Ga naar inhoud

onderhoud centrum

misteragga
 Delen

Aanbevolen berichten

misteragga Veteraan

misteragga

Geplaatst:
  • Auteur
Geplaatst:

hier is dan combofixlog.

ComboFix 12-10-24.02 - Brian 24-10-2012 20:23:23.8.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.3959.2638 [GMT 2:00]

Gestart vanuit: c:\users\Brian\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Brian\Desktop\CFScript.txt.txt

AV: McAfee Antivirus en antispyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}

FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}

SP: McAfee Antivirus en antispyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\system32\drivers\bfhg.sys"

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}

c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.dat

c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.exe

c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.lnk

c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.msi

c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.par

c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.res

c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\instance.dat

c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\mia.lib

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_savhyjjk

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-09-24 to 2012-10-24 ))))))))))))))))))))))))))))))

.

.

2012-10-24 18:27 . 2012-10-24 18:27 -------- d-----w- c:\users\Public\AppData\Local\temp

2012-10-24 18:27 . 2012-10-24 18:27 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-10-24 00:22 . 2012-10-24 00:22 -------- d-----w- c:\programdata\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}

2012-10-24 00:22 . 2012-10-24 00:22 -------- d-----w- c:\users\Brian\AppData\Roaming\WinBatch

2012-10-23 23:34 . 2012-10-23 23:34 -------- d-----w- c:\program files (x86)\ESET

2012-10-23 23:34 . 2012-10-23 23:34 -------- d--h--w- c:\windows\AxInstSV

2012-10-23 23:32 . 2012-10-23 23:32 -------- d-----w- c:\users\Brian\AppData\Roaming\Apple Computer

2012-10-23 23:28 . 2012-10-23 23:28 -------- d-----w- c:\programdata\IObit

2012-10-23 23:28 . 2012-10-23 23:28 -------- d-----w- c:\users\Brian\AppData\Roaming\IObit

2012-10-23 23:04 . 2012-10-23 23:04 -------- d-----w- c:\program files\Speccy

2012-10-21 22:24 . 2012-10-21 22:24 -------- d-----w- c:\users\Brian\AppData\Local\Facebook

2012-10-20 00:46 . 2012-10-20 00:46 -------- d-----w- c:\programdata\Malwarebytes

2012-10-20 00:45 . 2012-10-23 23:27 -------- d-----w- C:\test programma's

2012-10-17 20:36 . 2012-10-17 20:36 289768 ----a-w- c:\windows\system32\javaws.exe

2012-10-17 20:36 . 2012-10-17 20:36 108008 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll

2012-10-17 20:36 . 2012-10-17 20:36 189416 ----a-w- c:\windows\system32\javaw.exe

2012-10-17 20:36 . 2012-10-17 20:36 188904 ----a-w- c:\windows\system32\java.exe

2012-10-17 20:36 . 2012-10-17 20:36 -------- d-----w- c:\program files\Java

2012-10-17 20:35 . 2012-10-17 20:35 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-10-15 22:20 . 2012-10-15 22:20 -------- d-----w- c:\users\Brian\AppData\Local\Secunia PSI

2012-10-15 22:20 . 2012-10-15 22:20 -------- d-----w- c:\program files (x86)\Secunia

2012-10-14 13:25 . 2012-10-14 13:25 -------- d-----w- c:\programdata\WinBar

2012-10-14 13:25 . 2012-10-14 13:25 -------- d-----w- c:\program files (x86)\WinBar

2012-10-13 23:24 . 2012-10-13 23:24 -------- d-----w- c:\program files (x86)\Stardock

2012-10-13 21:19 . 2012-10-13 21:19 -------- d-----w- c:\users\Brian\AppData\Local\Stardock_Corporation

2012-10-13 21:15 . 2012-10-13 21:15 -------- d--h--w- c:\programdata\Common Files

2012-10-13 19:19 . 2012-10-13 19:19 61440 ----a-w- c:\windows\SysWow64\drivers\bfhg.sys

2012-10-13 19:19 . 2012-10-13 19:19 574 ----a-w- C:\cleanup.bat

2012-10-12 21:54 . 2012-10-12 21:54 -------- d-----w- c:\users\Brian\DoctorWeb

2012-10-12 02:02 . 2012-10-12 02:02 -------- d-----w- c:\users\Brian\AppData\Local\ElevatedDiagnostics

2012-10-10 03:24 . 2012-10-10 03:24 -------- d-----w- c:\windows\SysWow64\wbem\Logs

2012-10-10 03:04 . 2012-10-10 03:04 -------- d-----w- c:\program files (x86)\Trend Micro

2012-10-10 02:31 . 2012-08-31 18:19 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

2012-10-10 02:31 . 2012-08-30 18:03 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-10-10 02:31 . 2012-08-30 17:12 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-10-10 02:31 . 2012-08-30 17:12 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-10-10 02:29 . 2012-08-11 00:56 715776 ----a-w- c:\windows\system32\kerberos.dll

2012-10-10 02:29 . 2012-08-10 23:56 542208 ----a-w- c:\windows\SysWow64\kerberos.dll

2012-10-10 02:29 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll

2012-10-10 02:29 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll

2012-10-10 02:29 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll

2012-10-10 02:29 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll

2012-10-10 02:29 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll

2012-10-10 02:29 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll

2012-10-09 00:29 . 2012-10-09 00:29 -------- d-----w- c:\program files\HitmanPro

2012-10-09 00:29 . 2012-10-09 00:30 -------- d-----w- c:\programdata\HitmanPro

2012-10-05 23:30 . 2012-10-05 23:31 -------- d-----w- c:\users\Brian\AppData\Roaming\Canon

