Weergegeven resultaten: 1 t/m 16 van 16
  1. #1
    Approved 9-lifer FreakyJP's schermafbeelding
    Lid sinds
    21/11/04
    Locatie
    Brussel
    Berichten
    7.449
    iTrader
    83 (100%)

    pc geblokkeerd door virus (e-cops ukash zever)

    Daarnet is mijn pc geblokkeerd geraakt door dat virus waar de 'cyberpolitie' u zo €100 boete vraagt omdat je zogezegd kinderporno en contact met terroristen hebt. Anyway:

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 18:25:55, on 29/03/2012
    Platform: Windows 7 (WinNT 6.00.3504)
    MSIE: Internet Explorer v9.00 (9.00.8112.16421)
    Boot mode: Normal

    Running processes:
    C:\Program Files (x86)\D-Link\DWA-547 revA\wirelesscm.exe
    C:\Program Files (x86)\XFastUsb\XFastUsb.exe
    C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    B:\Adobe\apdproxy.exe
    B:\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Freecorder\FLVSrvc.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\Windows\SysWOW64\NOTEPAD.EXE
    B:\FFT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN | Hotmail | Messenger | Nieuws, sport, entertainment, video, lifestyle, auto en nog veel meer, dat is MSN !
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN | Hotmail | Messenger | Nieuws, sport, entertainment, video, lifestyle, auto en nog veel meer, dat is MSN !
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN | Hotmail | Messenger | Nieuws, sport, entertainment, video, lifestyle, auto en nog veel meer, dat is MSN !
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
    F2 - REGystem.ini: UserInit=userinit.exe
    O2 - BHO: Freecorder - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files (x86)\Freecorder\prxtbFree.dll
    O4 - HKLM\..\Run: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [THX TruStudio NB Settings] "C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" /r
    O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
    O4 - HKLM\..\Run: [SmartViewAgent] "C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe"
    O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "B:\Adobe\apdproxy.exe"
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.ex e" -launchedbylogin
    O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManage r.exe" -launchedbylogin
    O4 - HKLM\..\Run: [iTunesHelper] "B:\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [Freecorder FLV Service] "C:\Program Files (x86)\Freecorder\FLVSrvc.exe" /run
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
    O4 - HKCU\..\Run: [Steam] "B:\Steam\steam.exe" -silent
    O4 - HKCU\..\Run: [MyTomTomSA.exe] "C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe"
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe" -automount
    O4 - HKCU\..\Run: [Spotify] "C:\Users\FreakyJP\AppData\Roaming\Spotify\Spotify .exe" /uri spotify:autostart
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
    O4 - Startup: cgs8h0.exe.lnk = C:\Windows\System32\rundll32.exe
    O4 - Startup: Dropbox.lnk = C:\Users\FreakyJP\AppData\Roaming\Dropbox\bin\Drop box.exe
    O4 - Startup: OpenOffice.org 3.3 .lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
    O4 - Global Startup: AML Device Install.lnk = C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe
    O4 - Global Startup: Wireless Connection Manager.lnk = ?
    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
    O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
    O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
    O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspn et_state.exe (file missing)
    O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\ASRock\XFast LAN\spd.exe
    O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
    O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: JumpStart Wi-Fi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files (x86)\D-Link\DWA-547 revA\jswpsapi.exe
    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: SmartView service (SmartViewService) - Unknown owner - C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
    O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
    O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
    O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
    O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

    --
    End of file - 10510 bytes

  2. #2
    Member Juisterr's schermafbeelding
    Lid sinds
    10/11/06
    Locatie
    Oegstgeest
    Berichten
    2.529
    iTrader
    0
    Download ComboFix van één van deze locaties:

    Link 1
    Link 2


    * BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op.

    >>Hier<< kunt u lezen hoe u Combofix dient te gebruiken.




    http://www.imgdumper.nl/uploads4/4de...3-Combofix.JPG

    1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix.

    * (hier of hier 2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.
    3. Dubbelklik op "Combofix.exe" om de tool te starten.
    4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

    * Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion." herstart dan de computer.

    5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

  3. #3
    Approved 9-lifer FreakyJP's schermafbeelding
    Lid sinds
    21/11/04
    Locatie
    Brussel
    Berichten
    7.449
    iTrader
    83 (100%)
    Kan toch geen kwaad als ik dat niet met de 'geïnfecteerde account' doe hé?

