Ga naar inhoud

.Exe problemen

Feazy

Door Feazy
in Archief Windows Algemeen

 Delen

Aanbevolen berichten

Feazy Nieuweling

Feazy

Geplaatst:
Geplaatst:

Goede dag alle pc doktor van deze forum.

Ook ik heb sinds kort problemen met mijn laptop

Op mijn bereaublad zijn wat programmas snelkopp links beschadigd.

Ik kan bijna geen programma zoals Google chroom, mozilla thunderbird/firefox,

sportify, window movie maker, windows verkenner enz. direkt openen zonder de

venster met opties met programmas te openen. Alles wordt met een .exe extensie

weergegeven. rundl ook.

Ik vermoed een trojan en hebt met norton niks kunnen vinden. Avg gedownload maar wordt

weergegeven met een .exe extensie om op te slaan maar niet uit te voeren.

Help!!:dong::hmmmm2::dontknow:

Link naar reactie
Delen op andere sites
Dasle Grootmeester

Dasle

Geplaatst:
Geplaatst:

We zullen eerst eens nagaan of malware of virussen de oorzaak zijn van je probleem.

1. Download HijackThis. (klik er op)

Klik op HijackThis.msi en de download start automatisch na 5 seconden.

Bestand HijackThis.msi opslaan. Daarna kiezen voor "uitvoeren".

Hijackthis wordt nu op je PC geïnstalleerd, een snelkoppeling wordt op je bureaublad geplaatst.

Als je geen netwerkverbinding meer hebt, kan je de download doen met een andere pc en het bestand met een usb stick overbrengen

Als je enkel nog in veilige modus kan werken, moet je de executable (HijackThis.exe) downloaden.

Sla deze op in een nieuwe map op de C schijf (bvb C:\\hijackthis) en start hijackthis dan vanaf deze map.

De logjes kan je dan ook in die map terugvinden.

2. Klik op de snelkoppeling om HijackThis te starten. (lees eerst de rode tekst hieronder!)

Klik ofwel op "Do a systemscan and save a logfile", ofwel eerst op "Scan" en dan op "Savelog".

Er opent een kladblokvenster, hou gelijktijdig de CTRL en A-toets ingedrukt, nu is alles geselecteerd. Hou gelijktijdig de CTRL en C-toets ingedrukt, nu is alles gekopieerd. Plak nu het HJT logje in je bericht door CTRL en V-toets.

Krijg je een melding ""For some reason your system denied writing to the Host file ....", klik dan gewoon door op de OK-toets.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\\Program Files\\Trend Micro\\HiJackThis of C:\\Program Files (x86)\\Trend Micro\\HiJackThis. (Bekijk hier de afbeelding ---> Klik hier)

3. Na het plaatsen van je logje wordt dit door een expert nagekeken en hij begeleidt jou verder door het ganse proces.

Tip!

Wil je in woord en beeld weten hoe je een logje met HijackThis maakt en plaatst op het forum, klik dan HIER.

Link naar reactie
Delen op andere sites
Feazy Nieuweling

Feazy

Geplaatst:
  • Auteur
Geplaatst:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 14:58:42, on 9-3-2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Unable to get Internet Explorer version!

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe

C:\Program Files\Norton AntiVirus\Engine\20.3.0.36\ccSvcHst.exe

C:\Program Files\Norton Identity Safe\Engine\2013.3.0.26\ccSvcHst.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Thunderbird\thunderbird.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_171.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_171.exe

C:\Users\Corine\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snap.do/?publisher=QuickObrw&dpid=QuickObrw&co=NL&userid=f52fdfde-b0d7-4df9-8fb6-456fd6b5f8cb&searchtype=ds&q={searchTerms}

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: ThreeShips IEHelper - {17FDB9F8-DCC4-4F6A-AE07-B16018A48469} - C:\Program Files\Common Files\Threeships Shared\DLL\ThreeShipsIEHelper.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll

O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\20.3.0.36\IPS\IPSBHO.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll

O2 - BHO: DealPly - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files\DealPly\DealPlyIE.dll

O2 - BHO: Norton Identity Protection - {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files\Norton Identity Safe\Engine\2013.3.0.26\coIEPlg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo\YontooIEClient.dll

O3 - Toolbar: (no name) - {0cc09160-108c-4759-bab1-5c12c216e005} - (no file)

O3 - Toolbar: Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files\Norton Identity Safe\Engine\2013.3.0.26\coIEPlg.dll

O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)

O4 - HKLM\..\Run: [ConnectionCenter] "C:\Users\Corine\AppData\Local\Citrix\ICA Client\concentr.exe" /startup

O4 - HKLM\..\Run: [HF_G_Jul] "C:\Program Files\AVG Secure Search\HF_G_Jul.exe" /DoAction

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [4shared Update] "C:\Program Files\4shared Desktop\checkUpdate.exe"

O4 - HKCU\..\Run: [Google Update] "C:\Users\Corine\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [spotify Web Helper] "C:\Users\Corine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

O4 - HKCU\..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe /preload

O4 - HKCU\..\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

O4 - HKCU\..\Run: [sDP] C:\Program Files\FilesFrog Update Checker\update_checker.exe /auto

O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Corine\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Global Startup: Online plug-in.lnk = ?

