qones

sb56 · 2 november 2013

Goedendag

ik heb last van de startpagina Qones

krijg het niet weg

hierbij maar gelijk mijn logbestand

Logfile of random's system information tool 1.09 (written by random/random)

Run by SipB at 2013-11-02 15:27:30

Microsoft Windows 7 Home Premium Service Pack 1

System drive C: has 45 GB (43%) free of 103 GB

Total RAM: 4095 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 15:27:36, on 2-11-2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v10.0 (10.00.9200.16720)

Boot mode: Normal

Running processes:

C:\Users\SipB\AppData\Roaming\ACEStream\engine\ace_engine.exe

C:\Program Files (x86)\WinTV\Ir.exe

C:\Windows\SysWOW64\C2MP\UpdateChecker.exe

C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe

C:\Program Files (x86)\WinTV\WinTV7\WinTVTray.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

C:\Users\SipB\AppData\Roaming\ACEStream\updater\ace_update.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

C:\Program Files\trend micro\SipB.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Home Page}

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Supporters - Home - Feyenoord

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Start.qone8.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Make sure all words are spelled correctly=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Make sure all words are spelled correctly=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Make sure all words are spelled correctly=

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Start.qone8.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = Home Page}

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Home Page}

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = Make sure all words are spelled correctly=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll

O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll

O2 - BHO: Movies Toolbar (Dist. by Somoto Ltd.) - {3444c3c5-6c56-4a16-a453-832b05bf6ea4} - C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll

O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll

O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Microsoft-account - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office15\URLREDIR.DLL

O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~2\Office15\GROOVEEX.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll

O3 - Toolbar: Movies Toolbar (Dist. by Somoto Ltd.) - {3444c3c5-6c56-4a16-a453-832b05bf6ea4} - C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll

O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)

O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

O4 - HKLM\..\Run: [PowerDVD13Agent] "C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot

O4 - HKLM\..\Run: [Registry Helper] "C:\Program Files (x86)\Registry Helper\RegistryHelper.Exe" /boot

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [AceStream] C:\Users\SipB\AppData\Roaming\ACEStream\engine\ace_engine.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Global Startup: AutoStart IR.lnk = C:\Program Files (x86)\WinTV\Ir.exe

O4 - Global Startup: CodecPackUpdateChecker.lnk = C:\Windows\SysWOW64\C2MP\UpdateChecker.exe

O4 - Global Startup: WinTV Recording Status.lnk = C:\Program Files (x86)\WinTV\WinTV7\WinTVTray.exe

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll

O9 - Extra button: Lync - klikken om te bellen - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll

O9 - Extra 'Tools' menuitem: Lync - klikken om te bellen - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll

O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O17 - HKLM\System\CCS\Services\Tcpip\..\{441DC796-CCC6-4DA0-B6FF-5B592A99D2BB}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{441DC796-CCC6-4DA0-B6FF-5B592A99D2BB}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

O17 - HKLM\System\CS2\Services\Tcpip\..\{441DC796-CCC6-4DA0-B6FF-5B592A99D2BB}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL

O20 - AppInit_DLLs: c:\progra~2\movies~1\safety~1\safety~2.dll c:\progra~3\wincert\win32c~1.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: CyberLink PowerDVD 13 Media Server Monitor Service - CyberLink - C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe

O23 - Service: CyberLink PowerDVD 13 Media Server Service - CyberLink - C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\Program Files (x86)\WinTV\TVServer\HauppaugeTVServer.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: MBAMScheduler - Unknown owner - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (file missing)

O23 - Service: MBAMService - Unknown owner - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe

O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Service KMSELDI - Unknown owner - C:\Program Files\KMSpico\Service_KMS.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 13855 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

wininit.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

winlogon.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

atieclxx

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"

"taskhost.exe"

"C:\Windows\system32\Dwm.exe"

"C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe"

C:\Windows\Explorer.EXE

"C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe"

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

"C:\Program Files (x86)\WinTV\TVServer\HauppaugeTVServer.exe"

"C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\diMaster.dll" /prefetch:1

"C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe"

"C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe"

"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"

"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"

"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun

"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe"

"C:\Users\SipB\AppData\Roaming\ACEStream\engine\ace_engine.exe"

"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe"

C:\Windows\system32\wbem\wmiprvse.exe

WLIDSvcM.exe 2544

"C:\Program Files (x86)\WinTV\Ir.exe" /QUIET

"C:\Windows\SysWOW64\C2MP\UpdateChecker.exe"

"C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe" /c /a /s UserSession

"C:\Program Files (x86)\WinTV\WinTV7\WinTVTray.exe"