    ComboFix 12-03-29.02 - Wouter 29/03/2012 19:44:28.1.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.8175.6548 [GMT 2:00]
    Running from: c:\users\Wouter\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
    SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\ntuser.dat
    c:\users\FreakyJP\AppData\Roaming\Microsoft\Window s\Start Menu\Programs\Startup\cgs8h0.exe.lnk
    c:\users\FreakyJP\AppData\Roaming\Microsoft\Window s\Start Menu\Programs\Startup\OpenOffice.org 3.3 .lnk
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-02-28 to 2012-03-29 )))))))))))))))))))))))))))))))
    .
    .
    2012-03-29 16:44 . 2012-03-29 16:45 -------- d-----w- c:\users\Wouter\AppData\Roaming\vlc
    2012-03-29 16:11 . 2012-03-29 16:11 -------- d--h--w- c:\programdata\Common Files
    2012-03-29 16:10 . 2012-03-29 16:11 -------- d-----w- c:\programdata\MFAData
    2012-03-29 16:09 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DE4484ED-E1EC-4AEF-B142-86926314D3F4}\mpengine.dll
    2012-03-29 15:24 . 2012-03-29 15:24 -------- d-----w- c:\users\Wouter\AppData\Local\FLVService
    2012-03-25 08:46 . 2012-03-25 08:47 -------- d-----w- c:\program files (x86)\Freecorder
    2012-03-24 09:26 . 2012-03-24 09:26 -------- d-----w- c:\programdata\ATI
    2012-03-24 09:21 . 2012-03-24 09:21 -------- d-----w- c:\programdata\AMD
    2012-03-24 09:21 . 2012-03-24 09:21 -------- d-----w- c:\program files (x86)\AMD AVT
    2012-03-24 09:21 . 2012-03-24 09:21 -------- d-----w- c:\program files (x86)\AMD APP
    2012-03-24 09:19 . 2012-03-24 09:19 -------- d-----w- C:\AMD
    2012-03-18 14:49 . 2012-03-18 14:49 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
    2012-03-18 14:49 . 2012-03-18 14:49 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
    2012-03-14 23:44 . 2011-11-19 18:30 5504880 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-03-14 23:44 . 2011-11-19 14:25 3957616 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2012-03-14 23:44 . 2011-11-19 14:25 3902320 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2012-03-14 22:09 . 2012-02-03 04:16 3143168 ----a-w- c:\windows\system32\win32k.sys
    2012-03-14 22:09 . 2012-02-10 06:18 1541120 ----a-w- c:\windows\system32\DWrite.dll
    2012-03-14 22:09 . 2012-02-10 06:17 320512 ----a-w- c:\windows\system32\d3d10_1core.dll
    2012-03-14 22:09 . 2012-02-10 05:41 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
    2012-03-14 22:09 . 2012-02-10 05:41 218624 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
    2012-03-14 22:09 . 2012-02-10 06:17 1837568 ----a-w- c:\windows\system32\d3d10warp.dll
    2012-03-14 22:09 . 2012-02-10 06:17 902656 ----a-w- c:\windows\system32\d2d1.dll
    2012-03-14 22:09 . 2012-02-10 06:17 197120 ----a-w- c:\windows\system32\d3d10_1.dll
    2012-03-14 22:09 . 2012-02-10 05:41 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
    2012-03-14 22:09 . 2012-02-10 05:41 1170944 ----a-w- c:\windows\SysWow64\d3d10warp.dll
    2012-03-14 22:09 . 2012-02-10 05:41 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
    2012-03-14 22:04 . 2012-02-15 06:27 1031680 ----a-w- c:\windows\system32\rdpcore.dll
    2012-03-14 22:04 . 2012-02-15 05:44 826368 ----a-w- c:\windows\SysWow64\rdpcore.dll
    2012-03-14 22:04 . 2012-02-15 04:47 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2012-03-14 22:04 . 2012-02-15 04:46 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
    2012-03-14 22:04 . 2012-01-25 06:27 76288 ----a-w- c:\windows\system32\rdpwsx.dll
    2012-03-14 22:04 . 2012-01-25 06:27 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
    2012-03-14 22:04 . 2012-01-25 06:20 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
    2012-03-11 13:08 . 2012-03-11 13:08 -------- d-----w- c:\programdata\InstallShield
    2012-03-11 13:08 . 2012-03-11 13:08 -------- d-----w- c:\program files (x86)\Common Files\Jasc Software Inc
    2012-03-11 13:08 . 2012-03-11 13:08 -------- d-----w- c:\users\FreakyJP\AppData\Roaming\Jasc Software Inc
    2012-03-11 13:08 . 2012-03-11 13:08 -------- d-----w- c:\program files (x86)\Jasc Software Inc
    2012-03-04 09:22 . 2012-03-04 09:22 2434856 ----a-w- c:\windows\SysWow64\pbsvc_bc2.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2012-03-24 13:25 . 2011-10-01 11:55 280736 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
    2012-03-24 13:25 . 2011-10-01 11:01 280736 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
    2012-03-24 13:23 . 2011-10-01 11:01 215128 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
    2012-03-14 03:27 . 2011-09-15 21:41 8669240 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2012-03-04 10:29 . 2011-10-01 11:01 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
    2012-02-21 17:51 . 2012-02-21 17:51 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
    2012-02-21 17:51 . 2012-02-21 17:51 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
    2012-02-21 17:51 . 2012-02-21 17:51 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
    2012-02-21 17:51 . 2012-02-21 17:51 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
    2012-02-21 17:51 . 2012-02-21 17:51 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
    2012-02-21 17:51 . 2012-02-21 17:51 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
    2012-02-21 17:51 . 2012-02-21 17:51 367104 ----a-w- c:\windows\SysWow64\html.iec
    2012-02-21 17:51 . 2012-02-21 17:51 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
    2012-02-21 17:51 . 2012-02-21 17:51 1798656 ----a-w- c:\windows\SysWow64\jscript9.dll
    2012-02-21 17:51 . 2012-02-21 17:51 161792 ----a-w- c:\windows\SysWow64\msls31.dll
    2012-02-21 17:51 . 2012-02-21 17:51 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
    2012-02-21 17:51 . 2012-02-21 17:51 1127424 ----a-w- c:\windows\SysWow64\wininet.dll
    2012-02-21 17:51 . 2012-02-21 17:51 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
    2012-02-21 17:51 . 2012-02-21 17:51 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
    2012-02-21 17:51 . 2012-02-21 17:51 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
    2012-02-21 17:51 . 2012-02-21 17:51 49664 ----a-w- c:\windows\system32\imgutil.dll
    2012-02-21 17:51 . 2012-02-21 17:51 48640 ----a-w- c:\windows\system32\mshtmler.dll
    2012-02-21 17:51 . 2012-02-21 17:51 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
