HijackThis Logje Analyse

Hey,

Zou er iemand mijn HijjackThis logje kunnen nakijken? Ik heb een vermoeden dat er iets fout loop met de PC.

Alvast bedankt!

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 9:43:32, on 21/04/2014

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.16521)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\spotify.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

C:\Program Files (x86)\StrongVPN\StrongDial.exe

C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe

C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe

C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe

C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe

C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe

C:\windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe

C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe

C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe

C:\Users\Simon Derbaix\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O4 - HKLM\..\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [spotify] "C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

O4 - HKCU\..\Run: [spotify Web Helper] "C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

O4 - HKCU\..\Run: [strongVPN Client] "C:\Program Files (x86)\StrongVPN\StrongDial.exe" --silent

O4 - HKCU\..\Run: [KiesPDLR.exe] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run

O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O17 - HKLM\System\CCS\Services\Tcpip\..\{0B5B235B-6861-4591-92EE-D5C358C61A0B}: NameServer = 210.21.196.6,221.5.88.88

O17 - HKLM\System\CCS\Services\Tcpip\..\{1533AC16-7AFD-4139-B8C0-9C7AD90A7BB5}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{352A7F84-2DA0-4063-B5DC-6C26C8981AA7}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{3AEE2DB3-BBA2-473A-AF4C-A71BEA4ED632}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{4B410BB5-05D4-47BB-9C93-500D49EF3964}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{50A0840C-EDCC-4303-8A19-247CEFB1783A}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{59D1623D-8F78-456D-9DB2-42BE263F4017}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{60CE1F32-B682-40C9-9C4B-9DE8FF17ACE8}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{618B979A-F539-4981-92B0-13FF61EF270F}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{902DC9E6-EAC2-4ED8-B794-5EC12D80BE68}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{C35FC9D5-711B-4CC4-B595-4A4C94860862}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{D5F757C4-B566-4C32-A2C8-7FA53AB1DFFB}: NameServer = 8.8.8.8 8.8.4.4

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)

O23 - Service: Intel® Centrino® Wireless Bluetooth® + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

O23 - Service: Bluetooth Device Monitor - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

O23 - Service: Bluetooth Media Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

O23 - Service: Bluetooth OBEX Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

O23 - Service: Intel® Centrino® Wireless Bluetooth® + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: Intel® Capability Licensing Service Interface - Intel® Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe

O23 - Service: Intel® ME Service - Unknown owner - C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe

O23 - Service: Intel® Rapid Start Technology Service (irstrtsv) - Intel Corporation - C:\windows\SysWOW64\irstrtsv.exe

O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)

O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld.exe

O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: SamsungDeviceConfiguration (SamsungDeviceConfigurationWinService) - Unknown owner - C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)

O23 - Service: StrongVPN Service - Black Oak Computers, Inc. - C:\Program Files (x86)\StrongVPN\StrongService.exe

O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: SW Update Service (SWUpdateService) - Samsung Electronics CO., LTD. - C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe

O23 - Service: TeamViewer 9 (TeamViewer9) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)

O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

O23 - Service: Intel® PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--

End of file - 14729 bytes

Hallo Mintz,

op PCH!

HijackThis logjes worden al enige tijd niet meer gebruikt omdat ze te weinig informatie tonen.

Maak even een RSIT logje, dan kunnen we je vast en zeker verder helpen.

Download RSIT van de onderstaande locaties en sla deze op het bureaublad op.

Hier staat een beschrijving hoe je kan kijken of je een 32- of 64-bitversie van Windows heeft.

• 
  
• RSIT 32 bit (RSIT.exe)
  
• RSIT 64 bit (RSITx64.exe)
  

Dubbelklik op RSIT.exe om de tool te starten.

• 
  
• Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
  
• Vervolgens wordt de "Disclaimer of warranty" getoond, klik vervolgens op "Continue"
  
• Wanneer de tool gereed is worden er twee kladblok bestanden geopend genaamd "Log.txt" en "Info.txt" .
  

RSIT Logbestanden plaatsen

• 
  
• Voeg het logbestand met de naam "Log.txt" als bijlage toe aan het volgende bericht. (Dit logbestand kunt u tevens terug vinden in de map ""C:\\rsit")
  
• Het logbestand met de naam "Info.txt" wat geminimaliseerd is hoeft u niet te plaatsen. (Dit logbestand wordt enkel de eerst keer bij het uitvoeren aangemaakt).
  
• Hoe u een bijlage kunt toevoegen aan het bericht leest u hier.
  

Bekijk ook de instructievideo.

Hey Mako!

Haha, ok! Sorry daarvoor! Hier is dan het nieuwe logje!

