HiJack logje

marc69 · 7 februari 2013

Beste

Ik heb een probleeem dat ik niet opgelost krijg,

onderlijnde tekst met reclame op internet.

kunnen jullie mj verder helpen??

alvast bedankt

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:22:59, on 7/02/2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16457)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\Users\Marc\AppData\Roaming\BrowserCompanion\tcbhn.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

C:\Program Files (x86)\Belgium Identity Card\beid35gui.exe

C:\Program Files (x86)\iMesh Applications\MediaBar\Datamngr\datamngrUI.exe

C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE

C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\Program Files (x86)\Internet Explorer\IELowutil.exe

C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Marc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GECANGTG\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN | Hotmail | Messenger | Nieuws, sport, entertainment, video, lifestyle, auto en nog veel meer, dat is MSN !

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = HLN.be, Nieuws, sport en showbizz, 24/24, 7/7, meer dan 350 nieuwsupdates per dag

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, Messenger, het laatste nieuws en entertainment | MSN.NL

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Babylon Search

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer wordt aangeboden door MSN and Bing

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: YTD Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.7\ytdToolbarIE.dll

R3 - URLSearchHook: (no name) - {16CC3586-3547-4025-9E2F-F04C365D8B90} - (no file)

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: script helper for ie - {00cbb66b-1d3b-46d3-9577-323a336acb50} - C:\Program Files (x86)\BrowserCompanion\jsloader.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll

O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll

O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\IEBHO.dll

O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll

O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Update Timer - {963B125B-8B21-49A2-A3A8-E37092276531} - C:\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O2 - BHO: YTD Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.7\ytdToolbarIE.dll

O3 - Toolbar: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll

O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll

O3 - Toolbar: YTD Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.7\ytdToolbarIE.dll

O4 - HKLM\..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe

O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe"

O4 - HKLM\..\Run: [indexSearch] "C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe"

O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"

O4 - HKLM\..\Run: [brMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN

O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun

O4 - HKLM\..\Run: [beid] "C:\Program Files (x86)\Belgium Identity Card\beid35gui.exe" /startup

O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon

O4 - HKLM\..\Run: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

O4 - HKLM\..\Run: [searchProtection] C:\ProgramData\Search Protection\_run.bat

O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\RunOnce: [adawarebp] reg.exe delete "HKCU\Software\AppDataLow\Software\adawarebp" /f

O4 - HKCU\..\RunOnce: [adawarebp_XP] reg.exe delete "HKCU\Software\adawarebp" /f

O4 - Startup: tcbhn.lnk = C:\Users\Marc\AppData\Roaming\BrowserCompanion\tcbhn.exe

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files%20(x86)/Bejeweled%203/Images/stg_drm.ocx

O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files%20(x86)/Bejeweled%203/Images/armhelper.ocx

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll

O18 - Protocol: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll

O18 - Protocol: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll

O20 - AppInit_DLLs: c:\progra~3\browser manager\2.6.1123.78\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll

O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: Micro Star SCM - Micro-Star International Co., Ltd. - C:\Program Files (x86)\System Control Manager\MSIService.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe

O23 - Service: NitroPDFReaderDriverCreatorReadSpool2 (NitroReaderDriverReadSpool2) - Nitro PDF Software - C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)

O23 - Service: Software Updater (SrvUpdater) - Unknown owner - C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)

O23 - Service: Intel® Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 13901 bytes

juisterr · 7 februari 2013

Hallo, ziet er niet goed uit.

Uitvoeren als administrator.

Start HijackThis op en klik op scan.

Selecteer alleen de items die hieronder zijn genoemd:

R3 - URLSearchHook: YTD Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.7\ytdToolbarIE.dll

R3 - URLSearchHook: (no name) - {16CC3586-3547-4025-9E2F-F04C365D8B90} - (no file)

O2 - BHO: script helper for ie - {00cbb66b-1d3b-46d3-9577-323a336acb50} - C:\Program Files (x86)\BrowserCompanion\jsloader.dll

O2 - BHO: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll

O2 - BHO: Update Timer - {963B125B-8B21-49A2-A3A8-E37092276531} - C:\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll

O2 - BHO: YTD Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.7\ytdToolbarIE.dll

O3 - Toolbar: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll

O3 - Toolbar: YTD Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\6.7\ytdToolbarIE.dll

O4 - HKLM\..\Run: [searchSettings] "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

O4 - Startup: tcbhn.lnk = C:\Users\Marc\AppData\Roaming\BrowserCompanion\tcbhn.exe

O18 - Protocol: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll

O18 - Protocol: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll

O18 - Protocol: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll

O20 - AppInit_DLLs: c:\progra~3\browser manager\2.6.1123.78\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll

O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)

Sluit alle vensters behalve HijackThis

Klik op 'Fix checked' om de items te verwijderen.

