Laptop gecrashed

froesjel · 6 september 2014

Beste,

Gisteren (05.09.2014) is mijn laptop 2 X gecrashed. En vandaag terug.

Nochtans gebruik ik regelmatig CC Cleaner. Deze voer ik altijd uit als adm. Telkens als de LT uitvalt krijg ik een blauw scherm met tekst op. Onderaan staat "dumping physical memory" met daarnaast een soort timer die optelt tot 100% en dan valt hij uit en start terug op. Eens ik terug ben ingelogd verschijnt er een melding van windows. "Windows is onverwachts afgesloten en terug hersteld. Wij zoeken naar een oplossing voor dit probleem".

Daarom zou ik willen vragen of jullie eens kunnen kijken of er een groot probleem is of mms gehacked?

Mvg Alain.

kape · 7 september 2014

Download RSIT van de onderstaande locaties en sla deze op het bureaublad op.

Hoe je controleert of je met een 32- of 64-bitversie van Windows werkt kan je hier bekijken.

RSIT 32 bit (RSIT.exe)
RSIT 64 bit (RSITx64.exe)

Dubbelklik op RSIT.exe om de tool te starten.

Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Vervolgens wordt de "Disclaimer of warranty" getoond, klik vervolgens op "Continue"
Wanneer de tool gereed is worden er twee kladblok bestanden geopend genaamd "Log.txt" en "Info.txt" .

RSIT Logbestanden plaatsen

Voeg het logbestand met de naam "Log.txt" als bijlage toe aan het volgende bericht. (Dit logbestand kunt u tevens terug vinden in de map ""C:\\rsit")
Het logbestand met de naam "Info.txt" wat geminimaliseerd is hoeft u niet te plaatsen. (Dit logbestand wordt enkel de eerst keer bij het uitvoeren aangemaakt).
Hoe u een bijlage kunt toevoegen aan het bericht leest u hier.

De handleiding voor het gebruik van RSIT kan je HIER bekijken en we hebben ook nog een instructievideo.

froesjel · 7 september 2014

Logfile of random's system information tool 1.10 (written by random/random)

Run by alain at 2014-09-07 09:31:56

Microsoft Windows 7 Home Premium Service Pack 1

System drive C: has 472 GB (79%) free of 595 GB

Total RAM: 3563 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 9:32:06, on 7/09/2014

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.17239)

Boot mode: Normal

Running processes:

C:\Users\alain\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe

C:\Program Files (x86)\AVG\AVG2014\avgui.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Windows\SysWOW64\ctfmon.exe

C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe

C:\Program Files\trend micro\alain.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Microsoft-account - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll

O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [Facebook Update] "C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [isMyWinLockerReboot] msiexec.exe /qn /x{voidguid} (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [isMyWinLockerReboot] msiexec.exe /qn /x{voidguid} (User 'Default user')

O4 - Startup: Dropbox.lnk = alain\AppData\Roaming\Dropbox\bin\Dropbox.exe

O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O20 - AppInit_DLLs:

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe

O23 - Service: Dritek WMI Service (DsiWMIService) - Dritek System Inc. - C:\Program Files (x86)\Launch Manager\dsiwmis.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Live Updater Service - Acer Incorporated - C:\Program Files\Acer\Acer Updater\UpdaterService.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NTI IScheduleSvc - NTI Corporation - C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 10456 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe

c:\PROGRA~2\AVG\AVG2014\avgrsa.exe /boot

C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe /pipeName=74054d2f-ae9a-4c34-b4bd-ac2d1bd88c68 /coreSdkOptions=4382 /logConfFile="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014\temp\f52ddc3e-b656-4f5f-9b34-5a07a277b625-194-oopp.tmp" /loggerName=AVG.RS.Core /binaryPath="C:\Program Files (x86)\AVG\AVG2014\" /tempPath="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014\temp\" /logPath="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014\log\"

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

wininit.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

winlogon.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

"c:\Program Files\Microsoft Security Client\MsMpEng.exe"

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

atieclxx

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"

"C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe"

"C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe"

"C:\Program Files (x86)\Launch Manager\dsiwmis.exe"

"C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE"

"C:\Program Files\Acer\Acer Updater\UpdaterService.exe"

"C:\Program Files (x86)\Launch Manager\LMutilps32.exe" --system-level-mutex="Local\{B904A927-FE6B-48fd-8C83-6B807BED1F9C}" --enable-wmi-window

"C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe"

"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe"

C:\Windows\system32\svchost.exe -k imgsvc

"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"

"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"

WLIDSvcM.exe 2488

"C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe"

"C:\Program Files (x86)\AVG\AVG2014\avgemca.exe"

"C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"

C:\Windows\System32\alg.exe

"taskhost.exe"

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

"c:\Program Files\Microsoft Security Client\NisSrv.exe"

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding

"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

"C:\Users\alain\AppData\Roaming\Dropbox\bin\Dropbox.exe" /systemstartup

taskeng.exe {CE9C9B40-67FC-4335-9429-8F77EEDAC0E4}

"C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe"

"C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY

"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

C:\Windows\system32\SearchIndexer.exe /Embedding

ctfmon.exe

"C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe"

"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}

"C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe"

"C:\Users\alain\Documents\alain\RSITx64.exe"

C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3241781761-3953431157-4087400376-1000Core.job - C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3241781761-3953431157-4087400376-1000UA.job - C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe /ua /installsource scheduler

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]

Canon Easy-WebPrint EX BHO - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll [2014-01-24 209504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2014-08-10 256456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]

Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-12 1154720]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}]

Canon Easy-WebPrint EX BHO - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2014-01-24 176736]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-08-08 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Aanmeldhulp voor Microsoft-account - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2014-08-10 194504]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]

Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-12 1431712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-08-08 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-12 1154720]

{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll [2014-01-24 6126680]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2014-08-10 256456]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]

{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-12 1431712]

{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - Canon Easy-WebPrint EX - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2014-01-24 4438104]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2014-08-10 194504]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"Power Management"=C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [2011-05-10 1831528]

"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2014-03-11 1271072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"=C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-02-12 138096]

"swg"=C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2012-03-05 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeMovieService]

C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe [2011-02-18 177448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonQuickMenu]

C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [2013-05-02 1282120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dolby Advanced Audio v2]

C:\Dolby PCEE4\pcee4.exe [2011-02-03 506712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]

C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EgisTecPMMUpdate]

C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [2010-09-18 407920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EgisUpdate]

C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [2010-09-18 201584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON SX210 Series]

C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFDE.EXE [2008-11-06 223232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IJNetworkScannerSelectorEX]

C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [2013-02-19 453736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]

C:\Program Files (x86)\Launch Manager\LManager.exe [2011-03-31 1092688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVBg]

C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2011-03-21 2207848]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-04-07 11788392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-04-25 336384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuiteTray]

C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [2010-09-28 340336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2012-03-05 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^alain^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]

C:\Users\alain\AppData\Roaming\Dropbox\bin\Dropbox.exe [2014-07-30 36414496]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]

"AVG_UI"=C:\Program Files (x86)\AVG\AVG2014\avgui.exe [2014-08-25 5188112]

"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]

"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-07-25 256896]

C:\Users\alain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Dropbox.lnk - C:\Users\alain\AppData\Roaming\Dropbox\bin\Dropbox.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=5

"ConsentPromptBehaviorUser"=3

"EnableUIADesktopToggle"=0

"PromptOnSecureDesktop"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoActiveDesktop"=1

"NoActiveDesktopChanges"=1

"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"VIDC.UYVY"=msyuv.dll

"VIDC.YUY2"=msyuv.dll

"VIDC.YVYU"=msyuv.dll

"VIDC.IYUV"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"VIDC.YVU9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

"MSVideo8"=VfWWDM32.dll

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"aux"=wdmaud.drv

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-09-07 09:31:56 ----DC---- C:\rsit

2014-08-29 16:07:04 ----DC---- C:\ProgramData\Microsoft Help

2014-08-28 04:51:52 ----A---- C:\Windows\system32\win32k.sys

2014-08-28 04:51:50 ----A---- C:\Windows\SYSWOW64\gdi32.dll

2014-08-28 04:51:50 ----A---- C:\Windows\system32\gdi32.dll

2014-08-23 08:59:35 ----DC---- C:\Users\alain\AppData\Roaming\ATI

2014-08-13 08:01:50 ----A---- C:\Windows\SYSWOW64\infocardapi.dll

2014-08-13 08:01:50 ----A---- C:\Windows\system32\infocardapi.dll

2014-08-13 08:01:49 ----A---- C:\Windows\SYSWOW64\icardagt.exe

2014-08-13 08:01:49 ----A---- C:\Windows\system32\icardagt.exe

2014-08-13 08:01:46 ----A---- C:\Windows\SYSWOW64\icardres.dll

2014-08-13 08:01:46 ----A---- C:\Windows\system32\icardres.dll

2014-08-13 08:01:12 ----A---- C:\Windows\SYSWOW64\TsWpfWrp.exe

2014-08-13 08:01:12 ----A---- C:\Windows\system32\TsWpfWrp.exe

2014-08-13 07:58:37 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll

2014-08-13 07:58:36 ----A---- C:\Windows\SYSWOW64\mshtmled.dll

2014-08-13 07:58:36 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll

2014-08-13 07:58:35 ----A---- C:\Windows\SYSWOW64\urlmon.dll

2014-08-13 07:58:35 ----A---- C:\Windows\SYSWOW64\msfeeds.dll

2014-08-13 07:58:35 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll

2014-08-13 07:58:35 ----A---- C:\Windows\SYSWOW64\iernonce.dll

2014-08-13 07:58:35 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll

2014-08-13 07:58:35 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-08-13 07:58:35 ----A---- C:\Windows\system32\ieetwproxystub.dll

