Logje Hijackthis

asec · 27 januari 2013

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:18:23, on 27-1-2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16457)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Windows\System32\nvraidservice.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\HP\HP Software Update\hpwuschd2.exe

C:\Program Files\PowerISO\PWRISOVM.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files\DAEMON Tools Lite\DTLite.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\Christiaan Roetman\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O4 - HKLM\..\Run: [NVRaidService] C:\Windows\system32\nvraidservice.exe

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [Cm108Sound] RunDll32 cm108.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKCU\..\Run: [LG PC Suite III] C:\Program Files\LG Electronics\LG PC Suite III\SyncManangerApp.exe /launcher /icon

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Startup: Dropbox.lnk = Christiaan Roetman\AppData\Roaming\Dropbox\bin\Dropbox.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll

O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra button: Toon of verberg HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--

End of file - 10921 bytes

Alvast bedankt voor de hulp.

juisterr · 27 januari 2013

Logje is schoon, wat is het probleem ?

juisterr · 28 januari 2013

Verder geen problemen ?

asec · 31 januari 2013

Bedankt voor je reactie.

Mijn probleem is dat mijn internet browser heel vaak vastloopt. Wanneer ik dan het Windows bestand explorer.exe uit zet. Dan loopt de internet browser gewoon gelijk door en loopt hij niet meer vast.

Dit is overigens ook de redenen waarom ik zo laat reageer. Hij liep gewoon elke keer vast bij het laden van deze site.

kape · 1 februari 2013

Download eens een alternatieve browser (Firefox, Opera, o.i.d.) ... en bekijk dan eens of je daarmee dezelfde problemen hebt. Zo ja, is het een algemeen probleem dat kan bekeken worden. Zo nee, is het een specifiek probleem met I.E. en kan de aandacht enkel daarop gericht worden.

asec · 2 februari 2013

Het doet zich bij elke type browser voor.

juisterr · 2 februari 2013

Hallo, we gaan de volgende tool inzetten. zoek.exe ®by smeenk

Download zoek.exe naar het bureaublad.

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe
(hier of hier) kan je lezen hoe je dat doet.
Dubbelklik op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkwaardig probleem.
```
startupall;
filesrcm;
emptyclsid;
```
Vink nu de onderstaande opties aan.
- Chrome Look
- Reset Chrome
- Firefox Look
- Firefox Defaults
- Standaard Search
- Auto Clean
- Running processes
- Empty All Temp
- IE Defaults
[*] Klik nu op de knop "Run script".

[*] Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).

[*] Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.

[*] Post nu de inhoud van het geopende logje in het volgende bericht.

asec · 2 februari 2013

==== Running Processes ======================

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\PnkBstrA.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\System32\nvraidservice.exe

C:\Windows\System32\rundll32.exe

C:\Windows\system32\svchost.exe -k HPService

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\WUDFHost.exe

C:\Program Files\HP\HP Software Update\hpwuschd2.exe

C:\Program Files\PowerISO\PWRISOVM.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\DAEMON Tools Lite\DTLite.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\Christiaan Roetman\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Windows\system32\DllHost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

E:\Steam\GameOverlayUI.exe

C:\Program Files\Windows Live\Mail\wlmail.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Windows\system32\taskmgr.exe

C:\Windows\explorer.exe

E:\Steam\steam.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_146.exe

C:\Users\Christiaan Roetman\Downloads\zoek.exe

C:\Users\CHRIST~1\AppData\Local\Temp\RarSFX0\zoek.com

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1327539776-541167608-3217100770-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} deleted successfully

==== Deleting CLSID Registry Values ======================

==== FireFox Fix ======================

Deleted from C:\Users\Christiaan Roetman\AppData\Roaming\Mozilla\Firefox\Profiles\n1w41tw3.default\prefs.js:

Added to C:\Users\Christiaan Roetman\AppData\Roaming\Mozilla\Firefox\Profiles\n1w41tw3.default\prefs.js:

user_pref("browser.startup.homepage", "http://www.google.com");

user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.newtab.url", "http://www.google.com/");

user_pref("browser.search.defaultengine", "Google");

user_pref("browser.search.defaultenginename", "Google");

user_pref("browser.search.selectedEngine", "Google");

user_pref("browser.search.order.1", "Google");

user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.search.suggest.enabled", true);

user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

"C:\Windows\system32\appdata" deleted

"C:\Program Files\DAEMON Tools Toolbar" deleted

"C:\Users\Christiaan Roetman\AppData\LocalLow\AskToolbar" deleted

==== System Specs ======================

Windows: Windows 7 Professional Edition Service Pack 1 (Build 7601)

Internet Explorer: 9.0.8112.16421

Memory (RAM): 3583 MB

CPU Info: AMD Athlon 64 X2 Dual Core Processor 6000+

CPU Speed: 2993,1 MHz

Sound Card: Luidsprekers (ROCCAT Kulo) |

Luidsprekers (High Definition A |

Display Adapters: NVIDIA GeForce 9600 GT | NVIDIA GeForce 9600 GT | RDPDD Chained DD | RDP Encoder Mirror Driver | RDP Reflector Display Driver

Monitors: 1x; SyncMaster 2053BW/2053GW,SyncMaster Magic CX2053BW(Digital) |

Screen Resolution: 1680 X 1050 - 32 bit

Network: Network Present

Network Adapters: NVIDIA nForce 10/100/1000 Mbps Ethernet

CD / DVD Drives: 3x (F: | G: | H: | ) F: SONY DVD RW DRU-190A | G: MPIHIRM MZS96JST | H:

Ports: COM1 | COM4 | COM3 LPT Port NOT Present.

Mouse: 5 Button Wheel Mouse Present

Hard Disks: C: 99,9GB | D: 411,6GB | E: 419,9GB

Hard Disks - Free: C: 43,5GB | D: 138,3GB | E: 221,0GB

Manufacturer *: Phoenix Technologies, LTD

BIOS Info: AT/AT COMPATIBLE | 06/30/09 | HPQOEM - 42302e31

Time Zone: West-Europa (standaardtijd)

Motherboard *: ASUSTeK Computer INC. M3N78 PRO

Sun Java version: 1.7.0_11

Country: Nederland

Language: NLD

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\CHRIST~1\AppData\Local\Temp ====

====== C:\Windows\system32 =====

2013-01-28 21:56:49 C54CF441253746DFF5F4EB124DAEFEE5 3762120 ----a-w- C:\Windows\System32\FNTCACHE.DAT

2013-01-26 16:12:16 D93993A2D716A5BF633C76BE4FD11217 94112 ----a-w- C:\Windows\System32\WindowsAccessBridge.dll

2013-01-26 15:02:21 D3A08BA0A5C9CA61A10A8EB81C176692 13312 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll

2013-01-26 15:02:21 A86F5616EACB7155998011CEFFFB52F6 12800 ----a-w- C:\Windows\System32\RdpGroupPolicyExtension.dll

2013-01-26 15:02:21 18C48414627F5F1C57A8C7CA815E75BD 12288 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe

2013-01-26 15:02:19 E6446AB7A7E602CAFF51ACA3C68C1526 269312 ----a-w- C:\Windows\System32\aaclient.dll

2013-01-26 15:02:19 D3F64318307CEC05CBDE533D99976532 16896 ----a-w- C:\Windows\System32\wksprtPS.dll

2013-01-26 15:02:19 C551B35F71CA76C88112966238821105 317440 ----a-w- C:\Windows\System32\wksprt.exe

2013-01-26 15:02:19 AC3598BD1101BBC4365994BAB093BB62 2739712 ----a-w- C:\Windows\System32\rdpcorets.dll