2012-10-05 23:08 . 2012-10-05 23:08 -------- d-----w- c:\windows\nl

2012-10-05 23:07 . 2012-10-05 23:07 -------- d-----w- c:\windows\en

2012-10-05 23:06 . 2012-10-05 23:06 -------- d-----w- c:\program files\Windows Live

2012-10-05 22:55 . 2012-10-05 22:56 -------- d-----w- c:\program files\Soluto

2012-10-04 22:33 . 2012-10-04 22:33 53248 ----a-r- c:\users\Brian\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

2012-09-30 01:35 . 2012-09-30 01:35 -------- d-----w- c:\users\Brian\AppData\Roaming\Auslogics

2012-09-29 00:01 . 2012-09-29 00:02 -------- d-----w- c:\users\Brian\AppData\Roaming\QuickScan

2012-09-28 00:36 . 2012-04-20 14:40 196440 ----a-w- c:\windows\system32\drivers\HipShieldK.sys

2012-09-27 23:58 . 2012-09-27 23:58 -------- d-----w- c:\program files\Macrium

2012-09-25 20:49 . 2012-09-25 20:49 -------- d-----w- c:\users\Brian\AppData\Roaming\Malwarebytes

2012-09-25 17:08 . 2012-08-21 21:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe

2012-09-25 10:20 . 2012-09-25 10:20 -------- d-----w- c:\users\Brian\AppData\Local\Diagnostics

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-17 20:36 . 2012-09-14 16:51 916456 ----a-w- c:\windows\system32\deployJava1.dll

2012-10-17 20:36 . 2012-09-14 16:51 1034216 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-10-17 20:35 . 2012-09-14 16:53 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-10-17 20:35 . 2012-09-14 16:53 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-10-10 02:25 . 2012-09-14 15:19 65309168 ----a-w- c:\windows\system32\MRT.exe

2012-10-08 22:36 . 2012-09-14 16:50 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-08 22:36 . 2012-09-14 16:50 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-10-04 18:25 . 2012-09-20 22:47 54728 ----a-w- c:\windows\system32\drivers\Soluto.sys

2012-09-22 23:53 . 2012-09-22 23:53 56016 ----a-w- c:\windows\system32\drivers\fsbts.sys

2012-09-15 18:36 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll

2012-09-15 18:36 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll

2012-09-14 16:18 . 2010-06-24 19:33 19720 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-09-14 15:24 . 2012-09-14 15:24 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2012-09-14 15:24 . 2012-09-14 15:24 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2012-09-14 15:24 . 2012-09-14 15:24 89088 ----a-w- c:\windows\system32\ie4uinit.exe

2012-09-14 15:24 . 2012-09-14 15:24 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll

2012-09-14 15:24 . 2012-09-14 15:24 85504 ----a-w- c:\windows\system32\iesetup.dll

2012-09-14 15:24 . 2012-09-14 15:24 82432 ----a-w- c:\windows\system32\icardie.dll

2012-09-14 15:24 . 2012-09-14 15:24 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2012-09-14 15:24 . 2012-09-14 15:24 76800 ----a-w- c:\windows\system32\tdc.ocx

2012-09-14 15:24 . 2012-09-14 15:24 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe

2012-09-14 15:24 . 2012-09-14 15:24 74752 ----a-w- c:\windows\SysWow64\iesetup.dll

2012-09-14 15:24 . 2012-09-14 15:24 65024 ----a-w- c:\windows\system32\pngfilt.dll

2012-09-14 15:24 . 2012-09-14 15:24 63488 ----a-w- c:\windows\SysWow64\tdc.ocx

2012-09-14 15:24 . 2012-09-14 15:24 55296 ----a-w- c:\windows\system32\msfeedsbs.dll

2012-09-14 15:24 . 2012-09-14 15:24 534528 ----a-w- c:\windows\system32\ieapfltr.dll

2012-09-14 15:24 . 2012-09-14 15:24 49664 ----a-w- c:\windows\system32\imgutil.dll

2012-09-14 15:24 . 2012-09-14 15:24 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2012-09-14 15:24 . 2012-09-14 15:24 48640 ----a-w- c:\windows\system32\mshtmler.dll

2012-09-14 15:24 . 2012-09-14 15:24 452608 ----a-w- c:\windows\system32\dxtmsft.dll

2012-09-14 15:24 . 2012-09-14 15:24 448512 ----a-w- c:\windows\system32\html.iec

2012-09-14 15:24 . 2012-09-14 15:24 403248 ----a-w- c:\windows\system32\iedkcs32.dll

2012-09-14 15:24 . 2012-09-14 15:24 39936 ----a-w- c:\windows\system32\iernonce.dll

2012-09-14 15:24 . 2012-09-14 15:24 3695416 ----a-w- c:\windows\system32\ieapfltr.dat

2012-09-14 15:24 . 2012-09-14 15:24 367104 ----a-w- c:\windows\SysWow64\html.iec

2012-09-14 15:24 . 2012-09-14 15:24 35840 ----a-w- c:\windows\SysWow64\imgutil.dll

2012-09-14 15:24 . 2012-09-14 15:24 30720 ----a-w- c:\windows\system32\licmgr10.dll

2012-09-14 15:24 . 2012-09-14 15:24 282112 ----a-w- c:\windows\system32\dxtrans.dll

2012-09-14 15:24 . 2012-09-14 15:24 267776 ----a-w- c:\windows\system32\ieaksie.dll

2012-09-14 15:24 . 2012-09-14 15:24 249344 ----a-w- c:\windows\system32\webcheck.dll

2012-09-14 15:24 . 2012-09-14 15:24 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll

2012-09-14 15:24 . 2012-09-14 15:24 222208 ----a-w- c:\windows\system32\msls31.dll

