claro search

Robbe91 · 15 november 2012

Beste,

Ik ben ook besmet met claro search

Hier een logje:

(hopelijk kunnen jullie me helpen!)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 17:08:34, on 15/11/2012

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16455)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Norton AntiVirus\Engine\19.9.0.9\ccSvcHst.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe

C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe

C:\Program Files (x86)\uTorrent\uTorrent.exe

C:\Program Files (x86)\Hewlett-Packard\HP KEYBOARD\HPKEYBOARD.EXE

C:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen2\FastUserSwitching.exe

C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe

C:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen2\HWManager.exe

C:\Program Files (x86)\Common Files\Isabel\isa_kbc_certupdate.exe

C:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen2\OSDForm.exe

C:\Program Files (x86)\Hewlett-Packard\HP KEYBOARD\Keystatus.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

C:\Program Files (x86)\Free YouTube Downloader\ffmpeg.exe

C:\Windows\SysWOW64\schtasks.exe

C:\Program Files (x86)\Windows Media Player\wmplayer.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_110_ActiveX.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\thuis\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\19.9.0.9\IPS\IPSBHO.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL

O4 - HKLM\..\Run: [HP KEYBOARD] "C:\Program Files (x86)\Hewlett-Packard\HP KEYBOARD\HPKEYBOARD.EXE"

O4 - HKLM\..\Run: [buttons & OSDs control application gen2] C:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen2\FastUserSwitching.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [isaKbcCertUpdate] C:\Program Files (x86)\Common Files\Isabel\isa_kbc_certupdate.exe

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Global Startup: Bluetooth.lnk = ?

O8 - Extra context menu item: Afbeelding verzenden naar &Bluetooth-apparaat... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Pagina verzenden naar &Bluetooth-apparaat... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: Verzenden naar Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: Verzenden naar &Bluetooth-apparaat... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O15 - Trusted Zone: http://cbc-pdf.cbc.be

O15 - Trusted Zone: CBC

O15 - Trusted Zone: http://www.cbccorporate.be

O15 - Trusted Zone: http://www.csob.cz

O15 - Trusted Zone: http://www.csob.sk

O15 - Trusted Zone: Welcome to Isabel

O15 - Trusted Zone: *.isabel.be

O15 - Trusted Zone: Welcome to Isabel

O15 - Trusted Zone: http://kbc-pdf.kbc.be

O15 - Trusted Zone: KBC

O15 - Trusted Zone: *.kbc.be

O15 - Trusted Zone: KBC Asset Management

O15 - Trusted Zone: http://www.kbcam.com

O15 - Trusted Zone: http://www.kbcbankingforbusiness.com

O15 - Trusted Zone: http://www.kbccorporates.com

O15 - Trusted Zone: http://www.kbcfi.com

O15 - Trusted Zone: *.kbcgroup.eu

O15 - Trusted Zone: http://www.kbcmerchantbanking.com

O15 - Trusted Zone: http://www.kh.hu

O15 - Trusted Zone: http://cbc-pdf.cbc.be (HKLM)

O15 - Trusted Zone: CBC (HKLM)

O15 - Trusted Zone: http://www.cbccorporate.be (HKLM)

O15 - Trusted Zone: http://www.csob.cz (HKLM)

O15 - Trusted Zone: http://www.csob.sk (HKLM)

O15 - Trusted Zone: Welcome to Isabel (HKLM)

O15 - Trusted Zone: http://kbc-pdf.kbc.be (HKLM)

O15 - Trusted Zone: KBC (HKLM)

O15 - Trusted Zone: KBC Asset Management (HKLM)

O15 - Trusted Zone: http://www.kbcam.com (HKLM)

O15 - Trusted Zone: http://www.kbcbankingforbusiness.com (HKLM)

O15 - Trusted Zone: http://www.kbccorporates.com (HKLM)

O15 - Trusted Zone: http://www.kbcfi.com (HKLM)

O15 - Trusted Zone: http://www.kbcmerchantbanking.com (HKLM)

O15 - Trusted Zone: http://www.kh.hu (HKLM)

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL

O20 - AppInit_DLLs: c:\progra~3\browse~1\23796~1.11\{16cdf~1\browse~1.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Unknown owner - C:\Windows\system32\AEADISRV.EXE (file missing)