"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow

"C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

"C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot

"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0

C:\Windows\system32\wbem\unsecapp.exe -Embedding

"C:\Program Files (x86)\WinTV\TVServer\CaptureGenUSB.exe" -Embedding

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-5860c160-45a6-4364-86b1-c2defb9dd0b0 -SystemEventPortName:HostProcess-1b791ffa-6984-4597-97b6-e760eb0cdbb1 -IoCancelEventPortName:HostProcess-009c07b4-145e-4f9f-9d45-a7f63ae8ac5c -NonStateChangingEventPortName:HostProcess-012ac0b9-38e8-4397-b357-727e7dfe8e9a -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:ea39bace-b8d9-47a3-8dcb-010763acfc0d -DeviceGroupId:WpdFsGroup

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Users\SipB\AppData\Roaming\ACEStream\engine\..\updater\ace_update.exe

"C:\Program Files\Internet Explorer\iexplore.exe" Start.qone8.com

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7160 CREDAT:209921 /prefetch:2

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7160 CREDAT:734230 /prefetch:2

"C:\Users\SipB\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TU4PB9Z\RSITx64.exe"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

C:\Windows\tasks\AmiUpdXp.job

C:\Windows\tasks\Dealply.job

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]

Lync Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2013-07-10 205472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office15\URLREDIR.DLL [2013-09-13 878296]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]

RealNetworks Download and Record Plugin for Internet Explorer - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14 542376]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]

Lync Browser Helper - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01 139368]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3444c3c5-6c56-4a16-a453-832b05bf6ea4}]

Movies Toolbar (Dist. by Somoto Ltd.) - C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll [2013-08-19 92560]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

Norton Identity Protection - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll [2013-05-30 509776]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]

Norton Vulnerability Protection - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL [2012-08-10 387040]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-10-08 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Aanmeldhulp voor Microsoft-account - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office15\URLREDIR.DLL [2013-09-13 705240]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]

Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~2\Office15\GROOVEEX.DLL [2013-09-13 1724616]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-10-08 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{ae07101b-46d4-4a98-af68-0333ea26e113}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]

{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll [2013-05-30 509776]

{3444c3c5-6c56-4a16-a453-832b05bf6ea4} - Movies Toolbar (Dist. by Somoto Ltd.) - C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll [2013-08-19 92560]

{ae07101b-46d4-4a98-af68-0333ea26e113}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"NVRaidService"=C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe [2010-04-09 291944]

"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-08-12 7940128]

"Skytel"=C:\Program Files\Realtek\Audio\HDA\Skytel.exe [2011-08-12 1833504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]

"AceStream"=C:\Users\SipB\AppData\Roaming\ACEStream\engine\ace_engine.exe [2013-09-26 27904]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-11-16 641704]

"AMD AVT"=Cmd.exe /c start AMD Accelerated Video Transcoding device initialization /min C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe aml []

"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

"NUSB3MON"=C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2010-01-22 106496]

"PowerDVD13Agent"=C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe [2013-03-20 513048]

"TkBellExe"=C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [2013-10-20 295512]

"Registry Helper"=C:\Program Files (x86)\Registry Helper\RegistryHelper.Exe /boot []

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

AutoStart IR.lnk - C:\Program Files (x86)\WinTV\Ir.exe

CodecPackUpdateChecker.lnk - C:\Windows\SysWOW64\C2MP\UpdateChecker.exe

WinTV Recording Status.lnk - C:\Program Files (x86)\WinTV\WinTV7\WinTVTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"="C:\PROGRA~3\Wincert\WIN64C~1.DLL C:\PROGRA~2\MOVIES~1\SAFETY~1\x64\SAFETY~2.DLL "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=0

"ConsentPromptBehaviorUser"=3

"EnableLUA"=0

"EnableUIADesktopToggle"=0

"PromptOnSecureDesktop"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoActiveDesktop"=1

"NoActiveDesktopChanges"=1

"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"VIDC.UYVY"=msyuv.dll

"VIDC.YUY2"=msyuv.dll

"VIDC.YVYU"=msyuv.dll

"VIDC.IYUV"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"VIDC.YVU9"=tsbyuv.dll

"msacm.l3acm"=l3codeca.acm

"wave2"=wdmaud.drv

"midi2"=wdmaud.drv

"mixer2"=wdmaud.drv

"aux2"=wdmaud.drv

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"aux"=wdmaud.drv

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"VIDC.LAGS"=lagarith.dll

"VIDC.FFDS"=ff_vfw.dll

"msacm.l3codecp"=l3codecp.acm

"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-11-02 15:27:30 ----D---- C:\rsit

