Rootkit; Windows cannot access the specified device, path, or file. You may not...

Hensyr · 27 mei 2013

IE reset handmatig uitgevoerd zonder succes, downloaden van progs blijven "harmfull" en bij "running download" worden deze nog steeds gedeleted.

Vervolgens dezelfde reset uitgevoerd via de Fix It tool van Microsoft die je hebt aangegeven met hetzelfde resultaat: downloads worden tegen gehouden als gevaar en vernietigd in IE browser.

Dan heb ik eens zitten nadenken over wat je zei dat het niet aan het antivirus prog. kan liggen omdat dan alle browsers dezelfde effecten zouden hebben, en dat bracht mij op het idee dat er mogelijks een meegeleverde antivirus zou kunnen geïnstalleerd zijn met andere software die is gedownload in het verleden.

Daardoor heb ik even Revo uninstaller geopend en heb volgende progs verwijderd uit mijn machine:

- Simplitec Simplicheck meegeleverd bij Magix product

- Security Task Manager van Neuber software meegeleverd zonder te weten bij welke prog.

- Pando Media Booster een download versneller ergens voor een of andere download die ik niet meer weet

- Akamai NetSession Interface

- Akamai NetSession Interface Service ook weer een of andere download organizer of zoiets.

Dan heb ik het volgende progje gedownload via Firefox browser: SecurityCheck om te bepalen of er meerdere antivirus programma's draaien maar snap er niets van

dit is het logje van SecurityCheck:

Results of screen317's Security Check version 0.99.64

Windows 7 Service Pack 1 x64 (UAC is disabled!)

Internet Explorer 10

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Windows Firewall Disabled!

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

MVPS Hosts File

Secunia PSI (3.0.0.3001)

Java 7 Update 21

Adobe Flash Player 11.7.700.202

Adobe Reader 10.1.7 Adobe Reader out of Date!

Mozilla Firefox 20.0.1 Firefox out of Date!

````````Process Check: objlist.exe by Laurent````````

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 1%

````````````````````End of Log``````````````````````

Wat die MVPS Hosts File is is mij een raadsel.

Nu ga ik eerst even Combofix laten draaien, resultaten in volgend bericht.

Hensyr · 28 mei 2013

Combofix gedownload via Firefox browser uit Bleepingcomputer.

Log Combofix:

ComboFix 13-05-27.02 - Hendrik 28/05/2013 1:41.1.2 - x64

Microsoft Windows 7 Enterprise N 6.1.7601.1.1252.32.1033.18.4094.2376 [GMT 2:00]

Gestart vanuit: d:\my desktop\ComboFix.exe

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Hendrik\AppData\Local\bonus.exe

c:\windows\SysWow64\frapsvid.dll

c:\windows\SysWow64\pt

c:\windows\SysWow64\pt\AuthFWSnapIn.Resources.dll

c:\windows\SysWow64\pt\AuthFWWizFwk.Resources.dll

c:\windows\SysWow64\w3url.dll

.

(((((((((((((((((((( Bestanden Gemaakt van 2013-04-27 to 2013-05-27 ))))))))))))))))))))))))))))))

.

2013-05-27 13:32 . 2013-05-27 13:32 -------- d-----w- c:\program files (x86)\MPC-HC

2013-05-26 20:29 . 2013-05-26 20:29 -------- d-----w- c:\program files (x86)\Common Files\Java

2013-05-26 20:28 . 2013-05-26 20:27 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-05-26 20:27 . 2013-05-26 20:27 -------- d-----w- c:\program files (x86)\Java

2013-05-26 19:30 . 2013-05-26 19:30 311200 ----a-w- c:\windows\system32\javaws.exe

2013-05-26 19:30 . 2013-05-26 19:30 188832 ----a-w- c:\windows\system32\javaw.exe

2013-05-26 19:30 . 2013-05-26 19:30 188320 ----a-w- c:\windows\system32\java.exe

2013-05-26 19:30 . 2013-05-26 19:30 108448 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll

2013-05-26 17:54 . 2013-05-26 18:06 -------- d-----w- C:\TDSSKiller_Quarantine

2013-05-25 10:14 . 2013-05-25 10:14 -------- d-----w- c:\program files (x86)\FileASSASSIN

2013-05-24 11:42 . 2013-05-24 11:43 -------- d-----w- c:\program files\Microsoft Games

2013-05-24 01:57 . 2013-05-24 01:57 -------- d-----w- c:\program files (x86)\x264 Video Codec

2013-05-19 15:58 . 2013-05-19 16:06 -------- d-----w- c:\users\Hendrik\AppData\Roaming\BSplayer

2013-05-19 15:58 . 2013-05-19 15:58 -------- d-----w- c:\users\Hendrik\AppData\Roaming\BSplayer Pro

2013-05-19 15:58 . 2013-05-19 15:58 -------- d-----w- c:\program files (x86)\Webteh

2013-05-19 15:34 . 2013-05-19 15:34 -------- d-----w- c:\users\Hendrik\AppData\Local\DDMSettings

2013-05-19 15:25 . 2010-07-15 21:28 621056 ------w- c:\windows\SysWow64\MJ14.exe

2013-05-19 15:25 . 2010-07-15 21:28 621056 ------w- c:\windows\system32\MJ14.exe

2013-05-19 15:25 . 2013-05-19 15:25 -------- d-----w- c:\program files (x86)\J River

2013-05-19 15:25 . 2013-05-19 15:25 -------- d-----w- c:\users\Hendrik\AppData\Roaming\J River

2013-05-16 17:50 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll

2013-05-16 17:50 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll

2013-05-16 17:50 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2013-05-16 17:50 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2013-05-16 17:50 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll

2013-05-16 17:50 . 2013-02-27 05:52 14172672 ----a-w- c:\windows\system32\shell32.dll

2013-05-16 17:50 . 2013-02-27 05:52 197120 ----a-w- c:\windows\system32\shdocvw.dll

2013-05-16 17:50 . 2013-02-27 05:48 1930752 ----a-w- c:\windows\system32\authui.dll

2013-05-16 17:50 . 2013-02-27 06:02 111448 ----a-w- c:\windows\system32\consent.exe

2013-05-16 17:50 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\SysWow64\authui.dll

2013-05-16 17:49 . 2013-02-27 05:47 70144 ----a-w- c:\windows\system32\appinfo.dll

2013-05-16 17:48 . 2013-04-10 03:30 3153920 ----a-w- c:\windows\system32\win32k.sys

2013-05-16 17:11 . 2013-04-05 06:50 2647552 ----a-w- c:\windows\system32\iertutil.dll

2013-05-14 22:11 . 2013-05-14 22:11 9195912 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-26 20:27 . 2012-11-11 21:47 866720 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

2013-05-26 20:27 . 2011-04-17 18:53 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll

2013-05-26 19:30 . 2012-09-04 20:46 1092512 ----a-w- c:\windows\system32\npdeployJava1.dll

2013-05-26 19:30 . 2011-05-07 14:06 971680 ----a-w- c:\windows\system32\deployJava1.dll

2013-05-24 02:02 . 2009-07-13 23:19 328704 ----a-w- c:\windows\system32\services.exe

2013-05-24 01:58 . 2013-05-24 01:58 76232 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E782BA2-D9FE-4D25-A0B4-B445F7208D1E}\offreg.dll ERROR(0x00000005)

2013-05-24 01:57 . 2013-05-24 01:57 225280 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Media Tools\MediaIconsOverlays.dll ERROR(0x00000005)

2013-05-21 21:15 . 2013-05-21 21:17 964552 ------w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{41C20D7D-C06E-45AF-BC87-322811CAB5DC}\gapaengine.dll ERROR(0x00000005)

2013-05-18 10:32 . 2011-12-26 12:00 48648 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll ERROR(0x00000005)

2013-05-16 17:35 . 2011-04-12 18:43 75016696 ----a-w- c:\windows\system32\MRT.exe

2013-05-14 22:11 . 2012-04-01 20:46 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-05-14 22:11 . 2011-05-18 17:08 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-05-13 06:37 . 2013-05-23 09:12 9460464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E782BA2-D9FE-4D25-A0B4-B445F7208D1E}\mpengine.dll ERROR(0x00000005)

2013-05-13 06:37 . 2013-05-21 21:15 9460464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll ERROR(0x00000005)

2013-05-09 18:00 . 2010-06-24 09:33 22240 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig600.dll ERROR(0x00000005)

2013-05-02 15:29 . 2011-04-12 08:08 278800 ------w- c:\windows\system32\MpSigStub.exe

2013-04-24 18:16 . 2011-05-21 10:37 905296 ------w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll ERROR(0x00000005)

2013-04-13 05:49 . 2013-05-16 17:50 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49 . 2013-05-16 17:50 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49 . 2013-05-16 17:50 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49 . 2013-05-16 17:50 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45 . 2013-05-16 17:50 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-16 17:50 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

2013-04-12 23:44 . 2013-01-10 00:21 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll

2013-04-12 23:44 . 2013-01-10 00:21 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll

2013-04-12 14:45 . 2013-04-23 19:52 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-03-23 01:09 . 2013-03-23 01:09 354656 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl

2013-03-19 06:04 . 2013-04-10 10:57 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-19 05:46 . 2013-04-10 10:57 43520 ----a-w- c:\windows\system32\csrsrv.dll

2013-03-19 05:04 . 2013-04-10 10:57 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04 . 2013-04-10 10:57 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47 . 2013-04-10 10:57 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll

2013-03-19 03:06 . 2013-04-10 10:57 112640 ----a-w- c:\windows\system32\smss.exe

2013-03-18 12:05 . 2013-03-18 12:05 815320 ----a-w- c:\windows\system32\ncs2dmix.dll

2013-03-18 12:05 . 2013-03-18 12:05 796888 ----a-w- c:\windows\system32\accesor.dll

2013-03-18 11:59 . 2013-03-18 11:59 220888 ----a-w- c:\windows\system32\ncs2instutility.dll

2013-03-18 11:57 . 2013-03-18 11:57 3345112 ----a-w- c:\windows\system32\ncscolib.dll

2013-03-16 13:15 . 2013-03-16 13:15 226304 ----a-w- c:\windows\system32\elshyph.dll

2013-03-16 13:15 . 2013-03-16 13:15 185344 ----a-w- c:\windows\SysWow64\elshyph.dll

2013-03-16 13:15 . 2013-03-16 13:15 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2013-03-16 13:15 . 2013-03-16 13:15 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll

2013-03-16 13:15 . 2013-03-16 13:15 523264 ----a-w- c:\windows\SysWow64\vbscript.dll

2013-03-16 13:15 . 2013-03-16 13:15 158720 ----a-w- c:\windows\SysWow64\msls31.dll

2013-03-16 13:15 . 2013-03-16 13:15 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2013-03-16 13:15 . 2013-03-16 13:15 138752 ----a-w- c:\windows\SysWow64\wextract.exe

2013-03-16 13:15 . 2013-03-16 13:15 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2013-03-16 13:15 . 2013-03-16 13:15 61952 ----a-w- c:\windows\SysWow64\tdc.ocx

2013-03-16 13:15 . 2013-03-16 13:15 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2013-03-16 13:15 . 2013-03-16 13:15 38400 ----a-w- c:\windows\SysWow64\imgutil.dll

2013-03-16 13:15 . 2013-03-16 13:15 361984 ----a-w- c:\windows\SysWow64\html.iec

2013-03-16 13:15 . 2013-03-16 13:15 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2013-03-16 13:15 . 2013-03-16 13:15 12800 ----a-w- c:\windows\SysWow64\mshta.exe

2013-03-16 13:15 . 2013-03-16 13:15 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2013-03-16 13:15 . 2013-03-16 13:15 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll

2013-03-16 13:15 . 2013-03-16 13:15 197120 ----a-w- c:\windows\system32\msrating.dll

2013-03-16 13:15 . 2013-03-16 13:15 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2013-03-16 13:15 . 2013-03-16 13:15 97280 ----a-w- c:\windows\system32\mshtmled.dll

2013-03-16 13:15 . 2013-03-16 13:15 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll

2013-03-16 13:15 . 2013-03-16 13:15 81408 ----a-w- c:\windows\system32\icardie.dll

2013-03-16 13:15 . 2013-03-16 13:15 762368 ----a-w- c:\windows\system32\ieapfltr.dll

2013-03-16 13:15 . 2013-03-16 13:15 599552 ----a-w- c:\windows\system32\vbscript.dll

2013-03-16 13:15 . 2013-03-16 13:15 452096 ----a-w- c:\windows\system32\dxtmsft.dll

2013-03-16 13:15 . 2013-03-16 13:15 441856 ----a-w- c:\windows\system32\html.iec

2013-03-16 13:15 . 2013-03-16 13:15 281600 ----a-w- c:\windows\system32\dxtrans.dll

2013-03-16 13:15 . 2013-03-16 13:15 27648 ----a-w- c:\windows\system32\licmgr10.dll

2013-03-16 13:15 . 2013-03-16 13:15 270848 ----a-w- c:\windows\system32\iedkcs32.dll

2013-03-16 13:15 . 2013-03-16 13:15 247296 ----a-w- c:\windows\system32\webcheck.dll

2013-03-16 13:15 . 2013-03-16 13:15 235008 ----a-w- c:\windows\system32\url.dll

2013-03-16 13:15 . 2013-03-16 13:15 216064 ----a-w- c:\windows\system32\msls31.dll

2013-03-16 13:15 . 2013-03-16 13:15 167424 ----a-w- c:\windows\system32\iexpress.exe

2013-03-16 13:15 . 2013-03-16 13:15 1509376 ----a-w- c:\windows\system32\inetcpl.cpl

2013-03-16 13:15 . 2013-03-16 13:15 144896 ----a-w- c:\windows\system32\wextract.exe

2013-03-16 13:15 . 2013-03-16 13:15 1400416 ----a-w- c:\windows\system32\ieapfltr.dat

2013-03-16 13:15 . 2013-03-16 13:15 102912 ----a-w- c:\windows\system32\inseng.dll

2013-03-16 13:15 . 2013-03-16 13:15 173568 ----a-w- c:\windows\system32\ieUnatt.exe

2013-03-16 13:15 . 2013-03-16 13:15 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2013-03-16 13:15 . 2013-03-16 13:15 77312 ----a-w- c:\windows\system32\tdc.ocx

2013-03-16 13:15 . 2013-03-16 13:15 62976 ----a-w- c:\windows\system32\pngfilt.dll

2013-03-16 13:15 . 2013-03-16 13:15 52224 ----a-w- c:\windows\system32\msfeedsbs.dll

2013-03-16 13:15 . 2013-03-16 13:15 51200 ----a-w- c:\windows\system32\imgutil.dll

2013-03-16 13:15 . 2013-03-16 13:15 48640 ----a-w- c:\windows\system32\mshtmler.dll

2013-03-16 13:15 . 2013-03-16 13:15 149504 ----a-w- c:\windows\system32\occache.dll

2013-03-16 13:15 . 2013-03-16 13:15 13824 ----a-w- c:\windows\system32\mshta.exe

2013-03-16 13:15 . 2013-03-16 13:15 136192 ----a-w- c:\windows\system32\iepeers.dll

2013-03-16 13:15 . 2013-03-16 13:15 135680 ----a-w- c:\windows\system32\IEAdvpack.dll

2013-03-16 13:15 . 2013-03-16 13:15 12800 ----a-w- c:\windows\system32\msfeedssync.exe

2013-03-03 21:51 . 2013-03-03 22:20 258352 ----a-w- c:\windows\SysWow64\unicows.dll

2013-03-01 15:13 . 2013-03-01 15:13 225792 ----a-w- c:\windows\system32\Ncs2Setp.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]

"Ulead AutoDetector v2"="c:\program files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2006-11-29 90112]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-05-10 37960]

"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2013-04-12 295512]

"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-04-15 450560]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-02-13 1263952]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[32W_LCD_TV]"(1920x1080@60Hz)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

2;2 CareMon;CareMon [x]

R1 vfzafaaw;vfzafaaw;c:\windows\system32\drivers\vfzafaaw.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]

R3 cbVSCService11;Cobian Backup 11 Volume Shadow Copy Requester;c:\program files (x86)\Cobian Backup 11\cbVSCService11.exe [2012-06-29 67584]

R3 cpuz134;cpuz134;c:\program files (x86)\CPUID\PC Wizard 2010\pcwiz_x64.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-04-26 2702848]

R3 Media Jukebox 14 Service;Media Jukebox 14 Service;c:\program files (x86)\J River\Media Jukebox 14\JRService.exe [2010-07-15 379400]

R3 NisSrv;NisSrv;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]

R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]

R3 PSMounter;Macrium Reflect Image Explorer Service;c:\windows\system32\drivers\psmounter.sys [2011-07-01 40600]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 rt61x64;Linksys Wireless-G PCI Adapter Driver;c:\windows\system32\DRIVERS\WMP54Gv41x64.sys [x]

R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-09-29 695400]

R3 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2012-07-25 1326176]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]

R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-05-16 156912]

R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\users\Hendrik\AppData\Local\Temp\tmp8F63.tmp [x]

R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-22 61976]

R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys [2011-09-22 311144]

R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-09-22 431464]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-05-24 1840128]

S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [2013-02-23 183048]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2012-07-13 769432]

S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]

S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-06-21 341296]

S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-03-06 39056]

S2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [2011-07-01 301720]

S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2012-07-25 681056]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]

S2 supersafer64;supersafer64;c:\windows\SysWOW64\drivers\supersafer64.sys [2011-11-15 238072]

S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2010-11-11 81008]

S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-11-11 539248]

S3 RTL8192cu;Belkin Wireless Adapter;c:\windows\system32\DRIVERS\rtwlanu.sys [2012-02-01 1041000]

.

--- Andere Services/Drivers In Geheugen ---

.

*NewlyCreated* - NAL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}]

2009-07-14 01:14 126464 ----a-w- c:\windows\System32\advpack.dll

.

Inhoud van de 'Gedeelde Taken' map

.

2013-05-27 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 22:11]

.

2013-05-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-19 21:09]

.

2013-05-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-19 21:09]

.

2013-01-18 c:\windows\Tasks\PC SpeedUp Service Deactivator.job

- c:\program files (x86)\PC Speed Up\PCSUSD.exe [2012-12-31 13:13]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2013-04-16 14:10 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2013-04-16 14:10 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2013-04-16 14:10 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2013-04-16 14:10 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-06-09 11860072]

"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-06-23 1744152]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

FontCache

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>

LSP: d:\vmware workstation\vsocklib.dll

Trusted Zone: dexia.be

Trusted Zone: secunia.com

TCP: DhcpNameServer = 195.130.130.133 195.130.131.133

FF - ProfilePath - c:\users\Hendrik\AppData\Roaming\Mozilla\Firefox\Profiles\opp9rn57.default\

FF - ExtSQL: !HIDDEN! 2011-04-17 14:46; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-Akamai NetSession Interface - c:\users\Hendrik\AppData\Local\Akamai\netsession_win.exe

SafeBoot-28923202.sys

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

WebBrowser-{1392B8D2-5C05-419F-A8F6-B9F15A596612} - (no file)

WebBrowser-{87775FDB-6972-41F9-AE51-8326E38CB206} - (no file)

ShellIconOverlayIdentifiers-{1EC23CFF-4C58-458f-924C-8519AEF61B32} - (no file)

ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)

AddRemove-_{ADDBE07D-95B8-4789-9C76-187FFF9624B4} - c:\program files (x86)\Corel\CorelDRAW Essential Edition 3\Programs\MSILauncher {ADDBE07D-95B8-4789-9C76-187FFF9624B4}

AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\bm_installer.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRing0_1_2_0]

"ImagePath"="\??\c:\users\Hendrik\AppData\Local\Temp\tmp8F63.tmp"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.alb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FotoManager.9.alb"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="MAGIXviewer.eps"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="MAGIXviewer.gif"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="MAGIXviewer.iff"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="MAGIXviewer.pcd"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="MAGIXviewer.png"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="MAGIXviewer.tga"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="MAGIXviewer.tif"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="MAGIXviewer.tiff"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*]

"Licence0"="04F0D21-79D8-7A25-D702-433F"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Spotmau\PowerSuite Golden Edition\PowerSuite 2012\PcCheck\CareMon.exe

c:\program files (x86)\Creative\Shared Files\CTDevSrv.exe

c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE

c:\program files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler.exe

c:\windows\SysWOW64\vmnat.exe

c:\windows\SysWOW64\vmnetdhcp.exe

c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

.

**************************************************************************

.

Voltooingstijd: 2013-05-28 02:08:58 - machine werd herstart

ComboFix-quarantined-files.txt 2013-05-28 00:08

.

Pre-Run: 98.046.431.232 bytes free

Post-Run: 97.470.746.624 bytes free

.

- - End Of File - - 21B48F86C46B2EAA50E2A5CDFDB5F9D1

Hensyr · 28 mei 2013

IE browser geopend en geprobeerd een bestand te downloaden van Bleepingcomputer site, zonder succes.

Bestand wordt vernietigd als zijnde virus bevattend bestand.

zie screenshot:

[ATTACH=CONFIG]26130[/ATTACH]

Nogmaals geprobeerd om Microsoft Security Essentials te starten zonder succes, geen permissie.

zie screenshot:

[ATTACH=CONFIG]26131[/ATTACH]

kweezie wabbit · 29 mei 2013

Download zoek.exe naar het bureaublad.

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe
(hier of hier) kan je lezen hoe je dat doet.
Dubbelklik op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.

c:\windows\sysnative\services.exe;i
services.exe;z
vfzafaaw;s
c:\windows\system32\drivers\vfzafaaw.sys;f

Klik op de knop "Options" en vink nu de onderstaande opties aan.
- Running processes
- Recently Created
- Startup Information
- Installed Programs
- Reset IE proxy
- System Restore Point
- Shortcut Fix
- Reset Hosts
- Auto Clean
[*] Klik daarna op de knop "Run script".

[*] Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).

[*] Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.

[*] Post nu de inhoud van het geopende logje in het volgende bericht.

29 mei 2013 aangepast door Mako
Toevoeging van instructies

Hensyr · 30 mei 2013

Dag kweezie wabbit,

Dit is het resuultaat van zoek.exe:

Zoek.exe Version 4.0.0.2 Updated 28-May-2013

Tool run by Hendrik on do 30/05/2013 at 2:13:33,64.

Microsoft Windows 7 Enterprise N 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

==== System Restore Info ======================

30/05/2013 2:16:29 Zoek.exe System Restore Point Created Succesfully.

==== Running Processes ======================

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Spotmau\PowerSuite Golden Edition\PowerSuite 2012\PcCheck\CareMon.exe

C:\Windows\system32\CISVC.EXE

C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt

C:\Windows\system32\IProsetMonitor.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

C:\Program Files\Macrium\Reflect\ReflectService.exe

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

C:\Program Files (x86)\Secunia\PSI\sua.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe

C:\Windows\SysWOW64\vmnat.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\SysWOW64\vmnetdhcp.exe

C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler64.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe

C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\System32\WUDFHost.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

C:\Program Files (x86)\Nero\Update\NASvc.exe

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Program Files (x86)\ArcSoft\PhotoImpression 6\Monitor.exe

C:\Windows\system32\taskhost.exe

D:\My Desktop\zoek.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\system32\SearchFilterHost.exe

==== Reset Hosts File ======================

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.

127.0.0.1 localhost

::1 localhost

==== Suspicious Entrys Found ======================

SYMLINKS found in C:\Program Files\Windows Defender

SYMLINKS found in C:\Program Files\Microsoft Security Client

==== Possible Rootkit Infection ======================

C:\Windows\installer\{983db01c-a9ea-34b5-c553-35d95962080b}\L

C:\Windows\installer\{983db01c-a9ea-34b5-c553-35d95962080b}\U

==== Symlinks Removed ======================

Reparse point C:\Program Files\Windows Defender\MpAsDesc.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\MpClient.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\MpCmdRun.exe succesfully deleted

Reparse point C:\Program Files\Windows Defender\MpCommu.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\MpEvMsg.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\MpOAV.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\MpRTP.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\MpSvc.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\MSASCui.exe succesfully deleted

Reparse point C:\Program Files\Windows Defender\MsMpCom.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\MsMpLics.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\MsMpRes.dll succesfully deleted

Reparse point C:\Program Files\Windows Defender\ar-SA succesfully deleted

Reparse point C:\Program Files\Windows Defender\bg-BG succesfully deleted

Reparse point C:\Program Files\Windows Defender\cs-CZ succesfully deleted

Reparse point C:\Program Files\Windows Defender\da-DK succesfully deleted

Reparse point C:\Program Files\Windows Defender\de-DE succesfully deleted

Reparse point C:\Program Files\Windows Defender\el-GR succesfully deleted

Reparse point C:\Program Files\Windows Defender\en-US succesfully deleted

Reparse point C:\Program Files\Windows Defender\es-ES succesfully deleted

Reparse point C:\Program Files\Windows Defender\et-EE succesfully deleted

Reparse point C:\Program Files\Windows Defender\fi-FI succesfully deleted

Reparse point C:\Program Files\Windows Defender\fr-FR succesfully deleted

Reparse point C:\Program Files\Windows Defender\he-IL succesfully deleted

Reparse point C:\Program Files\Windows Defender\hr-HR succesfully deleted

Reparse point C:\Program Files\Windows Defender\hu-HU succesfully deleted

Reparse point C:\Program Files\Windows Defender\it-IT succesfully deleted

Reparse point C:\Program Files\Windows Defender\ja-JP succesfully deleted

Reparse point C:\Program Files\Windows Defender\ko-KR succesfully deleted

Reparse point C:\Program Files\Windows Defender\lt-LT succesfully deleted

Reparse point C:\Program Files\Windows Defender\lv-LV succesfully deleted

Reparse point C:\Program Files\Windows Defender\nb-NO succesfully deleted

Reparse point C:\Program Files\Windows Defender\nl-NL succesfully deleted

Reparse point C:\Program Files\Windows Defender\pl-PL succesfully deleted

Reparse point C:\Program Files\Windows Defender\pt-BR succesfully deleted

Reparse point C:\Program Files\Windows Defender\pt-PT succesfully deleted

Reparse point C:\Program Files\Windows Defender\ro-RO succesfully deleted

Reparse point C:\Program Files\Windows Defender\ru-RU succesfully deleted

Reparse point C:\Program Files\Windows Defender\sk-SK succesfully deleted

Reparse point C:\Program Files\Windows Defender\sl-SI succesfully deleted

Reparse point C:\Program Files\Windows Defender\sr-Latn-CS succesfully deleted

Reparse point C:\Program Files\Windows Defender\sv-SE succesfully deleted

Reparse point C:\Program Files\Windows Defender\th-TH succesfully deleted

Reparse point C:\Program Files\Windows Defender\tr-TR succesfully deleted

Reparse point C:\Program Files\Windows Defender\uk-UA succesfully deleted

Reparse point C:\Program Files\Windows Defender\zh-CN succesfully deleted

Reparse point C:\Program Files\Windows Defender\zh-TW succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\DbgHelp.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\EppManifest.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MpAsDesc.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MpClient.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MpCmdRun.exe succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MpCommu.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\mpevmsg.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MpOAv.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MpRTP.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MpSvc.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MSESysprep.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MsMpCom.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MsMpEng.exe succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MsMpLics.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MsMpRes.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\msseces.exe succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\msseoobe.exe succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\msseooberes.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\MsseWat.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\NisIpsPlugin.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\NisLog.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\NisSrv.exe succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\NisWFP.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\Setup.exe succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\SetupRes.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\shellext.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\sqmapi.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\SymSrv.dll succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\SymSrv.yes succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\Antimalware succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\Backup succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\Drivers succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\en-us succesfully deleted

Reparse point C:\Program Files\Microsoft Security Client\nl-nl succesfully deleted

==== Checking Systemdrive for Symlinks ======================

Volume in drive C is System

Volume Serial Number is 7A2B-D9D9

Directory of C:\

14/07/2009 07:08 <JUNCTION> Documents and Settings [C:\Users]

0 File(s) 0 bytes

Directory of C:\ProgramData

14/07/2009 07:08 <JUNCTION> Application Data [C:\ProgramData]

14/07/2009 07:08 <JUNCTION> Desktop [C:\Users\Public\Desktop]

14/07/2009 07:08 <JUNCTION> Documents [C:\Users\Public\Documents]

14/07/2009 07:08 <JUNCTION> Favorites [C:\Users\Public\Favorites]

14/07/2009 07:08 <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]

14/07/2009 07:08 <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]

0 File(s) 0 bytes

Directory of C:\Users

14/07/2009 07:08 <SYMLINKD> All Users [C:\ProgramData]

14/07/2009 07:08 <JUNCTION> Default User [C:\Users\Default]

0 File(s) 0 bytes

Directory of C:\Users\All Users

14/07/2009 07:08 <JUNCTION> Application Data [C:\ProgramData]

14/07/2009 07:08 <JUNCTION> Desktop [C:\Users\Public\Desktop]

14/07/2009 07:08 <JUNCTION> Documents [C:\Users\Public\Documents]

14/07/2009 07:08 <JUNCTION> Favorites [C:\Users\Public\Favorites]

14/07/2009 07:08 <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]

14/07/2009 07:08 <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]

0 File(s) 0 bytes

Directory of C:\Users\Default

14/07/2009 07:08 <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]

14/07/2009 07:08 <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]

14/07/2009 07:08 <JUNCTION> My Documents [C:\Users\Default\Documents]

14/07/2009 07:08 <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]

14/07/2009 07:08 <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]

14/07/2009 07:08 <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]

14/07/2009 07:08 <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]

14/07/2009 07:08 <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]

14/07/2009 07:08 <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]

0 File(s) 0 bytes

Directory of C:\Users\Default\AppData\Local

14/07/2009 07:08 <JUNCTION> Application Data [C:\Users\Default\AppData\Local]

14/07/2009 07:08 <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]

14/07/2009 07:08 <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Default\Documents

14/07/2009 07:08 <JUNCTION> My Music [C:\Users\Default\Music]

14/07/2009 07:08 <JUNCTION> My Pictures [C:\Users\Default\Pictures]

14/07/2009 07:08 <JUNCTION> My Videos [C:\Users\Default\Videos]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Roaming]

12/04/2011 10:00 <JUNCTION> Cookies [C:\Users\Hendrik\AppData\Roaming\Microsoft\Windows\Cookies]

12/04/2011 10:00 <JUNCTION> Local Settings [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> My Documents [C:\Users\Hendrik\Documents]

12/04/2011 10:00 <JUNCTION> NetHood [C:\Users\Hendrik\AppData\Roaming\Microsoft\Windows\Network Shortcuts]

12/04/2011 10:00 <JUNCTION> PrintHood [C:\Users\Hendrik\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]

12/04/2011 10:00 <JUNCTION> Recent [C:\Users\Hendrik\AppData\Roaming\Microsoft\Windows\Recent]

12/04/2011 10:00 <JUNCTION> SendTo [C:\Users\Hendrik\AppData\Roaming\Microsoft\Windows\SendTo]

12/04/2011 10:00 <JUNCTION> Start Menu [C:\Users\Hendrik\AppData\Roaming\Microsoft\Windows\Start Menu]

12/04/2011 10:00 <JUNCTION> Templates [C:\Users\Hendrik\AppData\Roaming\Microsoft\Windows\Templates]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [C:\Users\Hendrik\AppData\Local]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data

12/04/2011 10:00 <JUNCTION> Application Data [.]

12/04/2011 10:00 <JUNCTION> History [C:\Users\Hendrik\AppData\Local\Microsoft\Windows\History]

12/04/2011 10:00 <JUNCTION> Temporary Internet Files [.]

0 File(s) 0 bytes

Directory of C:\Users\Hendrik\AppData\LocalLow

06/03/2013 21:47 <JUNCTION> PlayReady [C:\ProgramData\Microsoft\PlayReady]

0 File(s) 0 bytes

Directory of C:\Users\Public\Documents

14/07/2009 07:08 <JUNCTION> My Music [C:\Users\Public\Music]

14/07/2009 07:08 <JUNCTION> My Pictures [C:\Users\Public\Pictures]

14/07/2009 07:08 <JUNCTION> My Videos [C:\Users\Public\Videos]

0 File(s) 0 bytes

Directory of C:\Users\UpdatusUser

11/07/2011 22:02 <JUNCTION> Application Data [C:\Users\UpdatusUser\AppData\Roaming]

11/07/2011 22:02 <JUNCTION> Cookies [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Cookies]

11/07/2011 22:02 <JUNCTION> Local Settings [C:\Users\UpdatusUser\AppData\Local]

11/07/2011 22:02 <JUNCTION> My Documents [C:\Users\UpdatusUser\Documents]

11/07/2011 22:02 <JUNCTION> NetHood [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Network Shortcuts]

11/07/2011 22:02 <JUNCTION> PrintHood [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]

11/07/2011 22:02 <JUNCTION> Recent [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Recent]

11/07/2011 22:02 <JUNCTION> SendTo [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\SendTo]

11/07/2011 22:02 <JUNCTION> Start Menu [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu]

11/07/2011 22:02 <JUNCTION> Templates [C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Templates]

0 File(s) 0 bytes

Directory of C:\Users\UpdatusUser\AppData\Local

11/07/2011 22:02 <JUNCTION> Application Data [C:\Users\UpdatusUser\AppData\Local]

11/07/2011 22:02 <JUNCTION> History [C:\Users\UpdatusUser\AppData\Local\Microsoft\Windows\History]

11/07/2011 22:02 <JUNCTION> Temporary Internet Files [C:\Users\UpdatusUser\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Users\UpdatusUser\Documents

11/07/2011 22:02 <JUNCTION> My Music [C:\Users\UpdatusUser\Music]

11/07/2011 22:02 <JUNCTION> My Pictures [C:\Users\UpdatusUser\Pictures]

11/07/2011 22:02 <JUNCTION> My Videos [C:\Users\UpdatusUser\Videos]

0 File(s) 0 bytes

Directory of C:\Windows\System32\config\systemprofile

11/07/2011 22:07 <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]

30/05/2013 01:02 <JUNCTION> Cookies [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies]

11/07/2011 22:07 <JUNCTION> Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]

11/07/2011 22:07 <JUNCTION> My Documents [C:\Windows\system32\config\systemprofile\Documents]

11/07/2011 22:07 <JUNCTION> NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]

11/07/2011 22:07 <JUNCTION> PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]

11/07/2011 22:07 <JUNCTION> Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]

11/07/2011 22:07 <JUNCTION> SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]

11/07/2011 22:07 <JUNCTION> Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]

11/07/2011 22:07 <JUNCTION> Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]

0 File(s) 0 bytes

Directory of C:\Windows\System32\config\systemprofile\AppData\Local

11/07/2011 22:07 <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]

11/07/2011 22:07 <JUNCTION> History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]

11/07/2011 22:07 <JUNCTION> Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]

0 File(s) 0 bytes

Directory of C:\Windows\System32\config\systemprofile\Documents

11/07/2011 22:07 <JUNCTION> My Music [C:\Windows\system32\config\systemprofile\Music]

11/07/2011 22:07 <JUNCTION> My Pictures [C:\Windows\system32\config\systemprofile\Pictures]

11/07/2011 22:07 <JUNCTION> My Videos [C:\Windows\system32\config\systemprofile\Videos]

0 File(s) 0 bytes

Directory of C:\Windows\SysWOW64\config\systemprofile