Mogenlijk een Keylogger. Hulp gevraagd,

arribarri · 19 september 2012

Hallo, ....

Ik ben Arribarri en ik woon nu al een tijd uit huis. (was nog bij mijn lieve mamaxD) Nu sinds, ik denk een 3 maanden wilde ik weer inloggen op mijn account voor BF3. Nu was alles weg bij Origin geen games meer niks. ik gebeld. Zeggen zo oowhja ik zie het al u bent gehackt. Dus alles veranderd hotmail ww veranderd, origin ww veranderd door ea-sports zelf en alles weer terug laten zetten door ea. Nu logde ik mij de volgende dag in bleek dat ik weer bij een andere pc was ingelogd. kunnen jullie mij hier mee helpen?

Heb hier een Hijack logje.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:56:42, on 19-9-2012

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16448)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

D:\Arwin\mine\hamachi-2-ui.exe

C:\Program Files (x86)\AVG Secure Search\vprot.exe

C:\Program Files (x86)\Internet Explorer\IELowutil.exe

C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QO9351LT\HijackThis.exe

c:\Users\User\Downloads\HijackThis.exe

C:\Windows\SysWOW64\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Funmoods Search

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.29.1\bh\BabylonToolbar.dll

O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll

O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\IPS\IPSBHO.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.0.0.7\AVG Secure Search_toolbar.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll

O3 - Toolbar: (no name) - !{51dd3535-abea-484a-b1cf-06ab7b092c0c} - (no file)

O3 - Toolbar: (no name) - !{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll

O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarTlbr.dll

O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.0.0.7\AVG Secure Search_toolbar.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "D:\Arwin\mine\hamachi-2-ui.exe" --auto-start

O4 - HKLM\..\Run: [DXM6Patch_981116] C:\Windows\p_981116.exe /Q:A

O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

O4 - HKLM\..\Run: [ROC_ROC_NT] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Free YouTube Download - C:\Users\User\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://verkopen.marktplaats.nl/js/widgets/imageUploader/aurigma/5_7_24_0/ImageUploader5.cab

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - http://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} - https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.66.2.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{EFAD5D6F-F8CA-448B-8A6A-E0BAB146A5FC}: NameServer = 10.93.88.1

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll

O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\13.0.0\ViProtocol.dll

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O20 - AppInit_DLLs:

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Arwin\mine\hamachi-2.exe

O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

O23 - Service: Hotspot Shield Service (hshld) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe

O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe

O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE

O23 - Service: Hotspot Shield Monitoring Service (HssWd) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe

O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

O23 - Service: Online Games Manager (ogmservice) - RealNetworks, Inc. - C:\Program Files (x86)\Online Games Manager\ogmservice.exe

O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

O23 - Service: TunngleService - Tunngle.net GmbH - C:\Program Files (x86)\Tunngle\TnglCtrl.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: Updater Service - Acer - C:\Program Files\Acer\Acer Updater\UpdaterService.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: vToolbarUpdater13.0.0 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.0.0\ToolbarUpdater.exe

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 14141 bytes

en of het wat uitmaakt hier ook nog een mbam logje.

Malwarebytes Anti-Malware 1.65.0.1400

www.malwarebytes.org

Databaseversie: v2012.09.19.09

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

User :: USER-PC [administrator]

19-9-2012 17:01:51

mbam-log-2012-09-19 (17-01-51).txt

Scantype: Snelle scan

Uitgeschakelde scanopties: P2P

Objecten gescand: 213442

Verstreken tijd: 5 minuut/minuten, 12 seconde(n)

Geheugenprocessen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels gedetecteerd: 3

HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Succesvol in quarantaine geplaatst en verwijderd.

HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> Succesvol in quarantaine geplaatst en verwijderd.

HKCU\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\215 APPS (PUP.CrossFire.SA) -> Succesvol in quarantaine geplaatst en verwijderd.

