Zita startpagina laad niet goed

Hensyr · 19 februari 2014

dag collega's,

vandaag zit ik hier bij een vriend thuis om een merkwaardig probleem op zijn computer op te lossen maar ik geraak niet verder dan het updaten van Adobe Flashplayer, Java en het resetten van Internet Explorer en het probleem blijft zich stellen.

Het doet zich alleen bij de webpagina's van Zita voor.

De pagina wordt niet goed geladen en na het indrukken van de F5 toets is het wel in orde.

voorbeeld:

[ATTACH=CONFIG]30449[/ATTACH]

zo als je kan zien is de pagina niet goed weergegeven.

[ATTACH=CONFIG]30448[/ATTACH]

Wat kan hier verder de oorzaak van zijn?

Wat kan ik doen om dit euvel op te lossen?

Dit probleem doet zich alleen voor bij Zita die hier de startpagina is van mijn vriend.

Andere pagina's zoals hier op het forum of op Google worden allemaal goed geladen.

Hensyr · 19 februari 2014

update:

na het scannen met malwarebytes is er toch wel het een en ander gevonden

dit is het log:

Malwarebytes Anti-Malware (-evaluatieversie-) 1.75.0.1300

www.malwarebytes.org

Databaseversie: v2014.02.19.06

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16518

User :: USER-HP [administrator]

Bescherming: Ingeschakeld

19/02/2014 13:15:56

mbam-log-2014-02-19 (13-15-56).txt

Scan type: Snelle scan

Uitgeschakelde scan opties: P2P

Objecten gescand: 233283

Verstreken tijd: 3 minuut/minuten, 29 seconde(n)

Geheugenprocessen gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Geheugenmodulen gedetecteerd: 1

C:\Users\User\AppData\Roaming\newnext.me\nengine.dll (PUP.Optional.NextLive.A) -> Zal worden verwijderd tijdens het herstarten.

Registersleutels gedetecteerd: 10

HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Optional.SoftwareUpdater) -> Succesvol in quarantaine geplaatst en verwijderd.

HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Optional.SoftwareUpdater) -> Succesvol in quarantaine geplaatst en verwijderd.

HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Optional.SoftwareUpdater) -> Succesvol in quarantaine geplaatst en verwijderd.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Optional.SoftwareUpdater) -> Succesvol in quarantaine geplaatst en verwijderd.

HKCR\Updater.AmiUpd.1 (PUP.Optional.SoftwareUpdater) -> Succesvol in quarantaine geplaatst en verwijderd.

HKCR\Updater.AmiUpd (PUP.Optional.SoftwareUpdater) -> Succesvol in quarantaine geplaatst en verwijderd.

HKLM\SOFTWARE\MediaPlayerV1alpha257 (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Webexp Enhanced (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Player (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaPlayerV1alpha257 (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

Registerwaarden gedetecteerd: 3

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NextLive (PUP.Optional.NextLive.A) -> Data: C:\Windows\SysWOW64\rundll32.exe "C:\Users\User\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l -> Succesvol in quarantaine geplaatst en verwijderd.

HKLM\SOFTWARE\Mozilla\Firefox\Extensions|ext@WebexpEnhancedV1alpha8852.net (PUP.Optional.WebExpEnhanced.A) -> Data: C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff -> Succesvol in quarantaine geplaatst en verwijderd.

HKLM\SOFTWARE\Mozilla\Firefox\Extensions|ext@MediaPlayerV1alpha257.net (PUP.Optional.MediaPlayerAlpha.A) -> Data: C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff -> Succesvol in quarantaine geplaatst en verwijderd.

Registerdata gedetecteerd: 0

(Geen kwaadaardige objecten gedetecteerd)

Mappen gedetecteerd: 28

C:\Users\User\AppData\Roaming\newnext.me (PUP.Optional.NextLive.A) -> Zal worden verwijderd tijdens het herstarten.