2013-11-02 15:27:30 ----D---- C:\Program Files\trend micro

2013-10-30 16:31:51 ----D---- C:\Windows\Minidump

2013-10-27 12:22:56 ----D---- C:\sh4ldr

2013-10-27 12:22:56 ----D---- C:\Program Files (x86)\Enigma Software Group

2013-10-27 12:22:36 ----D---- C:\Windows\9E897D0FF80441A3966C7BB6EB5B6BE8.TMP

2013-10-27 12:03:14 ----D---- C:\Users\SipB\AppData\Roaming\Malwarebytes

2013-10-27 12:03:06 ----D---- C:\ProgramData\Malwarebytes

2013-10-27 11:30:28 ----D---- C:\Users\SipB\AppData\Roaming\ParetoLogic

2013-10-27 11:30:28 ----D---- C:\Users\SipB\AppData\Roaming\DriverCure

2013-10-27 11:30:22 ----D---- C:\ProgramData\ParetoLogic

2013-10-27 11:17:39 ----D---- C:\Windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP

2013-10-27 10:57:28 ----A---- C:\autoexec.bat

2013-10-27 10:57:12 ----D---- C:\Program Files\Enigma Software Group

2013-10-27 10:56:51 ----D---- C:\Windows\037F8C0EE8E1408FABB4FC4ABF947E1B.TMP

2013-10-26 15:58:57 ----D---- C:\Program Files (x86)\AmiExt

2013-10-26 15:58:56 ----D---- C:\ProgramData\Registry Helper

2013-10-26 15:58:21 ----D---- C:\ProgramData\eSafe

2013-10-26 15:58:02 ----D---- C:\Program Files (x86)\DealPly

2013-10-26 15:25:36 ----D---- C:\Users\SipB\AppData\Roaming\SeeSimilar02

2013-10-26 15:23:11 ----D---- C:\Program Files (x86)\Video Performer

2013-10-22 09:07:24 ----D---- C:\Program Files (x86)\FuzeZip

2013-10-22 09:03:50 ----D---- C:\ProgramData\Package Cache

2013-10-22 09:03:19 ----D---- C:\ProgramData\Hauppauge

2013-10-22 09:01:39 ----D---- C:\Hauppauge

2013-10-21 18:15:56 ----A---- C:\Windows\SYSWOW64\unicows.dll

2013-10-20 11:40:39 ----D---- C:\Windows\SYSWOW64\C2MP

2013-10-20 11:23:20 ----D---- C:\Users\SipB\AppData\Roaming\RealNetworks

2013-10-20 11:22:58 ----D---- C:\Program Files (x86)\RealNetworks

2013-10-20 11:22:55 ----D---- C:\ProgramData\RealNetworks

2013-10-20 11:22:49 ----A---- C:\Windows\SYSWOW64\rmoc3260.dll

2013-10-20 11:22:47 ----A---- C:\Windows\SYSWOW64\pndx5032.dll

2013-10-20 11:22:47 ----A---- C:\Windows\SYSWOW64\pndx5016.dll

2013-10-20 11:22:46 ----A---- C:\Windows\SYSWOW64\pncrt.dll

2013-10-20 11:22:44 ----D---- C:\Program Files (x86)\Real

2013-10-20 11:22:32 ----D---- C:\Users\SipB\AppData\Roaming\Real

2013-10-20 11:22:11 ----D---- C:\ProgramData\Real

2013-10-16 09:07:00 ----H---- C:\Users\SipB\AppData\Roaming\EASEUS Data Recovery Wizard Professional v5 [CRACKED + SERIAL].exe