    2012-02-21 17:51 . 2012-02-21 17:51 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
    2012-02-21 17:51 . 2012-02-21 17:51 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
    2012-02-21 17:51 . 2012-02-21 17:51 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2012-02-21 17:51 . 2012-02-21 17:51 2308096 ----a-w- c:\windows\system32\jscript9.dll
    2012-02-21 17:51 . 2012-02-21 17:51 222208 ----a-w- c:\windows\system32\msls31.dll
    2012-02-21 17:51 . 2012-02-21 17:51 173056 ----a-w- c:\windows\system32\ieUnatt.exe
    2012-02-21 17:51 . 2012-02-21 17:51 152064 ----a-w- c:\windows\SysWow64\wextract.exe
    2012-02-21 17:51 . 2012-02-21 17:51 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
    2012-02-21 17:51 . 2012-02-21 17:51 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
    2012-02-21 17:51 . 2012-02-21 17:51 1390080 ----a-w- c:\windows\system32\wininet.dll
    2012-02-21 17:51 . 2012-02-21 17:51 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
    2012-02-21 17:51 . 2012-02-21 17:51 12288 ----a-w- c:\windows\system32\mshta.exe
    2012-02-21 17:51 . 2012-02-21 17:51 11776 ----a-w- c:\windows\SysWow64\mshta.exe
    2012-02-21 17:51 . 2012-02-21 17:51 114176 ----a-w- c:\windows\system32\admparse.dll
    2012-02-21 17:51 . 2012-02-21 17:51 101888 ----a-w- c:\windows\SysWow64\admparse.dll
    2012-02-21 17:51 . 2012-02-21 17:51 111616 ----a-w- c:\windows\system32\iesysprep.dll
    2012-02-21 17:51 . 2012-02-21 17:51 85504 ----a-w- c:\windows\system32\iesetup.dll
    2012-02-21 17:51 . 2012-02-21 17:51 76800 ----a-w- c:\windows\system32\tdc.ocx
    2012-02-21 17:51 . 2012-02-21 17:51 603648 ----a-w- c:\windows\system32\vbscript.dll
    2012-02-21 17:51 . 2012-02-21 17:51 448512 ----a-w- c:\windows\system32\html.iec
    2012-02-21 17:51 . 2012-02-21 17:51 30720 ----a-w- c:\windows\system32\licmgr10.dll
    2012-02-21 17:51 . 2012-02-21 17:51 165888 ----a-w- c:\windows\system32\iexpress.exe
    2012-02-21 17:51 . 2012-02-21 17:51 160256 ----a-w- c:\windows\system32\wextract.exe
    2012-02-21 17:51 . 2012-02-21 17:51 1493504 ----a-w- c:\windows\system32\inetcpl.cpl
    2012-02-15 10:01 . 2012-02-15 10:01 52736 ----a-w- c:\windows\system32\drivers\usbaapl64.sys
    2012-02-15 10:01 . 2012-02-15 10:01 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
    2012-02-15 03:48 . 2012-02-15 03:48 10856960 ----a-w- c:\windows\system32\drivers\atikmdag.sys
    2012-02-15 03:21 . 2012-02-15 03:21 25839104 ----a-w- c:\windows\system32\atio6axx.dll
    2012-02-15 03:18 . 2012-02-15 03:18 159744 ----a-w- c:\windows\system32\atiapfxx.exe
    2012-02-15 03:18 . 2011-07-28 21:40 791040 ----a-w- c:\windows\SysWow64\aticfx32.dll
    2012-02-15 03:17 . 2011-03-09 04:55 957952 ----a-w- c:\windows\system32\aticfx64.dll
    2012-02-15 03:13 . 2012-02-15 03:13 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
    2012-02-15 03:13 . 2012-02-15 03:13 496128 ----a-w- c:\windows\system32\atieclxx.exe
    2012-02-15 03:13 . 2012-02-15 03:13 235520 ----a-w- c:\windows\system32\atiesrxx.exe
    2012-02-15 03:11 . 2012-02-15 03:11 120320 ----a-w- c:\windows\system32\atitmm64.dll
    2012-02-15 03:10 . 2012-02-15 03:10 21504 ----a-w- c:\windows\system32\atimuixx.dll
    2012-02-15 03:10 . 2012-02-15 03:10 59392 ----a-w- c:\windows\system32\atiedu64.dll
    2012-02-15 03:10 . 2012-02-15 03:10 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
    2012-02-15 03:07 . 2011-07-28 21:30 6200320 ----a-w- c:\windows\SysWow64\atidxx32.dll
    2012-02-15 02:58 . 2012-02-15 02:58 19392000 ----a-w- c:\windows\SysWow64\atioglxx.dll
    2012-02-15 02:52 . 2011-07-28 21:20 7646208 ----a-w- c:\windows\system32\atidxx64.dll
    2012-02-15 02:41 . 2012-02-15 02:41 1113088 ----a-w- c:\windows\system32\atiumd6v.dll
    2012-02-15 02:40 . 2012-02-15 02:40 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll
    2012-02-15 02:40 . 2012-02-15 02:40 4958208 ----a-w- c:\windows\system32\atiumd6a.dll
    2012-02-15 02:34 . 2012-02-15 02:34 51200 ----a-w- c:\windows\system32\aticalrt64.dll
    2012-02-15 02:34 . 2012-02-15 02:34 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
    2012-02-15 02:34 . 2012-02-15 02:34 44544 ----a-w- c:\windows\system32\aticalcl64.dll
    2012-02-15 02:34 . 2012-02-15 02:34 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
    2012-02-15 02:34 . 2011-10-26 01:35 5954048 ----a-w- c:\windows\SysWow64\atiumdag.dll
    2012-02-15 02:34 . 2012-02-15 02:34 13859840 ----a-w- c:\windows\system32\aticaldd64.dll
    2012-02-15 02:29 . 2011-10-26 01:32 5062656 ----a-w- c:\windows\SysWow64\atiumdva.dll
    2012-02-15 02:29 . 2012-02-15 02:29 11561984 ----a-w- c:\windows\SysWow64\aticaldd.dll
    2012-02-15 02:25 . 2012-02-15 02:25 7551488 ----a-w- c:\windows\system32\atiumd64.dll
    2012-02-15 02:16 . 2011-09-10 11:59 58880 ----a-w- c:\windows\system32\coinst.dll
    2012-02-15 02:14 . 2012-02-15 02:14 512000 ----a-w- c:\windows\system32\atiadlxx.dll
    2012-02-15 02:13 . 2012-02-15 02:13 356352 ----a-w- c:\windows\SysWow64\atiadlxy.dll
    2012-02-15 02:13 . 2012-02-15 02:13 17408 ----a-w- c:\windows\system32\atig6pxx.dll
    2012-02-15 02:13 . 2012-02-15 02:13 14336 ----a-w- c:\windows\SysWow64\atiglpxx.dll
    2012-02-15 02:13 . 2012-02-15 02:13 14336 ----a-w- c:\windows\system32\atiglpxx.dll
    2012-02-15 02:13 . 2012-02-15 02:13 39936 ----a-w- c:\windows\system32\atig6txx.dll
    2012-02-15 02:13 . 2012-02-15 02:13 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll
    2012-02-15 02:13 . 2012-02-15 02:13 327680 ----a-w- c:\windows\system32\drivers\atikmpag.sys
    2012-02-15 02:12 . 2011-03-09 04:17 43008 ----a-w- c:\windows\system32\atiuxp64.dll
    2012-02-15 02:12 . 2011-07-28 20:53 33280 ----a-w- c:\windows\SysWow64\atiuxpag.dll
    2012-02-15 02:12 . 2011-11-10 02:11 39936 ----a-w- c:\windows\system32\atiu9p64.dll
    2012-02-15 02:12 . 2011-07-28 20:53 30208 ----a-w- c:\windows\SysWow64\atiu9pag.dll
    2012-02-15 02:11 . 2012-02-15 02:11 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
    2012-02-15 02:11 . 2012-02-15 02:11 54784 ----a-w- c:\windows\system32\atimpc64.dll
    2012-02-15 02:11 . 2012-02-15 02:11 54784 ----a-w- c:\windows\system32\amdpcom64.dll
    2012-02-15 02:11 . 2012-02-15 02:11 53760 ----a-w- c:\windows\SysWow64\atimpc32.dll