2014-08-13 07:58:34 ----A---- C:\Windows\SYSWOW64\mshtml.dll

2014-08-13 07:58:33 ----A---- C:\Windows\SYSWOW64\iesetup.dll

2014-08-13 07:58:32 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll

2014-08-13 07:58:32 ----A---- C:\Windows\system32\iernonce.dll

2014-08-13 07:58:32 ----A---- C:\Windows\system32\ie4uinit.exe

2014-08-13 07:58:31 ----A---- C:\Windows\SYSWOW64\jsproxy.dll

2014-08-13 07:58:31 ----A---- C:\Windows\SYSWOW64\iertutil.dll

2014-08-13 07:58:31 ----A---- C:\Windows\system32\urlmon.dll

2014-08-13 07:58:31 ----A---- C:\Windows\system32\ieetwcollectorres.dll

2014-08-13 07:58:31 ----A---- C:\Windows\system32\ieetwcollector.exe

2014-08-13 07:58:30 ----A---- C:\Windows\SYSWOW64\ieui.dll

2014-08-13 07:58:30 ----A---- C:\Windows\SYSWOW64\ieframe.dll

2014-08-13 07:58:30 ----A---- C:\Windows\SYSWOW64\dxtrans.dll

2014-08-13 07:58:30 ----A---- C:\Windows\system32\msfeeds.dll

2014-08-13 07:58:30 ----A---- C:\Windows\system32\dxtmsft.dll

2014-08-13 07:58:29 ----A---- C:\Windows\system32\iesetup.dll

2014-08-13 07:58:28 ----A---- C:\Windows\system32\iedkcs32.dll

2014-08-13 07:58:26 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll

2014-08-13 07:58:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe

2014-08-13 07:58:26 ----A---- C:\Windows\system32\iertutil.dll

2014-08-13 07:58:25 ----A---- C:\Windows\SYSWOW64\vbscript.dll

2014-08-13 07:58:25 ----A---- C:\Windows\SYSWOW64\jscript9.dll

2014-08-13 07:58:25 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll

2014-08-13 07:58:24 ----A---- C:\Windows\SYSWOW64\wininet.dll

2014-08-13 07:58:24 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll

2014-08-13 07:58:24 ----A---- C:\Windows\system32\jsproxy.dll

2014-08-13 07:58:23 ----A---- C:\Windows\SYSWOW64\msrating.dll

2014-08-13 07:58:22 ----A---- C:\Windows\system32\ieui.dll

2014-08-13 07:58:22 ----A---- C:\Windows\system32\dxtrans.dll

2014-08-13 07:58:21 ----A---- C:\Windows\system32\ieframe.dll

2014-08-13 07:58:20 ----A---- C:\Windows\system32\mshtmlmedia.dll

2014-08-13 07:58:20 ----A---- C:\Windows\system32\mshtmled.dll

2014-08-13 07:58:20 ----A---- C:\Windows\system32\ieUnatt.exe

2014-08-13 07:58:19 ----A---- C:\Windows\system32\jscript9diag.dll

2014-08-13 07:58:18 ----A---- C:\Windows\system32\vbscript.dll

2014-08-13 07:58:18 ----A---- C:\Windows\system32\jscript9.dll

2014-08-13 07:58:18 ----A---- C:\Windows\system32\ieapfltr.dll

2014-08-13 07:58:17 ----A---- C:\Windows\system32\wininet.dll

2014-08-13 07:58:16 ----A---- C:\Windows\system32\msrating.dll

2014-08-13 07:58:16 ----A---- C:\Windows\system32\MshtmlDac.dll

2014-08-13 07:58:14 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe

2014-08-13 07:58:14 ----A---- C:\Windows\system32\mshtml.dll

2014-08-13 07:57:11 ----A---- C:\Windows\system32\msi.dll

2014-08-13 07:57:10 ----A---- C:\Windows\SYSWOW64\msi.dll

2014-08-13 07:57:10 ----A---- C:\Windows\SYSWOW64\authui.dll

2014-08-13 07:57:10 ----A---- C:\Windows\system32\authui.dll

2014-08-13 07:57:09 ----A---- C:\Windows\SYSWOW64\msihnd.dll

2014-08-13 07:57:09 ----A---- C:\Windows\system32\msihnd.dll

2014-08-13 07:57:09 ----A---- C:\Windows\system32\consent.exe

2014-08-13 07:57:03 ----A---- C:\Windows\SYSWOW64\tzres.dll

2014-08-13 07:57:03 ----A---- C:\Windows\system32\tzres.dll

2014-08-13 07:56:38 ----A---- C:\Windows\SYSWOW64\KBDTAT.DLL

2014-08-13 07:56:38 ----A---- C:\Windows\system32\KBDTAT.DLL

2014-08-13 07:56:37 ----A---- C:\Windows\SYSWOW64\KBDYAK.DLL

2014-08-13 07:56:37 ----A---- C:\Windows\SYSWOW64\KBDRU1.DLL

2014-08-13 07:56:37 ----A---- C:\Windows\SYSWOW64\KBDRU.DLL

2014-08-13 07:56:37 ----A---- C:\Windows\SYSWOW64\KBDBASH.DLL

2014-08-13 07:56:37 ----A---- C:\Windows\system32\KBDYAK.DLL

2014-08-13 07:56:37 ----A---- C:\Windows\system32\KBDRU1.DLL

2014-08-13 07:56:37 ----A---- C:\Windows\system32\KBDRU.DLL

2014-08-13 07:56:37 ----A---- C:\Windows\system32\KBDBASH.DLL

2014-08-13 07:56:35 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys

2014-08-13 07:56:30 ----A---- C:\Windows\system32\rpcrt4.dll

2014-08-13 07:56:29 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll

2014-08-13 07:56:26 ----A---- C:\Windows\SYSWOW64\shell32.dll

2014-08-13 07:56:26 ----A---- C:\Windows\system32\shell32.dll

2014-08-13 07:53:19 ----A---- C:\Windows\system32\aepdu.dll

2014-08-13 07:53:17 ----A---- C:\Windows\system32\aeinv.dll

2014-08-08 05:47:53 ----AC---- C:\Windows\SYSWOW64\javaws.exe

2014-08-08 05:47:41 ----AC---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll

2014-08-08 05:47:41 ----AC---- C:\Windows\SYSWOW64\javaw.exe

2014-08-08 05:47:41 ----AC---- C:\Windows\SYSWOW64\java.exe

2014-08-08 05:47:24 ----DC---- C:\Program Files (x86)\Java

======List of files/folders modified in the last 1 month======

2014-09-07 09:32:06 ----DC---- C:\Windows\Prefetch

2014-09-07 09:32:04 ----DC---- C:\Program Files\trend micro

2014-09-07 09:30:09 ----DC---- C:\Windows\Temp

2014-09-07 08:13:36 ----DC---- C:\Windows\tracing

2014-09-07 07:15:12 ----DC---- C:\Users\alain\AppData\Roaming\Dropbox

2014-09-07 07:07:03 ----DC---- C:\Windows\inf

2014-09-07 07:06:59 ----DC---- C:\Windows\Minidump

2014-09-07 07:06:59 ----DC---- C:\Windows

2014-09-07 07:03:35 ----DC---- C:\Windows\system32\NDF

2014-09-07 06:57:19 ----DC---- C:\ProgramData\clear.fi

2014-09-07 06:54:32 ----DC---- C:\Windows\system32\config

2014-09-07 05:25:08 ----DC---- C:\ProgramData\MFAData

2014-09-06 10:39:11 ----DC---- C:\Windows\System32

2014-09-06 10:39:11 ----A---- C:\Windows\system32\PerfStringBackup.INI

2014-09-05 06:04:30 ----SHD---- C:\System Volume Information

2014-09-03 11:22:24 ----DC---- C:\ProgramData\CanonIJPLM

2014-09-03 09:58:01 ----SHDC---- C:\Windows\Installer

2014-09-03 09:58:00 ----SHDC---- C:\Config.Msi

2014-09-03 09:56:31 ----DC---- C:\Windows\system32\drivers

2014-08-30 13:20:18 ----DC---- C:\Users\alain\AppData\Roaming\SoftGrid Client

2014-08-29 18:45:26 ----HDC---- C:\ProgramData

2014-08-29 18:45:17 ----DC---- C:\Windows\system32\Tasks

2014-08-29 18:45:13 ----DC---- C:\Windows\Tasks

2014-08-29 16:07:16 ----SDC---- C:\Users\alain\AppData\Roaming\Microsoft

2014-08-28 09:14:21 ----D---- C:\Windows\winsxs

2014-08-28 09:10:39 ----DC---- C:\Windows\SysWOW64

2014-08-28 04:43:51 ----DC---- C:\Windows\system32\catroot2

2014-08-28 04:43:51 ----DC---- C:\Windows\system32\catroot

2014-08-24 08:32:04 ----D---- C:\Windows\rescache

2014-08-22 12:52:01 ----DC---- C:\Windows\Microsoft.NET

2014-08-22 12:50:21 ----RSDC---- C:\Windows\assembly

2014-08-15 05:38:58 ----AC---- C:\Windows\wininit.ini

2014-08-14 09:26:17 ----HDC---- C:\ProgramData\CanonIJScan

2014-08-14 09:26:17 ----DC---- C:\Users\alain\AppData\Roaming\Canon

2014-08-13 11:02:21 ----DC---- C:\Windows\debug

2014-08-13 08:51:47 ----DC---- C:\Windows\ehome

2014-08-13 08:51:46 ----RSDC---- C:\Windows\Fonts

2014-08-13 08:51:26 ----DC---- C:\Windows\SYSWOW64\nl-NL

2014-08-13 08:51:26 ----DC---- C:\Windows\system32\nl-NL

2014-08-13 08:51:21 ----DC---- C:\Program Files\Internet Explorer

2014-08-13 08:51:20 ----DC---- C:\Windows\SYSWOW64\en-US

2014-08-13 08:51:20 ----DC---- C:\Windows\PolicyDefinitions

2014-08-13 08:51:19 ----DC---- C:\Windows\system32\en-US

2014-08-13 08:51:19 ----DC---- C:\Program Files (x86)\Internet Explorer

2014-08-13 08:18:26 ----DC---- C:\Windows\system32\MRT

2014-08-13 08:13:17 ----A---- C:\Windows\system32\MRT.exe

2014-08-13 08:00:10 ----SDC---- C:\Windows\system32\CompatTel

2014-08-10 11:36:35 ----DC---- C:\Program Files (x86)\Google

2014-08-10 11:29:15 ----DC---- C:\Program Files (x86)

2014-08-08 05:48:14 ----DC---- C:\Program Files (x86)\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHA;AVGIDSHA; C:\Windows\system32\DRIVERS\avgidsha.sys [2014-06-17 190744]

R0 Avgloga;AVG Logging Driver; C:\Windows\system32\DRIVERS\avgloga.sys [2014-06-17 328984]

R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys [2014-08-06 123672]

R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys [2014-06-17 31512]

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-01-25 268512]

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]

R1 Avgdiska;AVG Disk Driver; C:\Windows\system32\DRIVERS\avgdiska.sys [2014-06-30 152344]

R1 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\avgidsdrivera.sys [2014-07-21 244504]

R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys [2014-06-17 235800]

R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys [2014-06-17 269080]

R1 avgtp;avgtp; \??\C:\Windows\system32\drivers\avgtpx64.sys [2014-03-21 49952]

R1 mwlPSDFilter;mwlPSDFilter; C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [2011-05-20 22912]

R1 mwlPSDNServ;mwlPSDNServ; C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [2011-05-20 20328]

R1 mwlPSDVDisk;mwlPSDVDisk; C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-05-20 62584]

R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-03-11 133928]

R2 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2013-03-01 36600]

R2 RMCAST;@%SystemRoot%\system32\wshrm.dll,-102; C:\Windows\system32\DRIVERS\RMCAST.sys [2010-11-21 146432]

R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-04-25 9257472]

R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-04-25 300544]

R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-03-17 2712064]

R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-04-12 2833256]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2011-01-25 77424]

R3 NTIDrvr;NTIDrvr; \??\C:\Windows\system32\drivers\NTIDrvr.sys [2011-03-10 18432]

R3 Sftfs;Sftfs; C:\Windows\system32\DRIVERS\Sftfslh.sys [2013-06-26 767144]

R3 Sftplay;Sftplay; C:\Windows\system32\DRIVERS\Sftplaylh.sys [2013-06-26 273576]

R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirlh.sys [2013-06-26 28840]