2012-09-14 15:24 . 2012-09-14 15:24 197120 ----a-w- c:\windows\system32\msrating.dll

2012-09-14 15:24 . 2012-09-14 15:24 165888 ----a-w- c:\windows\system32\iexpress.exe

2012-09-14 15:24 . 2012-09-14 15:24 163840 ----a-w- c:\windows\system32\ieakui.dll

2012-09-14 15:24 . 2012-09-14 15:24 161792 ----a-w- c:\windows\SysWow64\msls31.dll

2012-09-14 15:24 . 2012-09-14 15:24 160256 ----a-w- c:\windows\system32\wextract.exe

2012-09-14 15:24 . 2012-09-14 15:24 160256 ----a-w- c:\windows\system32\ieakeng.dll

2012-09-14 15:24 . 2012-09-14 15:24 152064 ----a-w- c:\windows\SysWow64\wextract.exe

2012-09-14 15:24 . 2012-09-14 15:24 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2012-09-14 15:24 . 2012-09-14 15:24 149504 ----a-w- c:\windows\system32\occache.dll

2012-09-14 15:24 . 2012-09-14 15:24 145920 ----a-w- c:\windows\system32\iepeers.dll

2012-09-14 15:24 . 2012-09-14 15:24 135168 ----a-w- c:\windows\system32\IEAdvpack.dll

2012-09-14 15:24 . 2012-09-14 15:24 12288 ----a-w- c:\windows\system32\mshta.exe

2012-09-14 15:24 . 2012-09-14 15:24 11776 ----a-w- c:\windows\SysWow64\mshta.exe

2012-09-14 15:24 . 2012-09-14 15:24 114176 ----a-w- c:\windows\system32\admparse.dll

2012-09-14 15:24 . 2012-09-14 15:24 111616 ----a-w- c:\windows\system32\iesysprep.dll

2012-09-14 15:24 . 2012-09-14 15:24 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2012-09-14 15:24 . 2012-09-14 15:24 10752 ----a-w- c:\windows\system32\msfeedssync.exe

2012-09-14 15:24 . 2012-09-14 15:24 103936 ----a-w- c:\windows\system32\inseng.dll

2012-09-14 15:24 . 2012-09-14 15:24 101888 ----a-w- c:\windows\SysWow64\admparse.dll

2012-09-12 16:11 . 2012-09-12 16:11 13504 ----a-w- c:\windows\system32\drivers\PSVolAcc.sys

2012-09-12 16:10 . 2012-09-12 16:10 57024 ----a-w- c:\windows\system32\drivers\psmounterex.sys

2012-09-12 14:07 . 2012-09-12 14:07 58368 ----a-w- c:\windows\SysWow64\sirenacm.dll

2012-09-12 13:57 . 2012-09-12 13:57 322048 ----a-w- c:\windows\WLXPGSS.SCR

2012-08-27 23:49 . 2012-09-14 15:09 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{15842E5C-D2D5-4CDE-947A-7EF9176424CE}\mpengine.dll

2012-08-24 11:15 . 2012-09-21 22:01 17810944 ----a-w- c:\windows\system32\mshtml.dll

2012-08-24 10:39 . 2012-09-21 22:01 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-08-24 10:31 . 2012-09-21 22:01 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-08-24 10:22 . 2012-09-21 22:01 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-08-24 10:21 . 2012-09-21 22:01 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-08-24 10:20 . 2012-09-21 22:01 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-08-24 10:18 . 2012-09-21 22:01 237056 ----a-w- c:\windows\system32\url.dll

2012-08-24 10:17 . 2012-09-21 22:01 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-08-24 10:14 . 2012-09-21 22:01 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-08-24 10:14 . 2012-09-21 22:01 816640 ----a-w- c:\windows\system32\jscript.dll

2012-08-24 10:13 . 2012-09-21 22:01 599040 ----a-w- c:\windows\system32\vbscript.dll

2012-08-24 10:12 . 2012-09-21 22:01 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-08-24 10:11 . 2012-09-21 22:01 729088 ----a-w- c:\windows\system32\msfeeds.dll

2012-08-24 10:10 . 2012-09-21 22:01 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-08-24 10:09 . 2012-09-21 22:01 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-08-24 10:04 . 2012-09-21 22:01 248320 ----a-w- c:\windows\system32\ieui.dll

2012-08-24 06:59 . 2012-09-21 22:01 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-08-24 06:51 . 2012-09-21 22:01 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-08-24 06:51 . 2012-09-21 22:01 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-08-24 06:47 . 2012-09-21 22:01 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-08-24 06:47 . 2012-09-21 22:01 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2012-08-24 06:43 . 2012-09-21 22:01 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2012-08-22 18:12 . 2012-09-15 19:09 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-08-22 18:12 . 2012-09-15 19:10 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-08-22 18:12 . 2012-09-15 19:09 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-08-22 18:12 . 2012-09-15 19:09 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

2012-08-20 17:38 . 2012-10-10 02:30 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2012-08-02 17:58 . 2012-09-14 15:11 574464 ----a-w- c:\windows\system32\d3d10level9.dll

2012-08-02 16:57 . 2012-09-14 15:11 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"Facebook Update"="c:\users\Brian\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-10-21 138096]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2012-09-12 1535112]

"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]

"LaunchHPOSIAPP"="c:\program files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\LaunchApp.exe" [2009-04-04 385024]

.

c:\users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Facebook Messenger.lnk - c:\users\Brian\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe [2012-9-25 247728]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2012-9-24 573536]

WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-1-21 2119488]

WDSmartWare.lnk - c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2010-1-21 9136960]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

"UacDisableNotify"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"EnableShellExecuteHooks"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux3"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]