2013-10-15 20:59:30 ----D---- C:\ProgramData\APN

2013-10-15 20:56:59 ----D---- C:\Program Files (x86)\TornTV.com

2013-10-13 19:22:51 ----D---- C:\Users\SipB\AppData\Roaming\Media Player Classic

2013-10-13 09:15:54 ----D---- C:\Program Files (x86)\MyPC Backup

2013-10-13 09:15:19 ----D---- C:\Users\SipB\AppData\Roaming\PerformerSoft

2013-10-13 09:15:02 ----D---- C:\Users\SipB\AppData\Roaming\SpeedAnalysis3

2013-10-12 22:05:09 ----D---- C:\Users\SipB\AppData\Roaming\CyberLink

2013-10-12 22:02:07 ----D---- C:\Program Files (x86)\CyberLink

2013-10-12 15:06:18 ----D---- C:\Users\SipB\AppData\Roaming\TFP

2013-10-12 15:06:18 ----A---- C:\Windows\SYSWOW64\VB6STKIT.DLL

2013-10-12 15:06:18 ----A---- C:\Windows\SYSWOW64\VB6FR.DLL

2013-10-12 15:06:18 ----A---- C:\Windows\SYSWOW64\MSCMCFR.DLL

2013-10-12 15:06:18 ----A---- C:\Windows\SYSWOW64\CMDLGFR.DLL

2013-10-12 14:58:40 ----D---- C:\Users\SipB\AppData\Roaming\dvdcss

2013-10-10 04:50:54 ----A---- C:\Windows\SYSWOW64\ieui.dll

2013-10-10 04:50:54 ----A---- C:\Windows\system32\ieui.dll

2013-10-10 04:50:53 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe

2013-10-10 04:50:53 ----A---- C:\Windows\SYSWOW64\iesysprep.dll

2013-10-10 04:50:53 ----A---- C:\Windows\SYSWOW64\iesetup.dll

2013-10-10 04:50:53 ----A---- C:\Windows\SYSWOW64\iernonce.dll

2013-10-10 04:50:53 ----A---- C:\Windows\system32\iesetup.dll

2013-10-10 04:50:53 ----A---- C:\Windows\system32\iernonce.dll

2013-10-10 04:50:52 ----A---- C:\Windows\SYSWOW64\iertutil.dll

2013-10-10 04:50:52 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe

2013-10-10 04:50:52 ----A---- C:\Windows\system32\iesysprep.dll

2013-10-10 04:50:52 ----A---- C:\Windows\system32\iertutil.dll

2013-10-10 04:50:52 ----A---- C:\Windows\system32\ie4uinit.exe

2013-10-10 04:50:51 ----A---- C:\Windows\SYSWOW64\msfeeds.dll

2013-10-10 04:50:50 ----A---- C:\Windows\SYSWOW64\jscript.dll

2013-10-10 04:50:50 ----A---- C:\Windows\system32\msfeeds.dll

2013-10-10 04:50:50 ----A---- C:\Windows\system32\jscript.dll

2013-10-10 04:50:49 ----A---- C:\Windows\SYSWOW64\jscript9.dll

2013-10-10 04:50:49 ----A---- C:\Windows\system32\jscript9.dll

2013-10-10 04:50:48 ----A---- C:\Windows\SYSWOW64\urlmon.dll

2013-10-10 04:50:48 ----A---- C:\Windows\system32\urlmon.dll

2013-10-10 04:50:47 ----A---- C:\Windows\system32\jsproxy.dll

2013-10-10 04:50:46 ----A---- C:\Windows\SYSWOW64\wininet.dll

2013-10-10 04:50:46 ----A---- C:\Windows\SYSWOW64\jsproxy.dll

2013-10-10 04:50:46 ----A---- C:\Windows\system32\wininet.dll

2013-10-10 04:50:45 ----A---- C:\Windows\SYSWOW64\ieframe.dll

2013-10-10 04:50:44 ----A---- C:\Windows\system32\ieframe.dll

2013-10-10 04:50:43 ----A---- C:\Windows\system32\mshtml.dll

2013-10-10 04:50:41 ----A---- C:\Windows\SYSWOW64\mshtml.dll

2013-10-09 19:35:24 ----D---- C:\Program Files (x86)\EaseUS

2013-10-09 12:03:18 ----A---- C:\Windows\SYSWOW64\lpk.dll

2013-10-09 12:03:18 ----A---- C:\Windows\SYSWOW64\fontsub.dll

2013-10-09 12:03:18 ----A---- C:\Windows\SYSWOW64\dciman32.dll

2013-10-09 12:03:18 ----A---- C:\Windows\SYSWOW64\atmlib.dll

2013-10-09 12:03:18 ----A---- C:\Windows\SYSWOW64\atmfd.dll

2013-10-09 12:03:18 ----A---- C:\Windows\system32\lpk.dll

2013-10-09 12:03:18 ----A---- C:\Windows\system32\fontsub.dll

2013-10-09 12:03:18 ----A---- C:\Windows\system32\dciman32.dll

2013-10-09 12:03:18 ----A---- C:\Windows\system32\atmlib.dll

2013-10-09 12:03:18 ----A---- C:\Windows\system32\atmfd.dll

2013-10-09 12:01:40 ----A---- C:\Windows\system32\drivers\Wdf01000.sys

2013-10-09 11:54:11 ----A---- C:\Windows\SYSWOW64\mswsock.dll

2013-10-09 11:54:11 ----A---- C:\Windows\system32\mswsock.dll

2013-10-09 11:54:11 ----A---- C:\Windows\system32\drivers\tcpip.sys

2013-10-09 11:54:11 ----A---- C:\Windows\system32\drivers\afd.sys

2013-10-09 11:52:49 ----A---- C:\Windows\system32\win32k.sys

2013-10-09 11:41:47 ----A---- C:\Windows\SYSWOW64\comctl32.dll