2013-01-26 15:02:19 A9D4140B8B843D5719F7C3EED8C0F9FD 37376 ----a-w- C:\Windows\System32\tsgqec.dll

2013-01-26 15:02:19 8999F18D38D55E34D356796507FFD639 192000 ----a-w- C:\Windows\System32\rdpendp_winip.dll

2013-01-26 15:02:19 40FF6C636380A87DE3A99F4E348BFDCB 1048064 ----a-w- C:\Windows\System32\mstsc.exe

2013-01-26 15:02:19 3F853160DEE5B71B9AD2F1BAF2B1E55B 46592 ----a-w- C:\Windows\System32\MsRdpWebAccess.dll

2013-01-26 15:02:19 3228AB5F8652EAABFF3C5FC7FD0F603A 221184 ----a-w- C:\Windows\System32\rdpudd.dll

2013-01-26 15:02:19 321BE3A2C87206B0C85ECD4FA4EBBF54 56320 ----a-w- C:\Windows\System32\TSWbPrxy.exe

2013-01-26 15:02:19 235B7E30D5B48A3B769C00DA166F080B 32768 ----a-w- C:\Windows\System32\TsUsbGDCoInstaller.dll

2013-01-26 15:02:18 EF1689081813A60D4610FF429530BA36 4916224 ----a-w- C:\Windows\System32\mstscax.dll

2013-01-26 15:01:52 AF78F66116814FDD6677CEBD73035CDD 247808 ----a-w- C:\Windows\System32\schannel.dll

2013-01-26 15:01:52 444430C44727B5F22B4DC17284798EBD 1039360 ----a-w- C:\Windows\System32\lsasrv.dll

2013-01-26 15:01:50 33B26FA5DBEB69FFAB703EDCB4E6DE4A 514560 ----a-w- C:\Windows\System32\qdvd.dll

====== C:\Windows\system32\drivers =====

2013-01-26 15:02:21 65375DF758CA1872AB7EBBBA457FD5E6 14848 ----a-w- C:\Windows\System32\drivers\rdpvideominiport.sys

2013-01-26 15:02:20 9CE253214ACAA5A7D323327D2055EFAA 49664 ----a-w- C:\Windows\System32\drivers\TsUsbFlt.sys

2013-01-26 15:01:52 5FE1ABF1AF591A3458C9CF24ED9A4D35 136560 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2013-01-26 15:01:52 42F158036BD4C2FF3122BF142E60E6FD 369856 ----a-w- C:\Windows\System32\drivers\cng.sys

====== C:\Windows\Tasks ======

====== C:\Windows\Temp ======

======= C:\Program Files =====

2013-01-28 21:42:32 -------- d-----w- C:\Program Files\Mozilla Maintenance Service

======= C: =====

====== C:\Users\Christiaan Roetman\AppData\Roaming ======

2013-01-29 05:56:44 2BC506BFCCC281AB0D05FDBA1C901B9C 110048 ----a-w- C:\users\Christiaan Roetman\AppData\Local\GDIPFONTCACHEV1.DAT

2013-01-28 21:42:38 -------- d-----w- C:\users\Christiaan Roetman\AppData\Roaming\Mozilla

====== C:\Users\Christiaan Roetman ======

2013-01-21 10:29:14 !HASH: COULD NOT OPEN FILE !!!!! 1917 --sha-w- C:\ProgramData\e4384ee8-8d4e-4e0d-9ec3-796b8c79c51c

2013-01-21 10:24:27 -------- d-----w- C:\ProgramData\a15fde06-ca7b-4cd8-92c8-559023897149

====== C: exe-files ==

2013-01-28 21:42:33 810278E354F18045AFF615CB20E8674B 105758 ----a-w- C:\Program Files\Mozilla Maintenance Service\Uninstall.exe

2013-01-28 21:42:32 9C3758018DED02F4AE53CCA1C5F084A2 115608 ----a-w- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

