Ga naar inhoud

Ongewenste internetpagina's (Reclame)

KellyWillems

Door KellyWillems
in Archief Internet & Netwerk

 Delen

Aanbevolen berichten

Jion Grootmeester

Jion

Geplaatst:
Geplaatst:

Dag Kelly,

welkom op PCH!

Download 51a5f5d096dae-icon_RSIT.pngRSIT van de onderstaande locaties en sla deze op het bureaublad op.

Hier staat een beschrijving hoe je kan kijken of je een 32- of 64-bitversie van Windows heeft.

Dubbelklik op RSIT.exe om de tool te starten.


  • Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
  • Vervolgens wordt de "Disclaimer of warranty" getoond, klik vervolgens op "Continue"
  • Wanneer de tool gereed is wordt er een kladblok bestand genaamd "Log" geopend.
  • Plaats de inhoud hiervan in het volgende bericht.

Link naar reactie
Delen op andere sites
KellyWillems Groentje

KellyWillems

Geplaatst:
  • Auteur
Geplaatst:

Logfile of random's system information tool 1.09 (written by random/random)

Run by Kelly Willems at 2013-09-18 17:29:10

Microsoft Windows 7 Home Premium Service Pack 1

System drive C: has 213 GB (72%) free of 295 GB

Total RAM: 3835 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 17:29:12, on 18-9-2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v10.0 (10.00.9200.16686)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

C:\Users\Kelly Willems\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

C:\Program Files\Sony\VAIO Care\listener.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Microsoft Office\Office12\POWERPNT.EXE

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files\trend micro\Kelly Willems.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Funmoods Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=bf2&s={searchTerms}&f=4

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll

O2 - BHO: C:\Program Files (x86)\2YourFace\bho.dll - {1185823F-F22F-4027-80E5-4F68ACD5DE5E} - C:\Program Files (x86)\2YourFace\bho.dll (file missing)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

O2 - BHO: Funmoods Helper Object - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - C:\Program Files (x86)\Funmoods\1.5.23.22\bh\escort.dll (file missing)

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll (file missing)

O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\Datamngr\BROWSE~1.DLL (file missing)

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll (file missing)

O3 - Toolbar: (no name) - !{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - (no file)

O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe

O4 - HKCU\..\Run: [EPLTarget\P0000000000000000] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE /EPT "EPLTarget\P0000000000000000" /M "Epson Stylus SX235"

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

O4 - HKCU\..\Run: [softango Downloader213706.exe] "C:\Users\KELLYW~1\AppData\Local\Temp\Softango Downloader213706.exe" /XML="C:\Users\KELLYW~1\AppData\Local\Temp\DAE3.tmp" /STP=0:1

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Startup: Dropbox.lnk = Kelly Willems\AppData\Roaming\Dropbox\bin\Dropbox.exe

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office15\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: Verzenden naar Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: Verzenden naar &Bluetooth-apparaat... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O20 - AppInit_DLLs: c:\progra~3\browse~1\261040~1.25\{c16c1~1\browse~1.dll

O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Updater Service (IBUpdaterService) - Softango - C:\ProgramData\IBUpdaterService\ibsvc.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe

O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: VAIO Care Performance Service (SampleCollector) - Sony Corporation - C:\Program Files\Sony\VAIO Care\VCPerfService.exe

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: VAIO Media plus Content Importer (SOHCImp) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe

O23 - Service: VAIO Media plus Digital Media Server (SOHDms) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe

O23 - Service: VAIO Media plus Device Searcher (SOHDs) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe

O23 - Service: VAIO Entertainment Common Service (SpfService) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: CamMonitor (uCamMonitor) - ArcSoft, Inc. - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Power Management - Sony Corporation - C:\Program Files\Sony\VAIO Power Management\SPMService.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe

O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe

O23 - Service: VAIO Content Metadata Intelligent Network Service Manager (VcmINSMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe

O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe

O23 - Service: VCService - Sony Corporation - C:\Program Files\Sony\VAIO Care\VCService.exe

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: VSNService - Sony Corporation - C:\Program Files\Sony\VAIO Smart Network\VSNService.exe

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update\VUAgent.exe

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 16349 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

wininit.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

winlogon.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

"c:\Program Files\Microsoft Security Client\MsMpEng.exe"

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

"C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe"

atieclxx

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"

"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"

"C:\Program Files\Bonjour\mDNSResponder.exe"

"C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe"

"C:\ProgramData\IBUpdaterService\ibsvc.exe" /SERVICE

"taskhost.exe"

"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"

"C:\Windows\system32\Dwm.exe"

taskeng.exe {67D227BE-0711-4730-9D2E-2069C8337DC4}

C:\Windows\Explorer.EXE

taskeng.exe {0008D303-49D7-4744-A326-630B0B81A8F2}

"C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe" /AutoStart

"C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe"

"C:\Program Files\Apoint\Apoint.exe"

C:\Windows\system32\svchost.exe -k imgsvc

"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

"C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe"

"C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

"C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe"

"C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe"

"C:\Program Files\Sony\VAIO Smart Network\VSNService.exe"

"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"

"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"

"C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe"

"C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"C:\Program Files (x86)\iTunes\iTunesHelper.exe"

"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

WLIDSvcM.exe 2200

"C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe"

"C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe"

"C:\Users\Kelly Willems\AppData\Roaming\Dropbox\bin\Dropbox.exe" /systemstartup

/Device:000000a0

C:\Windows\SysWOW64\DllHost.exe /Processid:{78FD0120-D39C-45D8-A9BE-2B802B3C23E5}

"C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe"

"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0

"c:\Program Files\Microsoft Security Client\NisSrv.exe"

"C:\Program Files\iPod\bin\iPodService.exe"

C:\Windows\System32\alg.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

"C:\Program Files\Apoint\ApMsgFwd.exe" -s{05FA8492-C047-4207-BE65-780D8591C113}

"C:\Program Files\Apoint\Apvfb.exe"

"Apntex.exe"

\??\C:\Windows\system32\conhost.exe "-188248982394714630-1668157313493245088-845634277203728919363010673-1655223432

"C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE" /n /dde

"C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe" /Stationary

C:\Windows\splwow64.exe 8192

"C:\Program Files\Sony\VAIO Update\VUAgent.exe"

"C:\Program Files\Sony\VAIO Care\VCPerfService.exe" "/service" "/sstates" "/sampleinterval=5000" "/procinterval=5" "/dllinterval=120" "/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1" "/counter=\Network Interface(*)\Bytes Total/sec:1" "/expandcounter=\Processor Information(*)\Processor Frequency:1" "/expandcounter=\Processor(*)\% Idle Time:1" "/expandcounter=\Processor(*)\% C1 Time:1" "/expandcounter=\Processor(*)\% C2 Time:1" "/expandcounter=\Processor(*)\% C3 Time:1" "/expandcounter=\Processor(*)\% Processor Time:1" "/directory=C:\ProgramData\Sony Corporation\VAIO Care\inteldata"

C:\Program Files\Sony\VAIO Care/listener.exe /silent /slot=0

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

"C:\Program Files\Sony\VAIO Care\VCsystray.exe"

"C:\Program Files\Sony\VAIO Care\VCService.exe"

"C:\Program Files\Sony\VAIO Care\VCAgent.exe"

"C:\Windows\system32\wuauclt.exe"