Simon

[ATTACH]31488[/ATTACH]

log.txt

Even opnieuw proberen:

Logfile of random's system information tool 1.09 (written by random/random)

Run by Simon Derbaix at 2014-04-21 16:51:33

Microsoft Windows 7 Home Premium Service Pack 1

System drive C: has 15 GB (15%) free of 94 GB

Total RAM: 3798 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:51:38, on 21/04/2014

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.16521)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\spotify.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

C:\Program Files (x86)\StrongVPN\StrongDial.exe

C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe

C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe

C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe

C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

C:\Program Files (x86)\Tencent\QQIntl\Bin\QQ.exe

C:\Program Files (x86)\Tencent\QQIntl\Bin\TXPlatform.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe

C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe

C:\Program Files\trend micro\Simon Derbaix.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O4 - HKLM\..\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [spotify] "C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart

O4 - HKCU\..\Run: [spotify Web Helper] "C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

O4 - HKCU\..\Run: [strongVPN Client] "C:\Program Files (x86)\StrongVPN\StrongDial.exe" --silent

O4 - HKCU\..\Run: [KiesPDLR.exe] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run

O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O17 - HKLM\System\CCS\Services\Tcpip\..\{0B5B235B-6861-4591-92EE-D5C358C61A0B}: NameServer = 210.21.196.6,221.5.88.88

O17 - HKLM\System\CCS\Services\Tcpip\..\{1533AC16-7AFD-4139-B8C0-9C7AD90A7BB5}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{352A7F84-2DA0-4063-B5DC-6C26C8981AA7}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{3AEE2DB3-BBA2-473A-AF4C-A71BEA4ED632}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{4B410BB5-05D4-47BB-9C93-500D49EF3964}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{50A0840C-EDCC-4303-8A19-247CEFB1783A}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{59D1623D-8F78-456D-9DB2-42BE263F4017}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{60CE1F32-B682-40C9-9C4B-9DE8FF17ACE8}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{618B979A-F539-4981-92B0-13FF61EF270F}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{902DC9E6-EAC2-4ED8-B794-5EC12D80BE68}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{C35FC9D5-711B-4CC4-B595-4A4C94860862}: NameServer = 8.8.8.8 8.8.4.4

O17 - HKLM\System\CCS\Services\Tcpip\..\{D5F757C4-B566-4C32-A2C8-7FA53AB1DFFB}: NameServer = 8.8.8.8 8.8.4.4

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)

O23 - Service: Intel® Centrino® Wireless Bluetooth® + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

O23 - Service: Bluetooth Device Monitor - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

O23 - Service: Bluetooth Media Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

O23 - Service: Bluetooth OBEX Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

O23 - Service: Intel® Centrino® Wireless Bluetooth® + High Speed Security Service (BTHSSecurityMgr) - Intel® Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: Intel® Capability Licensing Service Interface - Intel® Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe

O23 - Service: Intel® ME Service - Unknown owner - C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe

O23 - Service: Intel® Rapid Start Technology Service (irstrtsv) - Intel Corporation - C:\windows\SysWOW64\irstrtsv.exe

O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)

O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld.exe

O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: SamsungDeviceConfiguration (SamsungDeviceConfigurationWinService) - Unknown owner - C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)

O23 - Service: StrongVPN Service - Black Oak Computers, Inc. - C:\Program Files (x86)\StrongVPN\StrongService.exe

O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: SW Update Service (SWUpdateService) - Samsung Electronics CO., LTD. - C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe

O23 - Service: TeamViewer 9 (TeamViewer9) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)

O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

O23 - Service: Intel® PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--

End of file - 14514 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

wininit.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\lsm.exe

winlogon.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\svchost.exe -k RPCSS

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k GPSvcGroup

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\System32\spoolsv.exe

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"

"C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe"

C:\windows\system32\svchost.exe -k bthsvcs

"C:\Program Files\Intel\WiFi\bin\EvtEng.exe"

"C:\Program Files\Intel\iCLS Client\HeciServer.exe"

"C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe"

C:\windows\SysWOW64\irstrtsv.exe

"C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe"

"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe"

"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"

C:\xampp\mysql\bin\mysqld --defaults-file=C:\xampp\mysql\bin\my.ini mysql

C:\windows\System32\svchost.exe -k HPZ12

C:\windows\System32\svchost.exe -k HPZ12

"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"

"C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe"

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe"

"C:\Program Files (x86)\StrongVPN\StrongService.exe"

C:\windows\system32\WLANExt.exe 25755616

\??\C:\windows\system32\conhost.exe "840661540-140505265-9212547955276485841265604539-2922396842023341885719781657

"taskhost.exe"

"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe"

"C:\windows\system32\Dwm.exe"

C:\windows\Explorer.EXE

"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun

"C:\Users\Simon Derbaix\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart

"C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

"C:\Program Files (x86)\StrongVPN\StrongDial.exe" --silent

"C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" Run

"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

C:\windows\System32\svchost.exe -k secsvcs

"C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe"