R2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-09-24 656480]

R3 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-23 203264]

R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]

R3 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]

R3 gupdate;Google Update-service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 116648]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 116648]

R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys [2012-04-20 196440]

R3 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]

R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [2010-05-14 271712]

R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [2010-05-07 30304]

R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2012-06-22 106112]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2320920]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-09-14 1255736]

R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]

R4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-08 250808]

R4 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-08-06 681528]

R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R4 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]

S0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys [2012-09-22 56016]

S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2012-06-22 335784]

S0 Soluto;Soluto;c:\windows\system32\Drivers\Soluto.sys [2012-10-04 54728]

S1 A2DDA;A2 Direct Disk Access Support Driver;c:\users\Brian\Desktop\virus scanner\virus scanners\emsisoft\Run\a2ddax64.sys [2012-06-12 23208]

S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]

S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]

S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2012-06-22 218320]

S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2012-06-22 177144]

S2 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [2012-09-12 301760]

S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-09-24 1328736]

S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe [2012-10-04 604728]

S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-31 2754984]

S2 WDDMService;WD SmartWare Drive Manager Service;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2010-01-21 130048]

S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-23 7886848]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-23 285696]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-09-24 116752]

S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2012-06-22 69672]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2012-01-18 351136]

S3 LVUVC64;Logitech HD Webcam C310(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2012-01-18 4865568]

S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2012-06-22 513456]

S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2011-12-16 17976]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-09-03 349800]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2009-02-13 14464]

.

.

--- Andere Services/Drivers In Geheugen ---

.

*Deregistered* - mfeavfk01

.

Inhoud van de 'Gedeelde Taken' map

.

2012-10-09 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-14 22:36]

.

2012-10-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4085980671-1877415730-1580475011-1000Core.job

- c:\users\Brian\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-21 22:24]

.

2012-10-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4085980671-1877415730-1580475011-1000UA.job

- c:\users\Brian\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-21 22:24]

.

2012-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 16:29]

.

2012-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 16:29]

.

2012-10-24 c:\windows\Tasks\HPCeeScheduleForBRIAN-PC$.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]

.

2012-10-21 c:\windows\Tasks\HPCeeScheduleForBrian.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-07-26 2782096]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files (x86)\Stardock\Fences\FencesMenu64.dll" [2010-06-22 253288]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://google.nl/

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS VERWIJDERD - - - -

.

AddRemove-Fences - c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.exe

AddRemove-{10CD364B-FFCC-48BE-B469-B9622A033075} - c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.exe

AddRemove-{D40EB009-0499-459c-A8AF-C9C110766215} - c:\program files (x86)\Common Files\LogiShrd\Installer\{D40EB009-0499-459c-A8AF-C9C110766215}\setup.exe

.

.

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-4085980671-1877415730-1580475011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-4085980671-1877415730-1580475011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*]

"v5Licence0"="15-BDQC-7UK5-EXJX-PX69-4H1M-NKYDU2H"

"Activated"="N"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\windows\SysWOW64\rundll32.exe

c:\program files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\ModLEDKey.exe

c:\program files (x86)\TeamViewer\Version7\TeamViewer.exe

c:\program files (x86)\TeamViewer\Version7\tv_w32.exe

.

**************************************************************************

.

Voltooingstijd: 2012-10-24 20:31:18 - machine werd herstart

ComboFix-quarantined-files.txt 2012-10-24 18:31

ComboFix2.txt 2012-10-23 18:10

ComboFix3.txt 2012-10-21 23:03

.

Pre-Run: 1.435.170.000.896 bytes beschikbaar

Post-Run: 1.434.711.334.912 bytes beschikbaar

.

- - End Of File - - 4CF9E54C2F3230181B970073E63017BD

Link naar reactie
Delen op andere sites
kweezie wabbit Grootmeester

kweezie wabbit

Geplaatst:
Geplaatst:

Open het bestandje CFScript.txt.

Vervang de inhoud door onderstaande vetgedrukte tekst.

File::

c:\windows\SysWow64\drivers\bfhg.sys

Folder::

c:\programdata\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}

Sla de wijzigingen op en sluit het bestand

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht

Link naar reactie
Delen op andere sites
misteragga Veteraan

misteragga

Geplaatst:
  • Auteur
Geplaatst:

en dit is weer de volgende log.

combofix.

ComboFix 12-10-25.02 - Brian 26-10-2012 0:49.9.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.3959.2151 [GMT 2:00]

Gestart vanuit: c:\users\Brian\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Brian\Desktop\CFScript.txt.txt

AV: McAfee Antivirus en antispyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}

FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}

SP: McAfee Antivirus en antispyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

FILE ::

"c:\windows\SysWow64\drivers\bfhg.sys"

.

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}

c:\programdata\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}\0x0409.ini

c:\programdata\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}\HP Support Assistant.msi

c:\windows\SysWow64\drivers\bfhg.sys

.

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-09-25 to 2012-10-25 ))))))))))))))))))))))))))))))

.

.