    2012-02-15 02:11 . 2012-02-15 02:11 53760 ----a-w- c:\windows\SysWow64\amdpcom32.dll
    2012-02-14 21:05 . 2012-02-14 21:05 69632 ----a-w- c:\windows\system32\OpenVideo64.dll
    2012-02-14 21:05 . 2012-02-14 21:05 59904 ----a-w- c:\windows\SysWow64\OpenVideo.dll
    2012-02-14 21:05 . 2012-02-14 21:05 61952 ----a-w- c:\windows\system32\OVDecode64.dll
    2012-02-14 21:05 . 2012-02-14 21:05 54784 ----a-w- c:\windows\SysWow64\OVDecode.dll
    2012-02-14 21:05 . 2012-02-14 21:05 16507904 ----a-w- c:\windows\system32\amdocl64.dll
    2012-02-14 21:04 . 2012-02-14 21:04 13238272 ----a-w- c:\windows\SysWow64\amdocl.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
    2011-05-09 08:49 176936 ----a-w- c:\program files (x86)\Freecorder\prxtbFree.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Internet Explorer\Toolbar]
    "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files (x86)\Freecorder\prxtbFree.dll" [2011-05-09 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\ Windows\CurrentVersion\Run]
    "XFastUsb"="c:\program files (x86)\XFastUsb\XFastUsb.exe" [2011-09-10 4942336]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
    "THX TruStudio NB Settings"="c:\program files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" [2011-05-19 909824]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
    "Adobe Photo Downloader"="b:\adobe\apdproxy.exe" [2007-06-26 61440]
    "AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.ex e" [2008-08-14 611712]
    "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManage r.exe" [2011-01-12 1523360]
    "iTunesHelper"="b:\itunes\iTunesHelper.exe" [2012-03-06 421736]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-02-14 636032]
    "Freecorder FLV Service"="c:\program files (x86)\Freecorder\FLVSrvc.exe" [2011-03-24 167936]
    .
    c:\users\FreakyJP\AppData\Roaming\Microsoft\Window s\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\users\Wouter\AppData\Roaming\Dropbox\bin\Dropbo x.exe [N/A]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    AML Device Install.lnk - c:\program files (x86)\AMD AVT\bin\kdbsync.exe [2012-1-31 10752]
    Wireless Connection Manager.lnk - c:\program files (x86)\D-Link\DWA-547 revA\wirelesscm.exe [2011-9-10 517440]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework6 4\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 SmartViewService;SmartView service;c:\program files (x86)\DeviceVM\SmartView\SmartViewService.exe [x]
    R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]
    R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-01-23 1038088]
    R3 jswpsapi;JumpStart Wi-Fi Protected Setup;c:\program files (x86)\D-Link\DWA-547 revA\jswpsapi.exe [2008-09-26 954368]
    R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
    R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
    R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
    R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
    R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
    R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.s ys [x]
    S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\ sptd.sys [x]
    S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DR IVERS\AsrAppCharger.sys [x]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
    S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNET URPX.SYS [x]
    S1 JSWPSLWF;JumpStart Wireless Filter Driver;c:\windows\system32\DRIVERS\jswpslwfx.sys [2008-05-15 26624]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atik mdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atik mpag.sys [x]
    S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
    S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [x]
    S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [x]
    S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\driv ers\FNETTBOH_305.SYS [x]
    S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64 .sys [x]
    S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    .
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-05-18 11855976]
    "XFast LAN"="c:\program files\ASRock\XFast LAN\cFosSpeed.exe" [2011-07-04 1441152]
    "THXCfg64"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568]
    "XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 825184]
    "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.e xe" [2011-03-15 499608]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    TCP: DhcpNameServer = 192.168.1.1
    FF - ProfilePath - c:\users\Wouter\AppData\Roaming\Mozilla\Firefox\Pr ofiles\wsf05ro2.default\
    .
    - - - - ORPHANS REMOVED - - - -
    .
    ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    Wow6432Node-HKLM-Run-SmartViewAgent - c:\program files (x86)\DeviceVM\SmartView\SmartViewAgent.exe
    ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
    AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_bc2.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-734216792-2486251066-1224596371-1003\Software\SecuROM\License information*]
    "datasecu"=hex:79,e5,28,c6,f5,26,d4,f8,88,82,d1,fd ,16,30,d1,ae,d7,89,cf,35,3c,
    b4,1d,65,60,ef,e4,ee,c9,e7,ce,af,e4,09,85,bf,3b,49 ,ec,f0,0b,a1,ea,80,2d,a3,\
    "rkeysecu"=hex:33,6e,06,16,4b,b3,d3,19,4a,df,15,40 ,4d,ab,72,2c
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macrome d\\Flash\\FlashUtil11e_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUt il11e_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11 e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11 e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11 e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11 e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CL SID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\In terface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PC W\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\windows\SysWOW64\PnkBstrA.exe
    c:\program files (x86)\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
    .
    ************************************************** ************************
    .
    Completion time: 2012-03-29 19:50:18 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-03-29 17:50
    .
    Pre-Run: 3.414.401.024 bytes free
    Post-Run: 5.458.882.560 bytes free
    .
    - - End Of File - - 1B0BE8A751FFDA21F087BFFC415EBC31