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files (x86)\Norton AntiVirus\Engine\19.9.0.9\ccSvcHst.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: WD Drive Manager (WDDriveService) - Western Digital - C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 11570 bytes

kape · 15 november 2012

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen:

Klik hier

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

3. Dubbelklik op "Combofix.exe" om de tool te starten.

4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Robbe91 · 15 november 2012

ComboFix 12-11-13.03 - thuis 15/11/2012 17:50:14.1.2 - x64

Microsoft Windows 7 Professional 6.1.7601.1.1252.32.1043.18.4095.2694 [GMT 1:00]

Gestart vanuit: c:\users\thuis\Desktop\ComboFix.exe

AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_ACPIService

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-10-15 to 2012-11-15 ))))))))))))))))))))))))))))))

.

2012-11-15 16:54 . 2012-11-15 16:54 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-11-15 15:36 . 2012-11-15 15:36 -------- d-----w- c:\windows\system32\appmgmt

2012-11-15 15:34 . 2012-11-15 15:34 -------- d-----w- c:\windows\SysWow64\searchplugins

2012-11-15 15:34 . 2012-11-15 15:34 -------- d-----w- c:\windows\SysWow64\Extensions

2012-11-15 15:34 . 2012-11-15 15:34 -------- d-----w- c:\programdata\Babylon

2012-11-15 15:28 . 2012-11-15 15:29 -------- d-----w- c:\programdata\TuneUp Software

2012-11-15 15:28 . 2012-11-15 15:28 -------- d-sh--w- c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}

2012-11-15 15:28 . 2012-11-15 15:28 -------- d--h--w- c:\programdata\Common Files

2012-11-15 15:28 . 2012-11-15 15:36 -------- d-----w- c:\program files (x86)\Free YouTube Downloader

2012-11-14 21:10 . 2012-07-26 07:49 2560 ----a-w- c:\windows\system32\drivers\nl-NL\wdf01000.sys.mui

2012-11-14 21:10 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2012-11-14 21:10 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

2012-11-14 21:10 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

2012-11-14 21:04 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

2012-11-14 21:04 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

2012-11-14 21:04 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

2012-11-14 21:04 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

2012-11-14 21:04 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

2012-11-14 21:04 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

2012-11-14 21:04 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

2012-11-14 06:33 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll

2012-11-14 06:33 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll

2012-11-13 12:04 . 2012-11-13 12:04 -------- d-----w- c:\program files (x86)\Western Digital

2012-11-13 12:04 . 2012-11-13 12:04 -------- d-----w- c:\program files (x86)\Common Files\Western Digital

2012-11-12 18:10 . 2012-11-12 18:10 -------- d-----w- c:\program files (x86)\uTorrent

2012-11-12 06:44 . 2012-11-12 16:51 -------- d-----w- c:\program files (x86)\Common Files\Isabel

2012-11-12 06:44 . 2012-11-12 16:51 -------- d-----w- c:\program files (x86)\Common Files\Isabel CSP

2012-11-12 06:43 . 2012-11-12 06:44 -------- d-----w- c:\programdata\Isabel Services

2012-11-11 21:41 . 2012-11-11 21:41 -------- d-----w- c:\program files (x86)\MSXML 4.0

2012-11-10 17:32 . 2012-11-10 17:32 -------- d-----w- c:\program files (x86)\Common Files\Adobe

2012-11-10 14:56 . 2012-11-10 14:56 -------- d-----w- c:\program files (x86)\Google

2012-11-10 02:58 . 2012-11-10 02:58 -------- d-----w- c:\windows\SysWow64\wbem\en-US

2012-11-10 02:58 . 2012-11-10 02:58 -------- d-----w- c:\windows\system32\wbem\en-US

2012-11-10 02:58 . 2012-11-10 02:58 -------- d-----w- c:\windows\SysWow64\Wat

2012-11-10 02:58 . 2012-11-10 02:58 -------- d-----w- c:\windows\system32\Wat

2012-11-10 02:10 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe

2012-11-10 02:02 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys

2012-11-10 02:02 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll

2012-11-10 02:02 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll

2012-11-10 02:02 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll

2012-11-10 02:02 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll

2012-11-09 07:37 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll

2012-11-09 07:36 . 2011-03-12 12:08 1465344 ----a-w- c:\windows\system32\XpsPrint.dll