R3 Sftvol;Sftvol; C:\Windows\system32\DRIVERS\Sftvollh.sys [2013-06-26 23208]

R3 UBHelper;UBHelper; \??\C:\Windows\system32\drivers\UBHelper.sys [2011-03-10 17408]

R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-12-15 47232]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]

S3 A38CCID;CCID USB Smart Card Reader; C:\Windows\system32\DRIVERS\a38ccid.sys [2014-05-14 62592]

S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys [2010-12-30 117248]

S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2012-09-12 57856]

S3 huawei_cdcacm;huawei_cdcacm; C:\Windows\system32\DRIVERS\ew_jucdcacm.sys [2011-06-10 98816]

S3 huawei_cdcecm;huawei_cdcecm; C:\Windows\system32\DRIVERS\ew_jucdcecm.sys [2010-12-30 54784]

S3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys [2011-06-10 86016]

S3 huawei_ext_ctrl;huawei_ext_ctrl; C:\Windows\system32\DRIVERS\ew_juextctrl.sys [2011-06-10 28672]

S3 huawei_wwanecm;huawei_wwanecm; C:\Windows\system32\DRIVERS\ew_juwwanecm.sys [2011-06-10 213504]

S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-09-10 117248]

S3 hwusbfake;Huawei DataCard USB Fake; C:\Windows\system32\DRIVERS\ewusbfake.sys []

S3 KMWDFILTER;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 30208]

S3 netr7364;Stuurprogramma voor RT73 USB draadloze LAN-kaart voor Vista; C:\Windows\system32\DRIVERS\netr7364.sys [2009-06-10 707072]

S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-11-24 19456]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-12-01 250984]

S3 RTL8192su;%RTL8192su.DeviceDesc.DispName%; C:\Windows\system32\DRIVERS\RTL8192su.sys [2010-01-06 676864]

S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-11-13 56832]

S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]

S3 usbrndis6;USB RNDIS6-adapter; C:\Windows\system32\DRIVERS\usb80236.sys [2013-02-12 19968]

S3 usbscan;Stuurprogramma voor USB-scanner; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]

S3 WinUsb;WinUsb-stuurprogramma; C:\Windows\system32\drivers\WinUSB.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-04-25 204288]

R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [2014-08-25 3242000]

R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [2014-08-25 289328]

R2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2013-04-22 822504]

R2 DsiWMIService;Dritek WMI Service; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-03-31 352848]

R2 IJPLMSVC;Canon Inkjet Printer/Scanner/Fax Extended Survey Program; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [2013-05-14 140936]

R2 Live Updater Service;Live Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2012-04-05 255376]

R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2014-03-11 23808]

R2 NTI IScheduleSvc;NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-04-24 256832]

R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-06-26 523944]

R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]

R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 2292480]

R3 BBUpdate;BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe [2014-03-12 247968]

R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2014-03-11 347872]

R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-06-26 207528]

S2 BBSvc;BingBar Service; C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.exe [2014-03-12 193696]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]

S2 gupdate;Google Update-service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-09 116648]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09 262320]

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-03-04 655624]

S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-09-12 1512448]

S3 gupdatem;Google Update-service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-09 116648]

S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-10-09 194032]

S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-08-13 111616]

S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]

S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-03-05 1255736]

S4 aspnet_state;ASP.NET-statusservice; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]

S4 EgisTec Ticket Service;EgisTec Ticket Service; C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-09-28 172912]

S4 ePowerSvc;Acer ePower Service; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2011-05-10 872552]

S4 EPSON_EB_RPCV4_01;EPSON V5 Service4(01); C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE [2007-12-17 163840]

S4 EPSON_PM_RPCV4_01;EPSON V3 Service4(01); C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE [2007-01-11 126464]

S4 GREGService;GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2011-01-18 39528]

S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]

-----------------EOF-----------------

kape · 7 september 2014

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe (hier en hier) kan je lezen hoe je dat doet.

Download Zoek.exe naar het bureaublad (niet de .zip- of .rar-versie)

Wanneer Internet Explorer of een andere browser of virusscanner melding geeft dat dit bestand onveilig zou zijn kun je negeren, dit is namelijk een onterechte waarschuwing.
Dubbelklik op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.

  {5513F07E-936B-4E52-9B00-067394E91CC5};c
 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows];r64
"AppInit_DLLs"=-;r64
 emptyfolderscheck;delete 
startupall; 
filesrcm;

Klik op de knop "More options" en vink nu de onderstaande opties aan.
Do a Deep Scan
Auto Clean
De optie "Scan All Users" staat standaard aangevinkt.
Klik nu op de knop "Run script".
Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
Mocht er geen logje verschijnen, start zoek.exe dan opnieuw en klik op de knop zoek-results.log, de log verschijnt dan alsnog.
Post het geopende logje in het volgende bericht als bijlage.

Zoek.exe logbestand plaatsen

Voeg het logbestand met de naam "Zoek-results.log" als bijlage toe aan het volgende bericht. (Dit logbestand kunt u tevens terug vinden op de systeemschijf als C:\\Zoek-results.log.)
Hoe u een bijlage kunt toevoegen aan het bericht leest u hier.

froesjel · 7 september 2014

Zoek.exe v5.0.0.0 Updated 07-September-2014

Tool run by alain on zo 07/09/2014 at 17:41:49,69.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\alain\Documents\alain\zoek.exe [scan all users] [Checkboxes used]

==== Older Logs ======================

C:\zoek-results2014-09-07-110758.log 34148 bytes

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Running Processes ======================

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe

C:\Program Files (x86)\Launch Manager\dsiwmis.exe

C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

C:\Program Files\Acer\Acer Updater\UpdaterService.exe

C:\Program Files (x86)\Launch Manager\LMutilps32.exe

C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Users\alain\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe

C:\Program Files (x86)\AVG\AVG2014\avgui.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Windows\SysWOW64\ctfmon.exe

C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe

C:\Users\alain\Documents\alain\zoek.exe

C:\Windows\SysWOW64\cmd.exe

==== Deleting Services ======================

==== System Specs ======================

Windows: Windows 7 Home Premium Edition (64-bit) Service Pack 1 (Build 7601)

Memory (RAM): 3563 MB

CPU Info: AMD A4-3300M APU with Radeon HD Graphics

CPU Speed: 1943,9 MHz

Sound Card: Luidsprekers (Realtek High Defi |

Display Adapters: AMD Radeon HD 6480G | AMD Radeon HD 6480G | RDPDD Chained DD | RDP Encoder Mirror Driver | RDP Reflector Display Driver

Monitors: 1x; Algemeen PnP-beeldscherm |

Screen Resolution: 1600 X 900 - 32 bit

Network: Network Present

Network Adapters: Microsoft Virtual WiFi Miniport Adapter | Atheros AR5B97 Wireless Network Adapter | Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.20)

CD / DVD Drives: 1x (D: | ) D: TSSTcorpCDDVDW TS-L633F

Ports: COM Ports NOT Present. LPT Port NOT Present.

Mouse: 8 Button Wheel Mouse Present

Hard Disks: C: 581,1GB | Q: 0,0MB

Hard Disks - Free: C: 460,0GB | Q: 0,0MB

Manufacturer *: Acer

BIOS Info: AT/AT COMPATIBLE | 05/04/11 | ACRSYS - 1

Time Zone: West-Europa (standaardtijd)

Motherboard *: Acer JE70-SB

Country: Belgi‰

Language: NLB

==== System Specs (Software) ======================

Anti-Virus: AVG AntiVirus Free Edition 2014 On-access scanning disabled (Outdated)

Anti-Virus: Microsoft Security Essentials On-access scanning disabled (Outdated)

Anti-Spyware: Windows Defender disabled (Outdated)

Anti-Spyware: AVG AntiVirus Free Edition 2014 disabled (Outdated)

Anti-Spyware: Microsoft Security Essentials disabled (Outdated)

Internet Explorer Version: 11.0.9600.17239

Adobe Reader version: 11.0.8.4

Sun Java version: 1.7.0_67 (32-bit)

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\alain\AppData\Local\Temp ====

2014-09-07 04:56:55 D11FB7A5078631BE2E183DC56FCD5375 43008 -c--a-w- C:\Users\alain\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpokonnx.dll

====== Java Cache =====

====== C:\Windows\SysWOW64 =====

2014-08-28 02:51:50 980305AC3AF53C1964A11190451ABB32 311808 ----a-w- C:\Windows\SysWOW64\gdi32.dll

====== C:\Windows\SysWOW64\drivers =====

====== C:\Windows\Sysnative =====

2014-08-28 02:51:52 A347EF56B7CD8360B3EF7772FEA597B9 3163648 ----a-w- C:\Windows\Sysnative\win32k.sys

2014-08-28 02:51:50 860528C9E50AB84935843B23A80E665E 404480 ----a-w- C:\Windows\Sysnative\gdi32.dll

====== C:\Windows\Sysnative\drivers =====

2014-08-13 05:56:35 87CE5C8965E101CCCED1F4675557E868 985536 ----a-w- C:\Windows\Sysnative\drivers\dxgkrnl.sys

====== C:\Windows\Tasks ======

2014-08-10 09:32:27 0C3ACBE5A53427BA4574A71589019F3A 2984 -c--a-w- C:\Windows\Sysnative\Tasks\{0D8EF99F-AF1D-4A05-8A55-978FB2AE2594}

====== C:\Windows\Temp ======

======= C:\Program Files =====

======= C:\PROGRA~2 =====

======= C: =====

====== C:\Users\alain\AppData\Roaming ======

2014-09-07 11:07:58 -------- dc----w- C:\Users\Gast\AppData\Local\Temp

2014-09-07 11:07:58 -------- d-----w- C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp

2014-09-07 11:07:58 -------- d-----w- C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp

2014-09-07 11:07:57 -------- dc----w- C:\Users\Cody\AppData\Local\Temp

2014-09-01 11:41:03 -------- dc----w- C:\Users\Gast\AppData\Locallow\Adobe

2014-09-01 11:41:03 -------- dc----w- C:\Users\Gast\AppData\Local\Adobe

2014-08-29 14:07:04 -------- dc----w- C:\Users\alain\AppData\Local\Microsoft Help

2014-08-23 06:59:35 -------- dc----w- C:\Users\alain\AppData\Roaming\ATI

====== C:\Users\alain ======

2014-08-29 14:07:04 -------- dc----w- C:\ProgramData\Microsoft Help

====== C: exe-files ==

2014-09-07 15:39:45 0F78D7226515CE867F8279403807848A 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-3241781761-3953431157-4087400376-1000\$IIQ3FZU.exe

2014-09-07 15:34:11 EE2DE64056FD4743B81E37CDC15CC704 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-3241781761-3953431157-4087400376-1000\$IIVOR09.exe

2014-09-07 07:30:08 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 -c--a-w- C:\Users\alain\Documents\alain\RSITx64.exe

2014-09-03 07:51:40 A9F5BF3EC85A8F5EA668FD404B61C2B8 16912 -c--a-w- C:\Program Files (x86)\AVG\AVG2014\avgrdtesta.exe

2014-09-03 07:51:40 A715DD1F4D7894100FBA9153048FDE1B 62992 ----a-w- C:\Windows\System32\config\systemprofile\AppData\Local\Avg2014\update\backup\avguirux.exe