"C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe"

taskeng.exe {AFD9DCD7-AA8A-4867-9E6D-012AA94A33FE}

"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"

C:\windows\system32\wbem\unsecapp.exe -Embedding

C:\windows\system32\wbem\wmiprvse.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"

"C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe" --type=renderer --js-flags=--harmony-proxies --no-sandbox --lang=en-US --lang=en-US --log-severity=disable --channel="1304.1.2025291422\1252128725" /prefetch:673131151

"C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe" --type=renderer --js-flags=--harmony-proxies --no-sandbox --lang=en-US --lang=en-US --log-severity=disable --channel="1304.2.1958491515\1069193165" /prefetch:673131151

"C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe" --type=renderer --js-flags=--harmony-proxies --no-sandbox --lang=en-US --lang=en-US --log-severity=disable --channel="1304.3.1178440505\1591552396" /prefetch:673131151

"C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe" --type=renderer --js-flags=--harmony-proxies --no-sandbox --lang=en-US --lang=en-US --log-severity=disable --channel="1304.4.1249153261\915481076" /prefetch:673131151

"C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyHelper.exe" --type=gpu-process --channel="1304.5.1639419328\1383993864" --no-sandbox --lang=en-US --log-severity=disable --supports-dual-gpus=false --gpu-driver-bug-workarounds=0,9,19 --gpu-vendor-id=0x8086 --gpu-device-id=0x0166 --gpu-driver-vendor="Intel Corporation" --gpu-driver-version=8.15.10.2618 --lang=en-US --log-severity=disable /prefetch:822062411

"C:\Program Files (x86)\Skype\Phone\Skype.exe"

"C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"

"C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe"

"C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe"

"C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe"

"C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe"

C:\windows\system32\igfxext.exe -Embedding

C:\windows\system32\igfxsrvc.exe -Embedding

"C:\Program Files\Samsung\S Agent\CommonAgent.exe"

"C:\Program Files\Samsung\Easy Support Center\SamoyedAgent.exe"

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\windows\System32\alg.exe

C:\windows\system32\SearchIndexer.exe /Embedding

"C:\windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-ffbf65dd-b385-411d-a6fd-5d004f00c159 -SystemEventPortName:HostProcess-fccd80c8-739f-40b6-b3a0-32c3354f4170 -IoCancelEventPortName:HostProcess-7b22c7d6-97fb-4779-b365-12131733ac8a -NonStateChangingEventPortName:HostProcess-a5555217-4d20-47c3-9068-d2341b0de518 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:d9441b40-2cc4-454b-a772-1e2f3945e8cd -DeviceGroupId:

"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"

"C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe"

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe"

rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

"C:\Program Files\Elantech\ETDCtrl.exe"

C:\windows\system32\hkcmd.exe

C:\windows\system32\igfxpers.exe

rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /SRSSA

"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s

"C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe"

"C:\Program Files\Elantech\ETDCtrlHelper.exe"

"C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe" -Embedding

"C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe"

"C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe"

C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\windows\system32\svchost.exe -k HPService

"C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe"

C:\windows\system32\svchost.exe -k imgsvc

"C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe" /SERVICE

"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"

WLIDSvcM.exe 2364

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

"C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe"

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Simon Derbaix\Desktop\Category Description.docx"

C:\windows\splwow64.exe 12288

/MLogin:A79E59DC-148B-404F-81D4-5FAF1F30AF8E_0_0__PreProcess0000000000000000000000000000000000000000000000000 C:\Program Files (x86)\Tencent\QQIntl\Bin\QQ.exe

"C:\Program Files (x86)\Tencent\QQIntl\Bin\TXPlatform.exe" -Embedding

"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=1700.faf1bf0.1097256357 "C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" E7CF176E110C211B 1700 "\\.\pipe\gecko-crash-server-pipe.1700" plugin

"C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe" --proxy-stub-channel=Flash808.5FCD7F48.19902 --host-broker-channel=Flash808.5FCD7F48.10009 --host-pid=808 --host-npapi-version=27 --plugin-path="C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll"

"C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe" --channel=5620.0037F710.870654288 --proxy-stub-channel=Flash808.5FCD7F48.19902 --plugin-path="C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll" --host-npapi-version=27 --type=renderer

taskeng.exe {639328E8-3609-456C-BB18-4F92C7DD6F14}

"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

"C:\windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528

"C:\Users\Simon Derbaix\Downloads\RSITx64.exe"

C:\windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job

C:\windows\tasks\GoogleUpdateTaskMachineCore.job

C:\windows\tasks\GoogleUpdateTaskMachineUA.job

C:\windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

C:\windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Simon Derbaix\AppData\Roaming\Mozilla\Firefox\Profiles\r920uggt.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]