Registerwaarden gedetecteerd: 1

HKCU\Software\InstalledBrowserExtensions\215 Apps|4479 (PUP.CrossFire.SA) -> Data: Giant Savings -> Succesvol in quarantaine geplaatst en verwijderd.

Registerdata gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Mappen gedetecteerd: 2

C:\Program Files (x86)\Funmoods\1.5.23.22 (PUP.Funmoods) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Funmoods\1.5.23.22\bh (PUP.Funmoods) -> Succesvol in quarantaine geplaatst en verwijderd.

Bestanden gedetecteerd: 4

C:\Users\User\AppData\Local\funmoods.crx (PUP.Funmoods) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Users\User\Local Settings\Application Data\funmoods.crx (PUP.Funmoods) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Funmoods\1.5.23.22\escortShld.dll (PUP.Funmoods) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Funmoods\1.5.23.22\FavIcon.ico (PUP.Funmoods) -> Succesvol in quarantaine geplaatst en verwijderd.

(einde)

die 2 bestanden heb ik al wel verwijderd maar verder is het arabisch voor mij:dong:

hoop snel een antwoord te krijgen.

Groeten Arribarri

kape · 19 september 2012

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Funmoods Search

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)

O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.29.1\bh\BabylonToolbar.dll

O3 - Toolbar: (no name) - !{51dd3535-abea-484a-b1cf-06ab7b092c0c} - (no file)

O3 - Toolbar: (no name) - !{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarTlbr.dll

O4 - HKLM\..\Run: [DXM6Patch_981116] C:\Windows\p_981116.exe /Q:A

O20 - AppInit_DLLs:

Klik op 'Fix checked' om de items te verwijderen.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\Program Files\Trend Micro\HiJackThis of C:\Program Files (x86)\Trend Micro\HiJackThis.

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

3. Dubbelklik op "Combofix.exe" om de tool te starten.

4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht, samen met een nieuw logje van HijackThis.

arribarri · 20 september 2012

Hallo,

Allereerst, Kape bedankt voor je snelle reactie.

Ik heb hier een logje van de combofix en een logje van de hijackthis.

ComboFix 12-09-20.01 - User 20-09-2012 15:05:54.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.6142.4111 [GMT 2:00]

Gestart vanuit: c:\users\User\Desktop\ComboFix.exe

AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Common Files\Acer GameZone online.ico

c:\program files (x86)\Complitly

c:\program files (x86)\Complitly\chrome\ComplitlyChrome.crx

c:\program files (x86)\Complitly\FireFoxExtensionWithFF8Fix.exe

c:\program files (x86)\Complitly\FireFoxUninstaller.exe

c:\program files (x86)\Complitly\InstTracker.exe

c:\program files (x86)\Complitly\support@Complitly.com\chrome.manifest

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\appIcon.png

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\browserOverlay.xul

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\options.js

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\options.xul

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\utils.js

c:\program files (x86)\Complitly\support@Complitly.com\defaults\preferences\predictad.js