2014-09-03 07:51:40 9B3A0BC81C174ADF77DC6869AC6BCDDD 15888 ----a-w- C:\Windows\System32\config\systemprofile\AppData\Local\Avg2014\update\backup\avgrdtestx.exe

2014-09-03 07:51:40 88950BBD830F5CCA4B18BD6AB3DD05FF 16912 ----a-w- C:\Windows\System32\config\systemprofile\AppData\Local\Avg2014\update\backup\avgrdtesta.exe

2014-09-03 07:51:40 7556F0CCABAD60FA2F19165D6BBD92EA 62992 -c--a-w- C:\Program Files (x86)\AVG\AVG2014\avguirux.exe

2014-09-03 07:51:40 4505C7EEC5B0FFA5C45A7450198CBCC0 6018176 ----a-w- C:\Windows\System32\config\systemprofile\AppData\Local\Avg2014\update\backup\avgmfapx.exe

2014-09-03 07:51:40 23E082855C7B3552390F425153617767 6018176 -c--a-w- C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe

2014-09-03 07:51:40 0FED596E388C979A5E865CEBA466B927 15888 -c--a-w- C:\Program Files (x86)\AVG\AVG2014\avgrdtestx.exe

=== C: other files ==

2014-09-07 15:41:46 D6438BE54C3A66CBCA2BBA4749DCF5B7 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-3241781761-3953431157-4087400376-1000\$IQWUIIR.zip

2014-09-07 15:39:45 DC0BD2D13FF9083AF2E6BAF51643BD4E 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-3241781761-3953431157-4087400376-1000\$IS047YW.com

2014-09-07 15:34:01 51FF283B10FD007BE4C2E4052F629F69 544 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-3241781761-3953431157-4087400376-1000\$IRFR2DW.com

2014-09-07 10:18:56 CD01F2F46B95ABBEA783B5A4FC88D2AC 4108341 -c--a-w- C:\$RECYCLE.BIN\S-1-5-21-3241781761-3953431157-4087400376-1000\$RQWUIIR.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-3241781761-3953431157-4087400376-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver "

"swg"="C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"IsMyWinLockerReboot"="msiexec.exe /qn /x{voidguid}"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

"IsMyWinLockerReboot"="msiexec.exe /qn /x{voidguid}"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

"IsMyWinLockerReboot"="msiexec.exe /qn /x{voidguid}"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"IsMyWinLockerReboot"="msiexec.exe /qn /x{voidguid}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AVG_UI"="C:\Program Files (x86)\AVG\AVG2014\avgui.exe /TRAYONLY"

"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"BackupManagerTray"="C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe -h -k"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver "

"swg"="C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Power Management"="C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe "

"MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey"

==== Startup Registry Disabled ======================

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run-]

"SkyDrive"="\"C:\\Users\\alain\\AppData\\Local\\Microsoft\\SkyDrive\\SkyDrive.exe\" /background"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]

"SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""

"Adobe ARM"="\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\""

==== Startup Registry Disabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ArcadeMovieService]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="ArcadeMovieService"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\Acer\\clear.fi\\Movie\\clear.fiMovieService.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CanonQuickMenu]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="CanonQuickMenu"

"hkey"="HKLM"

"command"="C:\\Program Files (x86)\\Canon\\Quick Menu\\CNQMMAIN.EXE /logon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Dolby Advanced Audio v2]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Dolby Advanced Audio v2"

"hkey"="HKLM"

"command"="\"C:\\Dolby PCEE4\\pcee4.exe\" -autostart"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EgisTecPMMUpdate]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="EgisTecPMMUpdate"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\EgisTec IPS\\PmmUpdate.exe\" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EgisUpdate]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="EgisUpdate"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\EgisTec IPS\\EgisUpdate.exe\" -d "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EPSON SX210 Series]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="EPSON SX210 Series"

"hkey"="HKCU"

"command"="C:\\Windows\\system32\\spool\\DRIVERS\\x64\\3\\E_IATIFDE.EXE /FU \"C:\\Users\\alain\\AppData\\Local\\Temp\\E_S145B.tmp\" /EF \"HKCU\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IJNetworkScannerSelectorEX]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="IJNetworkScannerSelectorEX"

"hkey"="HKLM"

"command"="C:\\Program Files (x86)\\Canon\\IJ Network Scanner Selector EX\\CNMNSST.exe /FORCE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LManager]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="LManager"

"hkey"="HKLM"

"command"="C:\\Program Files (x86)\\Launch Manager\\LManager.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RtHDVBg]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="RtHDVBg"

"hkey"="HKLM"

"command"="C:\\Program Files\\Realtek\\Audio\\HDA\\RAVBg64.exe /FORPCEE4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RtHDVCpl]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="RtHDVCpl"

"hkey"="HKLM"

"command"="C:\\Program Files\\Realtek\\Audio\\HDA\\RAVCpl64.exe -s"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\StartCCC]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="StartCCC"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe\" MSRun"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SuiteTray]

"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="SuiteTray"

"hkey"="HKLM"

"command"="\"C:\\Program Files (x86)\\EgisTec MyWinLockerSuite\\x86\\SuiteTray.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\swg]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="swg"

"hkey"="HKCU"

"command"="\"C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^alain^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]

"item"="Dropbox"

"path"="C:\\Users\\alain\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Dropbox.lnk"

"backup"="C:\\Windows\\pss\\Dropbox.lnk.Startup"

"backupExtension"=".Startup"

"command"="C:\\Users\\alain\\AppData\\Roaming\\Dropbox\\bin\\Dropbox.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\EPSON_EB_RPCV4_01]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\EPSON_PM_RPCV4_01]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\VmbService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]