"Description"=Adobe® Flash® Player 12.0.0.77 Plugin

"Path"=C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@baidu.com/BDDownloadPlugin]

"Description"=BDDownload Plugin

"Path"=C:\Users\Simon Derbaix\AppData\Roaming\BaiduMiniDownloader\1.0.0.5\npBDDLPlug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59]

"Description"=Intel IPT WebApi plugin

"Path"=C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]

"Description"=This plugin updates Intel WebAPI component

"Path"=C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.55.2]

"Description"=Java™ Deployment Toolkit

"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2]

"Description"=Oracle® Next Generation Java™ Plug-In

"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]

"Description"=

"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]

"Description"=Ag Player Plugin

"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]

"Description"=Office Authorization plug-in for NPAPI browsers

"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]

"Description"=Microsoft SharePoint Plug-in for Firefox

"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@qq.com/npchrome]

"Description"=npchrome

"Path"=C:\Program Files (x86)\Common Files\Tencent\Npchrome\npchrome.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@qq.com/npqscall]

"Description"=npqscall

"Path"=C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@qq.com/TXSSO]

"Description"=QQ QuickLogin Helper

"Path"=C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.2.1\Bin\npSSOAxCtrlForPTLogin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]

"Description"=Google Update

"Path"=C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]

"Description"=Google Update

"Path"=C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]

"Description"=Handles PDFs in-place in Firefox

"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]

"Description"=Adobe® Flash® Player 12.0.0.77 Plugin

"Path"=C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.21.2]

"Description"=Java™ Deployment Toolkit

"Path"=C:\windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2]

"Description"=Oracle® Next Generation Java™ Plug-In

"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]

"Description"=

"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]

"Description"=Ag Player Plugin

"Path"=c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]

"Description"=Office Authorization plug-in for NPAPI browsers

"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL

C:\Users\Simon Derbaix\AppData\Roaming\Mozilla\Firefox\Profiles\r920uggt.default\extensions\

en-US@dictionaries.addons.mozilla.org

support@lastpass.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-05-28 553376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-05-28 211360]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-03-17 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-03-17 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]

"Spotify"=C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Spotify.exe [2014-04-11 6087224]

"Spotify Web Helper"=C:\Users\Simon Derbaix\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [2014-04-11 1171000]

"StrongVPN Client"=C:\Program Files (x86)\StrongVPN\StrongDial.exe [2014-02-25 1574896]

"KiesPDLR.exe"=C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2014-02-07 845120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS6ServiceManager]

C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR.exe]

C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2014-02-07 845120]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]

C:\Program Files (x86)\Samsung\Kies\Kies.exe [2014-02-07 1564992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]

C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [2014-02-07 311616]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]

"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]

C:\windows\system32\igfxdev.dll [2012-01-05 429056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=0

"ConsentPromptBehaviorUser"=3

"EnableLUA"=0

"EnableUIADesktopToggle"=0

"PromptOnSecureDesktop"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"DelayedDesktopSwitchTimeout"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145

"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"VIDC.UYVY"=msyuv.dll

"VIDC.YUY2"=msyuv.dll

"VIDC.YVYU"=msyuv.dll

"VIDC.IYUV"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"VIDC.YVU9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

"MSVideo8"=VfWWDM32.dll

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"aux1"=wdmaud.drv

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"aux"=wdmaud.drv

"wave2"=wdmaud.drv

"midi2"=wdmaud.drv

"mixer2"=wdmaud.drv

"wave3"=wdmaud.drv

"midi3"=wdmaud.drv

"mixer3"=wdmaud.drv

"wave4"=wdmaud.drv

"midi4"=wdmaud.drv

"mixer4"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2014-04-21 16:51:34 ----D---- C:\Program Files\trend micro