2013-10-09 11:41:47 ----A---- C:\Windows\system32\comctl32.dll

2013-10-09 11:07:36 ----A---- C:\Windows\system32\drivers\usbcir.sys

2013-10-09 11:07:34 ----A---- C:\Windows\system32\drivers\hidparse.sys

2013-10-09 11:07:34 ----A---- C:\Windows\system32\drivers\hidclass.sys

2013-10-09 11:07:33 ----A---- C:\Windows\SYSWOW64\WebClnt.dll

2013-10-09 11:07:33 ----A---- C:\Windows\SYSWOW64\davclnt.dll

2013-10-09 11:07:33 ----A---- C:\Windows\system32\WebClnt.dll

2013-10-09 11:07:33 ----A---- C:\Windows\system32\drivers\mrxdav.sys

2013-10-09 11:07:33 ----A---- C:\Windows\system32\davclnt.dll

2013-10-09 10:45:45 ----A---- C:\Windows\system32\ntoskrnl.exe

2013-10-09 10:45:44 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe

2013-10-09 10:45:44 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe

2013-10-09 10:45:44 ----A---- C:\Windows\system32\tdh.dll

2013-10-09 10:45:44 ----A---- C:\Windows\system32\ntdll.dll

2013-10-09 10:45:44 ----A---- C:\Windows\system32\advapi32.dll

2013-10-09 10:45:43 ----A---- C:\Windows\SYSWOW64\tdh.dll

2013-10-09 10:45:43 ----A---- C:\Windows\SYSWOW64\ntdll.dll

2013-10-09 10:45:43 ----A---- C:\Windows\SYSWOW64\advapi32.dll

2013-10-09 10:45:43 ----A---- C:\Windows\system32\wow64.dll

2013-10-09 10:45:42 ----A---- C:\Windows\SYSWOW64\wow32.dll

2013-10-09 10:45:42 ----A---- C:\Windows\SYSWOW64\user.exe

2013-10-09 10:45:42 ----A---- C:\Windows\SYSWOW64\setup16.exe

2013-10-09 10:45:42 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll

2013-10-09 10:45:42 ----A---- C:\Windows\SYSWOW64\instnm.exe

2013-10-09 10:35:06 ----A---- C:\Windows\SYSWOW64\PresentationCFFRasterizerNative_v0300.dll

2013-10-09 10:35:06 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2013-10-09 10:34:48 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys

2013-10-09 10:34:31 ----A---- C:\Windows\system32\scavengeui.dll

2013-10-09 10:30:32 ----A---- C:\Windows\system32\drivers\usbuhci.sys

2013-10-09 10:30:32 ----A---- C:\Windows\system32\drivers\usbport.sys

2013-10-09 10:30:32 ----A---- C:\Windows\system32\drivers\usbohci.sys

2013-10-09 10:30:32 ----A---- C:\Windows\system32\drivers\usbhub.sys

2013-10-09 10:30:32 ----A---- C:\Windows\system32\drivers\usbehci.sys

2013-10-09 10:30:32 ----A---- C:\Windows\system32\drivers\usbd.sys

2013-10-09 10:30:32 ----A---- C:\Windows\system32\drivers\usbccgp.sys

2013-10-06 13:41:06 ----A---- C:\Windows\unins000.exe

2013-10-06 13:41:06 ----A---- C:\Windows\unins000.dat

2013-10-06 13:41:00 ----D---- C:\Program Files (x86)\vGrabber-software

2013-10-06 12:26:33 ----D---- C:\ProgramData\PDVD

2013-10-06 12:26:33 ----D---- C:\ProgramData\CyberLink

2013-10-06 12:23:34 ----D---- C:\ProgramData\Temp

2013-10-06 12:23:33 ----D---- C:\ProgramData\install_clap

2013-10-06 10:20:45 ----D---- C:\ProgramData\Wincert

2013-10-06 10:19:59 ----D---- C:\Program Files (x86)\Movies Toolbar

2013-10-06 10:19:54 ----D---- C:\ProgramData\SafetyNut

2013-10-05 15:18:54 ----A---- C:\Windows\system32\drivers\pcouffin.sys

2013-10-05 15:18:54 ----A---- C:\Users\SipB\AppData\Roaming\pcouffin.sys

2013-10-05 15:18:54 ----A---- C:\Users\SipB\AppData\Roaming\inst.exe

2013-10-05 15:18:53 ----D---- C:\Users\SipB\AppData\Roaming\Vso

2013-10-05 15:18:36 ----D---- C:\Windows\SYSWOW64\sysdir

2013-10-05 15:18:36 ----D---- C:\ProgramData\Aviosoft

2013-10-05 15:18:36 ----D---- C:\Program Files (x86)\CloneDVD6

2013-10-05 13:41:13 ----D---- C:\Nieuwe map (2)

2013-10-05 12:45:26 ----D---- C:\Program Files (x86)\Runtime Software

2013-10-05 12:17:30 ----D---- C:\Nieuwe map

2013-10-05 11:08:15 ----D---- C:\Program Files (x86)\NEC Electronics

2013-10-03 04:47:32 ----D---- C:\ProgramData\SpotGrit

2013-10-03 04:47:11 ----SHD---- C:\Windows\SYSWOW64\AI_RecycleBin

2013-10-03 04:47:09 ----D---- C:\Program Files (x86)\SpotGrit

2013-10-03 04:44:35 ----D---- C:\Program Files\Microsoft Synchronization Services