2013-01-28 21:41:53 8374EA3D1BFE87566064E747D8037A32 20831872 ----a-w- C:\Users\Christiaan Roetman\Desktop\Firefox-Setup-18-0-1.exe

2013-01-28 21:41:31 EDCADB4C9F62E57AA1D68B55665D219E 379064 ----a-w- C:\Users\Christiaan Roetman\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIAKHCWR\SoftonicDownloader_voor_firefox.exe

2013-01-28 21:39:00 2CF6AB5D77623BBE24ACC41D056E3404 18686256 ----a-w- C:\Users\Christiaan Roetman\Desktop\IE9-Windows7-x86-nld.exe

2013-01-28 21:38:32 AE2A9BFA91886DF315AF11DC2B2A9D3E 379088 ----a-w- C:\Users\Christiaan Roetman\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A89R6UPW\SoftonicDownloader_voor_internet-explorer-9.exe

=== C: other files ==

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-1327539776-541167608-3217100770-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun"

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVRaidService"="C:\Windows\system32\nvraidservice.exe"

"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"AdobeAAMUpdater-1.0"="C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

"AdobeCS5.5ServiceManager"="C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe -launchedbylogin"

"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE"

"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"SwitchBoard"="C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe"

"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun"

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

==== Startup Folders ======================

2011-10-31 19:59:04 1059 ----a-w- C:\users\Christiaan Roetman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

2011-03-04 07:49:18 2069 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [09-01-2013 20:35]

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [16-01-2012 01:00]

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [16-01-2012 01:00]

==== Firefox Extensions ======================

AppDir: C:\Program Files\Mozilla Firefox

- Default - %AppDir%\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Christiaan Roetman\AppData\Roaming\Mozilla\Firefox\Profiles\n1w41tw3.default

9AC863FD5976316C29D4CB5E4C9EFD9C - C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll - Shockwave Flash

69505F9C479C4FF95621C3E1A7B6E5CE - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll - Adobe Acrobat

D1CC5365F151777DF447242E476796BA - C:\Program Files\Adobe\Reader 10.0\Reader\browser\nppdf32.dll - Adobe Acrobat

D1CC5365F151777DF447242E476796BA - C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll - Adobe Acrobat

B30BFE5817EF9BB23EF299E10C210C31 - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll - NVIDIA 3D Vision

CB2DB588335669AA88076DE419B2964B - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll - NVIDIA 3D VISION

F00DA1A135FCA11D4426D9A5AB72CF0F - C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll - AdobeAAMDetect

586FDC4E02623EE228EC35B9604AE5F2 - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll - Google Update

D4EE19A43A672D5617DBDE36F28262BA - C:\Users\Christiaan Roetman\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player

D0DA6B2FB50A0667CF4BACC2AEFEA009 - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll - Java Platform SE 7 U5

9013599B12923A45C029C34E8D2211AC - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll - Silverlight Plug-In

61FAF4A10CD6A2A691A86FB9C5EDB3F7 - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll - Pando Web Plugin

C517E5EA7CEE783F3681F62D2A362E5B - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live? Photo Gallery

2437BE68D5A37A75FAD51C5F0E9A03ED - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll - Google Earth Plugin

41561B8AE9E551BD08304D48DAA900FA - C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll - AdobeAAMDetect

BF2AD333C79072EEBE5AE0D72670E64E - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrlui.dll - Microsoft® Silverlight

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{ED9128D2-AB32-409A-9A85-C4E06606A9D4}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

{ED9128D2-AB32-409A-9A85-C4E06606A9D4} Wikipedia (nl) Url="http://nl.wikipedia.org/w/index.php?title=Speciaal:Zoeken&search={searchTerms}"

==== Reset Google Chrome ======================

Nothing found to reset

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1327539776-541167608-3217100770-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully

HKEY_USERS\S-1-5-21-1327539776-541167608-3217100770-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-1327539776-541167608-3217100770-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully

==== HijackThis Entries ======================