012-11-04 22:27 - 00000000 ____D C:\Windows\system32\Macromed
2017-04-11 20:36 - 2009-12-12 03:26 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-04-07 11:49 - 2014-08-07 20:40 - 00001935 _____ C:\Users\Public\Desktop\Samsung Kies 3.lnk
2017-03-30 20:58 - 2012-11-04 17:33 - 00000000 ____D C:\Users\Marcel\AppData\Roaming\Skype
2017-03-30 20:56 - 2012-11-09 00:21 - 00075264 _____ C:\Users\Marcel\Documents\hbvp.wps
2017-03-30 15:30 - 2015-10-24 12:49 - 00000898 _____ C:\Users\Public\Desktop\AVG Protection.lnk
2017-03-30 15:30 - 2014-11-09 12:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2017-03-29 23:52 - 2017-03-15 15:16 - 00000000 ____D C:\Users\Marcel\Documents\Bouwgrond Buggenhout
2017-03-29 23:41 - 2014-10-18 15:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-03-29 23:41 - 2014-04-22 10:04 - 00000000 ____D C:\ProgramData\Oracle
2017-03-29 23:41 - 2009-12-12 04:36 - 00000000 ____D C:\Program Files (x86)\Java
2017-03-29 23:40 - 2014-10-18 15:20 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2017-03-29 16:54 - 2012-11-04 13:53 - 00000000 ____D C:\Users\Marcel\AppData\Local\Corel
2017-03-29 16:54 - 2012-11-03 14:33 - 00000000 ____D C:\ProgramData\Corel
2017-03-29 16:53 - 2012-11-04 13:52 - 00000848 ___SH C:\ProgramData\KGyGaAvL.sys
2017-03-29 16:53 - 2012-11-04 13:51 - 00000000 ____D C:\Users\Marcel\Documents\My PSP Files
2017-03-29 13:44 - 2016-01-03 01:31 - 00000000 ____D C:\Users\Marcel\Documents\Betaalde rekeningen
2017-03-28 19:22 - 2016-11-18 03:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-03-21 18:03 - 2013-10-14 19:56 - 00000000 ____D C:\Users\Marcel\Documents\Pensioen Anita
2017-03-19 05:03 - 2012-11-06 00:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

==================== Bestanden in de root van sommige mappen =======

2013-06-27 01:28 - 2013-12-09 22:29 - 0003728 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
2012-11-03 18:06 - 2017-04-14 21:05 - 0002244 _____ () C:\Users\Marcel\AppData\Roaming\wklnhst.dat
2012-11-03 16:53 - 2012-11-03 16:53 - 0000000 _____ () C:\Users\Marcel\AppData\Local\AtStart.txt
2012-11-16 22:28 - 2015-11-24 14:20 - 0023040 _____ () C:\Users\Marcel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-11-03 16:53 - 2012-11-03 16:53 - 0000000 _____ () C:\Users\Marcel\AppData\Local\DSwitch.txt
2012-11-03 16:53 - 2012-11-03 16:53 - 0000000 _____ () C:\Users\Marcel\AppData\Local\QSwitch.txt
2014-03-24 19:53 - 2014-03-25 11:41 - 0007606 _____ () C:\Users\Marcel\AppData\Local\Resmon.ResmonCfg
2012-11-14 13:00 - 2012-11-14 13:00 - 3827065 _____ () C:\Users\Marcel\AppData\Local\tmpDSC00757.0
2012-11-14 13:00 - 2012-11-14 13:00 - 1374537 _____ () C:\Users\Marcel\AppData\Local\tmpDSC00757.JPG
2013-01-05 16:10 - 2013-01-05 16:10 - 3026397 _____ () C:\Users\Marcel\AppData\Local\tmpPICT0566.0
2013-01-05 16:10 - 2013-01-05 16:10 - 0725401 _____ () C:\Users\Marcel\AppData\Local\tmpPICT0566.JPG
2013-06-10 19:39 - 2014-06-05 00:28 - 0000182 _____ () C:\ProgramData\HPWALog.txt
2012-11-04 13:52 - 2017-03-29 16:53 - 0000848 ___SH () C:\ProgramData\KGyGaAvL.sys
2012-11-03 14:49 - 2012-11-03 14:49 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2009-12-12 04:03 - 2009-12-12 04:04 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2012-11-03 14:48 - 2012-11-03 14:48 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2009-12-12 03:59 - 2009-12-12 04:00 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2012-11-03 14:48 - 2012-11-03 14:48 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2012-11-03 14:49 - 2012-11-03 14:49 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2009-12-12 03:59 - 2009-12-12 03:59 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2009-12-12 04:00 - 2009-12-12 04:03 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2012-11-03 14:49 - 2012-11-03 14:49 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log