2014-04-21 16:51:33 ----D---- C:\rsit

2014-04-20 19:35:57 ----D---- C:\Program Files\CCleaner

2014-04-20 19:34:44 ----D---- C:\Program Files (x86)\MSXML 4.0

2014-04-20 19:29:46 ----A---- C:\windows\SYSWOW64\vbscript.dll

2014-04-20 19:29:46 ----A---- C:\windows\system32\vbscript.dll

2014-04-20 17:40:19 ----A---- C:\windows\SYSWOW64\iernonce.dll

2014-04-20 17:40:19 ----A---- C:\windows\system32\iertutil.dll

2014-04-20 17:40:18 ----A---- C:\windows\SYSWOW64\iertutil.dll

2014-04-20 17:40:18 ----A---- C:\windows\system32\ieetwcollectorres.dll

2014-04-20 17:40:17 ----A---- C:\windows\SYSWOW64\urlmon.dll

2014-04-20 17:40:17 ----A---- C:\windows\SYSWOW64\msfeeds.dll

2014-04-20 17:40:17 ----A---- C:\windows\SYSWOW64\ieetwproxystub.dll

2014-04-20 17:40:16 ----A---- C:\windows\SYSWOW64\mshtml.dll

2014-04-20 17:40:15 ----A---- C:\windows\SYSWOW64\iesetup.dll

2014-04-20 17:40:14 ----A---- C:\windows\system32\iernonce.dll

2014-04-20 17:40:13 ----A---- C:\windows\system32\urlmon.dll

2014-04-20 17:40:12 ----A---- C:\windows\SYSWOW64\jsproxy.dll

2014-04-20 17:40:12 ----A---- C:\windows\SYSWOW64\jscript9diag.dll

2014-04-20 17:40:12 ----A---- C:\windows\system32\ieetwproxystub.dll

2014-04-20 17:40:11 ----A---- C:\windows\SYSWOW64\ieui.dll

2014-04-20 17:40:11 ----A---- C:\windows\system32\msfeeds.dll

2014-04-20 17:40:09 ----A---- C:\windows\SYSWOW64\ieframe.dll

2014-04-20 17:40:07 ----A---- C:\windows\system32\iesetup.dll

2014-04-20 17:40:07 ----A---- C:\windows\system32\ie4uinit.exe

2014-04-20 17:40:06 ----A---- C:\windows\SYSWOW64\jscript9.dll

2014-04-20 17:40:06 ----A---- C:\windows\SYSWOW64\ieUnatt.exe

2014-04-20 17:40:05 ----A---- C:\windows\SYSWOW64\wininet.dll

2014-04-20 17:40:05 ----A---- C:\windows\SYSWOW64\msrating.dll

2014-04-20 17:40:05 ----A---- C:\windows\SYSWOW64\ieapfltr.dll

2014-04-20 17:40:05 ----A---- C:\windows\system32\jsproxy.dll

2014-04-20 17:40:05 ----A---- C:\windows\system32\ieetwcollector.exe

2014-04-20 17:40:04 ----A---- C:\windows\system32\ieui.dll

2014-04-20 17:40:04 ----A---- C:\windows\system32\ieframe.dll

2014-04-20 17:40:03 ----A---- C:\windows\system32\ieUnatt.exe

2014-04-20 17:40:02 ----A---- C:\windows\system32\jscript9diag.dll

2014-04-20 17:40:02 ----A---- C:\windows\system32\jscript9.dll

2014-04-20 17:40:02 ----A---- C:\windows\system32\ieapfltr.dll

2014-04-20 17:40:01 ----A---- C:\windows\system32\wininet.dll

2014-04-20 17:40:01 ----A---- C:\windows\system32\MsSpellCheckingFacility.exe

2014-04-20 17:40:01 ----A---- C:\windows\system32\msrating.dll

2014-04-20 17:40:00 ----A---- C:\windows\system32\mshtml.dll

2014-04-20 11:49:54 ----A---- C:\windows\system32\wmploc.DLL

2014-04-20 11:49:53 ----A---- C:\windows\SYSWOW64\wmploc.DLL

2014-04-20 11:49:53 ----A---- C:\windows\SYSWOW64\wmp.dll

2014-04-20 11:49:52 ----A---- C:\windows\system32\wmp.dll

2014-04-20 11:37:15 ----D---- C:\windows\Migration

2014-04-20 11:33:47 ----A---- C:\windows\system32\IEUDINIT.EXE

2014-04-20 11:23:49 ----A---- C:\windows\SYSWOW64\elshyph.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\wextract.exe

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\webcheck.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\url.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\SetIEInstalledDate.exe

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\RegisterIEPKEYs.exe

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\pngfilt.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\occache.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\msls31.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\mshtmlmedia.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\mshtmler.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\mshtmled.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\MshtmlDac.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\mshta.exe

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\msfeedssync.exe

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\msfeedsbs.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\licmgr10.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\jsIntl.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\jscript.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\JavaScriptCollectionAgent.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\inseng.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\imgutil.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\iexpress.exe

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\iesysprep.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\iepeers.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\iedkcs32.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\ieapfltr.dat

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\IEAdvpack.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\icardie.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\dxtrans.dll

2014-04-20 11:23:26 ----A---- C:\windows\SYSWOW64\dxtmsft.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\wextract.exe

2014-04-20 11:23:26 ----A---- C:\windows\system32\webcheck.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\url.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\SetIEInstalledDate.exe

2014-04-20 11:23:26 ----A---- C:\windows\system32\RegisterIEPKEYs.exe

2014-04-20 11:23:26 ----A---- C:\windows\system32\pngfilt.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\occache.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\msls31.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\mshtmlmedia.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\mshtmler.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\mshtmled.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\MshtmlDac.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\mshta.exe