2012-10-25 22:53 . 2012-10-25 22:53 -------- d-----w- c:\users\Public\AppData\Local\temp

2012-10-25 22:53 . 2012-10-25 22:53 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-10-24 00:22 . 2012-10-24 00:22 -------- d-----w- c:\users\Brian\AppData\Roaming\WinBatch

2012-10-23 23:34 . 2012-10-23 23:34 -------- d-----w- c:\program files (x86)\ESET

2012-10-23 23:34 . 2012-10-23 23:34 -------- d--h--w- c:\windows\AxInstSV

2012-10-23 23:32 . 2012-10-23 23:32 -------- d-----w- c:\users\Brian\AppData\Roaming\Apple Computer

2012-10-23 23:28 . 2012-10-23 23:28 -------- d-----w- c:\programdata\IObit

2012-10-23 23:28 . 2012-10-23 23:28 -------- d-----w- c:\users\Brian\AppData\Roaming\IObit

2012-10-23 23:04 . 2012-10-23 23:04 -------- d-----w- c:\program files\Speccy

2012-10-21 22:24 . 2012-10-21 22:24 -------- d-----w- c:\users\Brian\AppData\Local\Facebook

2012-10-20 00:46 . 2012-10-20 00:46 -------- d-----w- c:\programdata\Malwarebytes

2012-10-20 00:45 . 2012-10-23 23:27 -------- d-----w- C:\test programma's

2012-10-17 20:36 . 2012-10-17 20:36 289768 ----a-w- c:\windows\system32\javaws.exe

2012-10-17 20:36 . 2012-10-17 20:36 108008 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll

2012-10-17 20:36 . 2012-10-17 20:36 189416 ----a-w- c:\windows\system32\javaw.exe

2012-10-17 20:36 . 2012-10-17 20:36 188904 ----a-w- c:\windows\system32\java.exe

2012-10-17 20:36 . 2012-10-17 20:36 -------- d-----w- c:\program files\Java

2012-10-17 20:35 . 2012-10-17 20:35 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-10-15 22:20 . 2012-10-15 22:20 -------- d-----w- c:\users\Brian\AppData\Local\Secunia PSI

2012-10-15 22:20 . 2012-10-15 22:20 -------- d-----w- c:\program files (x86)\Secunia

2012-10-14 13:25 . 2012-10-14 13:25 -------- d-----w- c:\programdata\WinBar

2012-10-14 13:25 . 2012-10-14 13:25 -------- d-----w- c:\program files (x86)\WinBar

2012-10-13 23:24 . 2012-10-13 23:24 -------- d-----w- c:\program files (x86)\Stardock

2012-10-13 21:19 . 2012-10-13 21:19 -------- d-----w- c:\users\Brian\AppData\Local\Stardock_Corporation

2012-10-13 21:15 . 2012-10-13 21:15 -------- d--h--w- c:\programdata\Common Files

2012-10-13 19:19 . 2012-10-13 19:19 574 ----a-w- C:\cleanup.bat

2012-10-12 21:54 . 2012-10-12 21:54 -------- d-----w- c:\users\Brian\DoctorWeb

2012-10-12 02:02 . 2012-10-12 02:02 -------- d-----w- c:\users\Brian\AppData\Local\ElevatedDiagnostics

2012-10-10 03:24 . 2012-10-10 03:24 -------- d-----w- c:\windows\SysWow64\wbem\Logs

2012-10-10 03:04 . 2012-10-10 03:04 -------- d-----w- c:\program files (x86)\Trend Micro

2012-10-10 02:31 . 2012-08-31 18:19 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

2012-10-10 02:31 . 2012-08-30 18:03 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-10-10 02:31 . 2012-08-30 17:12 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-10-10 02:31 . 2012-08-30 17:12 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-10-10 02:29 . 2012-08-11 00:56 715776 ----a-w- c:\windows\system32\kerberos.dll

2012-10-10 02:29 . 2012-08-10 23:56 542208 ----a-w- c:\windows\SysWow64\kerberos.dll

2012-10-10 02:29 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll

2012-10-10 02:29 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll

2012-10-10 02:29 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll

2012-10-10 02:29 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll

2012-10-10 02:29 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll

2012-10-10 02:29 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll

2012-10-09 00:29 . 2012-10-09 00:29 -------- d-----w- c:\program files\HitmanPro

2012-10-09 00:29 . 2012-10-09 00:30 -------- d-----w- c:\programdata\HitmanPro

2012-10-05 23:30 . 2012-10-05 23:31 -------- d-----w- c:\users\Brian\AppData\Roaming\Canon

2012-10-05 23:08 . 2012-10-05 23:08 -------- d-----w- c:\windows\nl

2012-10-05 23:07 . 2012-10-05 23:07 -------- d-----w- c:\windows\en

2012-10-05 23:06 . 2012-10-05 23:06 -------- d-----w- c:\program files\Windows Live

2012-10-05 22:55 . 2012-10-05 22:56 -------- d-----w- c:\program files\Soluto

2012-10-04 22:33 . 2012-10-04 22:33 53248 ----a-r- c:\users\Brian\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

2012-09-30 01:35 . 2012-09-30 01:35 -------- d-----w- c:\users\Brian\AppData\Roaming\Auslogics

2012-09-29 00:01 . 2012-09-29 00:02 -------- d-----w- c:\users\Brian\AppData\Roaming\QuickScan

2012-09-28 00:36 . 2012-04-20 14:40 196440 ----a-w- c:\windows\system32\drivers\HipShieldK.sys

2012-09-27 23:58 . 2012-09-27 23:58 -------- d-----w- c:\program files\Macrium

.

.