- - - Updated - - -

Hallo, we gaan de volgende tool inzetten. zoek.exe ®by smeenk

Download zoek.exe naar het bureaublad.

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe
(hier of hier) kan je lezen hoe je dat doet.
Dubbelklik op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkwaardig probleem.
```
startupall;
filesrcm;
emptyclsid;
```
Vink nu de onderstaande opties aan.
- Standaard Search
- Auto Clean
- Running processes
- Empty All Temp
- IE Defaults
[*] Klik nu op de knop "Run script".

[*] Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).

[*] Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.

[*] Post nu de inhoud van het geopende logje in het volgende bericht.

marc69 · 7 februari 2013

Zoek.exe Version 4.0.0.1 Updated 07-February-2013

Tool run by Marc on do 07/02/2013 at 21:31:02,37.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

==== Running Processes ======================

C:\windows\system32\csrss.exe

C:\windows\system32\wininit.exe

C:\windows\system32\csrss.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\lsm.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\svchost.exe -k RPCSS

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\System32\spoolsv.exe

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\windows\system32\taskhost.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\windows\system32\Dwm.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\windows\Explorer.EXE

C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\System Control Manager\MSIService.exe

C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe

C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe

C:\windows\system32\taskeng.exe

C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\FSP\FspUip.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe

C:\windows\system32\wbem\unsecapp.exe

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

C:\windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Belgium Identity Card\beid35gui.exe

C:\Program Files (x86)\iMesh Applications\MediaBar\Datamngr\datamngrUI.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE

C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe

C:\windows\system32\SearchIndexer.exe

C:\windows\splwow64.exe

C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\windows\System32\WUDFHost.exe

C:\windows\system32\SearchProtocolHost.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\windows\System32\svchost.exe -k secsvcs

C:\windows\servicing\TrustedInstaller.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Users\Marc\AppData\Local\Temp\Temp1_zoek.zip\zoek.scr

C:\windows\SysWOW64\cmd.exe

C:\windows\system32\conhost.exe

C:\windows\system32\wbem\wmiprvse.exe

C:\Windows\SysWOW64\mshta.exe

C:\windows\system32\SearchFilterHost.exe

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Internet Explorer\SearchScopes\{03E102C3-AE51-4017-BA66-8FDDA9D0466C} deleted successfully

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Internet Explorer\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\application updater deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\application updater deleted successfully

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

hijackthis

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"BrowserMngr Start Page"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"bProtector Start Page"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"BrowserMngrDefaultScope"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"bProtectorDefaultScope"=-

==== Deleting Files \ Folders ======================

"C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml" deleted

"C:\Users\Marc\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data" deleted

"C:\Users\Marc\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences" deleted

"C:\user.js" deleted

"C:\prefs.js" deleted

"C:\Program Files (x86)\iMesh Applications\MediaBar\Datamngr\datamngrUI.exe" deleted