2014-04-20 11:23:26 ----A---- C:\windows\system32\msfeedssync.exe

2014-04-20 11:23:26 ----A---- C:\windows\system32\msfeedsbs.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\licmgr10.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\jsIntl.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\jscript.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\JavaScriptCollectionAgent.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\inseng.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\imgutil.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\iexpress.exe

2014-04-20 11:23:26 ----A---- C:\windows\system32\iesysprep.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\iepeers.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\iedkcs32.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\ieapfltr.dat

2014-04-20 11:23:26 ----A---- C:\windows\system32\IEAdvpack.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\icardie.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\elshyph.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\dxtrans.dll

2014-04-20 11:23:26 ----A---- C:\windows\system32\dxtmsft.dll

2014-04-19 23:55:37 ----D---- C:\windows\system32\MRT

2014-04-19 22:55:32 ----A---- C:\windows\SYSWOW64\msieftp.dll

2014-04-19 22:55:32 ----A---- C:\windows\system32\msieftp.dll

2014-04-19 22:53:08 ----A---- C:\windows\system32\wwansvc.dll

2014-04-19 22:53:08 ----A---- C:\windows\system32\wwanprotdim.dll

2014-04-19 22:53:07 ----A---- C:\windows\SYSWOW64\comctl32.dll

2014-04-19 22:53:07 ----A---- C:\windows\system32\comctl32.dll

2014-04-19 22:51:32 ----A---- C:\windows\SYSWOW64\wintrust.dll

2014-04-19 22:51:32 ----A---- C:\windows\system32\wintrust.dll

2014-04-19 22:51:06 ----A---- C:\windows\system32\consent.exe

2014-04-19 22:51:05 ----A---- C:\windows\system32\appinfo.dll

2014-04-19 22:50:47 ----A---- C:\windows\SYSWOW64\WMPhoto.dll

2014-04-19 22:50:47 ----A---- C:\windows\system32\WMPhoto.dll

2014-04-19 22:49:59 ----A---- C:\windows\SYSWOW64\cryptsvc.dll

2014-04-19 22:49:59 ----A---- C:\windows\SYSWOW64\cryptnet.dll

2014-04-19 22:49:59 ----A---- C:\windows\SYSWOW64\crypt32.dll

2014-04-19 22:49:59 ----A---- C:\windows\system32\cryptsvc.dll

2014-04-19 22:49:59 ----A---- C:\windows\system32\cryptnet.dll

2014-04-19 22:49:59 ----A---- C:\windows\system32\crypt32.dll

2014-04-19 22:49:51 ----A---- C:\windows\SYSWOW64\wer.dll

2014-04-19 22:49:51 ----A---- C:\windows\SYSWOW64\imagehlp.dll

2014-04-19 22:49:51 ----A---- C:\windows\system32\wer.dll

2014-04-19 22:49:51 ----A---- C:\windows\system32\imagehlp.dll

2014-04-19 22:49:42 ----A---- C:\windows\SYSWOW64\tzres.dll

2014-04-19 22:49:42 ----A---- C:\windows\system32\tzres.dll

2014-04-19 22:49:38 ----A---- C:\windows\SYSWOW64\msxml3r.dll

2014-04-19 22:49:38 ----A---- C:\windows\SYSWOW64\msxml3.dll

2014-04-19 22:49:38 ----A---- C:\windows\system32\msxml3r.dll

2014-04-19 22:49:38 ----A---- C:\windows\system32\msxml3.dll

2014-04-19 22:48:57 ----A---- C:\windows\system32\drivers\afd.sys

2014-04-19 22:44:44 ----A---- C:\windows\system32\win32k.sys

2014-04-19 22:44:44 ----A---- C:\windows\system32\drivers\portcls.sys

2014-04-19 22:44:44 ----A---- C:\windows\system32\drivers\drmk.sys

2014-04-19 22:44:41 ----A---- C:\windows\system32\drivers\ataport.sys

2014-04-19 22:44:29 ----A---- C:\windows\SYSWOW64\SmartcardCredentialProvider.dll

2014-04-19 22:44:29 ----A---- C:\windows\SYSWOW64\credui.dll

2014-04-19 22:44:29 ----A---- C:\windows\SYSWOW64\authui.dll

2014-04-19 22:44:29 ----A---- C:\windows\system32\SmartcardCredentialProvider.dll

