HackTool:Win32/keygen

Obladioblada · 12 augustus 2013

Beste, toen ik google chrome opende zoals altijd merkte ik dat er al vanaf de google search bar een popup kwam , dit was nooit ervoor. Bovenaan het http adres staat links ervan een icoontje , een slotje met een oranje driehoek op. Als ik dat even bekijk staat er iets dat mijn verbinding met google.be gecodeerd is met een 128bit codering , dit had ik ook niet. Ik liet dus mijn Microsoft security essentials een volledige scan doen en die zei me dat er een HackTool:Win32/keygen gevonden was. Deze heb ik dan proberen te verwijderen maar twijfel of dit gelukt is aangezien naast http nog staads dat slotje met driehoek staat en de popup.

Ik heb op het forum een gelijkaardig probleem gevonden ivm HackTool:Win32/keygen en heb dit eens gelezen. Ik heb het programma "hijackthis" en combifix al geinstalleerd. Kunnen jullie me verder helpen?

Vriendelijke groeten

kape · 12 augustus 2013

1. Download HijackThis. (klik er op)

De download start automatisch na 5 seconden.

Bestand HijackThis.msi opslaan. Daarna kiezen voor "uitvoeren".

Hijackthis wordt nu op je PC geïnstalleerd, een snelkoppeling wordt op je bureaublad geplaatst.

Als je geen netwerkverbinding meer hebt, kan je de download doen met een andere PC en het bestand met een USB-stick overbrengen

Als je enkel nog in veilige modus kan werken, moet je de executable (HijackThis.exe) downloaden. Dit kan je HIER doen.

Sla deze op in een nieuwe map op de C schijf (bvb C:\\hijackthis) en start hijackthis dan vanaf deze map. De logjes kan je dan ook in die map terugvinden.

2. Klik op de snelkoppeling om HijackThis te starten. (lees eerst de rode tekst hieronder!)

Klik ofwel op "Do a systemscan and save a logfile", ofwel eerst op "Scan" en dan op "Savelog".

Er opent een kladblokvenster, hou gelijktijdig de CTRL en A-toets ingedrukt, nu is alles geselecteerd. Hou gelijktijdig de CTRL en C-toets ingedrukt, nu is alles gekopieerd. Plak nu het HJT logje in je bericht door CTRL en V-toets.

Krijg je een melding ""For some reason your system denied writing to the Host file ....", klik dan gewoon door op de OK-toets.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\\Program Files\\Trend Micro\\HiJackThis of C:\\Program Files (x86)\\Trend Micro\\HiJackThis. (Bekijk hier de afbeelding ---> Klik hier)

3. Na het plaatsen van je logje wordt dit door een expert nagekeken en hij begeleidt jou verder door het ganse proces.

Tip!

Wil je in woord en beeld weten hoe je een logje met HijackThis maakt en plaatst op het forum, klik dan HIER.

Obladioblada · 13 augustus 2013

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 17:44:00, on 13-8-2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v10.0 (10.00.9200.16635)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

C:\Program Files (x86)\Origin\Origin.exe

C:\Program Files (x86)\Steam\Steam.exe

C:\Program Files (x86)\Yuna Software\Messenger Plus!\PlusService.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\AVG\AVG2013\avgui.exe

C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

C:\Windows\SysWOW64\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Microsoft-account - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [PlusService] C:\Program Files (x86)\Yuna Software\Messenger Plus!\PlusService.exe

O4 - HKLM\..\Run: [THX Audio Control Panel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi MB 2\THXAudioCP\THXAudio.exe" /r

O4 - HKLM\..\Run: [updReg] C:\Windows\UpdReg.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart

O4 - HKCU\..\Run: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

O4 - HKUS\S-1-5-21-2347913990-3140985635-972869033-1002\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')

O4 - HKUS\S-1-5-21-2347913990-3140985635-972869033-1002\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')

O4 - Startup: Logitech . Productregistratie.lnk = C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe

O4 - Global Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: ASGT - Unknown owner - C:\Windows\SysWOW64\ASGT.exe

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe

O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe

O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Intel® Capability Licensing Service Interface - Intel® Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe

O23 - Service: Intel® PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)

O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 9643 bytes

kape · 13 augustus 2013

Ga naar Start - Alle programma's - Bureauaccesoires.