C:\Users\User\AppData\Roaming\newnext.me\cache (PUP.Optional.NextLive.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1 (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852 (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ch (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\chrome (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\chrome\content (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\chrome\content\icons (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\chrome\content\icons\default (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ie (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717 (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ch (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\chrome (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\chrome\content (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\chrome\content\icons (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\chrome\content\icons\default (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ie (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257 (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ch (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\chrome (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\chrome\content (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\chrome\content\icons (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\chrome\content\icons\default (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ie (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Re-markit (PUP.Optional.ReMarkIt.A) -> Succesvol in quarantaine geplaatst en verwijderd.

Bestanden gedetecteerd: 34

C:\Users\User\AppData\Roaming\newnext.me\nengine.dll (PUP.Optional.NextLive.A) -> Zal worden verwijderd tijdens het herstarten.

C:\Users\User\AppData\Local\SwvUpdater\Updater.exe (PUP.Optional.SoftwareUpdater) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Users\User\AppData\Local\genienext\nengine.dll (PUP.Optional.NextLive.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Users\User\AppData\Roaming\newnext.me\nengine.cookie (PUP.Optional.NextLive.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Users\User\AppData\Roaming\newnext.me\cache\spark.bin (PUP.Optional.NextLive.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\uninstall.exe (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\chrome.manifest (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\install.rdf (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\chrome\content\ffWebexpEnhancedV1alpha8852.js (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\chrome\content\overlay.xul (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\chrome\content\icons\Thumbs.db (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha8852\ff\chrome\content\icons\default\WebexpEnhancedV1alpha8852_32.png (PUP.Optional.Webexp) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\uninstall.exe (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\chrome.manifest (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\install.rdf (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\chrome\content\ffVideoPlayerV3beta717.js (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\chrome\content\overlay.xul (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\chrome\content\icons\Thumbs.db (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta717\ff\chrome\content\icons\default\VideoPlayerV3beta717_32.png (Adware.VPlayer) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\uninstall.exe (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\chrome.manifest (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\install.rdf (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\chrome\content\ffMediaPlayerV1alpha257.js (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\chrome\content\overlay.xul (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\chrome\content\icons\Thumbs.db (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha257\ff\chrome\content\icons\default\MediaPlayerV1alpha257_32.png (PUP.Optional.MediaPlayerAlpha.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Re-markit\136.crx (PUP.Optional.ReMarkIt.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Re-markit\136.dll (PUP.Optional.ReMarkIt.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Re-markit\136.xpi (PUP.Optional.ReMarkIt.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Re-markit\crx.db (PUP.Optional.ReMarkIt.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Re-markit\sqlite3.dll (PUP.Optional.ReMarkIt.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Re-markit\Uninstall.exe (PUP.Optional.ReMarkIt.A) -> Succesvol in quarantaine geplaatst en verwijderd.

C:\Program Files (x86)\Re-markit\xpi.db (PUP.Optional.ReMarkIt.A) -> Succesvol in quarantaine geplaatst en verwijderd.

(einde)

- - - Updated - - -

het probleem met het laden van de Zita pagina's is echter niet opgelost hiermee.

clarkie · 19 februari 2014

Misschien ook eens RSIT uitvoeren.

Download RSIT van de onderstaande locaties en sla deze op het bureaublad op.

Hier staat een beschrijving hoe je kan kijken of je een 32- of 64-bitversie van Windows heeft.

RSIT 32 bit (RSIT.exe)
RSIT 64 bit (RSITx64.exe)

Dubbelklik op RSIT.exe om de tool te starten.

Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Vervolgens wordt de "Disclaimer of warranty" getoond, klik vervolgens op "Continue"
Wanneer de tool gereed is wordt er een kladblok bestand genaamd "Log" geopend.
Plaats de inhoud hiervan in het volgende bericht.

Bekijk ook de instructievideo.