c:\program files (x86)\Complitly\support@Complitly.com\install.rdf

c:\program files (x86)\Complitly\System.Data.SQLite.dll

c:\program files (x86)\Complitly\unins000.dat

c:\program files (x86)\Complitly\unins000.exe

c:\program files (x86)\DealPly

c:\program files (x86)\DealPly\DealPly.crx

c:\program files (x86)\DealPly\DealPly.xpi

c:\program files (x86)\DealPly\DealPlyIE.dll

c:\program files (x86)\DealPly\DealPlyTune.dll

c:\program files (x86)\DealPly\DealPlyUpdate.exe

c:\program files (x86)\DealPly\DealPlyUpdate.log

c:\program files (x86)\DealPly\DealPlyUpdateRun.exe

c:\program files (x86)\DealPly\icon.ico

c:\program files (x86)\DealPly\uninst.exe

c:\programdata\Amazon.ico

c:\programdata\MercadoLivre.ico

c:\programdata\windows

c:\programdata\windows\msxx.dat

c:\programdata\windows\vvve.dat

c:\programdata\Windows\wjdj.dat

c:\users\User\AppData\Roaming\.#

c:\users\User\AppData\Roaming\Akytdu

c:\users\User\AppData\Roaming\Akytdu\osli.iho

c:\users\User\AppData\Roaming\Ammay

c:\users\User\AppData\Roaming\Ammay\beaza.ipg

c:\users\User\AppData\Roaming\Byaty

c:\users\User\AppData\Roaming\Byaty\logy.exc

c:\users\User\AppData\Roaming\Byhyfi

c:\users\User\AppData\Roaming\Byhyfi\vewem.yrf

c:\users\User\AppData\Roaming\Dexe

c:\users\User\AppData\Roaming\Dexe\yztym.byt

c:\users\User\AppData\Roaming\Ebgovy

c:\users\User\AppData\Roaming\Ebgovy\iply.ume

c:\users\User\AppData\Roaming\Exxao

c:\users\User\AppData\Roaming\Exxao\lyynz.hiz

c:\users\User\AppData\Roaming\Fezev

c:\users\User\AppData\Roaming\Fezev\egxeg.bao

c:\users\User\AppData\Roaming\Huupq

c:\users\User\AppData\Roaming\Huupq\zere.uza

c:\users\User\AppData\Roaming\Icpeul

c:\users\User\AppData\Roaming\Icpeul\avbue.rye

c:\users\User\AppData\Roaming\Ifyl

c:\users\User\AppData\Roaming\Ifyl\ovav.dud

c:\users\User\AppData\Roaming\Igin

c:\users\User\AppData\Roaming\Igin\miik.uhz

c:\users\User\AppData\Roaming\Ilha

c:\users\User\AppData\Roaming\Ilha\feky.imu

c:\users\User\AppData\Roaming\Inwyo

c:\users\User\AppData\Roaming\Inwyo\yxwew.wuu

c:\users\User\AppData\Roaming\Ipuc

c:\users\User\AppData\Roaming\Ipuc\qiump.aco

c:\users\User\AppData\Roaming\Irti

c:\users\User\AppData\Roaming\Irti\puxay.ehb

c:\users\User\AppData\Roaming\Kyok

c:\users\User\AppData\Roaming\Kyok\upxa.uqc

c:\users\User\AppData\Roaming\Loewuh

c:\users\User\AppData\Roaming\Loewuh\miifp.qai

c:\users\User\AppData\Roaming\Lovaeb

c:\users\User\AppData\Roaming\Lovaeb\tupyx.gob

c:\users\User\AppData\Roaming\Memo

c:\users\User\AppData\Roaming\Memo\ycos.soi

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\chrome.manifest

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\funmoods.css

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\funmoods.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\arwDwn.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ae.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\bg.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ch.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cn.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cz.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\de.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\eg.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\en.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\es.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\fr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\gr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\he.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\il.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\it.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ja.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\jp.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\nl.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\no.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pl.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pt.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ro.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ru.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sa.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\se.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sv.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\tr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ua.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\us.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\help_16.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\home.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\logo.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\privecy_16_hot.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\tellafriend.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\loader.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\mtstart.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\tmplt.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\uninsthk.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\chrome.manifest

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\funmoods.css

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\funmoods.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\images\pref.jpg

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\arwDwn.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ae.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\bg.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ch.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\cn.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\cz.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\de.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\eg.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\en.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\es.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\fr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\gr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\he.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\il.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\it.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ja.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\jp.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\nl.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\no.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\pl.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\pt.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ro.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ru.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\sa.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\se.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\sv.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\tr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ua.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\us.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\help_16.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\home.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\logo.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\privecy_16_hot.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\tellafriend.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\loader.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\mtstart.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\preferences.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\tmplt.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\install.rdf

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\META-INF\le_c6a58f26_4d2d_4341_b387_c4f2289b6170.rsa

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\META-INF\le_c6a58f26_4d2d_4341_b387_c4f2289b6170.sf