C:\Windows\System32\vds.exe

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" iGoogle

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="4480.0.2025975938\1725535685" --supports-dual-gpus=false --gpu-driver-bug-workarounds=0,9,19 --disable-image-transport-surface --reduce-gpu-sandbox --gpu-vendor-id=0x1002 --gpu-device-id=0x9712 --gpu-driver-vendor="ATI Technologies Inc." --gpu-driver-version=8.712.0.0 --ignored=" --type=renderer " /prefetch:822062411

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtrials="D3D11Experiment/Enabled/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Control11 pct:10a m29stable:r2/NewMenuStyle/Compact2/OmniboxStopTimer/UseStopTimer/Prerender/PrerenderEnabled/PrerenderLocalPredictor/Disabled/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_86/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_13/UMA-Uniformity-Trial-50-Percent/default/" --extension-process --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="4480.2.862971343\241616998" /prefetch:673131151

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtrials="D3D11Experiment/Enabled/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Control11 pct:10a m29stable:r2/NewMenuStyle/Compact2/OmniboxStopTimer/UseStopTimer/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictor/Disabled/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_86/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_13/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="4480.8.1444670651\114559479" /prefetch:673131151

"C:\Program Files (x86)\Microsoft Office\Office12\POWERPNT.EXE" "C:\Users\Kelly Willems\Downloads\accountplan1..ppt"

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=ppapi --channel="4480.13.1025270408\1650015417" --lang=nl --ignored=" --type=renderer " /prefetch:-632637702

C:\Windows\system32\sppsvc.exe

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtrials="D3D11Experiment/Enabled/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Control11 pct:10a m29stable:r2/NewMenuStyle/Compact2/OmniboxStopTimer/UseStopTimer/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictor/Disabled/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_86/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_13/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="4480.17.2007622113\352069917" /prefetch:673131151

C:\Windows\system32\wbem\wmiprvse.exe

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nl --force-fieldtrials="D3D11Experiment/Enabled/ForceCompositingMode/thread/InfiniteCache/No/InstantExtended/Control11 pct:10a m29stable:r2/NewMenuStyle/Compact2/OmniboxStopTimer/UseStopTimer/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictor/Disabled/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_86/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_13/UMA-Uniformity-Trial-50-Percent/default/" --renderer-print-preview --enable-threaded-compositing --disable-html-notifications --channel="4480.20.1231342065\1009039076" /prefetch:673131151

"C:\Windows\system32\NOTEPAD.EXE" C:\rsit\info.txt

C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

"C:\Users\Kelly Willems\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0}]

DataMngr - C:\PROGRA~2\SEARCH~1\Datamngr\x64\BROWSE~1.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}]

MSS+ Identifier - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll [2013-02-05 94112]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}]

2YourFace Addon - C:\Program Files (x86)\2YourFace\bho.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 66280]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}]

DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2011-12-12 194432]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}]

Funmoods Helper Object - C:\Program Files (x86)\Funmoods\1.5.23.22\bh\escort.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-07-14 463272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Aanmeldhulp voor Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}]

Searchqu Toolbar - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0}]

DataMngr - C:\PROGRA~2\SEARCH~1\Datamngr\BROWSE~1.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]

Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-03-02 4296864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-07-14 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

!{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]

{CCC7A320-B3CA-4199-B1A6-9F516DD69829}

{99079a25-328f-4bd4-be04-00955acaa0a7} - Searchqu Toolbar - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll []

!{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-04-07 10134560]

"Apoint"=C:\Program Files\Apoint\Apoint.exe [2010-07-30 226160]

"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2013-01-27 1281512]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"=C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [2012-03-08 4280184]

"MobileDocuments"=C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe []

"EPLTarget\P0000000000000000"=C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE [2012-02-29 283232]

"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-01-08 3674320]

"Softango Downloader213706.exe"=C:\Users\KELLYW~1\AppData\Local\Temp\Softango Downloader213706.exe /XML=C:\Users\KELLYW~1\AppData\Local\Temp\DAE3.tmp /STP=0:1 []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-03-03 98304]

"PMBVolumeWatcher"=C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [2010-01-21 597792]

"DivXUpdate"=C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2011-07-29 1259376]

"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]

"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2012-04-18 421888]

"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2013-01-28 59720]

"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2013-02-20 152392]

"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-03-12 253816]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

McAfee Security Scan Plus.lnk - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

C:\Users\Kelly Willems\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Dropbox.lnk - C:\Users\Kelly Willems\AppData\Roaming\Dropbox\bin\Dropbox.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=5

"ConsentPromptBehaviorUser"=3

"EnableUIADesktopToggle"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoActiveDesktop"=1

"NoActiveDesktopChanges"=1

"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"VIDC.UYVY"=msyuv.dll

"VIDC.YUY2"=msyuv.dll

"VIDC.YVYU"=msyuv.dll

"VIDC.IYUV"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"VIDC.YVU9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

"MSVideo8"=VfWWDM32.dll

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"aux"=wdmaud.drv

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-09-18 17:26:46 ----D---- C:\rsit