Zoek het icoon van het opdrachtprompt en klik er op met de rechter muisknop en kies dan in het lijstje voor “uitvoeren als administrator” om het opdrachtprompt te openen.

Tik in: sc stop ASGT en druk op Enter.

Tik in: sc delete ASGT en druk op Enter.

Tik in exit en druk Enter.

Als je op een van deze instructies een foutmelding krijgt, ga dan gewoon door met de volgende instructie.

Download AdwCleaner by Xplode naar het bureaublad.

Sluit alle openstaande vensters.
Dubbelklik op AdwCleaner om hem te starten.
Klik vervolgens op Verwijderen.
Klik bij AdwCleaner – Informatie op OK
Klik bij AdwCleaner – Herstarten Noodzakelijk op OK

Dat tijdens de actie de snelkoppelingen verdwijnen, is normaal.

Nadat de PC opnieuw is opgestart, opent een logfile.

Post aansluitend de inhoud van dit log in je volgende bericht.

Obladioblada · 13 augustus 2013

# AdwCleaner v2.306 - Verslag gemaakt op 13/08/2013 om 21:24:13

# Geactualiseerd op 19/07/2013 door Xplode

# Besturingssysteem : Windows 7 Ultimate Service Pack 1 (64 bits)

# Gebruiker : Erik - ERIK-PC

# Opstarten Modus : Normale modus

# Gelanceerd vanaf : C:\Users\Erik\Downloads\adwcleaner (1).exe

# Optie [Verwijderen]

***** [Diensten] *****

***** [Files / Mappen] *****

***** [Register] *****

***** [browsers] *****

-\\ Internet Explorer v10.0.9200.16635

[OK] Het register bevat geen enkele ongeoorloofde invoer.

-\\ Google Chrome v28.0.1500.95

File : C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] De file bevat geen enkele ongeoorloofde invoer.

*************************

AdwCleaner[s1].txt - [1583 octets] - [12/08/2013 19:53:23]

AdwCleaner[s2].txt - [814 octets] - [13/08/2013 21:24:13]

########## EOF - C:\AdwCleaner[s2].txt - [873 octets] ##########

kape · 13 augustus 2013

Download ComboFix van één van de onderstaande locaties naar het bureaublad.

Bleeping Computer

Info Spyware

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met ComboFix.exe

(hier of hier) kan je lezen hoe je de gebruikte beveiligingssoftware kunt uitschakelen.

Dubbelklik op "ComboFix" om de tool te starten, Windows Vista, 7 & 8 gebruikers zullen een melding krijgen van UAC (Gebruikersaccountbeheer), klik hier op Ja / yes.
Op een Windows XP computer zal ComboFix de "Recovery Console" installeren als deze nog niet aanwezig is. (Een actieve internet verbinding is dan een vereiste).
Klik in het venster bij het 'Installeren van de Recovery Console' op "Ok".
Klik in het info scherm op "Ja" als de Recovery Console met succes is geïnstalleerd.
Klik in het scherm van de disclaimer op "I Agree", de benodigde onderdelen worden nu uitgepakt en middels ERUNT wordt er een register back-up gemaakt.
Wanneer dit gereed is zal ComboFix vanzelf starten, in het blauwe scherm ziet u de voortgang van de systeemscan die wordt uitgevoerd.
Belangrijk! gebruik de computer tijdens de scan niet voor andere zaken.
Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden zoals bijvoorbeeld bij de aanwezigheid van een rootkit, dit is normaal.
Wanneer ComboFix gereed is, zal het een logbestand aanmaken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

* Noot !!! Indien u één van de onderstaande meldingen krijgt na het gebruik van ComboFix herstart dan de computer.

Er is geprobeerd een ongeldige bewerking uit te voeren op een registersleutel die is gemarkeerd voor verwijdering.
Illegal operation attempted on a registry key that has been marked for deletion.