  4. #4
    Member
    Lid sinds
    22/08/09
    Locatie
    De Haan
    Berichten
    375
    iTrader
    0
    Wat ik gedaan heb is opgestart op safe-mode en een virusscan gerunned, dat heeft het gefixed voor mij. good luck

  5. #5
    Approved 9-lifer randal's schermafbeelding
    Lid sinds
    7/11/08
    Locatie
    Roeselare
    Berichten
    6.851
    iTrader
    432 (100%)
    zie pm
    inderdaad, dudenoob.. (zelfde gehad.. hitman pro gebruikt en de zever was eraf)

  6. #6
    Approved 9-lifer FreakyJP's schermafbeelding
    Lid sinds
    21/11/04
    Locatie
    Brussel
    Berichten
    7.449
    iTrader
    83 (100%)
    Idd, Safe mode + anti-virusscanner heeft het opgelost. Bedankt!

  7. #7
    Member Juisterr's schermafbeelding
    Lid sinds
    10/11/06
    Locatie
    Oegstgeest
    Berichten
    2.529
    iTrader
    0
    Kan toch geen kwaad als ik dat niet met de 'geïnfecteerde account' doe hé?
    Dat was wel de bedoeling dus.

    Heren, ik ben benieuwd of uw AV deze infectie echt verwijderd.