2013-09-18 17:26:46 ----D---- C:\Program Files\trend micro

2013-09-11 14:16:40 ----A---- C:\Windows\SYSWOW64\ieui.dll

2013-09-11 14:16:39 ----A---- C:\Windows\system32\ieui.dll

2013-09-11 14:16:38 ----A---- C:\Windows\SYSWOW64\iesetup.dll

2013-09-11 14:16:38 ----A---- C:\Windows\SYSWOW64\iernonce.dll

2013-09-11 14:16:38 ----A---- C:\Windows\system32\iesetup.dll

2013-09-11 14:16:38 ----A---- C:\Windows\system32\iernonce.dll

2013-09-11 14:16:37 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe

2013-09-11 14:16:37 ----A---- C:\Windows\SYSWOW64\iesysprep.dll

2013-09-11 14:16:37 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe

2013-09-11 14:16:37 ----A---- C:\Windows\system32\iesysprep.dll

2013-09-11 14:16:37 ----A---- C:\Windows\system32\ie4uinit.exe

2013-09-11 14:16:36 ----A---- C:\Windows\SYSWOW64\iertutil.dll

2013-09-11 14:16:36 ----A---- C:\Windows\system32\iertutil.dll

2013-09-11 14:16:33 ----A---- C:\Windows\SYSWOW64\msfeeds.dll

2013-09-11 14:16:33 ----A---- C:\Windows\SYSWOW64\jscript.dll

2013-09-11 14:16:33 ----A---- C:\Windows\system32\msfeeds.dll

2013-09-11 14:16:33 ----A---- C:\Windows\system32\jscript.dll

2013-09-11 14:16:31 ----A---- C:\Windows\SYSWOW64\jscript9.dll

2013-09-11 14:16:31 ----A---- C:\Windows\system32\jscript9.dll

2013-09-11 14:16:30 ----A---- C:\Windows\SYSWOW64\urlmon.dll

2013-09-11 14:16:29 ----A---- C:\Windows\system32\urlmon.dll

2013-09-11 14:16:28 ----A---- C:\Windows\SYSWOW64\jsproxy.dll

2013-09-11 14:16:28 ----A---- C:\Windows\system32\jsproxy.dll

2013-09-11 14:16:27 ----A---- C:\Windows\SYSWOW64\wininet.dll

2013-09-11 14:16:26 ----A---- C:\Windows\system32\wininet.dll

2013-09-11 14:16:25 ----A---- C:\Windows\SYSWOW64\ieframe.dll

2013-09-11 14:16:25 ----A---- C:\Windows\system32\ieframe.dll

2013-09-11 14:16:22 ----A---- C:\Windows\system32\mshtml.dll

2013-09-11 14:16:19 ----A---- C:\Windows\SYSWOW64\mshtml.dll

2013-09-11 13:06:24 ----A---- C:\Windows\system32\drivers\ataport.sys

2013-09-11 13:06:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe

2013-09-11 13:06:12 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe

2013-09-11 13:06:12 ----A---- C:\Windows\system32\ntoskrnl.exe

2013-09-11 13:06:11 ----A---- C:\Windows\system32\ntdll.dll

2013-09-11 13:06:10 ----A---- C:\Windows\SYSWOW64\ntdll.dll

2013-09-11 13:06:10 ----A---- C:\Windows\SYSWOW64\kernel32.dll

2013-09-11 13:06:10 ----A---- C:\Windows\system32\wow64.dll

2013-09-11 13:06:10 ----A---- C:\Windows\system32\KernelBase.dll

2013-09-11 13:06:09 ----A---- C:\Windows\SYSWOW64\KernelBase.dll

2013-09-11 13:06:09 ----A---- C:\Windows\system32\winsrv.dll

2013-09-11 13:06:09 ----A---- C:\Windows\system32\smss.exe

2013-09-11 13:06:09 ----A---- C:\Windows\system32\kernel32.dll

2013-09-11 13:06:09 ----A---- C:\Windows\system32\csrsrv.dll

2013-09-11 13:06:09 ----A---- C:\Windows\system32\conhost.exe

2013-09-11 13:06:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2013-09-11 13:06:08 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2013-09-11 13:06:08 ----A---- C:\Windows\SYSWOW64\wow32.dll

2013-09-11 13:06:08 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll

2013-09-11 13:06:08 ----A---- C:\Windows\system32\wow64win.dll

2013-09-11 13:06:08 ----A---- C:\Windows\system32\wow64cpu.dll

2013-09-11 13:06:08 ----A---- C:\Windows\system32\ntvdm64.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2013-09-11 13:06:07 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2013-09-11 13:06:06 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2013-09-11 13:06:05 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll

2013-09-11 13:06:05 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2013-09-11 13:06:05 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2013-09-11 13:06:05 ----A---- C:\Windows\SYSWOW64\user.exe

2013-09-11 13:06:05 ----A---- C:\Windows\SYSWOW64\setup16.exe

2013-09-11 13:06:05 ----A---- C:\Windows\SYSWOW64\instnm.exe

2013-09-11 13:06:05 ----A---- C:\Windows\SYSWOW64\apisetschema.dll

2013-09-11 13:06:05 ----A---- C:\Windows\system32\apisetschema.dll

2013-09-11 13:06:00 ----A---- C:\Windows\system32\win32k.sys

2013-09-11 13:05:51 ----A---- C:\Windows\system32\shell32.dll

2013-09-11 13:05:48 ----A---- C:\Windows\SYSWOW64\shell32.dll

2013-09-11 13:05:47 ----A---- C:\Windows\SYSWOW64\shdocvw.dll

2013-09-11 13:05:47 ----A---- C:\Windows\system32\shdocvw.dll

======List of files/folders modified in the last 1 month======

2013-09-18 17:26:46 ----RD---- C:\Program Files

2013-09-18 17:25:02 ----D---- C:\Windows\Temp

2013-09-18 16:45:24 ----D---- C:\Users\Kelly Willems\AppData\Roaming\Dropbox

2013-09-18 11:28:27 ----D---- C:\Windows\system32\config

2013-09-18 10:43:28 ----SHD---- C:\System Volume Information

2013-09-18 10:37:05 ----D---- C:\Windows\system32\FxsTmp

2013-09-17 17:29:16 ----D---- C:\Windows\rescache

2013-09-14 20:32:47 ----D---- C:\Windows\Microsoft.NET

2013-09-14 20:32:40 ----RSD---- C:\Windows\assembly

2013-09-14 20:26:27 ----SHD---- C:\Windows\Installer

2013-09-14 20:26:26 ----SHD---- C:\Config.Msi

2013-09-14 20:26:26 ----D---- C:\ProgramData\Microsoft Help

2013-09-12 11:20:40 ----D---- C:\Update

2013-09-12 11:19:01 ----D---- C:\Windows\winsxs

2013-09-12 11:15:25 ----D---- C:\Program Files (x86)\Internet Explorer

2013-09-12 11:15:24 ----D---- C:\Windows\SysWOW64

2013-09-12 11:15:24 ----D---- C:\Windows\System32

2013-09-12 11:15:23 ----D---- C:\Program Files\Internet Explorer

2013-09-12 11:15:20 ----D---- C:\Windows\AppPatch

2013-09-12 11:15:18 ----D---- C:\Windows\SYSWOW64\nl-NL

2013-09-12 11:15:18 ----D---- C:\Windows\system32\nl-NL

2013-09-12 11:15:15 ----D---- C:\Windows\system32\DriverStore

2013-09-12 11:15:14 ----D---- C:\Windows\system32\drivers

2013-09-11 14:17:10 ----D---- C:\Windows\system32\catroot2

2013-09-11 14:17:05 ----D---- C:\Windows\system32\catroot

2013-09-11 14:16:17 ----D---- C:\Windows\system32\MRT

2013-09-11 14:12:29 ----A---- C:\Windows\system32\MRT.exe

2013-09-11 13:35:33 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

2013-09-11 12:49:40 ----D---- C:\ProgramData\Sony Corporation

2013-09-08 10:31:06 ----D---- C:\Windows\inf

2013-09-08 10:31:06 ----A---- C:\Windows\system32\PerfStringBackup.INI

2013-09-05 14:17:31 ----RD---- C:\Program Files (x86)

2013-09-05 14:17:31 ----HD---- C:\ProgramData

2013-09-05 13:44:31 ----D---- C:\Windows\Prefetch

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amd_sata;amd_sata; C:\Windows\system32\drivers\amd_sata.sys [2010-07-01 73856]

R0 amd_xata;amd_xata; C:\Windows\system32\drivers\amd_xata.sys [2010-07-01 28800]

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\drivers\AtiPcie.sys [2010-04-07 16440]

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-01-20 230320]

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]

R0 PxHlpa64;PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [2011-11-29 55856]

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-02-04 283200]

R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]

R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atipmdag.sys [2010-04-07 6402560]

R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-04-07 188928]

R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2010-08-26 306296]

R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect; C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968]

R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2010-03-09 1550848]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-04-07 2298400]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-03-22 242720]

R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2010-03-09 231328]

R3 SFEP;Sony Firmware Extension Parser; C:\Windows\system32\drivers\SFEP.sys [2010-03-09 12032]

R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

S3 btwavdt;Bluetooth AVDT; C:\Windows\system32\drivers\btwavdt.sys [2010-03-09 132648]

S3 btwrchid;btwrchid; C:\Windows\system32\drivers\btwrchid.sys [2010-03-09 21160]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2012-02-16 99384]

S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2012-03-08 48488]