Sommige bestanden in TEMP:
====================
2016-09-10 14:17 - 2016-09-13 14:52 - 0476672 _____ () C:\Users\Marcel\AppData\Local\Temp\7za.exe
2016-05-14 00:49 - 2016-04-14 17:29 - 0186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Marcel\AppData\Local\Temp\avguirn_081414409114.exe
2016-01-05 23:03 - 2015-11-12 17:54 - 0091048 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Marcel\AppData\Local\Temp\avguirn_081506709407.exe
2016-02-23 20:19 - 2016-01-12 17:23 - 0179624 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Marcel\AppData\Local\Temp\avguirn_081608366118.exe
2016-07-27 10:06 - 2016-06-21 18:49 - 0186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Marcel\AppData\Local\Temp\avguirn_081644247461.exe
2016-04-08 00:25 - 2016-02-18 13:09 - 0179624 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Marcel\AppData\Local\Temp\avguirn_081714860404.exe
2016-05-31 16:17 - 2016-04-22 10:01 - 0186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Marcel\AppData\Local\Temp\avguirn_08268749882.exe
2016-01-15 22:37 - 2015-12-08 08:23 - 0091048 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Marcel\AppData\Local\Temp\avguirn_08727590742.exe
2016-06-23 21:05 - 2016-05-18 13:03 - 0186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Marcel\AppData\Local\Temp\avguirn_087402001.exe
2016-08-23 08:19 - 2016-07-20 14:01 - 0186640 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Marcel\AppData\Local\Temp\avguirn_08752632620.exe
2016-09-10 14:17 - 2016-09-13 14:52 - 0020480 _____ (E Dev) C:\Users\Marcel\AppData\Local\Temp\DaS_21.exe
2016-02-21 12:17 - 2017-04-07 11:47 - 0066048 _____ () C:\Users\Marcel\AppData\Local\Temp\Execute2App.exe
2016-09-10 14:17 - 2016-09-13 14:52 - 0388608 _____ (Trend Micro Inc.) C:\Users\Marcel\AppData\Local\Temp\hijackthis.exe
2016-07-21 14:11 - 2016-07-21 14:11 - 0741440 _____ (Oracle Corporation) C:\Users\Marcel\AppData\Local\Temp\jre-8u101-windows-au.exe
2016-10-19 09:10 - 2016-10-19 09:10 - 0737856 _____ (Oracle Corporation) C:\Users\Marcel\AppData\Local\Temp\jre-8u111-windows-au.exe
2017-03-29 23:38 - 2017-03-29 23:38 - 0739904 _____ (Oracle Corporation) C:\Users\Marcel\AppData\Local\Temp\jre-8u121-windows-au.exe
2016-03-19 12:08 - 2016-03-19 12:08 - 0736352 _____ (Oracle Corporation) C:\Users\Marcel\AppData\Local\Temp\jre-8u73-windows-au.exe
2016-03-28 11:52 - 2016-03-28 11:52 - 0736320 _____ (Oracle Corporation) C:\Users\Marcel\AppData\Local\Temp\jre-8u77-windows-au.exe
2016-04-26 11:20 - 2016-04-26 11:20 - 0739904 _____ (Oracle Corporation) C:\Users\Marcel\AppData\Local\Temp\jre-8u91-windows-au.exe
2016-09-15 02:00 - 2016-09-15 02:00 - 2458672 _____ (The OpenSSL Project, http://www.openssl.org/) C:\Users\Marcel\AppData\Local\Temp\libeay32.dll
2016-02-21 12:17 - 2014-05-07 17:43 - 0568832 _____ (Microsoft Corporation) C:\Users\Marcel\AppData\Local\Temp\msvcp90.dll
2016-09-15 02:00 - 2016-09-15 02:00 - 0970912 _____ (Microsoft Corporation) C:\Users\Marcel\AppData\Local\Temp\msvcr120.dll
2016-02-21 12:17 - 2014-05-07 17:43 - 0655872 _____ (Microsoft Corporation) C:\Users\Marcel\AppData\Local\Temp\msvcr90.dll
2016-09-10 14:17 - 2016-09-13 14:52 - 0030720 _____ (NirSoft) C:\Users\Marcel\AppData\Local\Temp\NirCmd.exe
2016-09-10 14:17 - 2016-09-13 14:52 - 0256512 _____ () C:\Users\Marcel\AppData\Local\Temp\PEVZ.EXE
2016-09-10 14:17 - 2016-09-13 14:52 - 0069632 _____ () C:\Users\Marcel\AppData\Local\Temp\remove.exe
2016-09-10 14:17 - 2016-09-13 14:52 - 0098816 _____ () C:\Users\Marcel\AppData\Local\Temp\sed.exe
2016-09-10 14:17 - 2016-09-13 14:52 - 0057344 _____ (Optimum X) C:\Users\Marcel\AppData\Local\Temp\shortcut.exe
2016-09-15 02:00 - 2016-09-15 02:00 - 0772672 _____ () C:\Users\Marcel\AppData\Local\Temp\sqlite3.dll
2016-09-10 14:17 - 2016-09-13 14:52 - 0161792 _____ (SteelWerX) C:\Users\Marcel\AppData\Local\Temp\swreg.exe
2016-09-10 14:17 - 2016-09-13 14:52 - 0217088 _____ (SteelWerX) C:\Users\Marcel\AppData\Local\Temp\swxcacls.exe
2016-09-10 14:17 - 2016-09-13 14:52 - 0154232 _____ (Noël Danjou) C:\Users\Marcel\AppData\Local\Temp\wget.exe
2016-09-10 14:17 - 2016-09-13 14:52 - 0024064 _____ () C:\Users\Marcel\AppData\Local\Temp\zoek-delete.exe