Obladioblada · 13 augustus 2013

ComboFix 13-08-13.02 - Erik 13-08-2013 21:36:21.2.12 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.31.1043.18.16326.13582 [GMT 2:00]

Gestart vanuit: c:\users\Erik\Downloads\ComboFix.exe

AV: AVG AntiVirus 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: AVG AntiVirus 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((( Bestanden Gemaakt van 2013-07-13 to 2013-08-13 ))))))))))))))))))))))))))))))

.

2013-08-13 19:39 . 2013-08-13 19:39 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-08-13 19:39 . 2013-08-13 19:39 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-08-13 16:59 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5FEA194D-5967-43B5-880C-A8F41DC3D5CB}\mpengine.dll

2013-08-13 15:39 . 2013-08-13 15:39 388096 ----a-r- c:\users\Erik\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2013-08-13 15:39 . 2013-08-13 15:39 -------- d-----w- c:\program files (x86)\Trend Micro

2013-08-12 16:56 . 2013-08-12 16:56 -------- d-----w- c:\users\Erik\AppData\Roaming\AVG2013

2013-08-12 16:56 . 2013-08-12 16:56 -------- d-----w- c:\users\Erik\AppData\Roaming\TuneUp Software

2013-08-12 16:55 . 2013-08-12 16:56 -------- d-----w- c:\programdata\AVG2013

2013-08-12 16:55 . 2013-08-12 16:55 -------- d-----w- C:\$AVG

2013-08-12 16:55 . 2013-08-12 16:55 -------- d-----w- c:\program files (x86)\AVG

2013-08-12 16:53 . 2013-08-13 19:19 -------- d-----w- c:\programdata\MFAData

2013-08-12 16:53 . 2013-08-12 16:59 -------- d-----w- c:\users\Erik\AppData\Local\Avg2013

2013-08-12 16:53 . 2013-08-12 16:53 -------- d--h--w- c:\programdata\Common Files

2013-08-12 16:53 . 2013-08-12 16:53 -------- d-----w- c:\users\Erik\AppData\Local\MFAData

2013-08-12 15:43 . 2013-08-12 15:43 -------- d-----w- c:\users\Erik\AppData\Local\ElevatedDiagnostics

2013-08-08 12:31 . 2013-08-08 12:31 -------- d-----w- c:\programdata\StarApp

2013-08-08 12:31 . 2013-08-12 17:55 -------- d-----w- c:\program files (x86)\SaveShare

2013-08-08 12:31 . 2013-08-12 17:08 -------- d-----w- c:\programdata\ssavenshare

2013-08-08 12:30 . 2013-08-08 12:33 -------- d-----w- c:\programdata\InstallMate

2013-08-06 21:05 . 2013-08-06 21:05 -------- d-----w- c:\users\Erik\AppData\Roaming\DeadlyBossModsUpdater

2013-08-06 21:05 . 2013-08-06 21:05 -------- d-----w- c:\program files (x86)\Master Games International

2013-08-01 00:39 . 2013-08-01 00:39 -------- d-----w- c:\windows\usb-audio.deTascam

2013-08-01 00:39 . 2011-04-28 19:18 53080 ----a-w- c:\windows\system32\drivers\tscusb2a.sys

2013-08-01 00:39 . 2011-04-28 19:18 31576 ----a-w- c:\windows\system32\drivers\tscusb2m.sys

2013-08-01 00:39 . 2011-04-28 19:18 419160 ----a-w- c:\windows\system32\drivers\tascusb2.sys

2013-08-01 00:39 . 2011-04-28 19:17 205656 ------w- c:\windows\system32\US-122_MKII_US-144_MKII.CPL

2013-07-31 23:46 . 2013-08-01 12:48 -------- d-----w- c:\users\Erik\AppData\Roaming\Audacity

2013-07-31 23:46 . 2013-08-01 00:46 -------- d-----w- c:\program files (x86)\Audacity

2013-07-31 23:46 . 2013-07-31 23:46 -------- d-----w- c:\users\Erik\AppData\Local\Programs

2013-07-27 22:00 . 2013-07-27 22:00 -------- d-----w- c:\users\Erik\AppData\Roaming\net.tw.air.ShrinkOMatic

2013-07-27 22:00 . 2013-07-27 22:00 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR

2013-07-19 23:51 . 2013-07-19 23:51 311608 ----a-w- c:\windows\system32\drivers\avgloga.sys