2013-10-03 04:44:35 ----D---- C:\Program Files\Microsoft SQL Server Compact Edition

2013-10-03 04:44:08 ----D---- C:\Program Files (x86)\Microsoft Synchronization Services

======List of files/folders modified in the last 1 month======

2013-11-02 15:27:30 ----RD---- C:\Program Files

2013-11-02 15:27:26 ----D---- C:\Windows\Temp

2013-11-02 14:14:16 ----D---- C:\Users\SipB\AppData\Roaming\vlc

2013-11-02 13:39:55 ----D---- C:\Windows\system32\config

2013-11-02 12:40:34 ----D---- C:\Windows\System32

2013-11-02 12:40:34 ----D---- C:\Windows\inf

2013-11-02 12:40:34 ----A---- C:\Windows\system32\PerfStringBackup.INI

2013-11-02 12:18:57 ----D---- C:\Windows\system32\Tasks

2013-11-02 12:18:26 ----SHD---- C:\System Volume Information

2013-11-01 18:59:50 ----HD---- C:\_acestream_cache_

2013-11-01 18:59:39 ----D---- C:\Users\SipB\AppData\Roaming\.ACEStream

2013-11-01 05:27:00 ----D---- C:\ProgramData\Oracle

2013-11-01 05:26:29 ----SHD---- C:\Windows\Installer

2013-11-01 05:26:29 ----D---- C:\Windows\SysWOW64

2013-11-01 05:26:26 ----D---- C:\Program Files (x86)\Java

2013-10-30 16:31:51 ----D---- C:\Windows

2013-10-28 17:23:54 ----D---- C:\Windows\system32\catroot2

2013-10-27 15:17:00 ----D---- C:\Windows\system32\NDF

2013-10-27 12:50:08 ----RD---- C:\Program Files (x86)

2013-10-27 12:50:08 ----D---- C:\Windows\system32\drivers

2013-10-27 12:10:39 ----RSHD---- C:\Users\SipB\AppData\Roaming\gwregsrffewgttzfdxadhds

2013-10-27 12:10:39 ----HD---- C:\ProgramData

2013-10-27 12:10:39 ----D---- C:\Program Files (x86)\Advanced System Protector

2013-10-27 11:58:48 ----D---- C:\Windows\Tasks

2013-10-27 11:58:48 ----D---- C:\Program Files (x86)\Common Files

2013-10-26 15:23:14 ----D---- C:\Users\SipB\AppData\Roaming\zulagames

2013-10-23 17:51:02 ----SD---- C:\Users\SipB\AppData\Roaming\Microsoft

2013-10-22 09:03:56 ----A---- C:\Windows\ODBCINST.INI

2013-10-22 09:03:56 ----A---- C:\Windows\ODBC.INI

2013-10-22 09:03:36 ----D---- C:\Program Files (x86)\WinTV

2013-10-22 09:03:36 ----A---- C:\Windows\Irremote.ini

2013-10-22 09:03:27 ----HD---- C:\Program Files (x86)\InstallShield Installation Information