"MSC"="\"c:\\Program Files\\Microsoft Security Client\\msseces.exe\" -hide -runkey"

==== Startup Folders ======================

2014-06-23 07:25:50 1053 -c--a-w- C:\Users\alain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a--c--- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [09/07/2014 13:49]

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3241781761-3953431157-4087400376-1000Core.job --a--c--- C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe [12/02/2013 14:13]

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3241781761-3953431157-4087400376-1000UA.job --a--c--- C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe [12/02/2013 14:13]

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [09/10/2012 07:53]

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [09/10/2012 07:53]

==== Other Scheduled Tasks ======================

"C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]

"C:\Windows\SysNative\tasks\Adobe online update program" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe]

"C:\Windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"]

"C:\Windows\SysNative\tasks\clear.fi" ["C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe"]

"C:\Windows\SysNative\tasks\clear.fiAgent" ["C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe"]

"C:\Windows\SysNative\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe]

"C:\Windows\SysNative\tasks\DMREngine" ["C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe"]

"C:\Windows\SysNative\tasks\FacebookUpdateTaskUserS-1-5-21-3241781761-3953431157-4087400376-1000Core" [C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe]

"C:\Windows\SysNative\tasks\FacebookUpdateTaskUserS-1-5-21-3241781761-3953431157-4087400376-1000UA" [C:\Users\alain\AppData\Local\Facebook\Update\FacebookUpdate.exe]

"C:\Windows\SysNative\tasks\Google Updater and Installer" [C:\Users\alain\AppData\Local\Google\Update\GoogleUpdate.exe]

"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]

"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]

"C:\Windows\SysNative\tasks\Java Update Scheduler" [C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe]

"C:\Windows\SysNative\tasks\User_Feed_Synchronization-{97AA51C9-AC69-4524-B564-DB6C5E236309}" [C:\Windows\system32\msfeedssync.exe]

"C:\Windows\SysNative\tasks\{0D8EF99F-AF1D-4A05-8A55-978FB2AE2594}" [C:\Program Files (x86)\Google\Chrome\Application\chrome.exe]

"C:\Windows\SysNative\tasks\{1137D312-D604-40E6-80D4-64945D0C9DCB}" [C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE]

"C:\Windows\SysNative\tasks\{1E86B152-0279-4C4A-B3F7-BF4C47CCD9C2}" [D:\AUTORUN.EXE]

"C:\Windows\SysNative\tasks\{37415A4E-3F55-412F-A600-E2EE497A832D}" [C:\Program Files (x86)\Mobistar Internet Everywhere\Mobistar Internet Everywhere.exe]

"C:\Windows\SysNative\tasks\{831227B2-235C-419D-A532-F99F94993806}" [D:\AUTORUN.EXE]

"C:\Windows\SysNative\tasks\{8E2D9D37-81B1-438C-93A9-B73D30E01F35}" [D:\AUTORUN.EXE]

"C:\Windows\SysNative\tasks\{AF454F46-4C32-4E2E-BCF4-563D25CB09BC}" [C:\Program Files (x86)\Microsoft Office\Options14\MSOO.EXE]

"C:\Windows\SysNative\tasks\{BAF2D979-D8DC-47F1-A257-4EAB52E461BF}" [C:\Program Files (x86)\Mobistar Internet Everywhere\Mobistar Internet Everywhere.exe]

"C:\Windows\SysNative\tasks\{CA4BF9A3-5B8D-473D-8610-5639D3C97E87}" [C:\Program Files (x86)\Microsoft Office\Options14\MSOO.EXE]

"C:\Windows\SysNative\tasks\{CADF8D62-B9C9-4A4D-A65D-35A3A9705C6E}" [D:\AUTORUN.EXE]

"C:\Windows\SysNative\tasks\{CDDEFDED-A3AD-41AD-B8CC-3802F4328783}" [C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE]

"C:\Windows\SysNative\tasks\{E7E3EE23-A1FA-496C-B7CF-DC47F484AFB9}" [C:\Program Files (x86)\Mobistar Internet Everywhere\Mobistar Internet Everywhere.exe]

"C:\Windows\SysNative\tasks\{E9764320-6B91-4284-B9B7-3184EBBE7639}" [C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE]

"C:\Windows\SysNative\tasks\{EA946BB5-03C2-4352-8CD3-C37E263CBB05}" [D:\AUTORUN.EXE]

"C:\Windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc]

==== Firefox Extensions ======================

ProfilePath: C:\Users\alain\AppData\Roaming\Mozilla\Firefox\Profiles\i4emk1mu.default

- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\alain\AppData\Roaming\Mozilla\Firefox\Profiles\i4emk1mu.default

506C758195FD6F4F1594C0F1B1E32A15 - C:\ProgramData\Kortingzoeker\FFExtension20131010193222\plugins\npdf.dll - MoneyMillionaire plugin

4F26678A032868EA584431944FB2E6C7 - C:\Users\alain\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15\npofficeondemand.dll - Microsoft Office 2013

FF0D6F82A0EC13952E83B9439100E45D - C:\Users\alain\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin

==== Chrome Look ======================

Google Docs - alain\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake

Google Drive - alain\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf

YouTube - alain\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

Google Search - alain\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

Google Wallet - alain\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Gmail - alain\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="Bing"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="Bing"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{20711F84-BDC0-4ABF-84DA-B974A90FDD74}"

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="{searchTerms - Google Search}"

{20711F84-BDC0-4ABF-84DA-B974A90FDD74} Bing Url="{searchTerms} - Bing"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="{searchTerms} - Google Search}"

==== HijackThis Entries ======================