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-17 20:36 . 2012-09-14 16:51 916456 ----a-w- c:\windows\system32\deployJava1.dll

2012-10-17 20:36 . 2012-09-14 16:51 1034216 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-10-17 20:35 . 2012-09-14 16:53 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-10-17 20:35 . 2012-09-14 16:53 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-10-10 02:25 . 2012-09-14 15:19 65309168 ----a-w- c:\windows\system32\MRT.exe

2012-10-08 22:36 . 2012-09-14 16:50 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-08 22:36 . 2012-09-14 16:50 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-10-04 18:25 . 2012-09-20 22:47 54728 ----a-w- c:\windows\system32\drivers\Soluto.sys

2012-09-22 23:53 . 2012-09-22 23:53 56016 ----a-w- c:\windows\system32\drivers\fsbts.sys

2012-09-15 18:36 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll

2012-09-15 18:36 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll

2012-09-14 16:18 . 2010-06-24 19:33 19720 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-09-14 15:24 . 2012-09-14 15:24 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2012-09-14 15:24 . 2012-09-14 15:24 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2012-09-14 15:24 . 2012-09-14 15:24 89088 ----a-w- c:\windows\system32\ie4uinit.exe

2012-09-14 15:24 . 2012-09-14 15:24 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll

2012-09-14 15:24 . 2012-09-14 15:24 85504 ----a-w- c:\windows\system32\iesetup.dll

2012-09-14 15:24 . 2012-09-14 15:24 82432 ----a-w- c:\windows\system32\icardie.dll

2012-09-14 15:24 . 2012-09-14 15:24 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2012-09-14 15:24 . 2012-09-14 15:24 76800 ----a-w- c:\windows\system32\tdc.ocx

2012-09-14 15:24 . 2012-09-14 15:24 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe

2012-09-14 15:24 . 2012-09-14 15:24 74752 ----a-w- c:\windows\SysWow64\iesetup.dll

2012-09-14 15:24 . 2012-09-14 15:24 65024 ----a-w- c:\windows\system32\pngfilt.dll

2012-09-14 15:24 . 2012-09-14 15:24 63488 ----a-w- c:\windows\SysWow64\tdc.ocx

2012-09-14 15:24 . 2012-09-14 15:24 55296 ----a-w- c:\windows\system32\msfeedsbs.dll

2012-09-14 15:24 . 2012-09-14 15:24 534528 ----a-w- c:\windows\system32\ieapfltr.dll

2012-09-14 15:24 . 2012-09-14 15:24 49664 ----a-w- c:\windows\system32\imgutil.dll

2012-09-14 15:24 . 2012-09-14 15:24 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2012-09-14 15:24 . 2012-09-14 15:24 48640 ----a-w- c:\windows\system32\mshtmler.dll

2012-09-14 15:24 . 2012-09-14 15:24 452608 ----a-w- c:\windows\system32\dxtmsft.dll

2012-09-14 15:24 . 2012-09-14 15:24 448512 ----a-w- c:\windows\system32\html.iec

2012-09-14 15:24 . 2012-09-14 15:24 403248 ----a-w- c:\windows\system32\iedkcs32.dll

2012-09-14 15:24 . 2012-09-14 15:24 39936 ----a-w- c:\windows\system32\iernonce.dll

2012-09-14 15:24 . 2012-09-14 15:24 3695416 ----a-w- c:\windows\system32\ieapfltr.dat

2012-09-14 15:24 . 2012-09-14 15:24 367104 ----a-w- c:\windows\SysWow64\html.iec

2012-09-14 15:24 . 2012-09-14 15:24 35840 ----a-w- c:\windows\SysWow64\imgutil.dll

2012-09-14 15:24 . 2012-09-14 15:24 30720 ----a-w- c:\windows\system32\licmgr10.dll

2012-09-14 15:24 . 2012-09-14 15:24 282112 ----a-w- c:\windows\system32\dxtrans.dll

2012-09-14 15:24 . 2012-09-14 15:24 267776 ----a-w- c:\windows\system32\ieaksie.dll

2012-09-14 15:24 . 2012-09-14 15:24 249344 ----a-w- c:\windows\system32\webcheck.dll

2012-09-14 15:24 . 2012-09-14 15:24 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll

2012-09-14 15:24 . 2012-09-14 15:24 222208 ----a-w- c:\windows\system32\msls31.dll

2012-09-14 15:24 . 2012-09-14 15:24 197120 ----a-w- c:\windows\system32\msrating.dll

2012-09-14 15:24 . 2012-09-14 15:24 165888 ----a-w- c:\windows\system32\iexpress.exe

2012-09-14 15:24 . 2012-09-14 15:24 163840 ----a-w- c:\windows\system32\ieakui.dll

2012-09-14 15:24 . 2012-09-14 15:24 161792 ----a-w- c:\windows\SysWow64\msls31.dll

2012-09-14 15:24 . 2012-09-14 15:24 160256 ----a-w- c:\windows\system32\wextract.exe

2012-09-14 15:24 . 2012-09-14 15:24 160256 ----a-w- c:\windows\system32\ieakeng.dll

2012-09-14 15:24 . 2012-09-14 15:24 152064 ----a-w- c:\windows\SysWow64\wextract.exe

2012-09-14 15:24 . 2012-09-14 15:24 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2012-09-14 15:24 . 2012-09-14 15:24 149504 ----a-w- c:\windows\system32\occache.dll

2012-09-14 15:24 . 2012-09-14 15:24 145920 ----a-w- c:\windows\system32\iepeers.dll

2012-09-14 15:24 . 2012-09-14 15:24 135168 ----a-w- c:\windows\system32\IEAdvpack.dll

2012-09-14 15:24 . 2012-09-14 15:24 12288 ----a-w- c:\windows\system32\mshta.exe

2012-09-14 15:24 . 2012-09-14 15:24 11776 ----a-w- c:\windows\SysWow64\mshta.exe

2012-09-14 15:24 . 2012-09-14 15:24 114176 ----a-w- c:\windows\system32\admparse.dll

2012-09-14 15:24 . 2012-09-14 15:24 111616 ----a-w- c:\windows\system32\iesysprep.dll

2012-09-14 15:24 . 2012-09-14 15:24 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2012-09-14 15:24 . 2012-09-14 15:24 10752 ----a-w- c:\windows\system32\msfeedssync.exe

2012-09-14 15:24 . 2012-09-14 15:24 103936 ----a-w- c:\windows\system32\inseng.dll