S3 netr28ux;Stuurprogramma voor RT2870 USB draadloze LAN-kaart voor Vista; C:\Windows\system32\DRIVERS\netr28ux.sys [2009-06-10 867328]

S3 RimUsb;BlackBerry Smartphone; C:\Windows\System32\Drivers\RimUsb_AMD64.sys []

S3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys [2009-01-09 31744]

S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2009-07-14 11264]

S3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-04-07 346144]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2012-02-16 203320]

S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2012-12-13 54784]

S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

S3 WSDPrintDevice;WSD-ondersteuning voor afdrukken via UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]

S3 WSDScan;Ondersteuning voor WSD-scan via UMB; C:\Windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-12-18 65192]

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-04-07 202752]

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-12-21 57008]

R2 Bonjour Service;Bonjour-service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]

R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2009-09-04 873248]

R2 EpsonBidirectionalService;EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [2006-12-19 94208]

R2 IBUpdaterService;Updater Service; C:\ProgramData\IBUpdaterService\ibsvc.exe [2013-03-11 601848]

R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]

R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-01-27 22056]

R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]

R2 SampleCollector;VAIO Care Performance Service; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [2011-01-29 259192]

R2 uCamMonitor;CamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]

R2 VAIO Event Service;VAIO Event Service; C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe [2010-03-02 217456]

R2 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager; C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-02-19 386416]

R2 VSNService;VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [2010-08-11 845312]

R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 2292096]

R3 iPod Service;iPod-service; C:\Program Files\iPod\bin\iPodService.exe [2013-02-20 641352]

R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]

R3 VCService;VCService; C:\Program Files\Sony\VAIO Care\VCService.exe [2011-02-14 44736]

R3 VUAgent;VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [2013-08-01 1368624]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S2 gupdate;Google Updateservice (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-07 135664]

S2 Roxio Upnp Server 10;Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-11-25 362992]

S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

S3 ACDaemon;ArcSoft Connect Daemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-11 257416]

S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-03-08 1492840]

S3 gupdatem;Google Update-service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-07 135664]

S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-12-07 182768]

S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-02-05 235216]

S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]

S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-11-25 313840]

S3 SOHCImp;VAIO Media plus Content Importer; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-09-10 108400]

S3 SOHDms;VAIO Media plus Digital Media Server; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-10-12 423280]

S3 SOHDs;VAIO Media plus Device Searcher; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-09-10 67952]

S3 SpfService;VAIO Entertainment Common Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-01-20 286936]

S3 VAIO Entertainment TV Device Arbitration Service;VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [2010-09-27 74496]

S3 VAIO Power Management;VAIO Power Management; C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2010-03-25 574320]

S3 VCFw;VAIO Content Folder Watcher; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-01-20 887000]

S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-05-19 549616]

S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface; C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-02-18 99104]

S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-06-06 1255736]

-----------------EOF-----------------

Link naar reactie
Delen op andere sites
Jion Grootmeester

Jion

Geplaatst:
Geplaatst:

Download 51a612a8b27e2-Zoek.pngZoek.zip naar het bureaublad.


  • Wanneer Internet Explorer of een andere browser of virusscanner melding geeft dat dit bestand onveilig zou zijn kun je negeren, dit is namelijk een onterechte waarschuwing.
  • Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe (hier en hier) kan je lezen hoe je dat doet.
  • Klik met de rechtermuisknop op Zoek.zip en klik op de optie "Alles uitpakken".
  • Dubbelklik op Zoek.exe om de tool te starten.
  • Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
  • Kopieer nu onderstaande code en plak die in het grote invulvenster:
  • Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem. 

{A3BC75A2-1F87-4686-AA43-5347D756017C};c
{1185823F-F22F-4027-80E5-4F68ACD5DE5E};c
C:\Program Files (x86)\2YourFace;fs
{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7};c
C:\Program Files (x86)\Funmoods;fs
{99079a25-328f-4bd4-be04-00955acaa0a7};c
C:\PROGRA~2\SEARCH~1;fs
{9D717F81-9148-4f12-8568-69135F087DB0};c
{CCC7A320-B3CA-4199-B1A6-9F516DD69829};c
{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3};c
c:\progra~3\browse~1;fs
IBUpdaterService;s
C:\ProgramData\IBUpdaterService;fs
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run];r
"Softango Downloader213706.exe"=-;r
autoclean;
startupall; 
filesrcm;


  • Klik nu op de knop "Run script".
  • Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
  • Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.
  • Post het geopende logje in het volgende bericht.

Link naar reactie
Delen op andere sites
KellyWillems Groentje

KellyWillems

Geplaatst:
  • Auteur
Geplaatst:

Zoek.exe Version 4.0.0.4 Updated 14-September-2013

Tool run by Kelly Willems on wo 18-09-2013 at 20:07:23,13.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Kelly Willems\Downloads\zoek (1)\zoek.exe [script inserted]

==== System Restore Info ======================

18-9-2013 20:09:20 Zoek.exe System Restore Point Created Succesfully.

==== Creating Sample_18-09-2013_2015.zip ======================

Process chrome.exe killed

Copied file C:\Users\Kelly Willems\AppData\Roaming\BabMaint.exe to sample\BabMaint.exe

sample\BabMaint.exe renamed to CC1A55091FD96BCB624AD791CD15D179

C:\Users\Public\Desktop\sample_18-09-2013_2015.zip created successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1185823F-F22F-4027-80E5-4F68ACD5DE5E} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Internet Explorer\SearchScopes\{52D8AABB-2050-D870-C26E-535CAA81A19C} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IBUpdaterService deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\IBUpdaterService deleted successfully

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Softango Downloader213706.exe"=-

==== Deleting Files \ Folders ======================

"C:\Program Files (x86)\Funmoods" not found

"C:\PROGRA~2\SEARCH~1" not found

"c:\progra~3\browse~1" not found

"C:\ProgramData\12505ec191c2807d1614d8035098f683_c" deleted

"C:\Users\Kelly Willems\AppData\Local\funmoods-speeddial_sf.crx" deleted

"C:\Users\Kelly Willems\AppData\Local\funmoods.crx" deleted

"C:\Windows\SysNative\roboot64.exe" deleted

"C:\Users\Kelly Willems\Downloads\iLividSetupV1 (1).exe" deleted

"C:\Users\Kelly Willems\Downloads\iLividSetupV1 (2).exe" deleted

"C:\Users\Kelly Willems\Downloads\iLividSetupV1 (3).exe" deleted

"C:\Users\Kelly Willems\Downloads\iLividSetupV1 (4).exe" deleted

"C:\Users\Kelly Willems\Downloads\iLividSetupV1.exe" deleted

"C:\Users\Kelly Willems\Downloads\SoftonicDownloader_for_ice-age-2-the-meltdown.exe" deleted

"C:\Users\Kelly Willems\Downloads\SoftonicDownloader_voor_ibm-spss-statistics.exe" deleted

"C:\Users\Kelly Willems\Downloads\SoftonicDownloader_voor_microsoft-word.exe" deleted