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\META-INF\manifest.mf

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\install.rdf

c:\users\User\AppData\Roaming\Niucr

c:\users\User\AppData\Roaming\Niucr\adqud.hia

c:\users\User\AppData\Roaming\Odukf

c:\users\User\AppData\Roaming\Odukf\xeig.yqo

c:\users\User\AppData\Roaming\Riuq

c:\users\User\AppData\Roaming\Riuq\yqifi.ukz

c:\users\User\AppData\Roaming\Roaming

c:\users\User\AppData\Roaming\Roaming\Quest3D\ShipSimExtreme\channels.lst

c:\users\User\AppData\Roaming\Rorake

c:\users\User\AppData\Roaming\Rorake\sofui.oxg

c:\users\User\AppData\Roaming\Tesi

c:\users\User\AppData\Roaming\Tesi\qyatu.ifa

c:\users\User\AppData\Roaming\Toeq

c:\users\User\AppData\Roaming\Toeq\vyybo.oke

c:\users\User\AppData\Roaming\Togehe

c:\users\User\AppData\Roaming\Togehe\edbo.ecv

c:\users\User\AppData\Roaming\Udvy

c:\users\User\AppData\Roaming\Udvy\ogypt.cal

c:\users\User\AppData\Roaming\Ufola

c:\users\User\AppData\Roaming\Ufola\deyf.wee

c:\users\User\AppData\Roaming\Umepgu

c:\users\User\AppData\Roaming\Umepgu\mevax.wit

c:\users\User\AppData\Roaming\Unhuh

c:\users\User\AppData\Roaming\Unhuh\arzer.yfd

c:\users\User\AppData\Roaming\Veulu

c:\users\User\AppData\Roaming\Veulu\cuux.ivi

c:\users\User\AppData\Roaming\Vywy

c:\users\User\AppData\Roaming\Vywy\rukoe.una

c:\users\User\AppData\Roaming\Xaatun

c:\users\User\AppData\Roaming\Xaatun\ceteq.isd

c:\users\User\AppData\Roaming\Xole

c:\users\User\AppData\Roaming\Xole\veixw.nae

c:\users\User\AppData\Roaming\Xozi

c:\users\User\AppData\Roaming\Xozi\quock.sug

c:\users\User\AppData\Roaming\Xyluu

c:\users\User\AppData\Roaming\Xyluu\myobd.eho

c:\users\User\AppData\Roaming\Yvar

c:\users\User\AppData\Roaming\Yvar\qaes.asb

c:\users\User\AppData\Roaming\Zeapa

c:\users\User\AppData\Roaming\Zeapa\ipvy.oga

c:\users\User\AppData\Roaming\Zuaws

c:\users\User\AppData\Roaming\Zuaws\olyh.omx

c:\windows\IsUn0413.exe

c:\windows\SysWow64\Packet.dll

c:\windows\SysWow64\pthreadVC.dll

c:\windows\SysWow64\wpcap.dll

F:\install.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

-------\Service_npf

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-08-20 to 2012-09-20 ))))))))))))))))))))))))))))))

.

2072-04-03 11:13 . 2008-03-21 12:46 607296 ------w- c:\program files (x86)\Microsoft Games\Age of Empires III\deformerdllyD.dll

2012-09-19 15:00 . 2012-09-19 15:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-09-19 15:00 . 2012-09-07 15:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-15 13:52 . 2012-09-15 13:52 -------- d-----w- c:\programdata\120C

2012-09-12 19:34 . 2012-09-12 19:34 -------- d-----w- c:\users\User\AppData\Local\AVG Secure Search

2012-09-12 19:34 . 2012-09-12 19:34 -------- d-----w- c:\programdata\AVG Secure Search

2012-09-12 19:34 . 2012-09-12 19:33 30568 ----a-w- c:\windows\system32\drivers\avgtpx64.sys

2012-09-12 19:34 . 2012-09-12 19:34 -------- d-----w- c:\program files (x86)\AVG Secure Search

2012-09-12 19:34 . 2012-09-12 19:34 -------- d-----w- c:\program files (x86)\Common Files\AVG Secure Search