2014-04-19 22:44:29 ----A---- C:\windows\system32\credui.dll

2014-04-19 22:44:29 ----A---- C:\windows\system32\authui.dll

2014-04-19 22:44:25 ----A---- C:\windows\SYSWOW64\lpk.dll

2014-04-19 22:44:25 ----A---- C:\windows\SYSWOW64\fontsub.dll

2014-04-19 22:44:25 ----A---- C:\windows\SYSWOW64\dciman32.dll

2014-04-19 22:44:25 ----A---- C:\windows\SYSWOW64\atmfd.dll

2014-04-19 22:44:25 ----A---- C:\windows\system32\lpk.dll

2014-04-19 22:44:25 ----A---- C:\windows\system32\fontsub.dll

2014-04-19 22:44:25 ----A---- C:\windows\system32\dciman32.dll

2014-04-19 22:44:25 ----A---- C:\windows\system32\atmlib.dll

2014-04-19 22:44:25 ----A---- C:\windows\system32\atmfd.dll

2014-04-19 22:44:24 ----A---- C:\windows\SYSWOW64\atmlib.dll

2014-04-19 22:41:20 ----A---- C:\windows\SYSWOW64\sspicli.dll

2014-04-19 22:41:20 ----A---- C:\windows\SYSWOW64\secur32.dll

2014-04-19 22:41:20 ----A---- C:\windows\SYSWOW64\schannel.dll

2014-04-19 22:41:20 ----A---- C:\windows\SYSWOW64\ncrypt.dll

2014-04-19 22:41:20 ----A---- C:\windows\system32\sspisrv.dll

2014-04-19 22:41:20 ----A---- C:\windows\system32\sspicli.dll

2014-04-19 22:41:20 ----A---- C:\windows\system32\secur32.dll

2014-04-19 22:41:20 ----A---- C:\windows\system32\schannel.dll

2014-04-19 22:41:20 ----A---- C:\windows\system32\ncrypt.dll

2014-04-19 22:41:20 ----A---- C:\windows\system32\lsass.exe

2014-04-19 22:41:20 ----A---- C:\windows\system32\lsasrv.dll

2014-04-19 22:41:20 ----A---- C:\windows\system32\drivers\ksecpkg.sys

2014-04-19 22:41:20 ----A---- C:\windows\system32\drivers\ksecdd.sys

2014-04-19 22:41:20 ----A---- C:\windows\system32\drivers\cng.sys

2014-04-19 22:37:47 ----A---- C:\windows\SYSWOW64\secproc_ssp_isv.dll

2014-04-19 22:37:47 ----A---- C:\windows\SYSWOW64\secproc_ssp.dll

2014-04-19 22:37:47 ----A---- C:\windows\SYSWOW64\secproc_isv.dll

2014-04-19 22:37:47 ----A---- C:\windows\SYSWOW64\secproc.dll

2014-04-19 22:37:47 ----A---- C:\windows\SYSWOW64\RMActivate_ssp_isv.exe

2014-04-19 22:37:47 ----A---- C:\windows\SYSWOW64\RMActivate_ssp.exe

2014-04-19 22:37:47 ----A---- C:\windows\SYSWOW64\RMActivate_isv.exe

2014-04-19 22:37:47 ----A---- C:\windows\SYSWOW64\RMActivate.exe

2014-04-19 22:37:47 ----A---- C:\windows\SYSWOW64\msdrm.dll

2014-04-19 22:37:47 ----A---- C:\windows\system32\secproc_ssp_isv.dll

2014-04-19 22:37:47 ----A---- C:\windows\system32\secproc_ssp.dll

2014-04-19 22:37:47 ----A---- C:\windows\system32\secproc_isv.dll

2014-04-19 22:37:47 ----A---- C:\windows\system32\secproc.dll

2014-04-19 22:37:47 ----A---- C:\windows\system32\RMActivate_ssp_isv.exe

2014-04-19 22:37:47 ----A---- C:\windows\system32\RMActivate_ssp.exe

2014-04-19 22:37:47 ----A---- C:\windows\system32\RMActivate_isv.exe

2014-04-19 22:37:47 ----A---- C:\windows\system32\RMActivate.exe

2014-04-19 22:37:47 ----A---- C:\windows\system32\msdrm.dll

2014-04-19 22:36:59 ----A---- C:\windows\system32\drivers\usbuhci.sys

2014-04-19 22:36:59 ----A---- C:\windows\system32\drivers\usbport.sys

2014-04-19 22:36:59 ----A---- C:\windows\system32\drivers\usbohci.sys

2014-04-19 22:36:59 ----A---- C:\windows\system32\drivers\usbhub.sys

2014-04-19 22:36:59 ----A---- C:\windows\system32\drivers\usbehci.sys

2014-04-19 22:36:59 ----A---- C:\windows\system32\drivers\usbd.sys

2014-04-19 22:36:59 ----A---- C:\windows\system32\drivers\usbccgp.sys