O8 - Extra context menu item: &Download All using 4shared Desktop - res://C:\Program Files\4shared Desktop\Desktop.32/D_ALL_LINK

O8 - Extra context menu item: &Download using 4shared Desktop - res://C:\Program Files\4shared Desktop\Desktop.32/D_ONE_LINK

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Free YouTube Download - C:\Users\Corine\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm

O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll

O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Users\Corine\AppData\Local\Citrix\ICA Client\IcaMimeFilter.dll

O20 - AppInit_DLLs: c:\progra~2\browse~1\25986~1.67\{c16c1~1\browse~1.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\20.3.0.36\ccSvcHst.exe

O23 - Service: Norton Identity Safe (NCO) - Symantec Corporation - C:\Program Files\Norton Identity Safe\Engine\2013.3.0.26\ccSvcHst.exe

O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

--

End of file - 11023 bytes

Link naar reactie
Delen op andere sites
juisterr Veteraan

juisterr

Geplaatst:
Geplaatst:

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

O2 - BHO: DealPly - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files\DealPly\DealPlyIE.dll

O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo\YontooIEClient.dll

O3 - Toolbar: (no name) - {0cc09160-108c-4759-bab1-5c12c216e005} - (no file)

O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)

O4 - HKLM\..\Run: [4shared Update] "C:\Program Files\4shared Desktop\checkUpdate.exe"

O4 - HKCU\..\Run: [spotify Web Helper] "C:\Users\Corine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

Klik op 'Fix checked' om de items te verwijderen.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map :

C:\\Program Files\\Trend Micro\\HiJackThis of C:\\Program Files (x86)\\Trend Micro\\HiJackThis.

- - - Updated - - -

Download zoek.exe naar het bureaublad.

  • Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe
    (hier of hier) kan je lezen hoe je dat doet.
  • Dubbelklik op Zoek.exe om de tool te starten.
  • Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
  • Kopieer nu onderstaande code en plak die in het grote invulvenster:
  • Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkwaardig probleem.
    startupall;
filesrcm;


  • Klik op de knop "Options" en vink nu de onderstaande opties aan.


    • Recently Created
    • Empty Temp Folders
    • Shortcut Fix
    • IE Defaults
    • Reset Hosts
    • Auto Clean

    [*] Klik daarna op de knop "Run script".

    [*] Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).

    [*] Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.

    [*] Post nu de inhoud van het geopende logje in het volgende bericht.

Link naar reactie
Delen op andere sites
Feazy Nieuweling

Feazy

Geplaatst:
  • Auteur
Geplaatst:

Zoek.exe Version 4.0.0.2 Updated 08-March-2013

Tool run by Corine on zo 10-03-2013 at 22:05:33,20.

Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x86

Running in: Normal Mode Internet Access Detected

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1198854313-3227596037-38767860-1001\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5} deleted successfully

HKEY_USERS\S-1-5-21-1198854313-3227596037-38767860-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully

HKEY_USERS\S-1-5-21-1198854313-3227596037-38767860-1001\Software\Microsoft\Internet Explorer\SearchScopes\{171719AB-0FAB-47E5-A6E2-8AF7E1FC78CA} deleted successfully

HKEY_USERS\S-1-5-21-1198854313-3227596037-38767860-1001\Software\Microsoft\Internet Explorer\SearchScopes\{70607AFD-3D0A-4391-9DDB-7922C39034B2} deleted successfully

HKEY_USERS\S-1-5-21-1198854313-3227596037-38767860-1001\Software\Microsoft\Internet Explorer\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e} deleted successfully

HKEY_USERS\S-1-5-21-1198854313-3227596037-38767860-1001\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Reset Hosts File ======================

# Copyright © 1993-2006 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.

127.0.0.1 localhost

::1 localhost

==== FireFox Fix ======================

ProfilePath: C:\Users\Corine\AppData\Roaming\Mozilla\Firefox\Profiles\7zqthzdi.default-1362604160772

user.js not found

---- Lines Customized removed from prefs.js ----

user_pref("extensions.testpilot.alreadyCustomizedToolbar", true);