2013-10-22 09:03:08 ----A---- C:\Windows\HCWPNP.INI

2013-10-22 09:02:49 ----A---- C:\hcwDriverInstall.txt

2013-10-21 18:15:56 ----D---- C:\ProgramData\ArcSoft

2013-10-20 14:10:21 ----D---- C:\Program Files\Google

2013-10-20 14:10:21 ----D---- C:\Program Files (x86)\Google

2013-10-20 13:55:26 ----D---- C:\Windows\LiveKernelReports

2013-10-20 11:22:45 ----A---- C:\Windows\SYSWOW64\msvcr71.dll

2013-10-20 11:22:45 ----A---- C:\Windows\SYSWOW64\msvcp71.dll

2013-10-17 02:16:17 ----D---- C:\Windows\system32\catroot

2013-10-14 02:02:44 ----RSD---- C:\Windows\assembly

2013-10-14 02:01:16 ----D---- C:\Windows\winsxs

2013-10-14 02:01:10 ----D---- C:\ProgramData\Microsoft Help

2013-10-13 09:15:13 ----D---- C:\ProgramData\DSearchLink

2013-10-11 04:56:39 ----D---- C:\Windows\system32\wdi

2013-10-11 02:01:13 ----D---- C:\Windows\system32\MRT

2013-10-11 02:00:20 ----A---- C:\Windows\system32\MRT.exe

2013-10-11 00:07:45 ----D---- C:\Windows\rescache

2013-10-10 18:06:50 ----D---- C:\Windows\Microsoft.NET

2013-10-10 04:53:38 ----D---- C:\Program Files (x86)\Internet Explorer

2013-10-10 04:53:37 ----D---- C:\Program Files\Internet Explorer

2013-10-10 04:50:28 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI

2013-10-09 18:11:30 ----D---- C:\Windows\AppPatch

2013-10-09 18:11:29 ----D---- C:\Windows\system32\nl-NL

2013-10-09 18:11:29 ----D---- C:\Windows\system32\DriverStore

2013-10-09 18:10:55 ----D---- C:\Program Files\Microsoft Silverlight

2013-10-09 18:10:55 ----D---- C:\Program Files (x86)\Microsoft Silverlight

2013-10-08 21:09:13 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

2013-10-08 07:50:37 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll

2013-10-08 07:46:52 ----A---- C:\Windows\SYSWOW64\javaws.exe

2013-10-08 07:46:47 ----A---- C:\Windows\SYSWOW64\javaw.exe

2013-10-08 07:46:23 ----A---- C:\Windows\SYSWOW64\java.exe

2013-10-08 04:44:30 ----D---- C:\Users\SipB\AppData\Roaming\NewsLeecher

2013-10-03 18:57:09 ----D---- C:\Windows\system32\LogFiles

2013-10-03 04:47:11 ----SHD---- C:\$Recycle.Bin

2013-10-03 04:44:07 ----D---- C:\Program Files (x86)\Microsoft SQL Server Compact Edition

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 nvrd64;NVIDIA nForce RAID Driver; C:\Windows\system32\DRIVERS\nvrd64.sys [2010-04-09 175720]

R0 nvstor64;nvstor64; C:\Windows\system32\DRIVERS\nvstor64.sys [2010-04-09 244328]

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]

R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS [2013-05-20 493656]

R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS [2013-05-22 1139800]

R1 BHDrvx64;BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20131022.001\BHDrvx64.sys [2013-10-23 1524824]

R1 ccSet_NIS;Norton Internet Security Settings Manager; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [2013-04-15 169048]

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2013-09-30 484952]

R1 IDSVia64;IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20131101.001\IDSvia64.sys [2013-10-28 521816]

R1 SRTSP;Symantec Real Time Storage Protection x64; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSP64.SYS [2013-05-15 796760]

R1 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [2013-03-04 36952]

R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [2012-07-27 224416]

R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\system32\drivers\NISx64\1404000.028\SYMNETS.SYS [2013-04-24 433752]

R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5};Power Control [2013/10/12 23:04:16]; \??\C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [2013-03-19 130320]

R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-11-16 11922944]

R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-11-16 359936]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-09-30 140376]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-08-12 1824672]

R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20131101.018\ENG64.SYS [2013-09-30 126040]

R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20131101.018\EX64.SYS [2013-09-30 2099288]

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2010-01-22 77824]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2010-01-22 180224]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2013-02-18 189288]

R3 NVNET;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmf6264.sys [2010-03-04 349416]

R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2010-03-22 29800]

R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2013-10-05 82816]

R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [2013-09-30 177312]

R3 USB28xxBGA;WinTV HVR-900; C:\Windows\system32\DRIVERS\emBDA64.sys [2010-03-30 653312]

R3 USB28xxOEM;WinTV OEM Filter; C:\Windows\system32\DRIVERS\emOEM64.sys [2010-03-25 154880]

S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-11-16 11922944]

S3 esgiguard;esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [2011-03-02 13088]

S3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys []

S3 NVENETFD;NVIDIA nForce-netwerkcontroller; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]

S3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2011-08-12 205472]

S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-09-05 65640]

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-11-16 238080]

R2 CyberLink PowerDVD 13 Media Server Monitor Service;CyberLink PowerDVD 13 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [2013-03-20 77576]

R2 CyberLink PowerDVD 13 Media Server Service;CyberLink PowerDVD 13 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [2013-03-20 323336]

R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [2010-01-21 496232]

R2 HauppaugeTVServer;HauppaugeTVServer; C:\Program Files (x86)\WinTV\TVServer\HauppaugeTVServer.exe [2013-05-15 581632]

R2 NIS;Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [2013-05-20 144368]

R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [2010-01-21 209000]

R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-08-14 39056]

R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 2292480]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

S2 gupdate;Google Update-service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-29 116648]

S2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe []

S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe []

S2 Service KMSELDI;Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [2013-08-21 516608]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-08 257416]

S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]

S3 gupdatem;Google Update-service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-29 116648]

S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-10-01 178824]

S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]

S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-09-15 1255736]

S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

alvast mijn dank voor de hulp

s,baarda

clarkie · 2 november 2013

Dag sb56,

Ik heb je bericht verplaatst naar bestrijding spyware & virussen.

Van zodra 1 van de experts online is zal deze je zeker verder helpen aangaande je vraag/probleem.

juisterr · 2 november 2013

Download Zoek.zip naar het bureaublad.