  8. #8
    Approved 9-lifer Cruez's schermafbeelding
    Lid sinds
    8/09/02
    Locatie
    Poperinge
    Berichten
    657
    iTrader
    99 (100%)
    sorry dat ik deze even omhoog kick. maar ik had onlangs ook pc trouble. (ik vermoed door gelijkaardig virus.)

    Geen admin rechten meer en dergelijke...

    nu is alles opgelost behalve als ik de pc opstart geeft hij de error dat

    cgs8h0.exe niet gestart kan worden.

    Iemand een oplossing hiervoor?

    Alvast bedankt

  9. #9
    Member Juisterr's schermafbeelding
    Lid sinds
    10/11/06
    Locatie
    Oegstgeest
    Berichten
    2.529
    iTrader
    0
    Waarom zou je die willen opstarten ?
    file CGS8H0.EXE (Trojan.Agent/Gen-Reveton) Lijkt me juist goed dat die niet opstart?

  10. #10
    Approved 9-lifer Cruez's schermafbeelding
    Lid sinds
    8/09/02
    Locatie
    Poperinge
    Berichten
    657
    iTrader
    99 (100%)
    mja ik dacht dat het een nodige file kon zijn die geinfecteerd was. Heb nu met ccleaner het opstarten ervan verhinderd. Es zien of hij de melding nog zal geven bij de volgende boot.

    grtz

  11. #11
    Member Juisterr's schermafbeelding
    Lid sinds
    10/11/06
    Locatie
    Oegstgeest
    Berichten
    2.529
    iTrader
    0
    Ja maar als je de instructies niet uitvoert zoals aangegeven werkt het of niet of slecht of er gaat iets mis.

  12. #12
    Approved 9-lifer Cruez's schermafbeelding
    Lid sinds
    8/09/02
    Locatie
    Poperinge
    Berichten
    657
    iTrader
    99 (100%)
    is in orde gekomen!

    mvg

  13. #13
    Member Juisterr's schermafbeelding
    Lid sinds
    10/11/06
    Locatie
    Oegstgeest
    Berichten
    2.529
    iTrader
    0
    Prima.

  14. #14
    Member
    Lid sinds
    8/07/12
    Locatie
    Schijndel
    Berichten
    1
    iTrader
    0

    Blokkade

    Mijn laptop is zojuist geblokkeerd geraakt door de zogenaamde "cyberpolitie".
    Na Combofix was dit het resultaat. Wat moet ik verder nog doen?