---- Lines Customized modified from prefs.js ----

---- FireFox user.js and prefs.js backups ----

prefs_10-03-2013_2221_.backup

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"bProtectorDefaultScope"=-

==== Deleting Files \ Folders ======================

"C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml" deleted

"C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml" deleted

"C:\Windows\tasks\RegClean Pro_DEFAULT.job" deleted

"C:\Windows\tasks\RegClean Pro_UPDATES.job" deleted

"C:\Windows\system32\roboot.exe" deleted

"C:\Program Files\Uninstall Information\ib_uninst_514" deleted

"C:\Program Files\Uninstall Information\ib_uninst_569" deleted

"C:\Program Files\DealPly" deleted

"C:\Program Files\Yontoo" deleted

"C:\Program Files\Perion" deleted

"C:\Program Files\Conduit" deleted

"C:\Users\Corine\AppData\Roaming\Babylon" deleted

"C:\Users\Corine\AppData\Roaming\Systweak" deleted

"C:\Users\Corine\AppData\Roaming\PerformerSoft" deleted

"C:\Windows\System32\searchplugins" deleted

"C:\Windows\System32\Extensions" deleted

"C:\ProgramData\Tarma Installer" deleted

"C:\ProgramData\Babylon" deleted

"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly" deleted

"C:\Users\Corine\AppData\Local\CRE" deleted

"C:\Users\Corine\AppData\Local\Conduit" deleted

"C:\Users\Corine\AppData\LocalLow\BabylonToolbar" deleted

"C:\Users\Corine\AppData\LocalLow\Incredibar.com" deleted

"C:\Users\Corine\AppData\LocalLow\PriceGong" deleted

"C:\Users\Corine\AppData\LocalLow\Conduit" deleted

"C:\Users\Corine\AppData\LocalLow\Toolbar4" deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====

2013-03-09 17:03:44 F7FB3254581C88182C1F33BD3ECA6C63 2562 ----a-w- C:\Windows\diagwrn.xml

2013-03-09 17:03:44 D1E75542EC8D1B4851765A57AC63618E 1908 ----a-w- C:\Windows\diagerr.xml

====== C:\Users\Corine\AppData\Local\Temp ====

2013-02-26 20:37:02 07356626437A164BB31285D2303DFEFB 20903528 ----a-w- C:\Users\Corine\AppData\Local\Temp\SkypeSetup.exe

====== C:\Windows\system32 =====

2013-03-03 15:34:59 786B9C958A4F217322C24C736263C51F 245760 ----a-w- C:\Windows\System32\OxpsConverter.exe

2013-03-03 15:34:52 140D9F911182357626165EA0BEB98C4F 156672 ----a-w- C:\Windows\System32\ncsi.dll

2013-03-03 15:34:51 58F67245D041FBE7AF88F4EAF79DF0FA 499712 ----a-w- C:\Windows\System32\iphlpsvc.dll

2013-03-03 15:34:51 50E0DD0A5B8D8BC353578F2F73926697 52224 ----a-w- C:\Windows\System32\nlaapi.dll

2013-03-03 15:34:51 5078492B9CAC9CB721698DB51F039035 175104 ----a-w- C:\Windows\System32\netcorehc.dll

2013-03-03 15:34:51 374071043F9E4231EE43BE2BB48DD36D 242176 ----a-w- C:\Windows\System32\nlasvc.dll

2013-03-03 15:34:51 23FC8068953C9BE2D63AE4EF1129112A 18944 ----a-w- C:\Windows\System32\netevent.dll

2013-03-03 15:31:29 72E953215CADE1A726C04AAFDF6B463D 49152 ----a-w- C:\Windows\System32\taskhost.exe

2013-03-03 15:31:01 EF71BA5DF59034962B0C62314A71351A 193536 ----a-w- C:\Windows\System32\dhcpcore6.dll

2013-03-03 15:31:01 81F6C1AE23B1C493D9E996C3103915D7 44032 ----a-w- C:\Windows\System32\dhcpcsvc6.dll

====== C:\Windows\system32\drivers =====

2013-03-09 05:54:57 629CABB0421668C9D3D402A3C3D77E14 21104 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-03-03 15:35:54 ED80D303102A746D30C1684B387BCBF1 33280 ----a-w- C:\Windows\System32\drivers\RNDISMP.sys

2013-03-03 15:35:54 8C9C922D71F1CD4DEF73F186416B7896 712048 ----a-w- C:\Windows\System32\drivers\ndis.sys

