start
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restrictie <======= AANDACHT
HKU\S-1-5-21-3460383440-3824553181-3943810373-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restrictie <======= AANDACHT
HKU\S-1-5-21-3460383440-3824553181-3943810373-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.amazon.com/gp/bit/amazonserp/ref=bit_bds-p17_serp_ie_us_display?ie=UTF8&tagbase=bds-p17&tbrId=v1_abb-channel-17_00548d89_1201_1403_20160516_BE_ie_sp_
SearchScopes: HKU\S-1-5-21-3460383440-3824553181-3943810373-1001 -> {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} URL = hxxps://www.amazon.com/gp/bit/amazonserp/ref=bit_bds-p17_serp_ie_us_display?ie=UTF8&tagbase=bds-p17&tbrId=v1_abb-channel-17_00548d89_1201_1403_20160516_BE_ie_ds_&tag=bds-p17-serp-us-ie-20&query={searchTerms}
FF NewTab: Mozilla\Firefox\Profiles\2kbomczq.default -> hxxps://www.amazon.com/gp/bit/amazonserp/ref=bit_bds-p17_serp_ff_us_display?ie=UTF8&tagbase=bds-p17&tbrId=v1_abb-channel-17_00548d89_1201_1403_20160516_BE_ff_nt_
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\2kbomczq.default -> Amazon
FF Plugin: @microsoft.com/GENUINE -> disabled [Geen bestand]
FF HKLM-x32\...\Firefox\Extensions: [belgiumeid@eid.belgium.be] - C:\Program Files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be => niet gevonden
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Geen bestand]
CHR HomePage: Default -> amazon.com/websearch/?ie=UTF8__PARAM__
CHR DefaultSearchKeyword: Default -> amazon
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
C:\ComboFix
2017-04-26 12:35 - 2016-11-12 12:13 - 00002896 _____ C:\Windows\System32\Tasks\AutoKMS
2017-04-26 12:35 - 2016-11-12 12:13 - 00000266 _____ C:\Windows\Tasks\AutoKMS.job
Task: {2E252E96-B0E1-4670-A729-A7FC10D2CDE8} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2016-11-12] ()
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
C:\Windows\AutoKMS
IE trusted site: HKU\S-1-5-21-3460383440-3824553181-3943810373-1001\...\amazon.com -> hxxps://amazon.com
EmptyTemp:
end