Hensyr · 20 februari 2014

Beste collega's,

Hier is het RSIT log van mijn vriend zijn computer:

Logfile of random's system information tool 1.09 (written by random/random)

Run by User at 2014-02-20 10:22:47

Microsoft Windows 7 Home Premium Service Pack 1

System drive C: has 1352 GB (95%) free of 1416 GB

Total RAM: 6127 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:22:51, on 20/02/2014

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.16518)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\ModLEDKey.exe

C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe

C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe

C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\CNYHKEY.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files\trend micro\User.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Zita

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O4 - HKLM\..\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [LaunchHPOSIAPP] C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\LaunchApp.exe

O4 - HKLM\..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe

O4 - HKLM\..\Run: [PDF Complete] C:\Program Files (x86)\PDF Complete\pdfsty.exe

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICEE.EXE /FU "C:\Windows\TEMP\E_S9942.tmp" /EF "HKCU"

O4 - HKCU\..\Run: [MyDriveConnect.exe] "C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-21-3377116301-4190559263-1612895777-1003\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')

O4 - HKUS\S-1-5-21-3377116301-4190559263-1612895777-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin_0.5.1.cab

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Program Files\IDT\WDM\AESTSr64.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE

O23 - Service: Easybits Services for Windows (ezSharedSvc) - EasyBits Software AS - C:\Windows\System32\ezSharedSvcHost.exe

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: GamesAppService - WildTangent, Inc. - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: HP Client Services (HPClientSvc) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files (x86)\PDF Complete\pdfsvc.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10101 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 12057 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

wininit.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

winlogon.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

"c:\Program Files\Microsoft Security Client\MsMpEng.exe"

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

"C:\Program Files\IDT\WDM\STacSV64.exe"

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"

C:\Windows\system32\nvvsvc.exe -session -first

"C:\Windows\system32\Dwm.exe"

C:\Windows\System32\spoolsv.exe

C:\Windows\Explorer.EXE

"taskhost.exe"

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"

taskeng.exe {8AFFB415-DC62-4DF2-8C9C-8A5F9F84C3FE}

"C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\ModLEDKey.exe"

"C:\Program Files\IDT\WDM\AESTSr64.exe"

"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"

"C:\Program Files\Bonjour\mDNSResponder.exe"

"C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE"

"C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe"

"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

"C:\Program Files\IDT\WDM\sttray64.exe"

C:\Windows\SysWOW64\ezSharedSvcHost.exe

"C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe"

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

"C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe"

"C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe"

"C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe"

"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe"

"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"

"C:\Program Files (x86)\PDF Complete\pdfsvc.exe" /startedbyscm:66B66708-40E2BE4D-pdfcService

"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1

"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\CNYHKEY.exe"

"C:\Program Files (x86)\iTunes\iTunesHelper.exe"

"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe"

C:\Windows\system32\svchost.exe -k imgsvc

"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"

"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"

WLIDSvcM.exe 3280

"C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"

"C:\Program Files\iPod\bin\iPodService.exe"

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-274e43f6-f9ea-4107-bd57-054a95df4ba6 -SystemEventPortName:HostProcess-89342787-aa1d-4844-b3e2-3bd536b2b384 -IoCancelEventPortName:HostProcess-e639e1fa-2d25-4ef5-a202-04580023c70e -NonStateChangingEventPortName:HostProcess-d30dedd3-3033-46e6-92c2-945c44c2fd0a -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:fecc4ecc-86bf-49af-a520-5db26a50917a -DeviceGroupId:WpdFsGroup

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

"c:\Program Files\Microsoft Security Client\NisSrv.exe"

C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}

"C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe"

"C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe"

"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"

"C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe"

C:\Windows\system32\sppsvc.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe11_ Global\UsGthrCtrlFltPipeMssGthrPipe11 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

"C:\Windows\system32\SearchFilterHost.exe" 0 540 544 552 65536 548

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3377116301-4190559263-1612895777-100012_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3377116301-4190559263-1612895777-100012 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

"C:\Users\User\Desktop\RSITx64.exe"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}]

Easy Photo Print - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2009-08-24 430592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-12-18 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Aanmeldhulp voor Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-12-18 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{9421DD08-935F-4701-A9CA-22DF90AC4EA6} - Easy Photo Print - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2009-08-24 430592]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"=c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [2008-11-20 62768]