2013-03-03 15:34:51 3EEBD3BD93DA46A26E89893C7AB2FF3B 35328 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys

2013-02-14 15:44:59 7C0507D2391AF5933600CBCED799F277 1293672 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2013-02-14 15:44:59 776FCEFE2CD27C442DF66D3F3535078D 240496 ----a-w- C:\Windows\System32\drivers\netio.sys

2013-02-14 15:44:58 AAB149EE616952BB84308C28E75ED20D 187752 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS

====== C:\Windows\Tasks ======

====== C:\Windows\Temp ======

======= C:\Program Files =====

2013-02-26 10:57:52 -------- dc----w- C:\Program Files\4shared Desktop

2013-02-24 10:13:27 -------- dc----w- C:\Program Files\Mozilla Thunderbird

======= C: =====

2013-02-26 15:51:29 FBFEE3E53FA68E27C10255A8FF7C5BCF 2456 -c--a-w- C:\{528C470E-599B-496F-875F-59FB18861154}

====== C:\Users\Corine\AppData\Roaming ======

2013-03-09 06:34:58 -------- d-----w- C:\users\Corine\AppData\Local\MFAData

2013-03-09 06:34:58 -------- d-----w- C:\users\Corine\AppData\Local\Avg2013

2013-03-06 17:00:53 407AAB8C27CF7081EECE071C90A65B83 17 ----a-w- C:\users\Corine\AppData\Local\resmon.resmoncfg

2013-02-28 20:20:58 -------- d-----w- C:\users\Corine\AppData\Local\ElevatedDiagnostics

2013-02-26 11:16:59 -------- d-----w- C:\users\Corine\AppData\Local\Screencast-O-Matic

2013-02-26 10:58:05 -------- d-----w- C:\users\Corine\AppData\Roaming\4shared Desktop

====== C:\Users\Corine ======

2013-03-09 06:34:58 -------- d-----w- C:\ProgramData\MFAData

====== C: exe-files ==

2013-03-09 15:29:44 F71EE08CF349F977E61C6E55A84A4639 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$I78C51B.exe

2013-03-09 15:29:44 F6A503A75FCEF59FABF6A5CA63E1E077 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$I84W3TA.exe

2013-03-09 15:29:44 D001DE41692B4F49F3F76A62AF4BA8F3 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IWUI0N9.exe

2013-03-09 15:29:44 CD4B3F8F68F9C696D13A690E9E41E6A0 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IN69485.exe

2013-03-09 15:29:44 A4217057A6BEA54889C7D0CCC9EAD008 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$II6I0SJ.exe

2013-03-09 15:29:44 A1B89E7F9920E4E676D4D3371B296AF5 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IOMGB9O.exe

2013-03-09 15:29:44 A02DFCA25B2CB43732C380BCCC7ED79C 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IXIYKXD.exe

2013-03-09 15:29:44 7FD112C8483E12C219415BDEA55F0B6D 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IW9JMJ4.exe

2013-03-09 15:29:44 7FD0BDA099AFEF9D729E3C33018738C3 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IEP900J.exe

2013-03-09 15:29:44 729B3EB67F2E19CA48E90961FD976554 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IVEQ7UG.exe

2013-03-09 15:29:44 2C139615CC482CFCEA9DF7F0B3B1814E 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IC4U87O.exe

2013-03-09 15:29:44 2AE8D100D907031BBFD565BB92C45CB3 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$I4BG0EF.EXE

2013-03-09 15:29:44 29932769407642C6AD7CF582DEEB6294 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$I1PNY01.exe

2013-03-09 15:29:44 024D7008FF22C92431672E1F31ACD7ED 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IVK5RSX.exe

2013-03-09 15:12:25 FB3257DD5C63FE2087CBBA21B64DB38B 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IBMG1AI.exe

2013-03-09 15:12:22 55DFA13D2B7E657CD73E34B1B6512895 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$I78576E.exe

2013-03-09 15:10:26 33087CADF5D73415A72084B91DA008B6 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IAK5NU6.exe

2013-03-09 15:10:23 E29DFD6D7262CC41BDF5FD1F5210E943 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$IL2LQWO.exe

2013-03-09 15:10:15 3899438FC5260CFB4D7F8B42236583D5 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$ICX4FW1.exe

2013-03-09 06:35:12 C44F12B72DF42A037E65713B0F50B9D8 7330384 ----a-w- C:\ProgramData\MFAData\SelfUpd\avgmfapx.exe

2013-03-09 06:35:03 A2DD738C3E673E76E5EA538702414BB7 15480 ----a-w- C:\ProgramData\MFAData\SelfUpd\avgrdtestx.exe