"C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" deleted

"C:\Program Files (x86)\Common Files\Spigot\Search Settings\wth157.dll" deleted

"C:\Program Files (x86)\Application Updater" deleted

"C:\Program Files (x86)\Search Results Toolbar" deleted

"C:\Program Files (x86)\BrowserCompanion" deleted

"C:\Program Files (x86)\iMesh Applications\MediaBar" deleted

"C:\Program Files (x86)\YTD Toolbar" deleted

"C:\Program Files (x86)\Common Files\Spigot" not deleted

"C:\Users\Marc\AppData\Roaming\BrowserCompanion" deleted

"C:\Users\Marc\AppData\Roaming\Babylon" deleted

"C:\Users\Marc\AppData\Roaming\Systweak" deleted

"C:\Users\Marc\AppData\Roaming\OpenCandy" deleted

"C:\windows\SysWow64\searchplugins" deleted

"C:\windows\SysWow64\Extensions" deleted

"C:\ProgramData\Browser Manager" deleted

"C:\ProgramData\Ask" deleted

"C:\ProgramData\Search Protection" deleted

"C:\ProgramData\Babylon" deleted

"C:\Users\Marc\AppData\Local\APN" deleted

"C:\Users\Marc\AppData\LocalLow\BabylonToolbar" deleted

"C:\Users\Marc\AppData\LocalLow\DataMngr" deleted

"C:\Users\Marc\AppData\LocalLow\bbrs_002.tb" deleted

"C:\Users\Marc\AppData\LocalLow\Search Settings" deleted

"C:\Program Files (x86)\iMesh Applications\MediaBar\Datamngr" deleted

"C:\Program Files (x86)\Common Files\Spigot\Search Settings" not deleted

==== System Specs ======================

Windows: Windows 7 Home Premium Edition (64-bit) Service Pack 1 (Build 7601)

Internet Explorer: 9.0.8112.16421

Memory (RAM): 3887 MB

CPU Info: Intel® Core i3 CPU M 370 @ 2.40GHz

CPU Speed: 2390.4 MHz

Sound Card: Speakers (Realtek High Definiti |

Display Adapters: Intel® HD Graphics | Intel® HD Graphics | RDPDD Chained DD | RDP Encoder Mirror Driver | RDP Reflector Display Driver

Monitors: 1x; Generic PnP Monitor |

Screen Resolution: 1600 X 900 - 32 bit

Network: Network Present

Network Adapters: Atheros AR9285 Wireless Network Adapter | Realtek PCIe GBE Family Controller

CD / DVD Drives: 1x (E: | ) E: SlimtypeDVD A DS8A5S

Ports: COM3 LPT Port NOT Present.

Mouse: 8 Button Wheel Mouse Present

Hard Disks: C: 272.8GB | D: 181.9GB | Q: 0.0MB

Hard Disks - Free: C: 169.3GB | D: 181.8GB | Q: 0.0MB

Manufacturer *: American Megatrends Inc.

BIOS Info: AT/AT COMPATIBLE | 09/23/09 | MSI_NB - 6222004

Time Zone: West-Europa (standaardtijd)

Motherboard *: MICRO-STAR INTERNATIONAL CO., LTD MS-1736

Sun Java version: 1.6.0_37

Country: Belgi‰

Language: NLB

==== Files Recently Created / Modified ======================

====== C:\windows ====

2013-02-03 17:48:07 E185BDA84E5F03F4E1D8DCA30E209277 1912 ----a-w- C:\windows\epplauncher.mif

====== C:\Users\Marc\AppData\Local\Temp ====

2013-02-07 18:34:01 4B3BA728905957A78886034A8BA86C7D 18339544 ----a-w- C:\Users\Marc\AppData\Local\Temp\c6947e29-e061-48ea-9982-94d3538aaa86.exe

2013-02-07 18:33:31 4CAB419288A3569B7BFA2D7C03140452 3087584 ----a-w- C:\Users\Marc\AppData\Local\Temp\10fa5ffb-b54c-4809-a6f8-78411ceba329.exe

====== C:\windows\SysWOW64 =====

2013-02-06 21:36:08 F2E571C8F4858F404B37BF316CC9CDF2 141312 ----a-w- C:\windows\SysWOW64\MSCMCFR.DLL

2013-02-06 21:36:08 DCBDCF28CBCF51EFE6D26BA3E05D734F 119568 ----a-w- C:\windows\SysWOW64\VB6FR.DLL

2013-02-06 21:36:08 CFF867572B44212B01B711C1FA009537 101888 ----a-w- C:\windows\SysWOW64\VB6STKIT.DLL

2013-02-06 21:36:08 A23596F0A33BFF856F6A48A5EC13B4A1 32768 ----a-w- C:\windows\SysWOW64\CMDLGFR.DLL

2013-02-03 18:10:08 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\windows\SysWOW64\sho91B9.tmp

====== C:\windows\SysWOW64\drivers =====

====== C:\windows\Sysnative =====

2013-02-03 17:51:23 94BCE5A03EF5F9340AD9095E0D409C82 273840 ------w- C:\windows\Sysnative\MpSigStub.exe