"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2013-10-23 1266912]

"SysTrayApp"=C:\Program Files\IDT\WDM\sttray64.exe [2012-04-24 1425408]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"EPSON Stylus DX8400 Series"=C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICEE.EXE [2007-04-12 213504]

"MyDriveConnect.exe"=C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [2013-11-29 473496]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]

"HP Software Update"=c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2008-12-08 54576]

""= []

"LaunchHPOSIAPP"=C:\Program Files (x86)\Hewlett-Packard\HP Keyboard\LaunchApp.exe [2009-04-04 385024]

"Easybits Recovery"=C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [2011-02-10 61112]

"PDF Complete"=C:\Program Files (x86)\PDF Complete\pdfsty.exe [2011-02-01 656920]

"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]

"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2011-09-27 59240]

"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2011-10-09 421736]

"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2011-07-05 421888]

"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{E54729E8-BB3D-4270-9D49-7389EA579090}"=C:\Windows\SysWow64\EZUPBH~1.DLL [2011-08-17 52920]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=5

"ConsentPromptBehaviorUser"=3

"EnableUIADesktopToggle"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoActiveDesktop"=1

"NoActiveDesktopChanges"=1

"ForceActiveDesktopOn"=0

"EnableShellExecuteHooks"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"vidc.uyvy"=msyuv.dll

"vidc.yuy2"=msyuv.dll

"vidc.yvyu"=msyuv.dll

"vidc.iyuv"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"vidc.yvu9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"wave2"=wdmaud.drv

"midi2"=wdmaud.drv

"mixer2"=wdmaud.drv

"wave3"=wdmaud.drv

"midi3"=wdmaud.drv

"mixer3"=wdmaud.drv

"wave4"=wdmaud.drv

"midi4"=wdmaud.drv

"mixer4"=wdmaud.drv

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-02-20 10:22:47 ----D---- C:\rsit