2013-03-09 06:35:03 88898DBB395E15F084C57533615C4BA6 16504 ----a-w- C:\ProgramData\MFAData\SelfUpd\avgrdtesta.exe

2013-03-09 06:35:03 150DE281AA5F4DA6FECAB535F93EC7F4 270968 ----a-w- C:\ProgramData\MFAData\SelfUpd\avgrunasx.exe

2013-03-09 06:35:03 0214EC38CFEF72AA54F5243F9D689F04 621176 ----a-w- C:\ProgramData\MFAData\SelfUpd\avgntdumpx.exe

2013-03-09 05:52:31 0FB6D382FA5FBF72D05FC2A4503B7DF2 10156344 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$RBMG1AI.exe

2013-03-09 05:32:35 BDFC48A2D947651B721745837E864D17 4318112 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$RVEQ7UG.exe

2013-03-06 16:15:47 DC54C110D465F5DBB5C761B4B2E8737E 12319816 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$R4BG0EF.EXE

2013-03-06 16:10:26 FF786A74F62361A71AECDB8F8AC95D6F 201808 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$ROMGB9O.exe

2013-03-03 21:29:30 BDFC48A2D947651B721745837E864D17 4318112 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$REP900J.exe

2013-03-03 21:28:57 BDFC48A2D947651B721745837E864D17 4318112 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$R1PNY01.exe

2013-03-03 21:28:24 BDFC48A2D947651B721745837E864D17 4318112 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$RVK5RSX.exe

2013-03-03 21:25:42 FF011C9083F1D9CC278899CFB630F6C6 3215792 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1198854313-3227596037-38767860-1001\$RCX4FW1.exe

=== C: other files ==

2013-03-09 15:18:44 3DE22831103D4EE760CDFC36632520E5 332 ----a-w- C:\Users\Corine\AppData\Local\Temp\wz1bf8\repair.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-1198854313-3227596037-38767860-1001\Software\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="C:\Users\Corine\AppData\Local\Google\Update\GoogleUpdate.exe /c"

"KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload"

@="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"

"SDP"="C:\Program Files\FilesFrog Update Checker\update_checker.exe /auto "

"Facebook Update"="C:\Users\Corine\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HF_G_Jul"="C:\Program Files\AVG Secure Search\HF_G_Jul.exe /DoAction"

"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"4shared Update"="C:\Program Files\4shared Desktop\checkUpdate.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="C:\Users\Corine\AppData\Local\Google\Update\GoogleUpdate.exe /c"

"KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload"

@="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"

"SDP"="C:\Program Files\FilesFrog Update Checker\update_checker.exe /auto "

"Facebook Update"="C:\Users\Corine\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe ARM]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Adobe ARM"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Adobe Reader Speed Launcher"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="iTunesHelper"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="QuickTime Task"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\uTorrent]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="uTorrent"

"hkey"="HKCU"

"command"="\"C:\\Program Files\\uTorrent\\uTorrent.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Corine^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]

"path"="C:\\Users\\Corine\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Dropbox.lnk"

"backup"="C:\\Windows\\pss\\Dropbox.lnk.Startup"

"backupExtension"=".Startup"

"command"="C:\\Users\\Corine\\AppData\\Roaming\\Dropbox\\bin\\Dropbox.exe "

"item"="Dropbox"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run-]

"Google Update"="\"C:\\Users\\Corine\\AppData\\Local\\Google\\Update\\GoogleUpdate.exe\" /c"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]

"DivXUpdate"="\"C:\\Program Files\\DivX\\DivX Update\\DivXUpdate.exe\" /CHECKNOW"

"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""

"SunJavaUpdateSched"="\"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\""

==== Startup Folders ======================

2010-11-06 19:57:15 2847 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Online plug-in.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [28-02-2013 17:57]

C:\Windows\tasks\DriverScanner.job --a------ C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe [20-10-2011 14:43]

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1198854313-3227596037-38767860-1001Core.job --a------ C:\Users\Corine\AppData\Local\Facebook\Update\FacebookUpdate.exe [30-01-2013 14:08]

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1198854313-3227596037-38767860-1001UA.job --a------ C:\Users\Corine\AppData\Local\Facebook\Update\FacebookUpdate.exe [30-01-2013 14:08]

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [04-04-2012 18:58]

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [04-04-2012 18:58]

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1198854313-3227596037-38767860-1001Core.job --a------ C:=C:=C:\Users\Corine\AppData\Local\Google\Update\GoogleUpdate.exe []

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1198854313-3227596037-38767860-1001UA.job --a------ line:=C:=C: []

==== Firefox Extensions ======================

ProfilePath: C:\Users\Corine\AppData\Roaming\Mozilla\Firefox\Profiles\7zqthzdi.default-1362604160772

- Instrument Test - %ProfilePath%\extensions\testpilot@labs.mozilla.com.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\Corine\AppData\Roaming\Mozilla\Firefox\Profiles\7zqthzdi.default-1362604160772

E64819B6014A93E2503BB52419A0F6F3 - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll - Shockwave Flash

78B8643467B68FCAD26C4D9E4A77EDB5 - C:\Users\Corine\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll - Google Talk Plugin Video Accelerator

FE66393FF0F0A1CAF53FA54EFBBA5533 - C:\Users\Corine\AppData\Roaming\Mozilla\plugins\npo1d.dll - Google Talk Plugin Video Renderer

416DE10C59706B4AB7F90CCD04C1EFB0 - C:\Users\Corine\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin

E0FF893763BA82BAABB869A351F0C455 - C:\Users\Corine\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll - Google Update

570A48F975661221A126FCFE3B38B7E1 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat

B1BB8EDC9D83D8096EE873F04CEE600C - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat

570A48F975661221A126FCFE3B38B7E1 - C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll - Adobe Acrobat

E0FF893763BA82BAABB869A351F0C455 - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll - Google Update

0B31B0F8FA99CFD009C8FBEA9E20C9DE - C:\Users\Corine\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin

4C5100476A8E6685C7F9F2EAF7BFF683 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll - Java Platform SE 7 U5

7A1E2AF50DDCDD49C114C1099DBEF6E1 - C:\Windows\system32\npDeployJava1.dll - Java Deployment Toolkit 7.0.50.255

9013599B12923A45C029C34E8D2211AC - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll - Silverlight Plug-In

74886F890A070C1B51EDF04F4BB3E011 - C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll - RealNetworks RealDownloader Chrome Background Extension Plug-In (32-bit)

B19C9E5D69AD348D38FF08C89887569B - C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll - RealNetworks RealDownloader HTML5VideoShim Plug-In (32-bit)

739DE28B93888897FC4E345FCA94F272 - C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll - RealDownloader Plugin

54BC55D3D9BD33A6CE38F811CF836794 - C:\Program Files\Google\Picasa3\npPicasa3.dll - Picasa

C517E5EA7CEE783F3681F62D2A362E5B - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live? Photo Gallery

B938C1AE3ADCE166190895685B0BEB0D - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll - DivX VOD Helper Plug-in

0734C95492371D092367F2F3AF794A0D - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll - DivX Web Player

D38AFAE9A9F77F9BE6473E9CC83D5647 - C:\Program Files\QuickTime\Plugins\npqtplugin7.dll - QuickTime Plug-in 7.6.9

8B98B1A31858618AD9544477E2F7814D - C:\Program Files\QuickTime\Plugins\npqtplugin6.dll - QuickTime Plug-in 7.6.9

D8F8E45ACC404661CF0787F2A0888180 - C:\Program Files\QuickTime\Plugins\npqtplugin5.dll - QuickTime Plug-in 7.6.9

7B55FEF2BA47A2420BB49CD93320077A - C:\Program Files\QuickTime\Plugins\npqtplugin4.dll - QuickTime Plug-in 7.6.9

D9F5A433758BC151850E53690D57663A - C:\Program Files\QuickTime\Plugins\npqtplugin3.dll - QuickTime Plug-in 7.6.9

2FE95733EB36CD762EAE54BBE9D8B11C - C:\Program Files\QuickTime\Plugins\npqtplugin2.dll - QuickTime Plug-in 7.6.9

8FD41344CB62DDB06E2A339F2C5F1947 - C:\Program Files\QuickTime\Plugins\npqtplugin.dll - QuickTime Plug-in 7.6.9

99F97C9FE748C37528C338A423577FCB - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll - Microsoft® Windows Media Player Firefox Plugin

15E298B5EC5B89C5994A59863969D9FF - C:\Windows\system32\npmproxy.dll - Microsoft® Windows® Operating System

BF2AD333C79072EEBE5AE0D72670E64E - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrlui.dll - Microsoft® Silverlight

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

dhkplhfnhceodhffomolpfigojocbpcb - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonChrome.crx[]

dlnembnfbcpjnepmfjmngjenhhajpdfd - C:\Program Files\IB Updater\source.crx[]

gaiilaahiahdejapggenmdmafpmbipje - C:\Program Files\DealPly\DealPly.crx[]

gclijllifhfpomppedeljakfegbcpojn - C:\Users\Corine\AppData\Local\CRE\gclijllifhfpomppedeljakfegbcpojn.crx[]

hgojaaaiddhmiiakpejiklijbalpckih - C:\Users\Corine\AppData\Roaming\StatusWinks\statuswinks.crx[05-11-2012 14:23]

idhngdhcfkoamngbedgpaokgjbnpdiji - C:\Program Files\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[23-03-2012 11:35]

jifflliplgeajjdhmkcfnngfpgbjonjg - C:\Program Files\Perion\NewTab\newTab.crx[]

meinjhkhgaalhfbinmclpmjikccbplkf - C:\Users\Corine\AppData\Local\CRE\meinjhkhgaalhfbinmclpmjikccbplkf.crx[]

niapdbllcanepiiimjjndipklodoedlc - C:\Users\Corine\AppData\Local\Temp\YontooLayers.crx[]

niogeckbkdcabhnapjbkeiklablhjoca - C:\Program Files\Perion\ChromeInfoBar\ChromeInfoBar.crx[]

nneajnkjbffgblleaoojgaacokifdkhm - C:\Program Files\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx[23-05-2011 19:24]

nppllibpnmahfaklnpggkibhkapjkeob - C:\Program Files\Norton Identity Safe\Engine\2013.3.0.26\Exts\Chrome.crx[14-02-2013 04:02]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions

gaiilaahiahdejapggenmdmafpmbipje - C:\Program Files\DealPly\DealPly.crx[]

gclijllifhfpomppedeljakfegbcpojn - C:\Users\Corine\AppData\Local\CRE\gclijllifhfpomppedeljakfegbcpojn.crx[]

meinjhkhgaalhfbinmclpmjikccbplkf - C:\Users\Corine\AppData\Local\CRE\meinjhkhgaalhfbinmclpmjikccbplkf.crx[]

kaseta.co - Corine - Default\Extensions\beejeneglcnjnccggaplaacafmfgapin

Tampermonkey - Corine - Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo

Go to IMDb - Corine - Default\Extensions\fipkcplmpmhcmfgkgahliaabodplkjio

Smiley Bar for Facebook - Corine - Default\Extensions\hgojaaaiddhmiiakpejiklijbalpckih

Until AM - Corine - Default\Extensions\kodigjkcpaoeodlnmcnekemakpnmegnk

FileConverter 1.4 - Corine - Default\Extensions\meinjhkhgaalhfbinmclpmjikccbplkf

USA Independence Day Theme - Corine - Default\Extensions\mhgggmlhfbnbhbkeogednenglhggdfif

Privacy Palette (Adblock + Security) - Corine - Default\Extensions\mjkcflkplhgpebknipkekjggglimnone

Norton Identity Protection - Corine - Default\Extensions\nppllibpnmahfaklnpggkibhkapjkeob

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.msn.com/"

"Use Search Asst"="yes"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]

"Default"="http://feed.snap.do/?publisher=QuickObrw&dpid=QuickObrw&co=NL&userid=f52fdfde-b0d7-4df9-8fb6-456fd6b5f8cb&searchtype=ds&q={searchTerms}"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

"Default"="http://feed.snap.do/?publisher=QuickObrw&dpid=QuickObrw&co=NL&userid=f52fdfde-b0d7-4df9-8fb6-456fd6b5f8cb&searchtype=ds&q={searchTerms}"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://feed.snap.do/?publisher=QuickObrw&dpid=QuickObrw&co=NL&userid=f52fdfde-b0d7-4df9-8fb6-456fd6b5f8cb&searchtype=ds&q={searchTerms}"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}] not found

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.msn.com/"

"Use Search Asst"="no"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

{8FC0472E-7FF6-4181-82A4-7742D6AB873B} Wikipedia (nl) Url="http://nl.wikipedia.org/w/index.php?title=Speciaal:Zoeken&search={searchTerms}"

{95B7759C-8C7F-4BF1-B163-73684A933233} AVG Secure Search Url="http://isearch.avg.com/search?cid={85D108BC-E873-488A-93C7-9136C84F50BE}&mid=3bbeb52cf32247d092b5d15f95bdb432-7bc8200defda1693a2824f9d0d45884106895f79〈=nl&ds=cv011&pr=sa&d=2012-06-23"

{EF320579-CCBB-47E2-944F-99EAF3775B06} Yahoo//nl.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811_yserp&p={searchTerms}"

==== shortcuts on Users Desktops ======================

C:\Users\Corine\Desktop\4shared Desktop.lnk - C:\Program Files\4shared Desktop\desktop.exe

C:\Users\Corine\Desktop\Google Chrome.lnk - C:\Users\Corine\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Corine\Desktop\moviemaker - Snelkoppeling.lnk - C:\Users\Corine\Desktop\youtube marleny\moviemaker.wlmp

C:\Users\Corine\Desktop\start word - Snelkoppeling.lnk - C:\Users\Corine\Documents\start word.doc

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Ashampoo Burning Studio 6 FREE.lnk - C:\Program Files\Ashampoo\Ashampoo Burning Studio 6 FREE\burningstudio.exe

C:\Users\Public\Desktop\DivX Plus Player.lnk - C:\Program Files\DivX\DivX Plus Player\DivX Plus Player.exe

C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Users\Public\Desktop\Mozilla Firefox.lnk - C:\Program Files\Mozilla Firefox\firefox.exe

C:\Users\Public\Desktop\Mozilla Thunderbird.lnk - C:\Program Files\Mozilla Thunderbird\thunderbird.exe

C:\Users\Public\Desktop\Picasa 3.lnk - C:\Program Files\Google\Picasa3\Picasa3.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Corine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Users\Corine\AppData\Local\Google\Chrome\Application\chrome.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Program Files\Mozilla Firefox\firefox.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk - C:\Program Files\Malwarebytes' Anti-Malware\mbam.chm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Verwijder Malwarebytes Anti-Malware.lnk - C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\chameleon.chm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton AntiVirus\LiveUpdate.lnk - C:\Program Files\Norton AntiVirus\Engine\20.3.0.36\uistub.exe /lu

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton AntiVirus\NBRT.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton AntiVirus\Norton AntiVirus.lnk - C:\Program Files\Norton AntiVirus\Engine\20.3.0.36\uistub.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton AntiVirus\Support.lnk - C:\Program Files\Norton AntiVirus\Engine\20.3.0.36\symerr.exe /support

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton AntiVirus\Uninstall Norton AntiVirus.lnk - C:\Program Files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV\2454B0AB\20.3.0.36\inststub.exe /X /shortcut

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Identity Safe\Norton Identity Safe.lnk - C:\Program Files\Internet Explorer\iexplore.exe symres:Identitysafe.html

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Identity Safe\Uninstall Norton Identity Safe.lnk -

==== shortcuts in Quick Launch ======================

C:\Users\Corine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk - C:\Program Files\Mozilla Thunderbird\thunderbird.exe

C:\Users\Corine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\HijackThis.lnk - C:\Users\Corine\Downloads\HijackThis.exe

C:\Users\Corine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files\Mozilla Firefox\firefox.exe

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\gclijllifhfpomppedeljakfegbcpojn deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\meinjhkhgaalhfbinmclpmjikccbplkf deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\niogeckbkdcabhnapjbkeiklablhjoca deleted successfully

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje deleted successfully

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\gclijllifhfpomppedeljakfegbcpojn deleted successfully

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\meinjhkhgaalhfbinmclpmjikccbplkf deleted successfully

==== Empty IE Cache ======================

C:\Users\Corine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

C:\Users\Corine\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Corine\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Corine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\users\Corine\AppData\Local\Mozilla\Firefox\Profiles\7zqthzdi.default-1362604160772\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\users\Corine\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

After Reboot

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied

C:\Users\Corine\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Corine\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

Sorry voor de late reactie

Link naar reactie
Delen op andere sites
juisterr Veteraan

juisterr

Geplaatst:
Geplaatst:

Dat is wel raar na deze opruiming.

Download ComboFix van één van deze locaties:

Link 1

Link 2

* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op

Hier kan je lezen hoe je Combofix moet gebruiken.

1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix. Hier is een handleiding over hoe je ze kan uitschakelen: klik hier of hier

2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.

3. Dubbelklik op "Combofix.exe" om de tool te starten.

4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion", herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

Link naar reactie
Delen op andere sites
 Delen
Ga naar topic overzicht
Logo

OVER ONS

PC Helpforum helpt GRATIS computergebruikers sinds juli 2006. Ons team geeft via het forum professioneel antwoord op uw vragen en probeert uw pc problemen zo snel mogelijk op te lossen. Word lid vandaag, plaats je vraag online en het PC Helpforum-team helpt u graag verder!

SITEMAP

×
×
  • Nieuwe aanmaken...

Belangrijke informatie

We hebben cookies geplaatst op je toestel om deze website voor jou beter te kunnen maken. Je kunt de cookie instellingen aanpassen, anders gaan we er van uit dat het goed is om verder te gaan.