2012-11-09 07:35 . 2012-08-24 18:05 220160 ----a-w- c:\windows\system32\wintrust.dll

2012-11-09 07:34 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys

2012-11-09 07:33 . 2012-05-14 05:26 956928 ----a-w- c:\windows\system32\localspl.dll

2012-11-09 07:31 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll

2012-11-09 07:31 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll

2012-11-08 19:37 . 2012-11-08 19:37 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared

2012-11-08 19:12 . 2012-11-08 19:12 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2012-11-08 19:12 . 2012-11-08 19:12 704136 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2012-11-08 18:56 . 2012-11-08 18:56 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-08 18:56 . 2012-11-08 18:56 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-11-08 18:56 . 2012-11-08 18:56 -------- d-----w- c:\windows\SysWow64\Macromed

2012-11-08 18:56 . 2012-11-08 18:56 -------- d-----w- c:\windows\system32\Macromed

2012-11-08 18:48 . 2009-04-20 11:29 249856 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpfpp70w.dll

2012-11-08 18:47 . 2012-11-08 18:47 -------- d-----w- c:\program files (x86)\Common Files\HP

2012-11-08 18:47 . 2012-11-08 18:47 -------- d-----w- c:\program files (x86)\Common Files\Hewlett-Packard

2012-11-08 18:47 . 2012-11-08 18:47 -------- d-----w- c:\windows\hpoj4500g510g-m

2012-11-08 18:46 . 2009-04-20 11:29 136704 ----a-w- c:\windows\system32\hpf3l70w.dll

2012-11-08 18:46 . 2012-11-08 18:47 -------- d-----w- c:\program files (x86)\HP

2012-11-08 18:46 . 2012-11-08 18:46 -------- d-----w- c:\programdata\HP

2012-11-08 18:46 . 2009-08-17 18:26 979456 ----a-w- c:\windows\system32\hpwwiax6.dll

2012-11-08 18:46 . 2009-08-17 18:26 642360 ----a-w- c:\windows\system32\hpzids40.dll

2012-11-08 18:46 . 2009-08-17 18:34 551424 ----a-w- c:\windows\system32\hppldcoi.dll

2012-11-08 18:46 . 2009-08-17 18:26 503296 ----a-w- c:\windows\system32\hpwvst01.dll

2012-11-08 18:46 . 2009-08-17 18:26 1418240 ----a-w- c:\windows\system32\hpwtiop5.dll

2012-11-08 12:38 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll

2012-11-08 12:38 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll

2012-11-08 12:38 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys

2012-11-08 12:35 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll

2012-11-08 12:35 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll

2012-11-08 12:35 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe

2012-11-08 12:35 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll

2012-11-08 12:35 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll

2012-11-08 12:35 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll

2012-11-08 12:35 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll

2012-11-08 12:35 . 2012-06-02 14:19 186752 ----a-w- c:\windows\system32\wuwebv.dll

2012-11-08 12:35 . 2012-06-02 14:15 36864 ----a-w- c:\windows\system32\wuapp.exe

2012-11-08 12:20 . 2012-11-08 12:20 -------- d-----w- c:\program files\Symantec

2012-11-08 12:20 . 2012-11-08 12:20 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

2012-11-08 12:20 . 2012-11-08 12:20 -------- d-----w- c:\program files\Common Files\Symantec Shared

2012-11-08 12:19 . 2012-11-09 07:20 -------- d-----w- c:\windows\system32\drivers\NAVx64

2012-11-08 12:19 . 2012-11-08 12:19 -------- d-----w- c:\program files (x86)\Norton AntiVirus

2012-11-08 12:19 . 2012-11-08 12:19 -------- d-----w- c:\programdata\Norton

2012-11-08 12:10 . 2012-11-08 12:10 -------- d-----w- c:\program files (x86)\NortonInstaller

2012-11-08 10:38 . 2012-11-08 10:38 -------- d-----w- c:\program files (x86)\Microsoft Works

2012-11-08 10:38 . 2012-11-11 09:43 -------- d-----w- c:\program files (x86)\Microsoft.NET