2014-02-20 10:22:47 ----D---- C:\Program Files\trend micro

2014-02-19 13:40:13 ----D---- C:\Program Files (x86)\MyDrive Connect

2014-02-19 11:37:37 ----A---- C:\Windows\SYSWOW64\javaws.exe

2014-02-19 11:37:35 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll

2014-02-19 11:37:35 ----A---- C:\Windows\SYSWOW64\javaw.exe

2014-02-19 11:37:35 ----A---- C:\Windows\SYSWOW64\java.exe

2014-02-14 14:39:34 ----A---- C:\Windows\SYSWOW64\vbscript.dll

2014-02-14 14:39:34 ----A---- C:\Windows\system32\vbscript.dll

2014-02-14 14:38:58 ----A---- C:\Windows\SYSWOW64\msrating.dll

2014-02-14 14:38:58 ----A---- C:\Windows\system32\msrating.dll

2014-02-14 14:38:57 ----A---- C:\Windows\SYSWOW64\ieui.dll

2014-02-14 14:38:57 ----A---- C:\Windows\system32\ieui.dll

2014-02-14 14:38:56 ----A---- C:\Windows\SYSWOW64\msfeeds.dll

2014-02-14 14:38:56 ----A---- C:\Windows\SYSWOW64\jsproxy.dll

2014-02-14 14:38:56 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe

2014-02-14 14:38:56 ----A---- C:\Windows\system32\msfeeds.dll

2014-02-14 14:38:56 ----A---- C:\Windows\system32\jsproxy.dll

2014-02-14 14:38:56 ----A---- C:\Windows\system32\iernonce.dll

2014-02-14 14:38:56 ----A---- C:\Windows\system32\ieetwcollectorres.dll

2014-02-14 14:38:56 ----A---- C:\Windows\system32\ie4uinit.exe

2014-02-14 14:38:55 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll

2014-02-14 14:38:55 ----A---- C:\Windows\SYSWOW64\iesetup.dll

2014-02-14 14:38:55 ----A---- C:\Windows\SYSWOW64\iernonce.dll

2014-02-14 14:38:55 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll

2014-02-14 14:38:55 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll

2014-02-14 14:38:55 ----A---- C:\Windows\system32\mshtml.dll

2014-02-14 14:38:55 ----A---- C:\Windows\system32\jscript9diag.dll

2014-02-14 14:38:55 ----A---- C:\Windows\system32\ieUnatt.exe

2014-02-14 14:38:55 ----A---- C:\Windows\system32\iesetup.dll

2014-02-14 14:38:55 ----A---- C:\Windows\system32\ieetwproxystub.dll

2014-02-14 14:38:55 ----A---- C:\Windows\system32\ieetwcollector.exe

2014-02-14 14:38:54 ----A---- C:\Windows\SYSWOW64\wininet.dll

2014-02-14 14:38:54 ----A---- C:\Windows\SYSWOW64\urlmon.dll

2014-02-14 14:38:54 ----A---- C:\Windows\SYSWOW64\iertutil.dll

2014-02-14 14:38:54 ----A---- C:\Windows\system32\wininet.dll

2014-02-14 14:38:54 ----A---- C:\Windows\system32\urlmon.dll

2014-02-14 14:38:54 ----A---- C:\Windows\system32\iertutil.dll

2014-02-14 14:38:54 ----A---- C:\Windows\system32\ieapfltr.dll

2014-02-14 14:38:53 ----A---- C:\Windows\SYSWOW64\ieframe.dll

2014-02-14 14:38:53 ----A---- C:\Windows\system32\ieframe.dll

2014-02-14 14:38:52 ----A---- C:\Windows\SYSWOW64\mshtml.dll

2014-02-14 14:38:52 ----A---- C:\Windows\SYSWOW64\jscript9.dll

2014-02-14 14:38:52 ----A---- C:\Windows\system32\jscript9.dll

2014-02-14 14:04:33 ----A---- C:\Windows\SYSWOW64\msxml3.dll

2014-02-14 14:04:33 ----A---- C:\Windows\system32\msxml3.dll

2014-02-14 14:04:32 ----A---- C:\Windows\SYSWOW64\msxml3r.dll

2014-02-14 14:04:32 ----A---- C:\Windows\system32\msxml3r.dll

2014-02-14 14:04:29 ----A---- C:\Windows\SYSWOW64\RMActivate_isv.exe

2014-02-14 14:04:29 ----A---- C:\Windows\SYSWOW64\RMActivate.exe

2014-02-14 14:04:29 ----A---- C:\Windows\system32\RMActivate_isv.exe

2014-02-14 14:04:29 ----A---- C:\Windows\system32\RMActivate.exe

2014-02-14 14:04:28 ----A---- C:\Windows\SYSWOW64\RMActivate_ssp_isv.exe

2014-02-14 14:04:28 ----A---- C:\Windows\SYSWOW64\RMActivate_ssp.exe

2014-02-14 14:04:28 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe

2014-02-14 14:04:28 ----A---- C:\Windows\system32\RMActivate_ssp.exe

2014-02-14 14:04:27 ----A---- C:\Windows\SYSWOW64\secproc_ssp_isv.dll