2013-07-19 23:50 . 2013-07-19 23:50 71480 ----a-w- c:\windows\system32\drivers\avgidsha.sys

2013-07-19 23:50 . 2013-07-19 23:50 246072 ----a-w- c:\windows\system32\drivers\avgidsdrivera.sys

2013-07-19 23:50 . 2013-07-19 23:50 206648 ----a-w- c:\windows\system32\drivers\avgldx64.sys

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-26 13:43 . 2013-07-08 21:25 290184 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr

2013-07-26 13:43 . 2013-07-08 21:10 290184 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

2013-07-25 19:47 . 2013-07-08 21:10 290184 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0

2013-07-12 15:59 . 2013-07-08 21:10 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe

2013-07-11 21:03 . 2013-07-08 21:10 2434856 ----a-w- c:\windows\SysWow64\pbsvc_bc2.exe

2013-07-10 20:25 . 2011-11-18 18:14 78185248 ----a-w- c:\windows\system32\MRT.exe

2013-07-09 23:32 . 2013-07-09 23:32 45880 ----a-w- c:\windows\system32\drivers\avgrkx64.sys

2013-07-03 00:35 . 2013-07-03 00:35 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2013-07-03 00:35 . 2013-07-03 00:35 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll

2013-07-03 00:35 . 2013-07-03 00:35 61952 ----a-w- c:\windows\SysWow64\tdc.ocx

2013-07-03 00:35 . 2013-07-03 00:35 523264 ----a-w- c:\windows\SysWow64\vbscript.dll

2013-07-03 00:35 . 2013-07-03 00:35 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2013-07-03 00:35 . 2013-07-03 00:35 38400 ----a-w- c:\windows\SysWow64\imgutil.dll

2013-07-03 00:35 . 2013-07-03 00:35 361984 ----a-w- c:\windows\SysWow64\html.iec

2013-07-03 00:35 . 2013-07-03 00:35 226304 ----a-w- c:\windows\system32\elshyph.dll

2013-07-03 00:35 . 2013-07-03 00:35 185344 ----a-w- c:\windows\SysWow64\elshyph.dll

2013-07-03 00:35 . 2013-07-03 00:35 158720 ----a-w- c:\windows\SysWow64\msls31.dll

2013-07-03 00:35 . 2013-07-03 00:35 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2013-07-03 00:35 . 2013-07-03 00:35 138752 ----a-w- c:\windows\SysWow64\wextract.exe

2013-07-03 00:35 . 2013-07-03 00:35 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2013-07-03 00:35 . 2013-07-03 00:35 12800 ----a-w- c:\windows\SysWow64\mshta.exe

2013-07-03 00:35 . 2013-07-03 00:35 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2013-07-03 00:35 . 2013-07-03 00:35 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2013-07-03 00:35 . 2013-07-03 00:35 97280 ----a-w- c:\windows\system32\mshtmled.dll

2013-07-03 00:35 . 2013-07-03 00:35 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2013-07-03 00:35 . 2013-07-03 00:35 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll

2013-07-03 00:35 . 2013-07-03 00:35 81408 ----a-w- c:\windows\system32\icardie.dll

2013-07-03 00:35 . 2013-07-03 00:35 77312 ----a-w- c:\windows\system32\tdc.ocx

2013-07-03 00:35 . 2013-07-03 00:35 762368 ----a-w- c:\windows\system32\ieapfltr.dll

2013-07-03 00:35 . 2013-07-03 00:35 62976 ----a-w- c:\windows\system32\pngfilt.dll

2013-07-03 00:35 . 2013-07-03 00:35 599552 ----a-w- c:\windows\system32\vbscript.dll

2013-07-03 00:35 . 2013-07-03 00:35 52224 ----a-w- c:\windows\system32\msfeedsbs.dll

2013-07-03 00:35 . 2013-07-03 00:35 51200 ----a-w- c:\windows\system32\imgutil.dll

2013-07-03 00:35 . 2013-07-03 00:35 48640 ----a-w- c:\windows\system32\mshtmler.dll

2013-07-03 00:35 . 2013-07-03 00:35 452096 ----a-w- c:\windows\system32\dxtmsft.dll