====== C:\windows\Sysnative\drivers =====

2013-02-06 17:24:09 14908F4F9005C29DE8F5587E271390EE 14456 ----a-w- C:\windows\Sysnative\drivers\gfibto.sys

====== C:\windows\Tasks ======

====== C:\windows\Temp ======

======= C:\Program Files =====

2013-01-10 15:13:35 -------- d-----w- C:\Program Files\Common Files\CANON

2013-01-10 15:11:27 -------- d-----w- C:\Program Files\Canon

2013-01-10 15:09:39 -------- d--h--w- C:\Program Files\CanonBJ

======= C:\Program Files (x86) =====

2013-02-06 21:29:10 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy

2013-02-06 21:27:59 -------- d-----w- C:\Program Files (x86)\SoftwareUpdater

2013-02-06 17:24:44 -------- d-----w- C:\Program Files (x86)\Ad-Aware Antivirus

2013-01-30 23:19:23 -------- d-----w- C:\Program Files (x86)\SkypeWebPlugin

2013-01-28 16:23:25 -------- d-----w- C:\Program Files (x86)\Common Files\Spigot

2013-01-10 15:08:46 -------- d-----w- C:\Program Files (x86)\Canon

======= C: =====

====== C:\Users\Marc\AppData\Roaming ======

2013-02-07 18:34:00 -------- d-----w- C:\users\Marc\AppData\Local\adawarebp

2013-02-06 21:36:08 -------- d-----w- C:\users\Marc\AppData\Roaming\TFP

2013-02-06 21:35:26 -------- d-----w- C:\users\Marc\AppData\Local\Torch

2013-02-06 17:28:56 -------- d-----w- C:\users\Marc\AppData\Roaming\LavasoftStatistics

2013-02-06 17:22:18 -------- d-----w- C:\users\Marc\AppData\Roaming\Ad-Aware Antivirus

2013-01-31 10:18:32 -------- d-----w- C:\users\Marc\AppData\Roaming\Fighters

2013-01-30 23:19:55 -------- d-----w- C:\users\Marc\AppData\Local\SkypeWebPlugin

2013-01-10 15:16:58 -------- d-----w- C:\users\Marc\AppData\Locallow\Canon Easy-WebPrint EX

====== C:\Users\Marc ======

2013-02-07 18:33:54 -------- d-----w- C:\ProgramData\Ad-Aware Browsing Protection

2013-02-06 21:29:10 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2013-02-06 17:29:31 -------- d-----w- C:\ProgramData\Ad-Aware Antivirus

2013-02-06 17:24:46 -------- d-----w- C:\ProgramData\Lavasoft

2013-01-31 10:18:43 -------- d-----w- C:\ProgramData\clp

2013-01-31 10:18:00 -------- d-----w- C:\ProgramData\Common Toolkit Suite

2013-01-31 10:16:22 -------- d-----w- C:\ProgramData\Fighters

2013-01-10 15:22:33 -------- d--h--w- C:\ProgramData\CanonIJEPPEX2

2013-01-10 15:22:33 -------- d--h--w- C:\ProgramData\CanonEPP

2013-01-10 15:17:08 -------- d-----w- C:\ProgramData\CanonIJMSetup

2013-01-10 15:13:22 -------- d-----w- C:\ProgramData\CanonIJWSpt

2013-01-10 15:10:30 -------- d--h--w- C:\ProgramData\CanonBJ

====== C: exe-files ==

2013-02-07 18:34:31 AD2961325270F3A34F36BB5622C62292 47496 ----a-w- C:\Users\Marc\AppData\Local\Temp\68654b13-9899-468b-8701-6c5eac74e7ff\amd64\sbbd.exe

2013-02-07 18:34:31 7D7A100919F0416FAC602F5345005058 44424 ----a-w- C:\Users\Marc\AppData\Local\Temp\68654b13-9899-468b-8701-6c5eac74e7ff\i386\sbbd.exe

2013-02-07 18:34:31 1A9D1452ABBC7C6DA6F6EC874669B7E9 200560 ----a-w- C:\Users\Marc\AppData\Local\Temp\68654b13-9899-468b-8701-6c5eac74e7ff\sbrc.exe

2013-02-07 18:34:31 18B82D26821485E3950F405F4B5D58A3 326024 ----a-w- C:\Users\Marc\AppData\Local\Temp\68654b13-9899-468b-8701-6c5eac74e7ff\CartSdk64.exe