==================== Bamital & volsnap ======================

(Er is geen automatische fix voor bestanden die de verificatie niet doorkomen.)

C:\Windows\system32\winlogon.exe => Bestand is getekend
C:\Windows\system32\wininit.exe => Bestand is getekend
C:\Windows\SysWOW64\wininit.exe => Bestand is getekend
C:\Windows\explorer.exe => Bestand is getekend
C:\Windows\SysWOW64\explorer.exe => Bestand is getekend
C:\Windows\system32\svchost.exe => Bestand is getekend
C:\Windows\SysWOW64\svchost.exe => Bestand is getekend
C:\Windows\system32\services.exe => Bestand is getekend
C:\Windows\system32\User32.dll => Bestand is getekend
C:\Windows\SysWOW64\User32.dll => Bestand is getekend
C:\Windows\system32\userinit.exe => Bestand is getekend
C:\Windows\SysWOW64\userinit.exe => Bestand is getekend
C:\Windows\system32\rpcss.dll => Bestand is getekend
C:\Windows\system32\dnsapi.dll => Bestand is getekend
C:\Windows\SysWOW64\dnsapi.dll => Bestand is getekend
C:\Windows\system32\Drivers\volsnap.sys => Bestand is getekend

LastRegBack: 2017-04-06 20:17

==================== Eind van FRST.txt ============================