"C:\Users\Kelly Willems\Downloads\SoftonicDownloader_voor_spss.exe" deleted

"C:\Users\Kelly Willems\Downloads\firstrowsportapp_setup(36).exe" deleted

"C:\user.js" deleted

"C:\END" deleted

"C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdSrch.xml" deleted

"C:\Users\Kelly Willems\AppData\Roaming\BabMaint.exe" deleted

"C:\Program Files (x86)\2YourFace" deleted

"C:\ProgramData\IBUpdaterService" deleted

"C:\Program Files (x86)\ShoppingReport2" deleted

"C:\Program Files (x86)\iLivid" deleted

"C:\Program Files (x86)\Giant Savings" deleted

"C:\Program Files (x86)\File Scout" deleted

"C:\Users\Kelly Willems\AppData\Roaming\BabSolution" deleted

"C:\Users\Kelly Willems\AppData\Roaming\Babylon" deleted

"C:\Users\Kelly Willems\AppData\Roaming\File Scout" deleted

"C:\Users\Kelly Willems\AppData\Roaming\SpecialSavings" deleted

"C:\Users\Kelly Willems\AppData\Roaming\PerformerSoft" deleted

"C:\ProgramData\APN" deleted

"C:\ProgramData\Partner" deleted

"C:\ProgramData\boost_interprocess" deleted

"C:\ProgramData\IBUpdaterService" deleted

"C:\ProgramData\InstallMate" deleted

"C:\ProgramData\Premium" deleted

"C:\ProgramData\Babylon" deleted

"C:\Users\Kelly Willems\AppData\Local\Ilivid Player" deleted

"C:\Users\Kelly Willems\AppData\Local\Wajam" deleted

"C:\Users\Kelly Willems\AppData\Local\PackageAware" deleted

"C:\Users\Kelly Willems\AppData\LocalLow\ShoppingReport2" deleted

"C:\Users\Kelly Willems\AppData\LocalLow\boost_interprocess" deleted

"C:\Users\Kelly Willems\AppData\LocalLow\BabylonToolbar" deleted

"C:\Users\Kelly Willems\AppData\LocalLow\Funmoods" deleted

"C:\Users\Kelly Willems\AppData\LocalLow\Softonic" deleted

"C:\Users\Kelly Willems\AppData\LocalLow\searchqutoolbar" deleted

"C:\Windows\SysWow64\searchplugins" deleted

"C:\Windows\SysWow64\Extensions" deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\KELLYW~1\AppData\Local\Temp ====

====== Java Cache =====

2013-08-27 19:51:09 86F6D5D0ACE2F3B4BFA90CD845EF50AA 478 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\2642e2c1-5d98625d

2013-08-27 19:56:30 0775F1385947186F0D6B7D1537AFB184 600014 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14\6a7b484e-62d7f187

2013-08-27 19:50:15 98C21C33BE025ED8CEBF7D846465F2AA 48963 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\2fac80d0-472b580d

2013-08-27 19:50:15 0181F5308441CEB2A3B3214B95BB9959 75397 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\5c381390-3c19bf45

2013-08-27 19:51:08 769B6AB82B6318708C3E9F001611A28E 15878 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\4309da12-2eeca869

2013-08-27 19:51:18 7BDD8DB903107A6B16CFAC89D16C026A 25024 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\5849be5a-254a19c7

2013-08-27 19:56:31 76C7B689916C723A2784D327A18209A5 1368 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\758aa09d-3afcf7c0

2013-08-27 19:51:09 408397F57A5BA331AE36046FE1C4407A 503 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\4772dde-14dc6692

2013-08-27 19:51:17 001D2BB4EE09F0C8BEC2D5D9CC116822 2945 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\73665f22-5c5b0e95

2013-08-27 19:51:10 E8AF11339C60D4E7F750BC220AFD178A 474 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\69f85a84-1cc22151

2013-08-27 19:51:18 D297EB8DBEFA7A1E0118084B93A783B3 11293 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\201043e9-22116b75

2013-08-27 19:50:59 3FE332023D6708B8D920A35611861690 898367 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\1e0116f0-2af181e6

2013-08-27 19:51:09 B65187B80C6A91EF1CF656570511C1C5 480 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\47e8c270-74afd3ac

2013-08-27 19:50:08 D07A3A1994C13D097B17D8E7B7A3C1BB 8074 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\558f44f1-4320189c

2013-08-27 19:51:09 F03D9A54657F08CB7ACBA3BD7C5D32F4 497 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\6298e0b5-6c05f583

2013-08-27 19:51:17 B36A7032A40FC13644FC8A2AAE23A0A4 776 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\4d18c6f8-45df131e

2013-08-27 19:51:09 2BB8E88C01BBD975365AF9A128EBEF63 1748 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\6a5353f8-5a0553f8

2013-08-27 19:52:23 842F02FA4D368A7A6E809F8F0A0E565F 47758 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\68d9897b-203c17cf

2013-08-27 19:51:09 7C51C178E92766AE9A7372C918125580 728 ----a-w- C:\Users\Kelly Willems\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\28395249-2242fb10

====== C:\Windows\SysWOW64 =====

2013-09-11 12:16:41 06EEAD5864F357ADC618F65A2F2C5156 2706432 ----a-w- C:\Windows\SysWOW64\mshtml.tlb

2013-09-11 12:16:40 BCA4913CDE903B4BDEEDAD1D6DBF5E2A 391168 ----a-w- C:\Windows\SysWOW64\ieui.dll

2013-09-11 12:16:38 7E540E07B97DCBCF8F76FA743B486BF2 61440 ----a-w- C:\Windows\SysWOW64\iesetup.dll

2013-09-11 12:16:38 000B55B43992179E69C2E83CCB8F1126 33280 ----a-w- C:\Windows\SysWOW64\iernonce.dll

2013-09-11 12:16:37 43852485D0B78C021A47E9548A4CFFE0 71680 ----a-w- C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-09-11 12:16:37 3B74EADF1B70251D3CDB87BC338DC34D 109056 ----a-w- C:\Windows\SysWOW64\iesysprep.dll

2013-09-11 12:16:36 281A720B0A984E325599EE1F0342E8FB 2048000 ----a-w- C:\Windows\SysWOW64\iertutil.dll

2013-09-11 12:16:33 2EC47CF6A36F6A83BB8B98C1425B4D41 493056 ----a-w- C:\Windows\SysWOW64\msfeeds.dll

2013-09-11 12:16:33 00531B52C9468929F2C651B3BCADCBC9 690688 ----a-w- C:\Windows\SysWOW64\jscript.dll

2013-09-11 12:16:31 79DC575FE905D5DD5C5A4C5993A7C7F9 2876928 ----a-w- C:\Windows\SysWOW64\jscript9.dll

2013-09-11 12:16:30 E5D91D6B81A293AB6854CAD112240A4B 1141248 ----a-w- C:\Windows\SysWOW64\urlmon.dll

2013-09-11 12:16:28 7C63629508BB87227C3C861355A155B4 39424 ----a-w- C:\Windows\SysWOW64\jsproxy.dll

2013-09-11 12:16:27 535F6263035F2530A62D5D64EF6E73D3 1767936 ----a-w- C:\Windows\SysWOW64\wininet.dll

2013-09-11 12:16:25 4FCC53B82D91607FB9AE24E617108BB2 13761024 ----a-w- C:\Windows\SysWOW64\ieframe.dll

2013-09-11 12:16:19 5D2D7E7850CE963C2F401D4DEE7BB32A 14332928 ----a-w- C:\Windows\SysWOW64\mshtml.dll