2012-09-14 15:24 . 2012-09-14 15:24 101888 ----a-w- c:\windows\SysWow64\admparse.dll

2012-09-12 16:11 . 2012-09-12 16:11 13504 ----a-w- c:\windows\system32\drivers\PSVolAcc.sys

2012-09-12 16:10 . 2012-09-12 16:10 57024 ----a-w- c:\windows\system32\drivers\psmounterex.sys

2012-09-12 14:07 . 2012-09-12 14:07 58368 ----a-w- c:\windows\SysWow64\sirenacm.dll

2012-09-12 13:57 . 2012-09-12 13:57 322048 ----a-w- c:\windows\WLXPGSS.SCR

2012-08-27 23:49 . 2012-09-14 15:09 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{15842E5C-D2D5-4CDE-947A-7EF9176424CE}\mpengine.dll

2012-08-24 11:15 . 2012-09-21 22:01 17810944 ----a-w- c:\windows\system32\mshtml.dll

2012-08-24 10:39 . 2012-09-21 22:01 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-08-24 10:31 . 2012-09-21 22:01 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-08-24 10:22 . 2012-09-21 22:01 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-08-24 10:21 . 2012-09-21 22:01 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-08-24 10:20 . 2012-09-21 22:01 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-08-24 10:18 . 2012-09-21 22:01 237056 ----a-w- c:\windows\system32\url.dll

2012-08-24 10:17 . 2012-09-21 22:01 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-08-24 10:14 . 2012-09-21 22:01 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-08-24 10:14 . 2012-09-21 22:01 816640 ----a-w- c:\windows\system32\jscript.dll

2012-08-24 10:13 . 2012-09-21 22:01 599040 ----a-w- c:\windows\system32\vbscript.dll

2012-08-24 10:12 . 2012-09-21 22:01 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-08-24 10:11 . 2012-09-21 22:01 729088 ----a-w- c:\windows\system32\msfeeds.dll

2012-08-24 10:10 . 2012-09-21 22:01 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-08-24 10:09 . 2012-09-21 22:01 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-08-24 10:04 . 2012-09-21 22:01 248320 ----a-w- c:\windows\system32\ieui.dll

2012-08-24 06:59 . 2012-09-21 22:01 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-08-24 06:51 . 2012-09-21 22:01 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-08-24 06:51 . 2012-09-21 22:01 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-08-24 06:47 . 2012-09-21 22:01 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-08-24 06:47 . 2012-09-21 22:01 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2012-08-24 06:43 . 2012-09-21 22:01 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2012-08-22 18:12 . 2012-09-15 19:09 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-08-22 18:12 . 2012-09-15 19:10 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-08-22 18:12 . 2012-09-15 19:09 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-08-22 18:12 . 2012-09-15 19:09 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

2012-08-21 21:01 . 2012-09-25 17:08 245760 ----a-w- c:\windows\system32\OxpsConverter.exe

2012-08-20 17:38 . 2012-10-10 02:30 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2012-08-02 17:58 . 2012-09-14 15:11 574464 ----a-w- c:\windows\system32\d3d10level9.dll

2012-08-02 16:57 . 2012-09-14 15:11 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"Facebook Update"="c:\users\Brian\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-10-21 138096]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2012-09-12 1535112]

"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]

"LaunchHPOSIAPP"="c:\program files (x86)\Hewlett-Packard\HP MAINSTREAM KEYBOARD\LaunchApp.exe" [2009-04-04 385024]

.

c:\users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Facebook Messenger.lnk - c:\users\Brian\AppData\Local\Facebook\Messenger\2.1.4651.0\FacebookMessenger.exe [2012-9-25 247728]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2012-9-24 573536]

WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-1-21 2119488]

WDSmartWare.lnk - c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2010-1-21 9136960]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

"UacDisableNotify"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"EnableShellExecuteHooks"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux3"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-09-24 656480]

R3 gupdate;Google Update-service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 116648]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 116648]

R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys [2012-04-20 196440]

R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [2010-05-14 271712]

R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [2010-05-07 30304]

R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2012-06-22 106112]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-09-14 1255736]

R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]

R4 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-08 250808]

R4 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-08-06 681528]

R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R4 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]

S0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys [2012-09-22 56016]

S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2012-06-22 335784]

S0 Soluto;Soluto;c:\windows\system32\Drivers\Soluto.sys [2012-10-04 54728]

S1 A2DDA;A2 Direct Disk Access Support Driver;c:\users\Brian\Desktop\virus scanner\virus scanners\emsisoft\Run\a2ddax64.sys [2012-06-12 23208]

S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]

S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]

S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-08-31 201304]

S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2012-06-22 218320]

S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2012-06-22 177144]

S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-09-24 1328736]

S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe [2012-10-04 604728]

S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-31 2754984]

S2 WDDMService;WD SmartWare Drive Manager Service;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2010-01-21 130048]

S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]

S3 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-23 203264]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-23 7886848]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-23 285696]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-09-24 116752]

S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2012-06-22 69672]

S3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]

S3 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

S3 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]

S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2012-01-18 351136]

S3 LVUVC64;Logitech HD Webcam C310(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2012-01-18 4865568]

S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2012-06-22 513456]

S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2011-12-16 17976]

S3 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [2012-09-12 301760]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-09-03 349800]

S3 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2320920]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2009-02-13 14464]

.

.

--- Andere Services/Drivers In Geheugen ---

.

*Deregistered* - mfeavfk01

.

Inhoud van de 'Gedeelde Taken' map

.

2012-10-09 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-14 22:36]

.

2012-10-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4085980671-1877415730-1580475011-1000Core.job

- c:\users\Brian\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-21 22:24]

.