2012-11-08 10:38 . 2012-11-08 10:38 -------- d-----w- c:\windows\PCHEALTH

2012-11-08 10:37 . 2012-11-08 10:37 -------- d-----w- c:\program files\Microsoft Office

2012-11-08 10:37 . 2012-11-08 10:37 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8

2012-11-08 10:36 . 2012-11-08 10:43 -------- d-----w- c:\programdata\Microsoft Help

2012-11-08 10:36 . 2012-11-08 10:36 -------- d-----r- C:\MSOCache

2012-11-08 10:06 . 2012-11-08 10:07 -------- d-----w- c:\programdata\NVIDIA

2012-11-08 10:05 . 2012-11-08 10:05 -------- d-----w- C:\Intel

2012-11-08 10:04 . 2012-11-08 10:05 -------- d-----w- c:\program files (x86)\Intel

2012-11-08 10:04 . 2012-11-08 10:04 -------- d-----w- c:\programdata\InstallShield

2012-11-08 10:01 . 2009-06-22 13:56 32768 ----a-w- c:\windows\SysWow64\adidrm.dll

2012-11-08 10:01 . 2009-07-30 11:53 540192 ----a-w- c:\windows\system32\NVUNINST.EXE

2012-11-08 09:59 . 2012-11-08 10:00 -------- d-----w- c:\program files (x86)\Hewlett-Packard

2012-11-08 09:59 . 2008-05-14 14:11 58880 ----a-w- c:\windows\SysWow64\SFFXComm.dll

2012-11-08 09:58 . 2012-11-08 10:04 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information

2012-11-08 09:58 . 2012-11-08 10:01 -------- d-----w- c:\program files (x86)\Analog Devices

2012-11-08 09:58 . 2012-11-08 10:01 -------- d-----w- c:\programdata\SonicFocus

2012-11-08 09:54 . 2009-07-01 11:46 98344 ----a-w- c:\windows\system32\drivers\btwaudio.sys

2012-11-08 09:54 . 2009-07-01 11:46 132648 ----a-w- c:\windows\system32\drivers\btwavdt.sys

2012-11-08 09:54 . 2009-07-01 11:46 21160 ----a-w- c:\windows\system32\drivers\btwrchid.sys

2012-11-08 09:54 . 2009-04-07 14:33 35104 ----a-w- c:\windows\system32\drivers\btwl2cap.sys

2012-11-08 09:54 . 2012-11-08 09:54 -------- d-----w- c:\program files\WIDCOMM

2012-11-08 09:53 . 2012-11-15 15:38 -------- d-sh--w- c:\windows\Installer

2012-11-08 09:47 . 2012-11-08 09:47 -------- d-----w- c:\users\thuis

2012-11-08 09:47 . 2012-11-08 09:47 -------- d-sh--we c:\users\Default\Sjablonen

2012-11-08 09:47 . 2012-11-08 09:47 -------- d-sh--we c:\users\Default\Netwerkprinteromgeving

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-06 09:46 . 2012-09-06 09:46 14464 ----a-w- c:\windows\system32\drivers\wdcsam64.sys

2012-08-20 17:38 . 2012-11-09 07:36 44032 ----a-w- c:\windows\apppatch\acwow64.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-11-12 968592]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"HP KEYBOARD"="c:\program files (x86)\Hewlett-Packard\HP KEYBOARD\HPKEYBOARD.EXE" [2009-09-25 696320]

"Buttons & OSDs control application gen2"="c:\program files (x86)\Hewlett-Packard\Buttons & OSDs control application gen2\FastUserSwitching.exe" [2009-07-06 208896]

"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-06-22 1314816]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]

"IsaKbcCertUpdate"="c:\program files (x86)\Common Files\Isabel\isa_kbc_certupdate.exe" [2012-10-15 1085528]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-1 1079584]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders credssp.dll, schannel.dll

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-11-10 1255736]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2012-09-06 14464]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAVx64\1309000.009\SYMDS64.SYS [2011-08-15 451192]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAVx64\1309000.009\SYMEFA64.SYS [2012-05-22 1129120]

S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\BASHDefs\20121106.001\BHDrvx64.sys [2012-10-23 1384608]