2013-07-03 00:35 . 2013-07-03 00:35 441856 ----a-w- c:\windows\system32\html.iec

2013-07-03 00:35 . 2013-07-03 00:35 281600 ----a-w- c:\windows\system32\dxtrans.dll

2013-07-03 00:35 . 2013-07-03 00:35 27648 ----a-w- c:\windows\system32\licmgr10.dll

2013-07-03 00:35 . 2013-07-03 00:35 270848 ----a-w- c:\windows\system32\iedkcs32.dll

2013-07-03 00:35 . 2013-07-03 00:35 247296 ----a-w- c:\windows\system32\webcheck.dll

2013-07-03 00:35 . 2013-07-03 00:35 235008 ----a-w- c:\windows\system32\url.dll

2013-07-03 00:35 . 2013-07-03 00:35 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll

2013-07-03 00:35 . 2013-07-03 00:35 216064 ----a-w- c:\windows\system32\msls31.dll

2013-07-03 00:35 . 2013-07-03 00:35 197120 ----a-w- c:\windows\system32\msrating.dll

2013-07-03 00:35 . 2013-07-03 00:35 173568 ----a-w- c:\windows\system32\ieUnatt.exe

2013-07-03 00:35 . 2013-07-03 00:35 167424 ----a-w- c:\windows\system32\iexpress.exe

2013-07-03 00:35 . 2013-07-03 00:35 1509376 ----a-w- c:\windows\system32\inetcpl.cpl

2013-07-03 00:35 . 2013-07-03 00:35 149504 ----a-w- c:\windows\system32\occache.dll

2013-07-03 00:35 . 2013-07-03 00:35 144896 ----a-w- c:\windows\system32\wextract.exe

2013-07-03 00:35 . 2013-07-03 00:35 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2013-07-03 00:35 . 2013-07-03 00:35 1400416 ----a-w- c:\windows\system32\ieapfltr.dat

2013-07-03 00:35 . 2013-07-03 00:35 13824 ----a-w- c:\windows\system32\mshta.exe

2013-07-03 00:35 . 2013-07-03 00:35 136192 ----a-w- c:\windows\system32\iepeers.dll

2013-07-03 00:35 . 2013-07-03 00:35 135680 ----a-w- c:\windows\system32\IEAdvpack.dll

2013-07-03 00:35 . 2013-07-03 00:35 12800 ----a-w- c:\windows\system32\msfeedssync.exe

2013-07-03 00:35 . 2013-07-03 00:35 102912 ----a-w- c:\windows\system32\inseng.dll

2013-07-03 00:32 . 2013-07-03 00:32 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2013-07-03 00:32 . 2013-07-03 00:32 465920 ----a-w- c:\windows\system32\WMPhoto.dll

2013-07-03 00:32 . 2013-07-03 00:32 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll

2013-07-03 00:32 . 2013-07-03 00:32 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 3928064 ----a-w- c:\windows\system32\d2d1.dll

2013-07-03 00:32 . 2013-07-03 00:32 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll

2013-07-03 00:32 . 2013-07-03 00:32 363008 ----a-w- c:\windows\system32\dxgi.dll

2013-07-03 00:32 . 2013-07-03 00:32 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 2776576 ----a-w- c:\windows\system32\msmpeg2vdec.dll

2013-07-03 00:32 . 2013-07-03 00:32 2565120 ----a-w- c:\windows\system32\d3d10warp.dll

2013-07-03 00:32 . 2013-07-03 00:32 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 249856 ----a-w- c:\windows\SysWow64\d3d10_1core.dll

2013-07-03 00:32 . 2013-07-03 00:32 2284544 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll

2013-07-03 00:32 . 2013-07-03 00:32 220160 ----a-w- c:\windows\SysWow64\d3d10core.dll

2013-07-03 00:32 . 2013-07-03 00:32 207872 ----a-w- c:\windows\SysWow64\WindowsCodecsExt.dll

2013-07-03 00:32 . 2013-07-03 00:32 1682432 ----a-w- c:\windows\system32\XpsPrint.dll

2013-07-03 00:32 . 2013-07-03 00:32 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll

2013-07-03 00:32 . 2013-07-03 00:32 1175552 ----a-w- c:\windows\system32\FntCache.dll

2013-07-03 00:32 . 2013-07-03 00:32 1158144 ----a-w- c:\windows\SysWow64\XpsPrint.dll

2013-07-03 00:32 . 2013-07-03 00:32 1080832 ----a-w- c:\windows\SysWow64\d3d10.dll

2013-07-03 00:32 . 2013-07-03 00:32 10752 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-07-03 00:32 . 2013-07-03 00:32 604160 ----a-w- c:\windows\SysWow64\d3d10level9.dll

2013-07-03 00:32 . 2013-07-03 00:32 648192 ----a-w- c:\windows\system32\d3d10level9.dll

2013-07-03 00:32 . 2013-07-03 00:32 3419136 ----a-w- c:\windows\SysWow64\d2d1.dll

2013-07-03 00:32 . 2013-07-03 00:32 333312 ----a-w- c:\windows\system32\d3d10_1core.dll

2013-07-03 00:32 . 2013-07-03 00:32 296960 ----a-w- c:\windows\system32\d3d10core.dll

2013-07-03 00:32 . 2013-07-03 00:32 293376 ----a-w- c:\windows\SysWow64\dxgi.dll

2013-07-03 00:32 . 2013-07-03 00:32 245248 ----a-w- c:\windows\system32\WindowsCodecsExt.dll

2013-07-03 00:32 . 2013-07-03 00:32 221184 ----a-w- c:\windows\system32\UIAnimation.dll

2013-07-03 00:32 . 2013-07-03 00:32 1988096 ----a-w- c:\windows\SysWow64\d3d10warp.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

"EADM"="c:\program files (x86)\Origin\Origin.exe" [2013-07-29 3549528]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2013-07-26 1807272]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"PlusService"="c:\program files (x86)\Yuna Software\Messenger Plus!\PlusService.exe" [2011-10-24 801792]

"THX Audio Control Panel"="c:\program files (x86)\Creative\Sound Blaster X-Fi MB 2\THXAudioCP\THXAudio.exe" [2011-08-29 1517056]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]

"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2013-06-30 4411440]

.

c:\users\Erik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Logitech . Productregistratie.lnk - c:\program files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe /remind /language=NLD /_WFM="." [2009-11-16 517384]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2011-9-18 102912]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UacDisableNotify"=dword:00000001

.

R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 gupdate;Google Update-service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]

R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]

R3 IOMap;IOMap;c:\windows\system32\drivers\IOMap64.sys;c:\windows\SYSNATIVE\drivers\IOMap64.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [x]

R3 NVFLASH;NVFLASH;c:\windows\system32\drivers\nvflash.sys;c:\windows\SYSNATIVE\drivers\nvflash.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys;c:\windows\SYSNATIVE\drivers\Synth3dVsc.sys [x]

R3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver;c:\windows\system32\Drivers\tascusb2.sys;c:\windows\SYSNATIVE\Drivers\tascusb2.sys [x]

R3 TASCAM_US144_MK2_MIDI;TASCAM US-144 mk2 WDM MIDI Device;c:\windows\system32\drivers\tscusb2m.sys;c:\windows\SYSNATIVE\drivers\tscusb2m.sys [x]

R3 TASCAM_US144_MK2_WDM;TASCAM US-144 mk2 WDM;c:\windows\system32\drivers\tscusb2a.sys;c:\windows\SYSNATIVE\drivers\tscusb2a.sys [x]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

S0 asahci64;asahci64;c:\windows\system32\DRIVERS\asahci64.sys;c:\windows\SYSNATIVE\DRIVERS\asahci64.sys [x]

S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]

S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]

S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]

S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]

S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]

S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]

S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [x]

S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]

S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]

S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]

S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys;c:\windows\SYSNATIVE\DRIVERS\MpNWMon.sys [x]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-08-01 09:02 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe

.

Inhoud van de 'Gedeelde Taken' map

.

2013-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-01 17:45]

.