    ComboFix 12-07-07.04 - s081032 08-07-2012 15:56:16.1.2 - x86 MINIMAL
    Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.3071.2004 [GMT 2:00]
    Running from: d:\desktop\ComboFix.exe
    AV: Symantec Endpoint Protection *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
    FW: Symantec Endpoint Protection *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
    SP: Symantec Endpoint Protection *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\epdcihtdlcfpgib
    c:\programdata\rsdjbdrh.exe
    c:\users\s081032\0.2272307077681769.exe
    c:\users\s081032\AppData\Local\Microsoft\Windows\T emporary Internet Files\{A36C655C-D2B0-4986-9BB3-19F41380333A}.xps
    c:\windows\system32\SET343D.tmp
    c:\windows\system32\SET4F70.tmp
    c:\windows\system32\SET5079.tmp
    c:\windows\system32\SET53BC.tmp
    c:\windows\system32\SET5B4B.tmp
    c:\windows\system32\SET5EDB.tmp
    c:\windows\system32\SET6633.tmp
    c:\windows\system32\SET6976.tmp
    c:\windows\system32\SET6ADC.tmp
    c:\windows\system32\SET7651.tmp
    c:\windows\system32\SET81DD.tmp
    c:\windows\system32\SET8A5B.tmp
    c:\windows\system32\SETB0D9.tmp
    c:\windows\system32\SETC444.tmp
    c:\windows\system32\SETC715.tmp
    c:\windows\system32\SETD3E2.tmp
    c:\windows\system32\SETDBC0.tmp
    c:\windows\system32\SETEBE3.tmp
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-06-08 to 2012-07-08 )))))))))))))))))))))))))))))))
    .
    .
    2012-07-08 13:13 . 2012-07-08 13:13 -------- d-----w- c:\programdata\yzzrlhamzotkuyj
    2012-07-06 16:45 . 2012-06-18 01:14 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2C9EAF76-7ECA-45B9-A7D0-1F8CC4D6FBB4}\mpengine.dll
    2012-07-04 10:45 . 2012-07-04 10:47 -------- d-----w- c:\program files\iTunes
    2012-07-04 10:45 . 2012-07-04 10:45 -------- d-----w- c:\program files\iPod
    2012-07-04 10:38 . 2012-07-04 10:38 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
    2012-07-04 10:38 . 2012-07-04 10:38 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
    2012-07-04 10:38 . 2012-07-04 10:38 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
    2012-07-04 10:38 . 2012-07-04 10:38 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
    2012-07-04 10:38 . 2012-07-04 10:38 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
    2012-07-04 10:38 . 2012-07-04 10:38 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
    2012-07-04 10:38 . 2012-07-04 10:38 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
    2012-07-04 10:38 . 2012-07-04 10:38 -------- d-----w- c:\program files\QuickTime
    2012-07-01 14:08 . 2012-07-01 14:09 -------- d-----w- C:\Fraps
    2012-06-29 12:48 . 2012-06-29 13:00 -------- d-----w- c:\program files\WMR14
    2012-06-26 13:06 . 2012-02-23 08:18 237072 ------w- c:\windows\system32\MpSigStub.exe
    2012-06-23 13:54 . 2012-06-23 13:54 9815752 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
    2012-06-22 12:08 . 2012-07-08 13:48 -------- d-----w- c:\users\s081032\AppData\Local\Htc
    2012-06-22 12:07 . 2012-06-22 12:08 -------- d-----w- c:\users\s081032\AppData\Roaming\HTC
    2012-06-22 12:03 . 2012-06-22 12:03 -------- d-----w- c:\program files\Spirent Communications
    2012-06-22 12:03 . 2012-06-22 12:06 -------- d-----w- c:\program files\HTC
    2012-06-19 12:43 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
    2012-06-19 12:43 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
    2012-06-19 12:43 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
    2012-06-19 12:43 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
    2012-06-19 12:43 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
    2012-06-19 12:43 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
    2012-06-19 12:43 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
    2012-06-19 12:42 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
    2012-06-19 12:42 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
    2012-06-13 10:25 . 2012-04-28 04:41 919040 ----a-w- c:\windows\system32\rdpcorets.dll
    2012-06-13 10:25 . 2012-04-28 03:17 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2012-06-13 10:24 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\system32\msi.dll
    2012-06-13 10:24 . 2012-05-15 01:05 2343936 ----a-w- c:\windows\system32\win32k.sys
    2012-06-13 10:24 . 2012-04-26 04:45 58880 ----a-w- c:\windows\system32\rdpwsx.dll
    2012-06-13 10:24 . 2012-04-26 04:45 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
    2012-06-13 10:24 . 2012-04-26 04:41 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
    2012-06-13 10:24 . 2012-05-01 04:44 164352 ----a-w- c:\windows\system32\profsvc.dll
    2012-06-13 10:24 . 2012-04-24 04:36 140288 ----a-w- c:\windows\system32\cryptsvc.dll
    2012-06-13 10:24 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\system32\crypt32.dll
    2012-06-13 10:24 . 2012-04-24 04:36 103936 ----a-w- c:\windows\system32\cryptnet.dll
    2012-06-11 18:17 . 2012-06-11 18:17 65536 ----a-w- c:\windows\system32\frapsvid.dll
    2012-06-11 09:37 . 2012-06-11 09:37 -------- d-----w- c:\programdata\ALM
    2012-06-11 09:26 . 2012-06-11 09:26 -------- d-----w- c:\programdata\FLEXnet
    2012-06-11 09:21 . 2008-04-07 03:38 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
    2012-06-11 09:21 . 2008-04-07 03:38 45392 ----a-r- c:\windows\system32\AdobePDF.dll
    2012-06-11 07:44 . 2012-06-11 07:44 -------- d-----w- c:\users\Public\Roaming
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2012-06-23 13:54 . 2012-04-11 16:27 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2012-06-23 13:54 . 2012-02-09 10:18 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-04-18 18:56 . 2012-04-18 18:56 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2012-04-18 18:56 . 2012-04-18 18:56 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-01-26 09:11 . 2012-06-05 12:17 444283 ----a-w- c:\program files\Common Files\WinPcapNmap.exe
    2010-08-03 09:11 819200 --sha-w- c:\windows\System32\xvidcore.dll
    2010-08-03 09:11 180224 --sha-w- c:\windows\System32\xvidvfw.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
    2009-10-27 12:48 1196936 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-10-27 1196936]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-10-27 1196936]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\Dr opboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-14 22:58 94208 ----a-w- c:\users\s081032\AppData\Roaming\Dropbox\bin\Dropb oxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\Dr opboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-14 22:58 94208 ----a-w- c:\users\s081032\AppData\Roaming\Dropbox\bin\Dropb oxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\shelliconoverlayidentifiers\Dr opboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-14 22:58 94208 ----a-w- c:\users\s081032\AppData\Roaming\Dropbox\bin\Dropb oxExt.14.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2012-02-13 3481408]
    "Spotify Web Helper"="c:\users\s081032\AppData\Roaming\Spotify\ Data\SpotifyWebHelper.exe" [2012-05-10 932528]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 287800]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2009-07-08 115560]
    "WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-09-01 499768]
    "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]
    "WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2007-05-23 192512]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
    "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]
    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.e xe" [2010-07-29 497648]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
