search.conduit.com verwijderen

andromeda · 9 januari 2013

Hallo

Het gevraagde logje.

ComboFix 13-01-08.01 - Paul 09/01/2013 19:17:03.2.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.32.1043.18.2989.1879 [GMT 1:00]

Gestart vanuit: c:\users\Paul\Downloads\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Paul\Desktop\cfscript

AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Optimizer Pro

c:\programdata\Premium

c:\programdata\Premium\OptimizerPro\OptimizerPro.exe

c:\programdata\Premium\OptimizerPro\profile.ini

c:\programdata\Premium\OptimizerPro\run2413.tmp

c:\programdata\Premium\OptimizerPro\run2A8A.tmp

c:\programdata\Premium\OptimizerPro\runB398.tmp

c:\programdata\Premium\OptimizerPro\runD450.tmp

c:\programdata\Premium\OptimizerPro\runDF09.tmp

c:\programdata\Premium\SaveAs\profile.ini

c:\programdata\Premium\SaveAs\run2FC7.tmp

c:\programdata\Premium\SaveAs\runA7D2.tmp

c:\programdata\Premium\SaveAs\runE61A.tmp

c:\programdata\Premium\SaveAs\SaveAs.exe

c:\programdata\WoW Worldwide Software LTD

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-12-09 to 2013-01-09 ))))))))))))))))))))))))))))))

.

2013-01-09 18:21 . 2013-01-09 18:21 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-01-09 15:42 . 2012-11-20 05:48 307200 ----a-w- c:\windows\system32\ncrypt.dll

2013-01-09 15:42 . 2012-11-20 04:51 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll

2013-01-09 15:42 . 2012-11-01 05:43 2002432 ----a-w- c:\windows\system32\msxml6.dll

2013-01-09 15:42 . 2012-11-01 05:43 1882624 ----a-w- c:\windows\system32\msxml3.dll

2013-01-09 15:42 . 2012-11-01 04:47 1389568 ----a-w- c:\windows\SysWow64\msxml6.dll

2013-01-09 15:42 . 2012-11-01 04:47 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll

2013-01-09 15:42 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll

2013-01-09 15:42 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll

2013-01-09 15:42 . 2012-11-23 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys

2013-01-09 15:42 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe

2013-01-09 13:59 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7AEB5DF5-7D11-47F2-816C-DFDED349AA7C}\mpengine.dll

2013-01-08 20:51 . 2013-01-08 20:51 388096 ----a-r- c:\users\Paul\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2013-01-08 20:51 . 2013-01-08 20:51 -------- d-----w- c:\program files (x86)\Trend Micro

2013-01-08 18:25 . 2013-01-08 18:25 -------- d-----w- c:\programdata\regid.1986-12.com.adobe

2013-01-08 18:24 . 2013-01-08 18:24 -------- d-----w- c:\program files\Adobe

2013-01-08 18:22 . 2013-01-08 18:25 -------- d-----w- c:\program files\Common Files\Adobe

2013-01-08 18:21 . 2013-01-08 18:21 -------- d-----w- c:\program files (x86)\Adobe Media Player

2013-01-08 17:13 . 2013-01-08 17:13 -------- d-----w- c:\users\Paul\AppData\Local\CRE

2013-01-08 17:13 . 2013-01-08 17:13 -------- d-----w- c:\program files (x86)\uTorrent

2013-01-08 17:12 . 2013-01-09 18:19 -------- d-----w- c:\users\Paul\AppData\Roaming\uTorrent

2013-01-08 16:35 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-01-08 11:50 . 2013-01-08 11:50 -------- d-----w- c:\program files\Stellarium

2013-01-03 20:02 . 2013-01-03 20:03 -------- d-----w- c:\users\Paul\AppData\Roaming\HpUpdate

2013-01-03 20:02 . 2013-01-03 20:02 -------- d-----w- c:\windows\Hewlett-Packard

2013-01-02 09:20 . 2013-01-02 09:20 -------- d-----w- c:\users\Paul\AppData\Local\Google

2012-12-28 13:37 . 2012-12-28 13:37 -------- d-----w- c:\users\Paul\AppData\Local\Programs

2012-12-26 08:03 . 2012-12-26 16:50 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird

2012-12-25 22:40 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll

2012-12-25 22:40 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2012-12-25 22:40 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll

2012-12-25 22:40 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

2012-12-25 16:49 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll

2012-12-25 16:49 . 2012-11-09 04:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-12-25 16:48 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll

2012-12-25 16:48 . 2012-11-02 05:11 376832 ----a-w- c:\windows\SysWow64\dpnet.dll

2012-12-25 16:45 . 2012-12-25 16:46 -------- d-----w- C:\24099cdff77651f2cd798f0041

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-01-09 15:43 . 2012-10-09 16:38 67599240 ----a-w- c:\windows\system32\MRT.exe

2012-12-14 15:49 . 2012-10-09 13:48 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-12-11 19:05 . 2012-10-09 16:10 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-12-11 19:05 . 2012-10-09 16:10 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-12-10 12:08 . 2012-12-10 12:08 73216 ----a-w- c:\windows\system32\drivers\ew_jucdcecm.sys

2012-12-10 12:08 . 2012-12-10 12:08 30720 ----a-w- c:\windows\system32\drivers\ew_juextctrl.sys