2012-09-12 19:33 . 2012-09-12 19:34 -------- d-----w- c:\users\User\AppData\Roaming\avg

2012-09-12 19:33 . 2012-09-12 20:01 -------- d-----w- c:\users\User\AppData\Roaming\Systweak

2012-09-12 19:33 . 2012-08-29 14:24 19368 ----a-w- c:\windows\system32\roboot64.exe

2012-09-12 17:56 . 2012-09-12 17:56 -------- d-----w- c:\users\User\AppData\Local\sabnzbd

2012-09-12 04:36 . 2012-08-22 18:12 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-09-12 04:36 . 2012-07-04 20:26 41472 ----a-w- c:\windows\system32\drivers\RNDISMP.sys

2012-09-12 04:36 . 2012-08-02 17:58 574464 ----a-w- c:\windows\system32\d3d10level9.dll

2012-09-12 04:36 . 2012-08-02 16:57 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll

2012-09-12 04:36 . 2012-08-22 18:12 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-09-12 04:36 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-09-12 04:36 . 2012-08-22 18:12 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

2012-09-11 17:49 . 2012-09-11 17:49 -------- d-----w- c:\users\User\AppData\Roaming\MusicNet

2012-09-11 17:49 . 2012-09-15 15:04 -------- d-----w- c:\users\User\AppData\Local\iMesh

2012-09-11 17:48 . 2012-09-13 07:24 -------- d-----w- c:\program files (x86)\iMesh Applications

2012-09-08 23:39 . 2012-09-08 23:39 -------- d-----w- C:\found.000

2012-09-07 14:11 . 2012-09-07 14:12 -------- d-----w- c:\program files (x86)\Catan

2012-08-23 12:14 . 2012-08-23 12:14 -------- d-----w- c:\users\User\AppData\Roaming\AlawarEntertainment

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-18 14:03 . 2012-01-02 15:26 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

2012-09-18 14:03 . 2011-02-25 23:01 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr

2012-09-12 17:14 . 2011-02-26 22:39 64462936 ----a-w- c:\windows\system32\MRT.exe

2012-09-08 13:43 . 2012-01-02 15:26 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0

2012-08-15 00:18 . 2012-07-18 12:38 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-08-15 00:18 . 2012-07-18 12:38 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-07-24 20:11 . 2012-07-24 20:11 41704 ----a-w- c:\windows\system32\drivers\hssdrv6.sys

2012-07-24 20:11 . 2012-07-24 20:11 38632 ----a-w- c:\windows\system32\drivers\taphss.sys

2012-07-18 18:15 . 2012-08-15 12:55 3148800 ----a-w- c:\windows\system32\win32k.sys

2012-07-18 13:43 . 2012-07-18 13:43 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

2012-07-06 02:17 . 2012-08-15 09:21 37536 ----a-w- c:\windows\system32\drivers\NISx64\1308000.00E\srtspx64.sys

2012-07-06 02:17 . 2012-08-15 09:21 737952 ----a-w- c:\windows\system32\drivers\NISx64\1308000.00E\srtsp64.sys

2012-07-05 20:06 . 2012-07-18 12:39 772544 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-07-04 22:16 . 2012-08-15 12:55 73216 ----a-w- c:\windows\system32\netapi32.dll

2012-07-04 22:13 . 2012-08-15 12:55 59392 ----a-w- c:\windows\system32\browcli.dll

2012-07-04 22:13 . 2012-08-15 12:55 136704 ----a-w- c:\windows\system32\browser.dll

2012-07-04 21:14 . 2012-08-15 12:55 41984 ----a-w- c:\windows\SysWow64\browcli.dll

2012-06-29 10:04 . 2012-07-18 07:37 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{22216181-D7D7-4849-A938-4F03043471C7}\mpengine.dll

2012-06-29 04:55 . 2012-08-15 20:48 17809920 ----a-w- c:\windows\system32\mshtml.dll