S1 ccSet_NAV;Norton AntiVirus Settings Manager;c:\windows\system32\drivers\NAVx64\1309000.009\ccSetx64.sys [2012-06-07 167072]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\IPSDefs\20121114.001\IDSvia64.sys [2012-11-07 513184]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAVx64\1309000.009\Ironx64.SYS [2012-04-18 190072]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NAVx64\1309000.009\SYMNETS.SYS [2012-04-18 405624]

S2 NAV;Norton AntiVirus;c:\program files (x86)\Norton AntiVirus\Engine\19.9.0.9\ccSvcHst.exe [2012-06-16 138272]

S2 WDDriveService;WD Drive Manager;c:\program files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [2012-09-06 248248]

S3 AVerAVF2;AVerAVF2;c:\windows\system32\DRIVERS\AVerAVF2.sys [2009-10-29 1116928]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-11-08 138912]

S3 netr28x;Ralink 802.11n stuurprogramma voor draadloze netwerken voor Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys [2009-06-10 620544]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-08-20 239616]

.

--- Andere Services/Drivers In Geheugen ---

.

*NewlyCreated* - WS2IFSL

.

Inhoud van de 'Gedeelde Taken' map

.

2012-11-15 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-08 18:56]

.

2012-11-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-10 14:56]

.

2012-11-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-10 14:56]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-31 16336416]

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Afbeelding verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Pagina verzenden naar &Bluetooth-apparaat... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