2012-10-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4085980671-1877415730-1580475011-1000UA.job

- c:\users\Brian\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-21 22:24]

.

2012-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 16:29]

.

2012-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 16:29]

.

2012-10-24 c:\windows\Tasks\HPCeeScheduleForBRIAN-PC$.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]

.

2012-10-21 c:\windows\Tasks\HPCeeScheduleForBrian.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-07-26 2782096]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files (x86)\Stardock\Fences\FencesMenu64.dll" [2010-06-22 253288]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://google.nl/

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS VERWIJDERD - - - -

.

AddRemove-Fences - c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.exe

AddRemove-{D40EB009-0499-459c-A8AF-C9C110766215} - c:\program files (x86)\Common Files\LogiShrd\Installer\{D40EB009-0499-459c-A8AF-C9C110766215}\setup.exe

.

.

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-4085980671-1877415730-1580475011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-4085980671-1877415730-1580475011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*]

"v5Licence0"="15-BDQC-7UK5-EXJX-PX69-4H1M-NKYDU2H"

"Activated"="N"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2012-10-26 00:55:07

ComboFix-quarantined-files.txt 2012-10-25 22:55

ComboFix2.txt 2012-10-24 18:31

ComboFix3.txt 2012-10-23 18:10

ComboFix4.txt 2012-10-21 23:03

.

Pre-Run: 1.434.047.524.864 bytes beschikbaar

Post-Run: 1.433.749.172.224 bytes beschikbaar

.

- - End Of File - - 1B96F0F0C461259D039A4C51A959069D

Link naar reactie
Delen op andere sites
misteragga Veteraan

misteragga

Geplaatst:
  • Auteur
Geplaatst:

ik had nog wel een kleine vraagje waarom dit ook weer is verwijderd

kan ik nu wel de programma Fences blijven gebruiken?

en mij logitech software is er niks meer mis mee?

ver komt de melding van de onderhoud centrum niet meer.

- - - - ORPHANS VERWIJDERD - - - -

.

AddRemove-Fences - c:\programdata\{A3A26C56-02C3-4F76-A033-12EE2FB52AE6}\Fences.exe

AddRemove-{D40EB009-0499-459c-A8AF-C9C110766215} - c:\program files (x86)\Common Files\LogiShrd\Installer\{D40EB009-0499-459c-A8AF-C9C110766215}\setup.exe

.

.

Link naar reactie
Delen op andere sites
kweezie wabbit Grootmeester

kweezie wabbit

Geplaatst:
Geplaatst:

Bij de eerste uitvoering gaat combofix een aantal instellingen wijzigen.

Misschien dat daar de knoop zit.

Aangezien het probleem met het onderhoudscentrum is opgelost, kunnen we combofix weer verwijderen.

Verwijder Combofix: Start -> Uitvoeren en typ: ComboFix /Uninstall (met spatie voor de /)

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

Link naar reactie
Delen op andere sites
kweezie wabbit Grootmeester

kweezie wabbit

Geplaatst:
Geplaatst:

Mooi zo. Dan gaan we nog wat opruimen en dan zijn we klaar.

Download CCleaner. (Als je het nog niet hebt)

Let op bij de installatie.

Haal beide vinkjes weg bij de vraag over de Chrome browser.

Installeer het en start CCleaner op.

Klik in de linkse kolom op “Cleaner”. Klik achtereenvolgens op ‘Analyseren’ en 'Schoonmaken'. Bevestigen met JA of OK

Klik vervolgens in de linkse kolom op “Register” en klik op ‘Scan naar problemen”. Als er fouten gevonden worden klik je op ”Herstel geselecteerde problemen” en ”OK”. Dan krijg je de vraag om een back-up te maken. Klik op “JA”. Kies dan “Herstel alle geselecteerde fouten”.

Soms is 1 analyse niet voldoende. Deze procedure mag je herhalen tot de analyse geen fouten meer aangeeft.

Sluit hierna CCleaner terug af.

Wil je dit uitgebreid in beeld bekijken, lees dan deze handleiding.

Het is aangewezen om de bestaande herstelpunten te verwijderen (daar kunnen besmette herstelpunten tussen zitten die je zou kunnen terugzetten) door systeemherstel tijdelijk uit te schakelen.

Doe dit via Configuratiescherm -> Systeem en Beveiliging -> Systeem -> Systeembeveiliging

Selecteer de schijf waarvan je de herstelpunten wil verwijderen -> klikken op "configureren".

Klik op "verwijderen". Dan krijg je een schermmelding. Klik hier op “Doorgaan”.

Dan worden alle herstelpunten verwijderd op de aangeduide schijf.

Klik na de verwijdering op "OK"

Maak dan meteen een nieuw herstelpunt, zodat je niet hoeft te wachten op een automatisch herstelpunt van het systeem.

Als allemaal gedaan is, mag je dit onderwerp afsluiten door een klik op de knop +Markeer als opgelost.

Nog veel computerplezier :ciao:

Link naar reactie
Delen op andere sites
Gast
Dit topic is nu gesloten voor nieuwe reacties.
 Delen
Ga naar topic overzicht
Logo

OVER ONS

PC Helpforum helpt GRATIS computergebruikers sinds juli 2006. Ons team geeft via het forum professioneel antwoord op uw vragen en probeert uw pc problemen zo snel mogelijk op te lossen. Word lid vandaag, plaats je vraag online en het PC Helpforum-team helpt u graag verder!

SITEMAP

×
×
  • Nieuwe aanmaken...

Belangrijke informatie

We hebben cookies geplaatst op je toestel om deze website voor jou beter te kunnen maken. Je kunt de cookie instellingen aanpassen, anders gaan we er van uit dat het goed is om verder te gaan.