2013-02-07 18:34:01 4B3BA728905957A78886034A8BA86C7D 18339544 ----a-w- C:\Users\Marc\AppData\Local\Temp\c6947e29-e061-48ea-9982-94d3538aaa86.exe

2013-02-07 18:33:31 4CAB419288A3569B7BFA2D7C03140452 3087584 ----a-w- C:\Users\Marc\AppData\Local\Temp\10fa5ffb-b54c-4809-a6f8-78411ceba329.exe

2013-02-07 18:32:47 2125ABEA96B43D3496B72834A9729DDC 6133368 ----a-w- C:\Users\Marc\Desktop\Adaware_Installer.exe

2013-02-06 21:29:17 794D4B48DFB6E999537C7C3947863463 1153368 ----a-w- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

2013-02-06 21:29:17 390679F7A217A5E73D756276C40AE887 2260480 ------w- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

2013-02-06 21:28:08 3745639103CC57F89C9B6684AC6C5A09 191933 ----a-w- C:\Program Files (x86)\SoftwareUpdater\uninstall.exe

2013-02-06 21:26:55 9383032F698463C054D74C456EDC2BDA 1188440 ----a-w- C:\Users\Marc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GECANGTG\installer_spybot_search__destroy_1_6_2_Dutch.exe

2013-02-03 17:51:23 94BCE5A03EF5F9340AD9095E0D409C82 273840 ------w- C:\Windows\System32\MpSigStub.exe

2013-02-03 17:47:00 B2FB415A7171B20E127AB4EB2EDB12B4 13541864 ----a-w- C:\Users\Marc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GECANGTG\mseinstall.exe

2013-02-01 09:23:23 51CA9A27C82F68874BBA3E2A87F6B400 670048 ----a-w- C:\Program Files (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\24.0.1312.57\24.0.1312.57_24.0.1312.56_chrome_updater.exe

=== C: other files ==

2013-02-07 18:34:31 BACAFDC32EFFAB03A25CE4BCB60ECC22 464776 ----a-w- C:\Users\Marc\AppData\Local\Temp\68654b13-9899-468b-8701-6c5eac74e7ff\CartSdk.dll

2013-02-07 18:34:31 483924F92E55A5F9423201EC635E2CED 13560 ----a-w- C:\Users\Marc\AppData\Local\Temp\68654b13-9899-468b-8701-6c5eac74e7ff\i386\gfibto.sys

2013-02-07 18:34:31 14908F4F9005C29DE8F5587E271390EE 14456 ----a-w- C:\Users\Marc\AppData\Local\Temp\68654b13-9899-468b-8701-6c5eac74e7ff\amd64\gfibto.sys

2013-02-07 18:34:01 2B2450982E89495CEE00C18271EA8AA8 294717 ----a-w- C:\Users\Marc\AppData\Local\adawarebp\data\temp.zip

2013-02-07 18:33:06 99551A64340029A87C5306D6A6606B53 617984 ----a-w- C:\Users\Marc\AppData\Local\Temp\f81a32b9-bbd2-4203-89e2-56a9630e1844\Statistics.dll

2013-02-06 21:39:44 D7C22643726363F0DAC9A75DCDA8A337 45056 ----a-w- C:\Users\Marc\AppData\Local\Torch\User Data\Default\Extensions\aaaalejpmnocmhmlbmlkjemekckoagne\6.0.0_0\background\ChromeUtilPlugin.dll

2013-02-06 21:36:24 D3C5DE9F32411EE00E554BBC1C06AC82 264192 ----a-w- C:\Users\Marc\AppData\Local\Torch\User Data\Default\Extensions\lecpjhggilhbceadobnggaagnpfpafhg\23.0.0.2295_0\TorchHelper.dll

2013-02-06 21:36:23 054A5B3591CDD6F6602888A2AC317178 426987 ----a-r- C:\Users\Marc\AppData\Local\Temp\scoped_dir_6160_13732\Chrome.crx

2013-02-06 21:36:08 F2E571C8F4858F404B37BF316CC9CDF2 141312 ----a-w- C:\Windows\SysWOW64\MSCMCFR.DLL

2013-02-06 21:36:08 DCBDCF28CBCF51EFE6D26BA3E05D734F 119568 ----a-w- C:\Windows\SysWOW64\VB6FR.DLL