    "SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.ex e" [2010-07-22 402432]
    "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
    "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-09 29984]
    "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-09 46368]
    "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
    "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
    "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
    "VDownloader"="c:\program files\VDownloader\VDownloader.exe" [2012-04-26 879616]
    "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.ex e" [2008-08-14 611712]
    "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
    "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
    "HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2012-04-17 651264]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-18 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
    .
    c:\users\s081032\AppData\Roaming\Microsoft\Windows \Start Menu\Programs\Startup\
    Dropbox.lnk - c:\users\s081032\AppData\Roaming\Dropbox\bin\Dropb ox.exe [2012-5-24 27112840]
    PdaNet Desktop.lnk - c:\program files\PdaNet for Android\PdaNetPC.exe [2012-3-14 484976]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-30 795936]
    DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2010-12-15 192512]
    VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2010-11-18 6144]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "mixer2"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\ccEvtMgr]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\ccSetMgr]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Norman Ad-Aware Service]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Symantec Antivirus]
    @="Service"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [x]
    R2 Autodesk Content Service;Autodesk Content Service;c:\program files\Autodesk\Content Service\Connect.Service.ContentService.exe [x]
    R2 gupdate;Google Update-service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
    R2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
    R2 mi-raysat_3dsmax2012_32;mental ray 3.9 Satellite for Autodesk 3ds Max Design 2012 32-bit - English 32-bit;c:\program files\Autodesk\3ds Max Design 2012\mentalimages\satellite\raysat_3dsmax2012_32se rver.exe [x]
    R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [x]
    R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe 86.sys [x]
    R2 risdpcie;risdpcie;c:\windows\system32\drivers\risd pe86.sys [x]
    R2 rixdpcie;rixdpcie;c:\windows\system32\drivers\rixd pe86.sys [x]
    R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [x]
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPl ayerUpdateService.exe [x]
    R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sy s [x]
    R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.s ys [x]
    R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
    R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]
    R3 DialComService;DIAL Communication Service;c:\program files\DIAL GmbH\DIAL Communication Framework\DialComService.exe [x]
    R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
    R3 gupdatem;Google Update-service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
    R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
    R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Norman\Norman Ad-Aware\KernExplorer.sys [x]
    R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
    R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
    R3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe [x]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EX E [x]
    R3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominipor t.sys [x]
    R3 rismc32;RICOH Smart Card Reader;c:\windows\system32\DRIVERS\rismc32.sys [x]
    R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [x]
    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VS TAZL3.SYS [x]
    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VS TDPV3.SYS [x]
    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVER S\VSTCNXT3.SYS [x]
    R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
    R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys [x]
    R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsus bflt.sys [x]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
    R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys [x]
    R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
    S2 Norman Ad-Aware Service;Norman Ad-Aware Service;c:\program files\Norman\Norman Ad-Aware\Norman_AAWService.exe [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-07-08 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpda teService.exe [2012-04-11 13:54]
    .
    2012-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-15 09:41]
    .
    2012-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-15 09:41]
    .
    2012-03-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1895577662-1677200029-1617787245-379706Core1cd0ab4ceaade0c.job
    - c:\users\s081032\AppData\Local\Google\Update\Googl eUpdate.exe [2012-03-06 17:15]
    .
    2012-07-08 c:\windows\Tasks\Norman Ad-Aware Update (Daily 1).job
    - c:\program files\Norman\Norman Ad-Aware\Norman_Ad-AwareAdmin.exe [2011-02-17 08:03]
    .
    2012-07-08 c:\windows\Tasks\Norman Ad-Aware Update (Daily 2).job
    - c:\program files\Norman\Norman Ad-Aware\Norman_Ad-AwareAdmin.exe [2011-02-17 08:03]
    .
    2012-07-08 c:\windows\Tasks\Norman Ad-Aware Update (Daily 3).job
    - c:\program files\Norman\Norman Ad-Aware\Norman_Ad-AwareAdmin.exe [2011-02-17 08:03]
    .
    2012-07-08 c:\windows\Tasks\Norman Ad-Aware Update (Daily 4).job
    - c:\program files\Norman\Norman Ad-Aware\Norman_Ad-AwareAdmin.exe [2011-02-17 08:03]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://www.google.nl/
    uInternet Settings,ProxyOverride = *.local
    IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
    IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    .
    .
    ------- File Associations -------
    .
    .scr=AutoCADScriptFile
    .txt=
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    HKCU-Run-rsdjbdrhetwzoxn - c:\programdata\rsdjbdrh.exe
    SafeBoot-Symantec Antvirus
    AddRemove-{33A22B2D-55BA-4508-B767-BF2E9C21A73F} - c:\program files (x86)\InstallShield Installation Information\{33A22B2D-55BA-4508-B767-BF2E9C21A73F}\setup.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PC W\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2012-07-08 16:05:08
    ComboFix-quarantined-files.txt 2012-07-08 14:05
    .
    Pre-Run: 10.673.295.360 bytes free
    Post-Run: 14.195.617.792 bytes free
    .
    - - End Of File - - 7A57D70583E0EB25236244DAAA3A3D18

  15. #15
    Member Juisterr's schermafbeelding
    Lid sinds
    10/11/06
    Locatie
    Oegstgeest
    Berichten
    2.529
    iTrader
    0
    Hallo Ikkegp, wil je een eigen topic beginnen aub.

  16. #16
    Member
    Lid sinds
    25/07/12
    Locatie
    Enschede
    Berichten
    1
    iTrader
    0
    Ik heb mijn pc met veilige modus en internetmogelijkheden opgestart en malwarebytes gedownload. Deze heb ik een snelle scan laten uitvoeren en de malware verwijderd.

Discussie informatie

Users Browsing this Thread

Op dit moment bekijken 1 gebruikers deze discussie. (0 leden en 1 gasten)

Regels voor berichten

  • Je mag geen nieuwe discussies starten
  • Je mag niet reageren op berichten
  • Je mag geen bijlagen versturen
  • Je mag niet je berichten bewerken
  •