2012-06-29 04:09 . 2012-08-15 20:48 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-06-29 03:56 . 2012-08-15 20:48 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-06-29 03:49 . 2012-08-15 20:48 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-06-29 03:49 . 2012-08-15 20:48 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-06-29 03:48 . 2012-08-15 20:48 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-06-29 03:47 . 2012-08-15 20:48 237056 ----a-w- c:\windows\system32\url.dll

2012-06-29 03:45 . 2012-08-15 20:48 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-06-29 03:44 . 2012-08-15 20:48 816640 ----a-w- c:\windows\system32\jscript.dll

2012-06-29 03:43 . 2012-08-15 20:48 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-06-29 03:42 . 2012-08-15 20:48 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-06-29 03:40 . 2012-08-15 20:48 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-06-29 03:39 . 2012-08-15 20:48 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-06-29 03:35 . 2012-08-15 20:48 248320 ----a-w- c:\windows\system32\ieui.dll

2012-06-29 00:16 . 2012-08-15 20:48 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-06-29 00:09 . 2012-08-15 20:48 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-06-29 00:08 . 2012-08-15 20:48 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-06-29 00:04 . 2012-08-15 20:48 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-06-29 00:00 . 2012-08-15 20:48 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-09-16 13:12 . 2012-04-21 11:59 3623592 ----a-w- c:\program files (x86)\Common Files\ApnToolbarInstaller.exe

2011-09-16 13:12 . 2012-04-21 11:59 143240 ----a-w- c:\program files (x86)\Common Files\ApnStub.exe

2010-01-26 09:11 . 2012-07-23 13:56 444283 ----a-w- c:\program files\Common Files\WinPcapNmap.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2012-09-12 19:33 1756616 ----a-w- c:\program files (x86)\AVG Secure Search\13.0.0.7\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\13.0.0.7\AVG Secure Search_toolbar.dll" [2012-09-12 1756616]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:41 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]

"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-10-06 393216]

"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-07-31 896400]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"LogMeIn Hamachi Ui"="d:\arwin\mine\hamachi-2-ui.exe" [2012-08-29 1996200]

"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-09-12 959944]

"ROC_ROC_NT"="c:\program files (x86)\AVG Secure Search\ROC_ROC_NT.exe" [2012-09-12 856160]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update-service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-20 136176]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-15 250056]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-20 136176]

R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]

R3 PCDSRVC{91725DDC-D497D3C5-06020101}_0;PCDSRVC{91725DDC-D497D3C5-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\users\user\appdata\local\temp\uxdolmlbtct2\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe [2012-04-19 736104]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-02-18 51712]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-26 1255736]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1308000.00E\SYMDS64.SYS [2011-07-25 451192]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1308000.00E\SYMEFA64.SYS [2012-05-22 1129120]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2012-09-12 30568]

S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120905.001\BHDrvx64.sys [2012-08-31 1385120]

S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1308000.00E\ccSetx64.sys [2012-06-07 167072]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-08-20 270912]

S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys [2012-07-24 41704]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120919.001\IDSvia64.sys [2012-09-01 513184]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1308000.00E\Ironx64.SYS [2012-04-18 190072]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1308000.00E\SYMNETS.SYS [2012-04-18 405624]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-10-26 204288]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-06-11 361984]

S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]

S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [2010-11-09 21992]

S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\arwin\mine\hamachi-2.exe [2012-08-29 2369960]

S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2012-04-05 8704]

S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\openvpnas.exe [2012-08-03 476016]

S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2012-08-03 387440]

S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe [2012-06-16 138272]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-12 62208]

S2 ogmservice;Online Games Manager;c:\program files (x86)\Online Games Manager\ogmservice.exe [2012-06-08 521344]

S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2012-02-03 793048]

S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-08-13 3064000]

S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S2 vToolbarUpdater13.0.0;vToolbarUpdater13.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.0.0\ToolbarUpdater.exe [2012-09-12 711112]

S2 yksvc;Marvell Yukon Service;c:\windows\System32\svchost.exe [2009-07-14 27136]

S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-10-26 10496512]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-10-26 326656]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-02-23 95760]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-09-09 138912]

S3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;c:\windows\system32\DRIVERS\RTL85n64.sys [2010-03-23 2061856]

S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 31232]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-09-28 395264]

.