2013-09-11 11:06:13 1A9E4EE88B31750E5CA207424143F99C 3968960 ----a-w- C:\Windows\SysWOW64\ntkrnlpa.exe

2013-09-11 11:06:12 5D0325AEF9DE48330908EC2E2DB0359F 3913664 ----a-w- C:\Windows\SysWOW64\ntoskrnl.exe

2013-09-11 11:06:10 365A5034093AD9E04F433046C4CDF6AB 1114112 ----a-w- C:\Windows\SysWOW64\kernel32.dll

2013-09-11 11:06:10 0184CC60AB10C8124D69AFB332C6AF1C 1292192 ----a-w- C:\Windows\SysWOW64\ntdll.dll

2013-09-11 11:06:09 1B7343C3765638D4D17CB925F84F8ABE 274944 ----a-w- C:\Windows\SysWOW64\KernelBase.dll

2013-09-11 11:06:08 73EF27E157855E3CB18B021BC9622E4C 5120 ----a-w- C:\Windows\SysWOW64\wow32.dll

2013-09-11 11:06:08 57EC6102661E0E1D156C1EC251E7CAF8 14336 ----a-w- C:\Windows\SysWOW64\ntvdm64.dll

2013-09-11 11:06:05 B83592F532FB320F0001F8099ECC192B 7680 ----a-w- C:\Windows\SysWOW64\instnm.exe

2013-09-11 11:06:05 8489D083E46BFD2096A6CECFF6C7C227 2048 ----a-w- C:\Windows\SysWOW64\user.exe

2013-09-11 11:06:05 812A161FC470FA832C3F0CC3D7ACA2F9 6656 ----a-w- C:\Windows\SysWOW64\apisetschema.dll

2013-09-11 11:06:05 3808FD7522646BEB1CCEA94C45D4228C 25600 ----a-w- C:\Windows\SysWOW64\setup16.exe

2013-09-11 11:05:48 E02781D4871844DCD30DF1D69A650F78 12872704 ----a-w- C:\Windows\SysWOW64\shell32.dll

2013-09-11 11:05:47 2C4A87CA8C00E98EFDCFA2E8EC9A3503 180224 ----a-w- C:\Windows\SysWOW64\shdocvw.dll

====== C:\Windows\SysWOW64\drivers =====

====== C:\Windows\Sysnative =====

2013-09-11 12:16:41 B98DDA3209E252884F6F9431A43424B3 2706432 ----a-w- C:\Windows\Sysnative\mshtml.tlb

2013-09-11 12:16:39 C016B4170A836CBA9DF98F02CD055C1B 526336 ----a-w- C:\Windows\Sysnative\ieui.dll

2013-09-11 12:16:38 91573C042B3D9163F29CB1E1E51FF51A 39936 ----a-w- C:\Windows\Sysnative\iernonce.dll

2013-09-11 12:16:38 7248896237039BBC477DBB9C62C37FCB 67072 ----a-w- C:\Windows\Sysnative\iesetup.dll

2013-09-11 12:16:37 73BA149C61D2B164E25E1455D9D7F648 89600 ----a-w- C:\Windows\Sysnative\RegisterIEPKEYs.exe

2013-09-11 12:16:37 390231BA1644AFE0ADD5A7F186EF6FA4 136704 ----a-w- C:\Windows\Sysnative\iesysprep.dll

2013-09-11 12:16:37 3581F49B7B32B4514FFD9481ED8BAE61 51712 ----a-w- C:\Windows\Sysnative\ie4uinit.exe

2013-09-11 12:16:36 8E9898BF21FF4232EE07BD5D1D1C6281 2647040 ----a-w- C:\Windows\Sysnative\iertutil.dll

2013-09-11 12:16:33 DCAE7117A97F5922B853981D6D491D71 603136 ----a-w- C:\Windows\Sysnative\msfeeds.dll

2013-09-11 12:16:33 CF57F63E6878BEA029B1098D03143AED 855552 ----a-w- C:\Windows\Sysnative\jscript.dll

2013-09-11 12:16:31 C6DBD79D39061F189A3F1055D44E1590 3959296 ----a-w- C:\Windows\Sysnative\jscript9.dll

2013-09-11 12:16:29 35552F806607A86E65B6047BF695D34B 1365504 ----a-w- C:\Windows\Sysnative\urlmon.dll

2013-09-11 12:16:28 537394CF1A70BFFB0B3C7510404CF91C 53248 ----a-w- C:\Windows\Sysnative\jsproxy.dll

2013-09-11 12:16:26 AAFA952E774DDDB0956D3BDFAE5B5B99 2241024 ----a-w- C:\Windows\Sysnative\wininet.dll

2013-09-11 12:16:25 08F6335D55310C334B13B9616E61D13D 15404544 ----a-w- C:\Windows\Sysnative\ieframe.dll

2013-09-11 12:16:22 CC4AE7E2ECAEE7612B3C0D3AB302375C 19246592 ----a-w- C:\Windows\Sysnative\mshtml.dll

2013-09-11 11:06:12 63B563F1FC047AB3E21530DBBE773260 5550528 ----a-w- C:\Windows\Sysnative\ntoskrnl.exe

2013-09-11 11:06:11 5B79D52A0388D8DEC5BF68411EA05A02 1732032 ----a-w- C:\Windows\Sysnative\ntdll.dll

2013-09-11 11:06:10 B22C00ED0491FD7B8803D7DDE2849F4C 424448 ----a-w- C:\Windows\Sysnative\KernelBase.dll

2013-09-11 11:06:10 AA913C4E63B6F3F52E20BC9932205BCC 243712 ----a-w- C:\Windows\Sysnative\wow64.dll

2013-09-11 11:06:09 F0970A4BC8395659C22BF53D0FADF16F 112640 ----a-w- C:\Windows\Sysnative\smss.exe

2013-09-11 11:06:09 D8973E71F1B35CD3F3DEA7C12D49D0F0 1161216 ----a-w- C:\Windows\Sysnative\kernel32.dll

2013-09-11 11:06:09 BF95EA5809E3BBF55370F7CB309FEBD0 338432 ----a-w- C:\Windows\Sysnative\conhost.exe

2013-09-11 11:06:09 88EDD0B34EED542745931E581AD21A32 215040 ----a-w- C:\Windows\Sysnative\winsrv.dll

2013-09-11 11:06:09 216BABD555BC550952320EEA89C25DDF 43520 ----a-w- C:\Windows\Sysnative\csrsrv.dll

2013-09-11 11:06:08 9209EA3F29DFC339A87EFD604E035FE4 362496 ----a-w- C:\Windows\Sysnative\wow64win.dll

2013-09-11 11:06:08 659D71E315FB40FFE9AD46CB0588BEB1 13312 ----a-w- C:\Windows\Sysnative\wow64cpu.dll

2013-09-11 11:06:08 49CEA3942A2B99A906EAFC94B853EDBD 16384 ----a-w- C:\Windows\Sysnative\ntvdm64.dll

2013-09-11 11:06:05 70A1D465390C393AA118D9764E065B06 6656 ----a-w- C:\Windows\Sysnative\apisetschema.dll

2013-09-11 11:06:00 42A88ECF903BFE11411D188DCE830E84 3155456 ----a-w- C:\Windows\Sysnative\win32k.sys