Wanneer Internet Explorer of een andere browser of virusscanner melding geeft dat dit bestand onveilig zou zijn kun je negeren, dit is namelijk een onterechte waarschuwing.
Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe (hier en hier) kan je lezen hoe je dat doet.

Klik met de rechtermuisknop op Zoek.zip en klik op de optie "Alles uitpakken".
Dubbelklik vervolgens op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:

Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.

Qone8;U
Qone8;FF
Qone8;A
Qone8;Z
Qone8;S
emptyclsid;
emptyfolderscheck;delete
firefoxlook; 
Chromelook; 
CHRdefaults;
autoclean; 
iedefaults; 
filesrcm;

Klik nu op de knop "Run script".
Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.
Post het geopende logje in het volgende bericht als bijlage.

sb56 · 3 november 2013

Hallo

in het logje ,als ik de code kopieer en dan op plakken druk ,verschijn alleen de eerste regel

Qones8;U

veder denk ik dat er niks gebeurd

kape · 3 november 2013

En heb je de volledige code gekopieerd ?

Qone8;U
Qone8;FF
Qone8;A
Qone8;Z
Qone8;S
emptyclsid;
emptyfolderscheck;delete
firefoxlook; 
Chromelook; 
CHRdefaults;
autoclean; 
iedefaults; 
filesrcm;

En dan in het invulvak geplakt ?

sb56 · 3 november 2013

ja ,dat heb ik gedaan

kape · 3 november 2013

ja ,dat heb ik gedaan

Typ dan de code over ipv te kopiëren en plakken. Let daarbij wel op de correcte schrijfwijze van de verschillende items.

juisterr · 3 november 2013

Probeer het eens met alleen deze code.

Qone8;U
Qone8;FF
Qone8;A
Qone8;Z
Qone8;S
emptyclsid;
emptyfolderscheck;delete  
filesrcm;

sb56 · 4 november 2013

hallo

als ik de code heb getypt ,dat is op een regel gekomen ,is dat goed?

en wat gebeurt er dan veder?

sb56 · 4 november 2013

Logfile of random's system information tool 1.09 (written by random/random)

Run by SipB at 2013-11-04 20:02:16

Microsoft Windows 7 Home Premium Service Pack 1

System drive C: has 43 GB (42%) free of 103 GB

Total RAM: 4095 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:02:18, on 4-11-2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v10.0 (10.00.9200.16720)

Boot mode: Normal

Running processes:

C:\Users\SipB\AppData\Roaming\ACEStream\engine\ace_engine.exe

C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe

C:\Program Files (x86)\WinTV\Ir.exe

C:\Windows\SysWOW64\C2MP\UpdateChecker.exe

C:\Program Files (x86)\WinTV\WinTV7\WinTVTray.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe

C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\8hbrmon.exe

C:\Users\SipB\AppData\Roaming\ACEStream\updater\ace_update.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

C:\Program Files\trend micro\SipB.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Home Page}

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Supporters - Home - Feyenoord

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Start.qone8.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Make sure all words are spelled correctly=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Make sure all words are spelled correctly=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Make sure all words are spelled correctly=

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Start.qone8.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = Home Page}

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Home Page}

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = Make sure all words are spelled correctly=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {93a3111f-4f74-4ed8-895e-d9708497629e} - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll

R3 - URLSearchHook: (no name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\8hSrcAs.dll

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll

O2 - BHO: Toolbar BHO - {312f84fb-8970-4fd3-bddb-7012eac4afc9} - C:\PROGRA~2\VIDEOD~2\bar\1.bin\4zbar.dll

O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll

O2 - BHO: Movies Toolbar (Dist. by Somoto Ltd.) - {3444c3c5-6c56-4a16-a453-832b05bf6ea4} - C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll

O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll

O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Microsoft-account - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Search Assistant BHO - {a4c2fb10-84c3-44eb-9f9e-860fa1d9a797} - C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\8hSrcAs.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office15\URLREDIR.DLL

O2 - BHO: Search Assistant BHO - {c547c6c2-561b-4169-a2a5-20ba771ca93b} - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll

O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~2\Office15\GROOVEEX.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O2 - BHO: Toolbar BHO - {fbcbc43a-dca9-4192-a4c8-b57fd0f77d4d} - C:\PROGRA~2\ALLIN1~2\bar\1.bin\8hbar.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll

O3 - Toolbar: Movies Toolbar (Dist. by Somoto Ltd.) - {3444c3c5-6c56-4a16-a453-832b05bf6ea4} - C:\PROGRA~2\MOVIES~1\SAFETY~1\SRTOOL~1\IE\searchresultsDx.dll

O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)

O3 - Toolbar: VideoDownloadConverter - {48586425-6bb7-4f51-8dc6-38c88e3ebb58} - C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll

O3 - Toolbar: Allin1Convert - {cd1a63ba-a08c-431b-9a34-f240aadc728d} - C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\8hbar.dll