Trusted Zone: cbc.be\cbc-pdf

Trusted Zone: cbc.be\cbconline

Trusted Zone: cbc.be\static

Trusted Zone: cbc.be\www

Trusted Zone: cbc.eu\ipa-a

Trusted Zone: cbc.eu\ipa-f

Trusted Zone: cbc.eu\www

Trusted Zone: cbccorporate.be\secure

Trusted Zone: cbccorporate.be\www

Trusted Zone: csob.cz\www

Trusted Zone: csob.sk\www

Trusted Zone: fgov.be\*.minfin

Trusted Zone: isabel.be

Trusted Zone: isabel.be\*.IBS6

Trusted Zone: isabel.be\col

Trusted Zone: isabel.be\gotoIBS6

Trusted Zone: isabel.be\my

Trusted Zone: isabel.be\my.beta

Trusted Zone: isabel.be\pki

Trusted Zone: isabel.be\www

Trusted Zone: isabel.be\www.beta

Trusted Zone: isabel.eu\col

Trusted Zone: isabel.eu\www

Trusted Zone: isabel.eu\www.beta

Trusted Zone: kbc.be

Trusted Zone: kbc.be\kbc-pdf

Trusted Zone: kbc.be\kbconline

Trusted Zone: kbc.be\static

Trusted Zone: kbc.be\www

Trusted Zone: kbc.com\www

Trusted Zone: kbc.eu\www

Trusted Zone: kbcam.be\www

Trusted Zone: kbcam.com\www

Trusted Zone: kbcbankingforbusiness.com\www

Trusted Zone: kbccorporates.com\secure

Trusted Zone: kbccorporates.com\www

Trusted Zone: kbcfi.com\secure

Trusted Zone: kbcfi.com\www

Trusted Zone: kbcgroup.eu

Trusted Zone: kbcgroup.eu\multimediafiles

Trusted Zone: kbcgroup.eu\www

Trusted Zone: kbcmerchantbanking.com\secure

Trusted Zone: kbcmerchantbanking.com\www

Trusted Zone: kh.hu\www

Trusted Zone: nbb.be\*

Trusted Zone: socialsecurity.be\*

Trusted Zone: wise-corporate-ebanking.com\www

Trusted Zone: zoomit.be\*

Trusted Zone: cbc.be\cbc-pdf

Trusted Zone: cbc.be\cbconline

Trusted Zone: cbc.be\static

Trusted Zone: cbc.be\www

Trusted Zone: cbc.eu\ipa-a

Trusted Zone: cbc.eu\ipa-f

Trusted Zone: cbc.eu\www

Trusted Zone: cbccorporate.be\secure

Trusted Zone: cbccorporate.be\www

Trusted Zone: csob.cz\www

Trusted Zone: csob.sk\www

Trusted Zone: fgov.be\*.minfin

Trusted Zone: isabel.be\*.IBS6

Trusted Zone: isabel.be\col

Trusted Zone: isabel.be\gotoIBS6

Trusted Zone: isabel.be\my

Trusted Zone: isabel.be\my.beta

Trusted Zone: isabel.be\pki

Trusted Zone: isabel.be\www

Trusted Zone: isabel.be\www.beta

Trusted Zone: isabel.eu\col

Trusted Zone: isabel.eu\www

Trusted Zone: isabel.eu\www.beta

Trusted Zone: kbc.be\kbc-pdf

Trusted Zone: kbc.be\kbconline

Trusted Zone: kbc.be\static

Trusted Zone: kbc.be\www

Trusted Zone: kbc.com\www

Trusted Zone: kbc.eu\www

Trusted Zone: kbcam.be\www

Trusted Zone: kbcam.com\www

Trusted Zone: kbcbankingforbusiness.com\www

Trusted Zone: kbccorporates.com\secure

Trusted Zone: kbccorporates.com\www

Trusted Zone: kbcfi.com\secure

Trusted Zone: kbcfi.com\www

Trusted Zone: kbcgroup.eu\multimediafiles

Trusted Zone: kbcgroup.eu\www

Trusted Zone: kbcmerchantbanking.com\secure

Trusted Zone: kbcmerchantbanking.com\www

Trusted Zone: kh.hu\www

Trusted Zone: nbb.be\*

Trusted Zone: socialsecurity.be\*

Trusted Zone: wise-corporate-ebanking.com\www

Trusted Zone: zoomit.be\*

TCP: DhcpNameServer = 192.168.2.1

.

- - - - ORPHANS VERWIJDERD - - - -

.

AddRemove-sp44407 - c:\hp\Softpaq\sp44407\sp44407.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NAV]

"ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\19.9.0.9\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\19.9.0.9\diMaster.dll\" /prefetch:1"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe

.

**************************************************************************

.

Voltooingstijd: 2012-11-15 17:59:53 - machine werd herstart

ComboFix-quarantined-files.txt 2012-11-15 16:59

.

Pre-Run: 467.157.172.224 bytes beschikbaar

Post-Run: 467.088.269.312 bytes beschikbaar

.

- - End Of File - - 0FD292A0856EF05B7B73A2149A4518D1

kape · 16 november 2012

Open een kladblokbestand.

Kopieer en plak daarin de onderstaande vetgedrukte tekst.

Folder::

c:\windows\SysWow64\searchplugins

c:\windows\SysWow64\Extensions

c:\programdata\Babylon

c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}

c:\program files (x86)\Free YouTube Downloader

Sla dit bestand op je bureaublad op als CFScript.

Sleep CFScript.txt in ComboFix.exe

Dit zal ComboFix doen herstarten. Start opnieuw op als dat gevraagd wordt.

Post na herstart de inhoud van de Combofix.txt in je volgende bericht.

Download AdwCleaner by Xplode naar je bureaublad.

Sluit alle openstaande vensters.
Vista en Windows 7 gebruikers: Rechtsklik op AdwCleaner en selecteer als Administrator uitvoeren...
Voor XP: Gewoon dubbelklikken op AdwCleaner.
Klik vervolgens op Verwijderen.
Klik bij AdwCleaner – Informatie op OK
Klik bij AdwCleaner – Herstarten Noodzakelijk op OK

Dat tijdens de actie de snelkoppelingen verdwijnen, is normaal. Nadat de PC opnieuw is opgestart, opent een logfile. Post de inhoud van dit log in je volgende bericht.

Robbe91 · 16 november 2012

ComboFix 12-11-13.03 - thuis 16/11/2012 11:44:10.2.2 - x64

Microsoft Windows 7 Professional 6.1.7601.1.1252.32.1043.18.4095.2881 [GMT 1:00]

Gestart vanuit: c:\users\thuis\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\thuis\Desktop\CFScript..txt

AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Free YouTube Downloader

c:\program files (x86)\Free YouTube Downloader\ffmpeg.exe

c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}

c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}\{D3742F82-1C1A-4DCC-ABBD-0E831C0185CC}.msi

c:\programdata\Babylon

c:\windows\SysWow64\Extensions

c:\windows\SysWow64\searchplugins

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-10-16 to 2012-11-16 ))))))))))))))))))))))))))))))

.

2012-11-16 10:48 . 2012-11-16 10:48 -------- d-----w- c:\users\Default\AppData\Local\temp