2013-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-07-01 17:45]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-08-07 6827664]

"THXCfg64"="c:\windows\system32\THXCfg64.dll" [2011-05-13 26624]

"RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 17920]

"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2013-02-21 2991856]

"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-07-03 1028896]

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.nl

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 195.130.131.4 195.130.130.132

.

- - - - ORPHANS VERWIJDERD - - - -

.

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-2347913990-3140985635-972869033-1000\Software\SecuROM\License information*]

"datasecu"=hex:59,be,77,d1,02,fc,37,9d,ae,19,09,bb,e6,c7,23,95,1d,03,32,2a,bd,

90,0a,ae,c5,8f,bb,6f,23,18,2b,2a,2f,39,c7,f9,71,8a,89,f4,c8,c2,91,a4,1b,83,\

"rkeysecu"=hex:09,47,b7,5a,4c,d4,4f,16,ca,82,12,ac,b3,10,d0,77

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Voltooingstijd: 2013-08-13 21:40:32

ComboFix-quarantined-files.txt 2013-08-13 19:40

ComboFix2.txt 2013-08-12 18:28

.

Pre-Run: 307.823.427.584 bytes beschikbaar

Post-Run: 307.522.027.520 bytes beschikbaar

.

- - End Of File - - F502733301B3A37E621CD84C41DEF3DE

A36C5E4F47E84449FF07ED3517B43A31

kape · 13 augustus 2013

Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.

Schakel alle antivirus- en antispywareprogramma's uit, want deze kunnen namelijk conflicteren met ComboFix.

(hier of hier) kan je lezen hoe je de gebruikte beveiligingssoftware kunt uitschakelen.

Open een nieuw leeg Kladblok scherm, kopieer en plak hierin de volgende code.

 
 Folder::
 c:\programdata\StarApp
 c:\program files (x86)\SaveShare
 c:\programdata\ssavenshare
 c:\programdata\InstallMate

Sla dit op op je Bureaublad als CFScript.txt

Sleep CFScript.txt in ComboFix.exe zoals getoond in onderstaand voorbeeld:

Nu zal ComboFix vanzelf worden gestart.

Start opnieuw op als daarom gevraagd wordt, en post de inhoud van de Combofix.txt in je volgende antwoord.

Obladioblada · 13 augustus 2013

ComboFix 13-08-13.02 - Erik 13-08-2013 22:04:10.3.12 - x64

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.31.1043.18.16326.13357 [GMT 2:00]

Gestart vanuit: c:\users\Erik\Downloads\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Erik\Desktop\CFScript.txt

AV: AVG AntiVirus 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: AVG AntiVirus 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\SaveShare

c:\program files (x86)\SaveShare\uninstall.exe

c:\programdata\InstallMate

c:\programdata\InstallMate\{6E90C1E5-1D1D-485E-AAB5-553FB573E313}\_Setup.dll

c:\programdata\InstallMate\{6E90C1E5-1D1D-485E-AAB5-553FB573E313}\20130808143059.log

c:\programdata\InstallMate\{6E90C1E5-1D1D-485E-AAB5-553FB573E313}\Custom.dll

c:\programdata\InstallMate\{6E90C1E5-1D1D-485E-AAB5-553FB573E313}\Readme.txt

c:\programdata\InstallMate\{6E90C1E5-1D1D-485E-AAB5-553FB573E313}\Setup.dat

c:\programdata\InstallMate\{6E90C1E5-1D1D-485E-AAB5-553FB573E313}\Setup.exe

c:\programdata\InstallMate\{6E90C1E5-1D1D-485E-AAB5-553FB573E313}\Setup.ico

c:\programdata\InstallMate\{6E90C1E5-1D1D-485E-AAB5-553FB573E313}\TsuDll.dll

c:\programdata\ssavenshare

c:\programdata\ssavenshare\1BRy2c.tlb

c:\programdata\ssavenshare\1ct75h.dll

c:\programdata\ssavenshare\settings.ini

c:\programdata\StarApp

.

(((((((((((((((((((( Bestanden Gemaakt van 2013-07-13 to 2013-08-13 ))))))))))))))))))))))))))))))

.

2013-08-13 20:06 . 2013-08-13 20:06 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-08-13 20:06 . 2013-08-13 20:06 -------- d-----w- c:\users\Default\AppData\Local\temp