2013-09-11 11:05:51 AD662B34B161198B9D66A564EDDA7D43 14172672 ----a-w- C:\Windows\Sysnative\shell32.dll

2013-09-11 11:05:47 23B001185B7C3CB1F4BDEB143E6B45B7 197120 ----a-w- C:\Windows\Sysnative\shdocvw.dll

====== C:\Windows\Sysnative\drivers =====

2013-09-11 11:06:24 059F00DEF82BF41E433B7ED465847726 155584 ----a-w- C:\Windows\Sysnative\drivers\ataport.sys

====== C:\Windows\Tasks ======

====== C:\Windows\Temp ======

======= C:\Program Files =====

2013-09-18 15:26:46 -------- d-----w- C:\Program Files\trend micro

======= C:\Program Files (x86) =====

======= C: =====

====== C:\Users\Kelly Willems\AppData\Roaming ======

2013-09-14 18:14:17 6E2EA5632EB6C18A1F7A65359F4D6369 8388608 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\~FontCache-S-1-5-21-138639859-981195683-154723956-1000.dat

2013-09-14 18:13:44 5735C29725C2738C60315CB0BB057A40 627756 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\~FontCache-System.dat

2013-08-30 10:19:55 -------- d-----w- C:\Users\Kelly Willems\AppData\Local\Albelli Fotoboeken

====== C:\Users\Kelly Willems ======

2013-09-18 15:24:55 662C39FC1E27131551D557862CEC47F0 935175 ----a-w- C:\Users\Kelly Willems\Downloads\RSITx64.exe

2013-08-27 19:56:31 -------- d-----w- C:\Users\Kelly Willems\.jordan

====== C: exe-files ==

2013-09-18 15:26:46 9A2347903D6EDB84C10F288BC0578C1C 388608 ----a-w- C:\Program Files\trend micro\Kelly Willems.exe

2013-09-18 15:24:55 662C39FC1E27131551D557862CEC47F0 935175 ----a-w- C:\Users\Kelly Willems\Downloads\RSITx64.exe

2013-09-15 10:07:23 514FC42D49F76C16CC1839A6B9D3AC05 1611104 ----a-w- C:\Program Files (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\29.0.1547.66\29.0.1547.66_29.0.1547.62_chrome_updater.exe

=== C: other files ==

2013-09-18 18:15:21 7F6E53E831E20B74ACE580BBDA06C156 57606 ----a-w- C:\Users\Public\Desktop\sample_18-09-2013_2015.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background"

"MobileDocuments"="C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe"

"EPLTarget\P0000000000000000"="C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE /EPT EPLTarget\P0000000000000000 /M Epson Stylus SX235"

"DAEMON Tools Lite"="C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe -autorun"

"Softango Downloader213706.exe"="C:\Users\KELLYW~1\AppData\Local\Temp\Softango Downloader213706.exe /XML=C:\Users\KELLYW~1\AppData\Local\Temp\DAE3.tmp /STP=0:1"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun"

"PMBVolumeWatcher"="C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe"

"DivXUpdate"="C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe /CHECKNOW"

"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe -atboottime"

"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe"

"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background"

"MobileDocuments"="C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe"

"EPLTarget\P0000000000000000"="C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE /EPT EPLTarget\P0000000000000000 /M Epson Stylus SX235"

"DAEMON Tools Lite"="C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe -autorun"

"Softango Downloader213706.exe"="C:\Users\KELLYW~1\AppData\Local\Temp\Softango Downloader213706.exe /XML=C:\Users\KELLYW~1\AppData\Local\Temp\DAE3.tmp /STP=0:1"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s"

"MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey"

"Apoint"="%ProgramFiles%\Apoint\Apoint.exe "

==== Startup Folders ======================

2012-10-11 11:10:34 1061 ----a-w- C:\Users\Kelly Willems\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

2010-12-07 04:11:55 834 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk

2012-09-03 12:39:27 2046 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [11-09-2013 13:35]

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [07-12-2010 06:22]

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [07-12-2010 06:22]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

bbjciahceamgodcoidkjpchnokgfpphh - C:\Users\KELLYW~1\AppData\Local\funmoods.crx[]

bfcpnihmbfoaeoakalclfalkdepgiaje - C:\Users\Kelly Willems\AppData\Roaming\SpecialSavings\SpecialSavings.crx[]

cjpglkicenollcignonpgiafdgfeehoj - C:\Users\KELLYW~1\AppData\Local\funmoods-speeddial_sf.crx[]

lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx[02-03-2012 11:53]

lmblfngognklgemafekefcdjcnkdhmdm - C:\Program Files (x86)\2YourFace\2YourFace.crx[]

ndkhncnongaclekkbelchmeafffimifj - C:\Users\Kelly Willems\AppData\Local\Giant Savings\Chrome\Giant Savings.crx[]

nneajnkjbffgblleaoojgaacokifdkhm - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx[12-12-2011 15:13]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions

bbjciahceamgodcoidkjpchnokgfpphh - C:\Users\KELLYW~1\AppData\Local\funmoods.crx[]

cjpglkicenollcignonpgiafdgfeehoj - C:\Users\KELLYW~1\AppData\Local\funmoods-speeddial_sf.crx[]

TelevisionFanatic - Kelly Willems - Default\Extensions\aeabcpaecighknefeclfogpodjmmccki

Funmoods - Kelly Willems - Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh

SpecialSavings - Kelly Willems - Default\Extensions\bfcpnihmbfoaeoakalclfalkdepgiaje

Skype Click to Call - Kelly Willems - Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl

Chrome In-App Payments service - Kelly Willems - Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

==== Chrome Fix ======================

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_excel-2013.nl.softonic.com_0.localstorage deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_excel-2013.nl.softonic.com_0.localstorage-journal deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_microsoft-office-2010.nl.softonic.com_0.localstorage deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_microsoft-office-2010.nl.softonic.com_0.localstorage-journal deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_microsoft-word.nl.softonic.com_0.localstorage deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_microsoft-word.nl.softonic.com_0.localstorage-journal deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_nl.softonic.com_0.localstorage deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_nl.softonic.com_0.localstorage-journal deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pinterest.en.softonic.com_0.localstorage deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pinterest.en.softonic.com_0.localstorage-journal deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_info.claro-search.com_0.localstorage deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_info.claro-search.com_0.localstorage-journal deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage-journal deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfcpnihmbfoaeoakalclfalkdepgiaje deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bfcpnihmbfoaeoakalclfalkdepgiaje_0.localstorage deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bfcpnihmbfoaeoakalclfalkdepgiaje_0.localstorage-journal deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage deleted successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://searchfunmoods.com/?f=1&a=test331&chnl=test331&cd=2XzuyEtN2Y1L1QzuyE0CtD0FyC0E0E0A0CtDyCzzyEyBzz0EtN0D0Tzu0CtByBzytN1L2XzutBtFtCtFtBtFtAtAtC&cr=536942329"

"Backup.Old.Start Page"="http://search.babylon.com/?affID=113480&tt=010712_3&babsrc=HP_ss_cr&mntrId=4c32478e0000000000004c0f6eeac068"

"Search Page"="http://www.google.com"

"Default_Page_URL"="http://www.google.com/ig/redirectdomain?brand=SVED&bmod=EU01"

"Search Bar"="http://www.google.com/ie"