2013-02-06 21:36:08 CFF867572B44212B01B711C1FA009537 101888 ----a-w- C:\Windows\SysWOW64\VB6STKIT.DLL

2013-02-06 21:36:08 A23596F0A33BFF856F6A48A5EC13B4A1 32768 ----a-w- C:\Windows\SysWOW64\CMDLGFR.DLL

2013-02-06 21:29:11 AD1EA59C74D873AC22FB839B8E3E97F7 1168216 --sha-r- C:\Program Files (x86)\Spybot - Search & Destroy\advcheck.dll

2013-02-06 17:28:11 9D3D007C2540A69812D798A36F3279B7 5310784 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\vcore.dll

2013-02-06 17:28:10 D1B01B7933F26211E80EAC667A909E1B 230752 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\patchw32.dll

2013-02-06 17:28:10 C731FC78CB6546C7FE189C9A40D7EED0 337800 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\remediation.dll

2013-02-06 17:28:10 9179B5903E3329827F5D8A45CEFA1C08 186248 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\updater.dll

2013-02-06 17:28:09 FB5C1ED6BBA79291FDA664CF142EEA4D 276360 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libRar.dll

2013-02-06 17:28:09 E3D358B05BDACFC3464AE7541AADE0D0 68568 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\gfiarkup.dll

2013-02-06 17:28:09 C8EA2E332EC6884D08CE2D5EEFCB8440 284552 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libEmail.dll

2013-02-06 17:28:09 BF47C9A5372E4DF8F435AB2F03BE3C32 165768 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libMachoUniv.dll

2013-02-06 17:28:09 B15B445AAC976F0E58C3B7A26E633CD0 136560 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\IncompatiblePrograms.dll

2013-02-06 17:28:09 7DC7D177B59D55B1A09F3A8E14FDFB58 186248 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\lib7zip.dll

2013-02-06 17:28:09 7B33E611511197DFD27B37A444FB4014 964928 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\lgpl.dll

2013-02-06 17:28:09 6B59E42D12D76455E1657DF2BFD47C90 83312 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\kbu.dll

2013-02-06 17:28:09 5D2638498DEA94F0D65136D49625A8DC 165768 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libtd.dll

2013-02-06 17:28:09 5798D98B64240F18A012AA76F632734A 198536 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libNSIS.dll

2013-02-06 17:28:09 56DD7D9679A86EFC4C31A03A92C3237D 169864 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libRTF.dll

2013-02-06 17:28:09 50BC994B5BD8A2F905A69F601FC3DC1D 190344 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libBase64.dll

2013-02-06 17:28:09 477E3D0DF9DC60957CB9E0C0D8B47019 378760 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libVvs.dll

2013-02-06 17:28:09 3225B53B1C53672E97295861947ED3DE 169864 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libMsi.dll

2013-02-06 17:28:09 28188263A5D451261ECBFA6303D4D702 448392 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libMsCab.dll

2013-02-06 17:28:09 1F8A4BE6C00F689A6FE3A678B5C2B603 341896 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libOleA.dll

2013-02-06 17:28:09 0EFC248A61B604DC84C89F400CA1C1F0 190344 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libCHM.dll

2013-02-06 17:28:09 0E47902C881A09DC64D5DEBA611B370A 243592 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\libZip.dll

2013-02-06 17:28:08 E80C14B9C6E5B57BB7710B356857A964 38096 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\gfiark64.sys

2013-02-06 17:28:08 BA421BDAA4D14D525F55E14B2C8C6E19 25560 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\gfiark.dll

2013-02-06 17:28:08 01B2BE86C39752A0FFB30ED1FB4A141C 33616 ----a-w- C:\Program Files (x86)\Ad-Aware Antivirus\Definitions\gfiark32.sys

2013-02-06 17:24:09 14908F4F9005C29DE8F5587E271390EE 14456 ----a-w- C:\Windows\System32\drivers\gfibto.sys

2013-02-06 11:52:04 8B2430762099598DA40686F754632EFD 451192 ----a-r- C:\Windows\System32\drivers\NISx64\1309010.00E\symds64.sys

2013-02-06 11:52:04 891793E00432FA055CF040605C260E49 737952 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\srtsp64.sys

2013-02-06 11:52:04 5CB7F2FD7E30A0F52F93574BFC3A8041 1129120 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\symefa64.sys