--- Andere Services/Drivers In Geheugen ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

Inhoud van de 'Gedeelde Taken' map

.

2012-09-20 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-18 00:18]

.

2012-09-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-20 10:56]

.

2012-09-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-20 10:56]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]

2012-07-24 20:11 287048 ----a-w- c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:44 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VDownloader"="c:\program files\VDownloader\VDownloader.exe" [2012-07-17 881664]

"combofix"="c:\combofix\CF31613.3XE" [2010-11-20 345088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x1

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

uLocal Page = c:\windows\SYSTEM32\blank.htm

uInternet Settings,ProxyOverride = <local>

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Free YouTube Download - c:\users\User\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

TCP: DhcpNameServer = 212.54.40.25 212.54.35.25

TCP: Interfaces\{EFAD5D6F-F8CA-448B-8A6A-E0BAB146A5FC}: NameServer = 10.93.88.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\13.0.0\ViProtocol.dll

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

Toolbar-!{51dd3535-abea-484a-b1cf-06ab7b092c0c} - (no file)

Toolbar-!{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

Toolbar-!{51dd3535-abea-484a-b1cf-06ab7b092c0c} - (no file)

Toolbar-!{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)

AddRemove-Advanced System Protector_is1 - c:\program files (x86)\Advanced System Protector\unins000.exe

AddRemove-Catan - c:\windows\IsUn0413.exe

AddRemove-DealPly - c:\program files (x86)\DealPly\uninst.exe

AddRemove-{4FFBB818-B13C-11E0-931D-B2664824019B}_is1 - c:\program files (x86)\Complitly\unins000.exe

AddRemove-{8FB495A1-4A3F-4C1D-BD27-3F3AB2E66763} - c:\programdata\{B1148819-B88A-4DDE-A988-CA8093A887F4}\iMesh_V11_en_Setup.exe

AddRemove-733602830.PC Speed Up - PCSpeedUp.com - c:\program files\Microsoft Silverlight\5.0.61118.0\Silverlight.Configuration.exe

AddRemove-FLV Player - c:\program files (x86)\FLVPlayer\Uninstall\Uninstall.exe

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]

"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.8.0.14\diMaster.dll\" /prefetch:1"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_5891ae0.dll"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{91725DDC-D497D3C5-06020101}_0]

"ImagePath"="\??\c:\users\user\appdata\local\temp\uxdolmlbtct2\pcdrdiag\bin\pcdsrvc_x64.pkms"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-1653913758-1519129782-4275150660-1000\Software\SecuROM\License information*]

"datasecu"=hex:cf,84,98,64,f0,f7,7a,16,f1,ba,9c,ca,67,1e,70,1e,72,58,0c,8f,07,

ba,4f,f5,fb,07,c4,87,d5,ba,c9,28,0a,a6,e0,24,a6,a1,ec,b9,b0,e4,e1,51,eb,37,\

"rkeysecu"=hex:19,57,10,fa,ad,2e,12,9d,09,8d,d8,dc,d6,c9,77,4a

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files (x86)\Hotspot Shield\HssWPR\hsssrv.exe

c:\windows\SysWOW64\PnkBstrA.exe

.

**************************************************************************

.

Voltooingstijd: 2012-09-20 15:37:57 - machine werd herstart

ComboFix-quarantined-files.txt 2012-09-20 13:37

.

Pre-Run: 56.507.609.088 bytes beschikbaar

Post-Run: 56.760.922.112 bytes beschikbaar

.

- - End Of File - - C67EA1EDF1376BFDDC310DE0ED17D552

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:39:06, on 20-9-2012

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16448)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe

C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe

C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

C:\Program Files (x86)\uTorrent\uTorrent.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

D:\Arwin\mine\hamachi-2-ui.exe

C:\Program Files (x86)\AVG Secure Search\vprot.exe

C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

c:\Users\User\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL