Malware Trace.Registry.C.O.B.R.A.Toolbar 1.5 (A)

BJHM · 11 juli 2013

Goedenavond.

Sinds kort heb ik malware op mijn computer dat Emsisoft onder de noemer: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A) benoemt.

Ik zou u willen verzoeken mij te willen helpen bij het verwijderen van die malware. Heb geprobeerd deze via Emsisoft te verwijderen

of op zijn minst in quarantaire te plaatsen maar dat lukt slechts zeer gedeeltelijk.

Onderstaand het log van Emsisoft:

Emsisoft Anti-Malware - Versie 8.0

Laatste Update: 11-7-2013 14:22:27

Gebruikersaccount: DELL\Bart

Scaninstellingen:

Scanmodus: Diepe scan

Objecten: Rootkits, Geheugen, Sporen, C:\, E:\, Q:\

Detecteer riskware: Uit

Scan archieven: Aan

ADS Scan: Aan

Bestandsextensiefilter: Uit

Geavanceerde cache: Aan

Directe schijftoegang: Uit

Scan gestart: 11-7-2013 14:22:39

Value: HKEY_CLASSES_ROOT\CLSID\{3C89A618-6472-4B2B-8B5B-C0FE2EA3F236}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{4661410E-A88C-46EE-9FFB-F8DA8ADAAE65}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{58279179-3E20-4DAC-802F-C16C94527553} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{58279179-3E20-4DAC-802F-C16C94527553}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{69A00CC1-6CD6-4C08-A888-C19CF81E8B84}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{85C5B5B0-2140-47BC-AC03-27FE689DD8DE} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{85E24D11-8EC4-4784-9D9D-16285A1D4248} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{85E24D11-8EC4-4784-9D9D-16285A1D4248}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{B7612F6D-C39D-4C69-AC47-815AF35EE6CB} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{B7612F6D-C39D-4C69-AC47-815AF35EE6CB}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{C912024A-C20F-4CB6-9B5B-2DD1268014E2} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{D43DEE33-575E-412E-82DE-B064C7AC7FF8}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_CLASSES_ROOT\CLSID\{E82070F7-4174-4F49-8DCF-C87F8DDF0BAA} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{3C89A618-6472-4B2B-8B5B-C0FE2EA3F236}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{4661410E-A88C-46EE-9FFB-F8DA8ADAAE65}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{58279179-3E20-4DAC-802F-C16C94527553} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{58279179-3E20-4DAC-802F-C16C94527553}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{69A00CC1-6CD6-4C08-A888-C19CF81E8B84}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{85C5B5B0-2140-47BC-AC03-27FE689DD8DE} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{85E24D11-8EC4-4784-9D9D-16285A1D4248} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{85E24D11-8EC4-4784-9D9D-16285A1D4248}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{B7612F6D-C39D-4C69-AC47-815AF35EE6CB} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{B7612F6D-C39D-4C69-AC47-815AF35EE6CB}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{C912024A-C20F-4CB6-9B5B-2DD1268014E2} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{D43DEE33-575E-412E-82DE-B064C7AC7FF8}\INPROCSERVER32 -> THREADINGMODEL Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{E82070F7-4174-4F49-8DCF-C87F8DDF0BAA} -> APPID Ontdekt: Trace.Registry.C.O.B.R.A. Toolbar 1.5 (A)

Gescand 585284

Gevonden 26

Scan geëindigd: 11-7-2013 18:21:52

Scantijd: 3:59:13

Ik hoop van u te mogen vernemen wat iki moet doen bij het verwijderen. Bij voorbaat dank.

Vriendelijke groet

BJHM

kape · 11 juli 2013

Download MalwareBytes' Anti-Malware (website) en sla het op je bureaublad op.

Zorg dat er na de installatie een vinkje is geplaatst bij:

Update MalwareBytes' Anti-Malware
Start MalwareBytes' Anti-Malware
Je krijgt hier ook de keuze om de evaluatie versie van MBAM te gebruiken, indien je dit niet wilt vink dit dan uit.

Klik daarna op "Voltooien".

Indien een update gevonden wordt, zal die gedownload en geïnstalleerd worden.

Bij problemen!!! (Lees de onderstaande instructies)

Zodra het programma gestart is, ga dan naar het tabblad "Instellingen".
Vink hier aan: "Sluit Internet Explorer tijdens verwijdering van malware".
Ga daarna naar het tabblad "Scanner", kies hier voor "Snelle Scan".
Druk vervolgens op "Scannen" om de scan te starten.
Het scannen kan een tijdje duren, dus wees geduldig.
Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.
Zorg ervoor dat daar alles aangevinkt is, daarna klik op: "Verwijder geselecteerde".
Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten.
Herstart de computer indien nodig en post hierna de log in het volgende bericht.

BJHM · 11 juli 2013

Goedenavond Kape.

Dank voor de instructies. Heb MBAM gedraaid, deze detecteerde geen malware,

Onderstaand het log:

Malwarebytes Anti-Malware 1.75.0.1300

Malwarebytes : Free anti-malware download

Databaseversie: v2013.07.11.05

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16635

Bart :: DELL [administrator]

11-7-2013 20:36:52

mbam-log-2013-07-11 (20-36-52).txt

Scan type: Snelle scan

Uitgeschakelde scan opties: P2P

Objecten gescand: 246628

Verstreken tijd: 10 minuut/minuten, 4 seconde(n)

Geheugenprocessen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registersleutels gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registerwaarden gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Registerdata gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Mappen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Bestanden gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

(einde)

Vriendelijke groet

BJHM

kape · 11 juli 2013

Vreemd dat Emsisoft dit aangeeft en Malwarebytes niet. We zoeken even verder:

Download ComboFix van één van de onderstaande locaties naar het bureaublad.

Bleeping Computer

Info Spyware

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met ComboFix.exe

(hier of hier) kan je lezen hoe je de gebruikte beveiligingssoftware kunt uitschakelen.

Dubbelklik op "ComboFix" om de tool te starten, Windows Vista, 7 & 8 gebruikers zullen een melding krijgen van UAC (Gebruikersaccountbeheer), klik hier op Ja / yes.
Op een Windows XP computer zal ComboFix de "Recovery Console" installeren als deze nog niet aanwezig is. (Een actieve internet verbinding is dan een vereiste).
Klik in het venster bij het 'Installeren van de Recovery Console' op "Ok".
Klik in het info scherm op "Ja" als de Recovery Console met succes is geïnstalleerd.
Klik in het scherm van de disclaimer op "I Agree", de benodigde onderdelen worden nu uitgepakt en middels ERUNT wordt er een register back-up gemaakt.
Wanneer dit gereed is zal ComboFix vanzelf starten, in het blauwe scherm ziet u de voortgang van de systeemscan die wordt uitgevoerd.
Belangrijk! gebruik de computer tijdens de scan niet voor andere zaken.
Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden zoals bijvoorbeeld bij de aanwezigheid van een rootkit, dit is normaal.
Wanneer ComboFix gereed is, zal het een logbestand aanmaken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

* Noot !!! Indien u één van de onderstaande meldingen krijgt na het gebruik van ComboFix herstart dan de computer.

Er is geprobeerd een ongeldige bewerking uit te voeren op een registersleutel die is gemarkeerd voor verwijdering.
Illegal operation attempted on a registry key that has been marked for deletion.

BJHM · 11 juli 2013

Hallo Kape. ComboFix gedraaid, onderstaand het log: (Mag ik aannemen dat ik de uitschakeling van de diverse antivirus- en antispywareprogramma's weer ongedaan

kan maken?):

ComboFix 13-07-11.03 - Bart 11-07-2013 21:33:41.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.4056.1907 [GMT 2:00]

Gestart vanuit: c:\users\Bart\Downloads\ComboFix.exe

AV: AVG Internet Security 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

FW: AVG Internet Security 2013 *Enabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

SP: AVG Internet Security 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Install.exe

c:\programdata\LoJackNotifier.txt

c:\users\Bart\javahelper.exe

c:\windows\SysWow64\muzapp.exe

c:\windows\SysWow64\System32\MASetupCleaner.exe

c:\windows\SysWow64\System32\muzapp.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_BCMWLTRY.EXE pid: 1992 578: c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE

-------\Service_conhost.exe pid: 1968 24: c:\windows\System32\nl-NL\conhost.exe.mui

-------\Service_conhost.exe pid: 6660 24: c:\windows\System32\nl-NL\conhost.exe.mui

-------\Service_Handle v3.42

-------\Service_lsm.exe pid: 872 250: c:\windows\System32\nl-NL\lsm.exe.mui

-------\Service_MsMpEng.exe pid: 1052 36C: c:\program files\Microsoft Security Client\MpCmdRun.exe

-------\Service_MsMpEng.exe pid: 1052 39C: c:\program files\Microsoft Security Client\NisSrv.exe

-------\Service_rundll32.exe pid: 2784 30: c:\windows\System32\nl-NL\rundll32.exe.mui

-------\Service_rundll32.exe pid: 2800 30: c:\windows\System32\nl-NL\rundll32.exe.mui

-------\Service_rundll32.exe pid: 2824 58: c:\windows\SysWOW64\nl-NL\rundll32.exe.mui

-------\Service_SftService.exe pid: 4208 A4: c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE.20130711130416_1.log

-------\Service_STService.exe pid: 4736 F4: c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\STSERVICE.EXE.20130711130419_1.log

-------\Service_Sysinternals - Windows Sysinternals: Documentation, downloads and additional resources

-------\Service_wlanext.exe pid: 1960 44: c:\windows\System32\nl-NL\wlanext.exe.mui

-------\Service_wmpnetwk.exe pid: 6200 3C: c:\program files\Windows Media Player\nl-NL\wmpnetwk.exe.mui

.

(((((((((((((((((((( Bestanden Gemaakt van 2013-06-11 to 2013-07-11 ))))))))))))))))))))))))))))))

.

2013-07-11 19:48 . 2013-07-11 19:52 -------- d-----w- c:\users\NeroMediaHomeUser.4\AppData\Local\temp

2013-07-11 19:48 . 2013-07-11 19:48 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-07-11 11:00 . 2003-12-12 11:16 266240 ------w- c:\windows\Dit.DLL

2013-07-11 11:00 . 2003-07-11 08:31 61440 ----a-w- c:\windows\DitExp.exe

2013-07-11 10:07 . 2013-06-11 23:25 15404032 ----a-w- c:\windows\system32\ieframe.dll

2013-07-11 10:07 . 2013-06-11 23:25 19238912 ----a-w- c:\windows\system32\mshtml.dll

2013-07-11 09:50 . 2013-05-27 05:50 1011712 ----a-w- c:\program files\Windows Defender\MpSvc.dll

2013-07-11 09:50 . 2013-05-27 05:50 571904 ----a-w- c:\program files\Windows Defender\MpClient.dll

2013-07-11 09:50 . 2013-05-27 05:50 314880 ----a-w- c:\program files\Windows Defender\MpCommu.dll

2013-07-11 09:50 . 2013-05-27 04:57 392704 ----a-w- c:\program files (x86)\Windows Defender\MpClient.dll

2013-07-11 09:50 . 2013-05-27 04:57 4608 ----a-w- c:\program files (x86)\Windows Defender\MsMpLics.dll

2013-07-11 09:50 . 2013-05-27 04:57 54784 ----a-w- c:\program files (x86)\Windows Defender\MpOAV.dll

2013-07-11 09:50 . 2013-05-27 03:15 9216 ----a-w- c:\program files (x86)\Windows Defender\MpAsDesc.dll

2013-07-11 09:49 . 2013-05-06 06:03 1887744 ----a-w- c:\windows\system32\WMVDECOD.DLL

2013-07-11 09:49 . 2013-05-06 04:56 1620480 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL

2013-07-11 09:49 . 2013-06-04 06:00 624128 ----a-w- c:\windows\system32\qedit.dll

2013-07-11 09:49 . 2013-06-04 04:53 509440 ----a-w- c:\windows\SysWow64\qedit.dll

2013-07-11 09:49 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll

2013-07-11 09:49 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll

2013-07-11 09:49 . 2013-06-05 03:34 3153920 ----a-w- c:\windows\system32\win32k.sys

2013-07-11 09:49 . 2013-04-10 05:48 1732608 ----a-w- c:\program files\Windows Journal\NBDoc.DLL

2013-07-11 09:49 . 2013-04-10 05:46 1393152 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll

2013-07-11 09:49 . 2013-04-10 05:46 1367040 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll

2013-07-11 09:49 . 2013-04-10 05:46 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll

2013-07-11 09:49 . 2013-04-10 05:03 936448 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll

2013-06-28 09:51 . 2013-06-30 15:28 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird

2013-06-24 17:00 . 2012-08-23 09:31 35192 ----a-w- c:\windows\system32\TURegOpt.exe

2013-06-24 17:00 . 2012-08-23 09:31 26488 ----a-w- c:\windows\system32\authuitu.dll

2013-06-24 17:00 . 2012-08-23 09:31 21880 ----a-w- c:\windows\SysWow64\authuitu.dll

2013-06-24 16:58 . 2013-06-24 17:00 -------- d-----w- c:\programdata\AVG

2013-06-24 16:57 . 2013-06-24 16:57 -------- d-sh--w- c:\programdata\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}

2013-06-13 17:11 . 2013-06-13 17:11 -------- d-----w- c:\program files\iPod

2013-06-13 17:11 . 2013-06-13 17:12 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-06-13 17:11 . 2013-06-13 17:12 -------- d-----w- c:\program files\iTunes

2013-06-13 17:11 . 2013-06-13 17:12 -------- d-----w- c:\program files (x86)\iTunes

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll

2013-06-13 17:04 . 2013-06-13 17:04 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin.dll

2013-06-13 17:03 . 2013-06-13 17:04 -------- d-----w- c:\program files (x86)\QuickTime

2013-06-12 17:51 . 2013-03-31 22:52 1887232 ----a-w- c:\windows\system32\d3d11.dll

2013-06-12 17:51 . 2013-04-25 23:30 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-11 12:12 . 2013-07-11 12:12 76232 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8121BFCF-AA66-42C3-9AAF-78695A5C6A53}\offreg.dll

2013-07-11 10:10 . 2010-07-09 19:09 78185248 ----a-w- c:\windows\system32\MRT.exe

2013-07-11 08:38 . 2012-03-30 19:41 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-07-11 08:38 . 2011-05-21 11:11 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-06-21 14:47 . 2013-06-21 14:48 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5CE04BD2-86DA-48EE-8BAD-2ABCAEB8AA70}\gapaengine.dll

2013-06-18 14:14 . 2012-10-09 10:31 236688 ----a-w- c:\windows\system32\drivers\RapportKE64.sys

2013-06-12 03:08 . 2013-07-11 12:08 9552976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8121BFCF-AA66-42C3-9AAF-78695A5C6A53}\mpengine.dll

2013-06-12 03:08 . 2013-07-11 10:48 9552976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-05-23 06:13 . 2012-10-06 05:48 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2013-05-11 16:51 . 2012-07-12 12:59 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-05-02 15:29 . 2011-02-15 17:15 278800 ------w- c:\windows\system32\MpSigStub.exe

2013-05-01 01:59 . 2013-05-01 01:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx

2013-05-01 01:59 . 2013-05-01 01:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts

2013-04-30 12:26 . 2013-04-30 12:26 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-04-30 12:26 . 2012-06-13 20:23 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2013-04-30 12:26 . 2010-07-04 10:05 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll

2013-04-30 12:19 . 2013-04-30 12:19 108448 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll

2013-04-30 12:19 . 2013-04-30 12:20 311200 ----a-w- c:\windows\system32\javaws.exe

2013-04-30 12:19 . 2013-04-30 12:19 188832 ----a-w- c:\windows\system32\javaw.exe

2013-04-30 12:19 . 2013-04-30 12:19 188320 ----a-w- c:\windows\system32\java.exe

2013-04-30 12:19 . 2012-10-24 11:00 1092512 ----a-w- c:\windows\system32\npdeployJava1.dll

2013-04-30 12:19 . 2010-07-04 10:06 971680 ----a-w- c:\windows\system32\deployJava1.dll

2013-04-13 05:49 . 2013-05-16 13:18 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49 . 2013-05-16 13:18 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49 . 2013-05-16 13:18 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49 . 2013-05-16 13:18 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45 . 2013-05-16 13:18 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-16 13:18 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Nero MediaHome 4"="c:\program files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe" [2009-06-23 4891944]

"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-12-20 844296]

"Spotify Web Helper"="c:\users\Bart\Desktop\Toepassingen\Data\SpotifyWebHelper.exe" [2013-05-12 1105408]

"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2012-12-20 1476104]

"KiesAirMessage"="c:\program files (x86)\Samsung\Kies\KiesAirMessage.exe" [2012-12-18 578560]

"Spotify"="c:\users\Bart\Desktop\Toepassingen\Spotify.exe" [2013-05-12 4573184]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2010-02-09 1807680]

"KMCONFIG"="c:\program files (x86)\Silvercrest OM1008 driver\StartAutorun.exe" [2008-05-29 212992]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]

"SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2012-08-21 105120]

"EMET Notifier"="c:\program files (x86)\EMET\EMET_notifier.exe" [2012-05-09 152152]

"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2013-04-28 4408368]

"Memeo Instant Backup"="c:\program files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe" [2012-04-14 131072]

"Memeo AutoSync"="c:\program files (x86)\Memeo\AutoSync\MemeoLauncher2.exe" [2011-05-04 144608]

"Seagate Dashboard"="c:\program files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe" [2011-06-01 79112]

"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-12-20 310280]

"emsisoft anti-malware"="c:\program files (x86)\Emsisoft Anti-Malware\a2guard.exe" [2013-07-11 2928040]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-10-12 559616]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]

NDAS Geräte-Manager.lnk - c:\program files\NDAS\System\ndasmgmt.exe /startup [2010-1-13 389608]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-12-16 1324384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"EnableShellExecuteHooks"= 1 (0x1)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{1869181A-9F50-4FCF-8BFF-1B8588ECB85C}"= "c:\program files\CallingID\CallingIDLinkAdvisor2.0\x86\LinkAdvisor\CIDLinkAdvisor.dll" [2013-06-26 3684888]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rpcnet]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"ArcSoft Connection Service"=c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x]

R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [x]

R3 BTCOM;Bluetooth Serial port driver;c:\windows\system32\DRIVERS\btcomport.sys;c:\windows\SYSNATIVE\DRIVERS\btcomport.sys [x]

R3 BTCOMBUS;Bluetooth Serial Port Bus Service;c:\windows\system32\Drivers\btcombus.sys;c:\windows\SYSNATIVE\Drivers\btcombus.sys [x]

R3 BthAvrcp;Bluetooth AVRCP-profiel;c:\windows\system32\DRIVERS\BthAvrcp.sys;c:\windows\SYSNATIVE\DRIVERS\BthAvrcp.sys [x]

R3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\Drivers\btnetBus.sys;c:\windows\SYSNATIVE\Drivers\btnetBus.sys [x]

R3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]

R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]

R3 e.dentifier2;SmartCard Reader ABN AMRO e.dentifier2;c:\windows\system32\DRIVERS\aabed2.sys;c:\windows\SYSNATIVE\DRIVERS\aabed2.sys [x]

R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]

R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]

R3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys;c:\windows\SYSNATIVE\Drivers\IvtBtBus.sys [x]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Netwerkinspectie;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]

R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]

S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]

S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]

S0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\Drivers\BtHidBus.sys;c:\windows\SYSNATIVE\Drivers\BtHidBus.sys [x]

S0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys;c:\windows\SYSNATIVE\drivers\eubakup.sys [x]

S0 EUBKMON;EUBKMON;c:\windows\system32\drivers\EUBKMON.sys;c:\windows\SYSNATIVE\drivers\EUBKMON.sys [x]

S0 EUFS;EUFS;c:\windows\system32\drivers\eufs.sys;c:\windows\SYSNATIVE\drivers\eufs.sys [x]

S0 ndasfs;ndasfs;c:\windows\system32\DRIVERS\ndasfs.sys;c:\windows\SYSNATIVE\DRIVERS\ndasfs.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys;c:\windows\SYSNATIVE\Drivers\RapportKE64.sys [x]

S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [x]

S1 archlp;archlp;SysWOW64\drivers\archlp.sys;SysWOW64\drivers\archlp.sys [x]

S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6a.sys;c:\windows\SYSNATIVE\DRIVERS\avgfwd6a.sys [x]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]

S1 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys;c:\windows\SYSNATIVE\drivers\eudskacs.sys [x]

S1 ndasfat;NDAS FAT File System Service;c:\windows\system32\DRIVERS\ndasfat.sys;c:\windows\SYSNATIVE\DRIVERS\ndasfat.sys [x]

S1 ndasrofs;NDAS ROFS File System Service;c:\windows\system32\DRIVERS\ndasrofs.sys;c:\windows\SYSNATIVE\DRIVERS\ndasrofs.sys [x]

S1 RapportCerberus_51755;RapportCerberus_51755;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_51755.sys;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_51755.sys [x]

S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [x]

S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [x]

S2 a2AntiMalware;Emsisoft Anti-Malware 7.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_7f58c91b65c73836\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_7f58c91b65c73836\AESTSr64.exe [x]

S2 avgfws;AVG Firewall;c:\program files (x86)\AVG\AVG2013\avgfws.exe;c:\program files (x86)\AVG\AVG2013\avgfws.exe [x]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [x]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [x]

S2 CIDLinkAdvisorService;CIDLinkAdvisorService;c:\program files\CallingID\CallingIDLinkAdvisor2.0\x86\LinkAdvisor\CIDLinkAdvisorService.exe;c:\program files\CallingID\CallingIDLinkAdvisor2.0\x86\LinkAdvisor\CIDLinkAdvisorService.exe [x]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe;c:\program files\Dell\DellDock\DockLogin.exe [x]

S2 EASEUS Agent;EASEUS Agent;c:\program files (x86)\EASEUS\Todo Backup\bin\Agent.exe;c:\program files (x86)\EASEUS\Todo Backup\bin\Agent.exe [x]

S2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files (x86)\Silvercrest OM1008 driver\KMWDSrv.exe;c:\program files (x86)\Silvercrest OM1008 driver\KMWDSrv.exe [x]

S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\siteadvisor\mcsacore.exe;c:\progra~2\mcafee\siteadvisor\mcsacore.exe [x]

S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [x]

S2 NitroReaderDriverReadSpool;NitroPDFReaderDriverCreatorReadSpool;c:\program files\Common Files\Nitro PDF\Reader\1.0\NitroPDFReaderDriverServicex64.exe;c:\program files\Common Files\Nitro PDF\Reader\1.0\NitroPDFReaderDriverServicex64.exe [x]

S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [x]

S2 RapportMgmtService;Rapport Management Service;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [x]

S2 SeagateDashboardService;Seagate Dashboard Service;c:\program files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe;c:\program files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe [x]

S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]

S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]

S2 TuneUp.UtilitiesSvc;AVG PC TuneUp Service;c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe;c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [x]

S3 EUDISK;EASEUS Disk Enumerator;c:\windows\system32\drivers\eudisk.sys;c:\windows\SYSNATIVE\drivers\eudisk.sys [x]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [x]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]

.

--- Andere Services/Drivers In Geheugen ---

.

*NewlyCreated* - WS2IFSL

.

Inhoud van de 'Gedeelde Taken' map

.

2013-07-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 08:38]

.

2013-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-11 17:40]

.

2013-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-11 17:40]

.

2013-07-11 c:\windows\Tasks\RMAutoUpdate.job

- c:\program files (x86)\Registry Mechanic\SULauncher.exe [2012-11-08 13:44]

.

2013-07-11 c:\windows\Tasks\RMSchedule.job

- c:\program files (x86)\Registry Mechanic\RegMech.exe [2012-11-08 13:43]

.

2013-01-29 c:\windows\Tasks\ROC_REG_JAN_DELETE.job

- c:\programdata\AVG January 2013 Campaign\ROC.exe [2013-01-28 21:16]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-04-06 384296]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-02-25 487424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-02-21 365592]

"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-02-21 165912]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-02-21 387608]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]

"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 2184520]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{1869181A-9F50-4FCF-8BFF-1B8588ECB85C}"= "c:\program files\CallingID\CallingIDLinkAdvisor2.0\LinkAdvisor\CIDLinkAdvisor.dll" [2013-06-26 4332056]

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.upc.nl/live

uDefault_Search_URL = hxxp://www.google.com/ie

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Free YouTube Download - c:\users\Bart\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm

IE: Free YouTube to Mp3 Converter - c:\users\Bart\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm

TCP: DhcpNameServer = 62.179.104.196 213.46.228.196

FF - ProfilePath - c:\users\Bart\AppData\Roaming\Mozilla\Firefox\Profiles\zuc5ciyr.default-1371095820922\

FF - prefs.js: browser.startup.homepage - UPC Live - UPC Nederland

FF - ExtSQL: 2013-06-13 05:46; {4ED1F68A-5463-4931-9384-8FFF5ED91D92}; c:\program files (x86)\McAfee\SiteAdvisor

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKLM-Run-AVG_TRAY - (no file)

SafeBoot-CleanHlp

SafeBoot-CleanHlp.sys

SafeBoot-SolutoService

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BCMLogon]

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BCMWLTRY.EXE pid: 1992 578: C:]

--

"ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\conhost.exe pid: 1968 24: C:]

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\conhost.exe pid: 6660 24: C:]

--

"ImagePath"="\SystemRoot\system32\DRIVERS\lsi_scsi.sys"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lsm.exe pid: 872 250: C:]

--

"ImagePath"="system32\drivers\MSKSSRV.sys"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsMpEng.exe pid: 1052 36C: C:]

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsMpEng.exe pid: 1052 39C: C:]

--

"ImagePath"="System32\Drivers\RtsUStor.sys"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rundll32.exe pid: 2784 30: C:]

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rundll32.exe pid: 2800 30: C:]

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rundll32.exe pid: 2824 58: C:]

--

"ImagePath"="\"c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE\""

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SftService.exe pid: 4208 A4: C:]

--

"ServiceDll"="%SystemRoot%\System32\wiaservc.dll"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\STService.exe pid: 4736 F4: C:]

--

"ImagePath"="system32\DRIVERS\WinUsb.sys"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wlanext.exe pid: 1960 44: C:]

--

"ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wmpnetwk.exe pid: 6200 3C: C:]

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE

c:\windows\SysWOW64\rundll32.exe

c:\program files (x86)\Nero\Nero MediaHome 4\NMMediaServerService.exe

c:\program files (x86)\Dell DataSafe Local Backup\TOASTER.EXE

c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

c:\program files (x86)\Trusteer\Rapport\bin\RapportService.exe

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

.

**************************************************************************

.

Voltooingstijd: 2013-07-11 22:05:31 - machine werd herstart

ComboFix-quarantined-files.txt 2013-07-11 20:05

.

Pre-Run: 91.588.640.768 bytes beschikbaar

Post-Run: 90.807.947.264 bytes beschikbaar

.

- - End Of File - - 920F2B4A151A131B501C7EE4E0FD5524

D41D8CD98F00B204E9800998ECF8427E

Vriendelijke groet

BJHM

kape · 11 juli 2013

Combofix mag je verwijderen. Dat doe je best zo:

Verwijder Combofix: Start -> Uitvoeren/Zoekopdracht/Programma’s en bestanden zoeken en typ daar: ComboFix /Uninstall (met spatie voor de /).

Dit zal Combofix verwijderen + gerelateerde mappen en bestanden, herstelt de klokinstellingen opnieuw, verbergt de bestandsextensies, gaat verborgen bestanden en systeembestanden terug verbergen en maakt een nieuw herstelpunt.

Indien aanwezig mag je de map C:\Qoobox manueel verwijderen.

Antivirus en antispyware mag je terug inschakelen ... en laat dan Emsisoft eens opnieuw scannen.

BJHM · 11 juli 2013

Hallo Kape.

Dank voor de info. Heb Emsisoft gedraaid en gezien dat de 26 bedreigingen (met gemiddeld risico) nog worden gedetecteerd. Onderstaand het log:

Emsisoft Anti-Malware - Versie 8.0

Laatste Update: 11-7-2013 22:50:52

Gebruikersaccount: DELL\Bart

Scaninstellingen:

Scanmodus: Snelle scan

Objecten: Rootkits, Geheugen, Sporen

Detecteer riskware: Uit

Scan archieven: Uit

ADS Scan: Aan

Bestandsextensiefilter: Uit

Geavanceerde cache: Aan

Directe schijftoegang: Uit

Scan gestart: 11-7-2013 22:51:05