"Default_Search_URL"="http://www.google.com/ie"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

@="http://www.google.com/search?q=%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://start.facemoods.com/?a=bf2&s={searchTerms}&f=4"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://start.facemoods.com/?a=bf2&s={searchTerms}&f=4"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://www.google.com/ie"

"Default_Search_URL"="http://www.google.com/ie"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] not found

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Search Bar"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Start Page"="http://www.google.com"

"Backup.Old.Start Page"="http://www.google.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]

"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"

"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{483830EE-A4CD-4b71-B0A3-3D82E62A6909} Unknown Url="Not_Found"

{4B8C28A7-A9BC-45F8-990D-21499EED643C} QuestScan Url="http://www.questscan.com/?prt=QstscanPB&keywords={searchTerms}"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

{97570EDF-D6BF-463F-BDF2-72A4ABDE49F4} eBay Url="http://rover.ebay.com/rover/1/1346-81661-16445-1/4?sa{searchTerms}"

{AD0AF670-5E27-49A8-B762-0E39B3718E3A} AVG Secure Search Url="http://search.avg.com/route/?d=$instd$&v=$ver$&i=$dchid$&tp=chrome&q={searchTerms}&lng={moz:locale}&iy=&ychte=nl"

{B09AEF6C-9BDC-48B1-9FEF-8BD19A71E9F7} Google Url="http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

{D1C4ED82-CD22-4D0D-A8C1-27C440DA53CD} Zinio Url="http://services.zinio.com/search?s={searchTerms}&rf=sonyslices"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} deleted successfully

HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\bfcpnihmbfoaeoakalclfalkdepgiaje deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\lmblfngognklgemafekefcdjcnkdhmdm deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\ndkhncnongaclekkbelchmeafffimifj deleted successfully

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh deleted successfully

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Kelly Willems\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Kelly Willems\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

C:\Users\Kelly Willems\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

C:\Users\Kelly Willems\AppData\Local\Google\Chrome\User Data\Default\Application Cache\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied

C:\Users\KELLYW~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on wo 18-09-2013 at 20:26:57,10 ======================

Link naar reactie
Delen op andere sites
Jion Grootmeester

Jion

Geplaatst:
Geplaatst:

Je hebt nog een oudere versie van Java staan, naast je nieuwe versie.

Oudere versies hebben lekken die malware de kans geeft om zich te installeren op je systeem.


  • Sluit alle programma's die eventueel open zijn - Zeker je web browser!
  • Ga dan naar Start > Configuratiescherm > Software en verwijder alle oudere versies van Java 6 uit de Softwarelijst.
  • Herstart je pc.

Er is een sample aangemaakt. Zou je dat eens willen uploaden met Mijn Bestand en de link hier plaatsen a.u.b?

Bestand: C:\Users\Public\Desktop\sample_18-09-2013_2015.zip

Start 51a612a8b27e2-Zoek.pngZoek.exe nogmaals met het onderstaande script.

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe

(hier of hier) kan je lezen hoe je dat doet.


  • Dubbelklik op Zoek.exe om de tool te starten.
  • Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
  • Kopieer nu onderstaande code en plak die in het grote invulvenster:
  • Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem. 
     
[HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Run];r
"Softango Downloader213706.exe"=-;r
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run];r
"Softango Downloader213706.exe"=-;r
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4B8C28A7-A9BC-45F8-990D-21499EED643C}];r
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AD0AF670-5E27-49A8-B762-0E39B3718E3A}];r


  • Klik nu op de knop "Run script".
  • Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
  • Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.
  • Post het geopende logje in het volgende bericht.

Link naar reactie
Delen op andere sites
KellyWillems Groentje

KellyWillems

Geplaatst:
  • Auteur
Geplaatst:

Zoek.exe Version 4.0.0.4 Updated 19-September-2013

Tool run by Kelly Willems on do 19-09-2013 at 16:24:26,84.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Kelly Willems\AppData\Local\Temp\Temp1_zoek.zip\zoek.com [script inserted]

==== Older Logs ======================

C:\zoek-results18-09-2013-2026.log 36062 bytes

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-21-138639859-981195683-154723956-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"Softango Downloader213706.exe"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Softango Downloader213706.exe"=-

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4B8C28A7-A9BC-45F8-990D-21499EED643C}]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AD0AF670-5E27-49A8-B762-0E39B3718E3A}]

==== EOF on do 19-09-2013 at 16:25:11,35 ======================

Link naar reactie
Delen op andere sites
Jion Grootmeester

Jion

Geplaatst:
Geplaatst:

1.

Download 5217db3eb6d8b-AdwCleaner3.pngAdwCleaner by Xplode naar je bureaublad.


  • Sluit alle openstaande vensters.
  • Dubbelklik op AdwCleaner om hem te starten.
  • Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren,
  • Door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
  • Klik vervolgens op Scan.
  • Klik vervolgens op Clean als er items zijn gevonden.
  • Klik bij Herstarten Noodzakelijk op OK

Nadat de PC opnieuw is opgestart, opent meestal een logfile.

Anders is het hier terug te vinden C:\AdwCleaner\AdwCleaner[R1].txt.

Post aansluitend de inhoud van dit log in je volgende bericht.

2.

Download 51a46ae42d560-malwarebytes_anti_malware.pngMalwareBytes' Anti-Malware (website) en sla het op je bureaublad op.

Zorg dat er na de installatie een vinkje is geplaatst bij:


  • Update MalwareBytes' Anti-Malware
  • Start MalwareBytes' Anti-Malware
  • Je krijgt hier ook de keuze om de evaluatie versie van MBAM te gebruiken, indien je dit niet wilt vink dit dan uit.

Klik daarna op "Voltooien".

Indien een update gevonden wordt, zal die gedownload en geïnstalleerd worden.


  • Zodra het programma gestart is, ga dan naar het tabblad "Instellingen".
  • Vink hier aan: "Sluit Internet Explorer tijdens verwijdering van malware".
  • Ga daarna naar het tabblad "Scanner", kies hier voor "Snelle Scan".
  • Druk vervolgens op "Scannen" om de scan te starten.
  • Het scannen kan een tijdje duren, dus wees geduldig.
  • Wanneer de scan voltooid is, klik op OK, daarna "Bekijk Resultaten" om de resultaten te zien.
  • Zorg ervoor dat daar alles aangevinkt is, daarna klik op: "Verwijder geselecteerde".
  • Na het verwijderen zal een log openen en zal er gevraagd worden om de computer opnieuw op te starten.
  • Herstart de computer indien nodig en post hierna de log in het volgende bericht.

Wil je die sample ook nog is posten a.u.b? :-)

Link naar reactie
Delen op andere sites
 Delen
Ga naar topic overzicht
Logo

OVER ONS

PC Helpforum helpt GRATIS computergebruikers sinds juli 2006. Ons team geeft via het forum professioneel antwoord op uw vragen en probeert uw pc problemen zo snel mogelijk op te lossen. Word lid vandaag, plaats je vraag online en het PC Helpforum-team helpt u graag verder!

SITEMAP

×
×
  • Nieuwe aanmaken...

Belangrijke informatie

We hebben cookies geplaatst op je toestel om deze website voor jou beter te kunnen maken. Je kunt de cookie instellingen aanpassen, anders gaan we er van uit dat het goed is om verder te gaan.