2014-02-14 14:04:27 ----A---- C:\Windows\SYSWOW64\secproc_ssp.dll

2014-02-14 14:04:27 ----A---- C:\Windows\SYSWOW64\secproc_isv.dll

2014-02-14 14:04:27 ----A---- C:\Windows\SYSWOW64\secproc.dll

2014-02-14 14:04:27 ----A---- C:\Windows\SYSWOW64\msdrm.dll

2014-02-14 14:04:27 ----A---- C:\Windows\system32\secproc_ssp_isv.dll

2014-02-14 14:04:27 ----A---- C:\Windows\system32\secproc_ssp.dll

2014-02-14 14:04:27 ----A---- C:\Windows\system32\secproc_isv.dll

2014-02-14 14:04:27 ----A---- C:\Windows\system32\secproc.dll

2014-02-14 14:04:27 ----A---- C:\Windows\system32\msdrm.dll

2014-02-14 14:04:23 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll

2014-02-14 14:04:23 ----A---- C:\Windows\system32\d3d10warp.dll

2014-02-14 14:04:22 ----A---- C:\Windows\SYSWOW64\d2d1.dll

2014-02-14 14:04:22 ----A---- C:\Windows\system32\d2d1.dll

2014-01-30 13:26:21 ----D---- C:\Program Files (x86)\MediaPlayerV1

======List of files/folders modified in the last 1 month======

2014-02-20 10:22:47 ----RD---- C:\Program Files

2014-02-20 10:21:40 ----D---- C:\Windows\Temp

2014-02-20 10:11:03 ----D---- C:\Windows\system32\config

2014-02-20 10:01:13 ----D---- C:\Windows\System32

2014-02-20 10:01:13 ----D---- C:\Windows\inf

2014-02-20 10:01:13 ----A---- C:\Windows\system32\PerfStringBackup.INI

2014-02-20 09:59:19 ----A---- C:\Windows\SYSWOW64\log.txt

2014-02-20 09:57:15 ----D---- C:\ProgramData\PDFC

2014-02-19 14:05:06 ----D---- C:\Windows\system32\catroot

2014-02-19 13:40:19 ----SHD---- C:\Windows\Installer

2014-02-19 13:40:13 ----RD---- C:\Program Files (x86)

2014-02-19 13:29:13 ----AD---- C:\Windows

2014-02-19 13:25:30 ----D---- C:\Windows\system32\Tasks

2014-02-19 13:25:30 ----D---- C:\Program Files (x86)\VideoPlayerV3

2014-02-19 13:25:29 ----D---- C:\Windows\Tasks

2014-02-19 13:15:24 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-19 13:15:22 ----D---- C:\Windows\system32\drivers

2014-02-19 12:30:39 ----D---- C:\Windows\debug

2014-02-19 12:28:26 ----D---- C:\Program Files\CCleaner

2014-02-19 11:54:36 ----SD---- C:\Users\User\AppData\Roaming\Microsoft

2014-02-19 11:45:16 ----AD---- C:\Windows\SysWOW64

2014-02-19 11:37:50 ----D---- C:\ProgramData\Oracle

2014-02-19 11:37:34 ----D---- C:\Program Files (x86)\Java

2014-02-19 11:36:45 ----SHD---- C:\System Volume Information

2014-02-16 12:09:50 ----D---- C:\Windows\system32\MRT

2014-02-16 12:09:44 ----A---- C:\Windows\system32\MRT.exe

2014-02-15 11:20:25 ----D---- C:\Windows\system32\wdi

2014-02-15 11:04:48 ----RSD---- C:\Windows\assembly

2014-02-15 11:04:48 ----D---- C:\Windows\Microsoft.NET

2014-02-15 10:41:38 ----D---- C:\Windows\system32\catroot2

2014-02-14 14:51:35 ----D---- C:\Windows\winsxs

2014-02-14 14:49:48 ----D---- C:\Windows\SYSWOW64\nl-NL

2014-02-14 14:49:47 ----D---- C:\Windows\system32\nl-NL

2014-02-14 14:49:46 ----D---- C:\Program Files\Internet Explorer

2014-02-14 14:49:46 ----D---- C:\Program Files (x86)\Internet Explorer

2014-02-14 14:48:26 ----D---- C:\ProgramData\Microsoft Help

2014-02-14 14:48:06 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI

2014-02-11 16:04:14 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

2014-01-30 13:26:34 ----A---- C:\extensions.ini

2014-01-30 13:26:23 ----HD---- C:\ProgramData

2014-01-30 13:26:22 ----HD---- C:\Windows\system32\GroupPolicy

2014-01-30 13:26:22 ----D---- C:\Windows\SYSWOW64\GroupPolicy

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel RAID Controller; C:\Windows\system32\drivers\iaStor.sys [2010-11-05 438808]

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-09-27 248240]

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]

R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 134944]