2012-12-10 12:08 . 2012-12-10 12:08 224768 ----a-w- c:\windows\system32\drivers\ew_juwwanecm.sys

2012-12-10 12:08 . 2012-12-10 12:08 13952 ----a-w- c:\windows\system32\drivers\ew_usbenumfilter.sys

2012-12-10 12:08 . 2012-12-10 12:08 1001472 ----a-w- c:\windows\system32\drivers\mod7700.sys

2012-12-10 12:08 . 2012-12-10 12:08 90112 ----a-w- c:\windows\system32\drivers\ew_jubusenum.sys

2012-12-10 12:08 . 2012-12-10 12:08 436224 ----a-w- c:\windows\system32\drivers\ewusbwwan.sys

2012-12-10 12:08 . 2012-12-10 12:08 32768 ----a-w- c:\windows\system32\drivers\ewdcsc.sys

2012-12-10 12:08 . 2012-12-10 12:08 225920 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys

2012-12-10 12:08 . 2012-12-10 12:08 22016 ----a-w- c:\windows\system32\drivers\ew_hwupgrade.sys

2012-12-10 12:08 . 2012-12-10 12:08 1490656 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll

2012-12-10 12:08 . 2012-12-10 12:08 1490656 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01007.dll

2012-12-10 12:08 . 2012-12-10 12:08 117248 ----a-w- c:\windows\system32\drivers\ew_hwusbdev.sys

2012-12-10 12:08 . 2012-12-10 12:08 104448 ----a-w- c:\windows\system32\drivers\ew_jucdcacm.sys

2012-11-28 18:22 . 2012-11-28 18:22 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{88DE1E05-0533-4730-B39E-A6BB90DD7F08}\gapaengine.dll

2012-11-21 10:21 . 2012-11-21 10:21 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-11-21 10:21 . 2012-11-21 10:21 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-11-21 10:21 . 2012-11-21 10:21 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-11-08 10:29 . 2012-11-08 10:29 1402312 ----a-w- c:\windows\SysWow64\msxml4.dll

2012-10-18 12:22 . 2012-10-20 13:13 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2012-10-16 08:38 . 2012-12-03 10:47 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38 . 2012-12-03 10:47 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39 . 2012-12-03 10:47 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

2012-10-12 07:19 . 2012-10-18 12:19 9291768 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0EE407C5-C5CB-4604-8360-2ABEB59356C3}\mpengine.dll

.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Directory of C:\24099cdff77651f2cd798f0041 ----

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2013-01-08 969104]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"Boingo Wi-Fi"="c:\program files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk" [2010-09-30 2429]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-11 98304]

"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-27 6998656]

"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2009-08-20 170624]

"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 LlamaYA movil. RunOuc;LlamaYA movil. OUC;c:\program files (x86)\LlamaYA movil\UpdateDog\ouc.exe [2012-12-10 655712]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]

R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2012-12-10 117248]

R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [2012-12-10 104448]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-11-13 67072]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]

R3 NisSrv;Microsoft Netwerkinspectie;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]

R3 QHY5II_A;QHY5II_A;c:\windows\system32\DRIVERS\QHY5II_A.sys [2012-08-08 24000]

R3 QHY5II_B;QHY5II_B;c:\windows\system32\DRIVERS\QHY5II_B.sys [2012-08-08 55232]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-10-10 1255736]

S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2009-12-07 379520]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-11 202752]

S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [2011-03-14 346976]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]

S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-10-15 117760]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2012-12-10 90112]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Inhoud van de 'Gedeelde Taken' map

.

2013-01-09 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-09 19:05]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 621440]

"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-11-27 487424]

"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584]

"Setwallpaper"="c:\programdata\SetWallpaper.cmd" [bU]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com/ie

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

TCP: DhcpNameServer = 195.130.131.132 195.130.130.4

FF - ProfilePath - c:\users\Paul\AppData\Roaming\Mozilla\Firefox\Profiles\hc7khe8p.default\

FF - prefs.js: browser.search.defaulturl -

FF - ExtSQL: !HIDDEN! 2012-10-09 17:41; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

WebBrowser-{87775FDB-6972-41F9-AE51-8326E38CB206} - (no file)

AddRemove-SP_156f8a5f - c:\program files (x86)\SaveAs\uninstall.exe

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2013-01-09 19:24:07

ComboFix-quarantined-files.txt 2013-01-09 18:24

ComboFix2.txt 2013-01-09 13:57

.

Pre-Run: 435.769.282.560 bytes beschikbaar

Post-Run: 435.738.574.848 bytes beschikbaar

.

- - End Of File - - 1FB8D0E49C40A776CCC093882B7CBCB8

Mvg Paul

kape · 9 januari 2013

Mooi zo ... heeft Malwarebytes nu nog wat te vertellen ?

andromeda · 9 januari 2013

Wie weet het laatste logje?

Malwarebytes Anti-Malware (PRO) 1.70.0.1100

Malwarebytes : Free anti-malware download

Databaseversie: v2013.01.09.07

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Paul :: PAUL-LPT [administrator]

Bescherming: Uitgeschakeld

9/01/2013 19:55:34

mbam-log-2013-01-09 (19-55-34).txt

Scan type: Snelle scan

Uitgeschakelde scan opties: P2P

Objecten gescand: 215581

Verstreken tijd: 3 minuut/minuten, 56 seconde(n)

Geheugenprocessen gedetecteerd: 0