2013-02-06 11:52:04 5013A76CAAA1D7CF1C55214B490B4E35 190072 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\ironx64.sys

2013-02-06 11:52:04 3911BD0E68C010E5438A87706ABBE9AB 405624 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\symnets.sys

2013-02-06 11:52:04 2C6FFCCA37B002AAB3C7C31A6D780A76 167072 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\ccsetx64.sys

2013-02-06 11:52:04 1CB7BB3B0561FB5ECFE37F7731E8BF3E 37536 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\srtspx64.sys

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe"

"MGSysCtrl"="C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe"

"ArcSoft Connection Service"="C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe"

"SSBkgdUpdate"="C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot"

"PaperPort PTD"="C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe"

"IndexSearch"="C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe"

"PPort11reminder"="C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe -r C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"

"BrMfcWnd"="C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN"

"ControlCenter3"="C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun"

"beid"="C:\Program Files (x86)\Belgium Identity Card\beid35gui.exe /startup"

"DATAMNGR"="C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE"

"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"CanonSolutionMenuEx"="C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon"

"SearchSettings"="C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"

"Ad-Aware Browsing Protection"="C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"

"SearchProtection"="C:\ProgramData\Search Protection\_run.bat"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s"

"IgfxTray"="C:\windows\system32\igfxtray.exe"

"HotKeysCmds"="C:\windows\system32\hkcmd.exe"

"Persistence"="C:\windows\system32\igfxpers.exe"

"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon"

"fspuip"="%ProgramFiles%\FSP\fspuip.exe "

==== Task Scheduler Jobs ======================

C:\windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [01/10/2011 14:50]

C:\windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [01/10/2011 14:50]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

lfffjahnfbocnaooecgijfnbpcfekoik - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx[]

mkfokfffehpeedafpekjeddnmnjhmcmk - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\Exts\Chrome.crx[01/02/2013 23:18]

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="HLN.be, Nieuws, sport en showbizz, 24/24, 7/7, meer dan 350 nieuwsupdates per dag"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]

"SearchAssistant"="Babylon Search"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search]

"SearchAssistant"="Babylon Search"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] not found

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="HLN.be, Nieuws, sport en showbizz, 24/24, 7/7, meer dan 350 nieuwsupdates per dag"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="{searchTerms} - Bing"

{070B11A3-AE3B-4D95-AA31-97B1E0E6C79A} Yahoo//search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}"

{16CC3586-3547-4025-9E2F-F04C365D8B90} EazelBar Search Url="Eazel search}"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="{searchTerms} - Google Search}"

{7CDCFDF1-8DA1-4EAE-AC6D-83F3500A8D87} Bing Url="{searchTerms} - Bing"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{28387537-e3f9-4ed7-860c-11e69af4a8a0} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{28387537-e3f9-4ed7-860c-11e69af4a8a0} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436a-86E4-9690573BEE8A} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00cbb66b-1d3b-46d3-9577-323a336acb50} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00cbb66b-1d3b-46d3-9577-323a336acb50} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{474597C5-AB09-49d6-A4D5-2E8D7341384E} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{474597C5-AB09-49d6-A4D5-2E8D7341384E} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{963B125B-8B21-49A2-A3A8-E37092276531} deleted successfully

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{963B125B-8B21-49A2-A3A8-E37092276531} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28387537-e3f9-4ed7-860c-11e69af4a8a0} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{28387537-e3f9-4ed7-860c-11e69af4a8a0} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28387537-e3f9-4ed7-860c-11e69af4a8a0} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436a-86E4-9690573BEE8A} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{00cbb66b-1d3b-46d3-9577-323a336acb50} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00cbb66b-1d3b-46d3-9577-323a336acb50} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{474597C5-AB09-49d6-A4D5-2E8D7341384E} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{963B125B-8B21-49A2-A3A8-E37092276531} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{963B125B-8B21-49A2-A3A8-E37092276531} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-946685803-2627052754-3257207740-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{F3FEE66E-E034-436a-86E4-9690573BEE8A} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{28387537-e3f9-4ed7-860c-11e69af4a8a0} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F3FEE66E-E034-436a-86E4-9690573BEE8A} deleted successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\lfffjahnfbocnaooecgijfnbpcfekoik deleted successfully

==== HijackThis Entries ======================