R3 Afc;PPdus ASPI Shell; C:\Windows\SysWOW64\drivers\Afc.sys [2006-11-14 22784]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 34152]

R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2013-04-04 25928]

R3 MEIx64;Intel® Management Engine Interface; C:\Windows\system32\drivers\HECIx64.sys [2010-10-19 56344]

R3 netr28x;Ralink 802.11n Extensible Wireless Driver; C:\Windows\system32\DRIVERS\netr28x.sys [2012-12-06 2350176]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2013-02-18 189288]

R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-12-28 412776]

R3 Sftfs;Sftfs; C:\Windows\system32\DRIVERS\Sftfslh.sys [2013-06-26 767144]

R3 Sftplay;Sftplay; C:\Windows\system32\DRIVERS\Sftplaylh.sys [2013-06-26 273576]

R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirlh.sys [2013-06-26 28840]

R3 Sftvol;Sftvol; C:\Windows\system32\DRIVERS\Sftvollh.sys [2013-06-26 23208]

R3 STHDA;@%SystemRoot%\system32\stlang64.dll,-10305; C:\Windows\system32\DRIVERS\stwrt64.sys [2012-04-24 536576]

S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-06-10 6108416]

S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2011-08-17 19968]

S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2011-08-17 27136]

S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]

S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]

S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2011-08-17 9216]

S3 usb_rndisx;USB RNDIS-adapter; C:\Windows\system32\drivers\usb8023x.sys [2013-02-12 19968]

S3 usbscan;Stuurprogramma voor USB-scanner; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]

S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2013-08-29 33280]

S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2011-08-17 9216]

S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-18 65432]

R2 AESTFilters;Andrea ST Filters Service; C:\Program Files\IDT\WDM\AESTSr64.exe [2009-03-02 89600]

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2011-10-09 55144]

R2 Bonjour Service;Bonjour-service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]

R2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2013-04-22 822504]

R2 EPSON_PM_RPCV4_01;EPSON V3 Service4(01); C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE [2007-01-11 126464]

R2 ezSharedSvc;Easybits Services for Windows; C:\Windows\syswow64\ezSharedSvcHost.exe [2010-04-23 514232]

R2 HP Health Check Service;HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [2011-02-23 125496]

R2 HPClientSvc;HP Client Services; C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]

R2 HPDrvMntSvc.exe;HP Quick Synchronization Service; C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-01-26 92216]

R2 LMS;Intel® Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe [2011-02-01 326168]

R2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]

R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]

R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-10-23 23808]

R2 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2012-03-15 889664]

R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-03-15 2458944]

R2 pdfcDispatcher;PDF Document Manager; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [2011-02-01 1127448]

R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-06-26 523944]

R2 STacSV;@%SystemRoot%\system32\stlang64.dll,-10101; C:\Program Files\IDT\WDM\STacSV64.exe [2012-04-24 318464]

R2 UNS;Intel® Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]

R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 2292096]

R3 iPod Service;iPod-service; C:\Program Files\iPod\bin\iPodService.exe [2011-10-09 934760]

R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2013-10-23 348376]

R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-06-26 207528]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-11 257928]

S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-19 44376]

S3 GamesAppService;GamesAppService; C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 hpqwmiex;HP Software Framework Service; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [2011-01-26 791608]

S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-02-06 111616]

S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]

S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-10-15 1255736]

S4 NetMsmqActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

S4 NetPipeActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

S4 NetTcpActivator;@c:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

-----------------EOF-----------------

Hensyr · 20 februari 2014

correctie

Omdat de vorige RSIT uitgevoerd werd zonder externe schijf heb ik het opnieuw gedaan met deze keer de externe schijf aangesloten

dit is de nieuwe RSIT log:

Logfile of random's system information tool 1.09 (written by random/random)

Run by User at 2014-02-20 10:45:25

Microsoft Windows 7 Home Premium Service Pack 1

System drive C: has 1352 GB (95%) free of 1416 GB

Total RAM: 6127 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:45:27, on 20/02/2014