2014-04-19 22:36:58 ----A---- C:\windows\SYSWOW64\d3d11.dll

2014-04-19 22:36:58 ----A---- C:\windows\system32\d3d11.dll

2014-04-19 22:36:50 ----A---- C:\windows\SYSWOW64\apisetschema.dll

2014-04-19 22:36:50 ----A---- C:\windows\system32\smss.exe

2014-04-19 22:36:50 ----A---- C:\windows\system32\csrsrv.dll

2014-04-19 22:36:50 ----A---- C:\windows\system32\apisetschema.dll

2014-04-19 22:36:44 ----A---- C:\windows\SYSWOW64\WMVDECOD.DLL

2014-04-19 22:36:44 ----A---- C:\windows\system32\WMVDECOD.DLL

2014-04-19 22:36:41 ----A---- C:\windows\system32\drivers\Wdf01000.sys

2014-04-19 22:36:32 ----A---- C:\windows\SYSWOW64\rpcrt4.dll

2014-04-19 22:36:32 ----A---- C:\windows\system32\rpcrt4.dll

2014-04-19 22:36:27 ----A---- C:\windows\system32\drivers\usbvideo.sys

2014-04-19 22:36:27 ----A---- C:\windows\system32\drivers\usbcir.sys

2014-04-19 22:36:21 ----A---- C:\windows\system32\drivers\usbscan.sys

2014-04-19 22:36:21 ----A---- C:\windows\system32\drivers\hidparse.sys

2014-04-19 22:36:21 ----A---- C:\windows\system32\drivers\hidclass.sys

2014-04-19 22:36:20 ----A---- C:\windows\SYSWOW64\WebClnt.dll

2014-04-19 22:36:20 ----A---- C:\windows\SYSWOW64\davclnt.dll

2014-04-19 22:36:20 ----A---- C:\windows\system32\WebClnt.dll

2014-04-19 22:36:20 ----A---- C:\windows\system32\drivers\mrxdav.sys

2014-04-19 22:36:20 ----A---- C:\windows\system32\davclnt.dll

2014-04-19 22:36:18 ----A---- C:\windows\SYSWOW64\d3d10warp.dll

2014-04-19 22:36:18 ----A---- C:\windows\system32\d3d10warp.dll

2014-04-19 22:36:18 ----A---- C:\windows\system32\d2d1.dll

2014-04-19 22:36:17 ----A---- C:\windows\SYSWOW64\d2d1.dll

2014-04-19 22:35:51 ----A---- C:\windows\SYSWOW64\mswsock.dll

2014-04-19 22:35:51 ----A---- C:\windows\system32\mswsock.dll

2014-04-19 22:35:51 ----A---- C:\windows\system32\drivers\tssecsrv.sys

2014-04-19 22:35:45 ----A---- C:\windows\SYSWOW64\ntoskrnl.exe

2014-04-19 22:35:45 ----A---- C:\windows\SYSWOW64\ntkrnlpa.exe

2014-04-19 22:35:45 ----A---- C:\windows\system32\ntoskrnl.exe

2014-04-19 22:35:45 ----A---- C:\windows\system32\ntdll.dll

2014-04-19 22:35:45 ----A---- C:\windows\system32\advapi32.dll

2014-04-19 22:35:44 ----A---- C:\windows\SYSWOW64\tdh.dll

2014-04-19 22:35:44 ----A---- C:\windows\SYSWOW64\ntdll.dll

2014-04-19 22:35:44 ----A---- C:\windows\SYSWOW64\advapi32.dll

2014-04-19 22:35:44 ----A---- C:\windows\system32\tdh.dll

2014-04-19 22:35:39 ----A---- C:\windows\system32\drivers\tcpip.sys

2014-04-19 22:35:38 ----A---- C:\windows\system32\drivers\netio.sys

2014-04-19 22:35:32 ----A---- C:\windows\SYSWOW64\iologmsg.dll

2014-04-19 22:35:32 ----A---- C:\windows\system32\iologmsg.dll

2014-04-19 22:35:32 ----A---- C:\windows\system32\drivers\storport.sys

2014-04-19 22:35:32 ----A---- C:\windows\system32\drivers\msiscsi.sys

2014-04-19 22:35:32 ----A---- C:\windows\system32\drivers\Diskdump.sys

2014-04-19 22:35:21 ----A---- C:\windows\system32\shell32.dll

2014-04-19 22:35:20 ----A---- C:\windows\SYSWOW64\shell32.dll

2014-04-19 22:35:20 ----A---- C:\windows\SYSWOW64\shdocvw.dll

2014-04-19 22:35:20 ----A---- C:\windows\system32\shdocvw.dll

2014-04-19 22:34:00 ----A---- C:\windows\SYSWOW64\win32spl.dll

2014-04-19 22:34:00 ----A---- C:\windows\SYSWOW64\gdi32.dll

2014-04-19 22:34:00 ----A---- C:\windows\system32\win32spl.dll

2014-04-19 22:34:00 ----A---- C:\windows\system32\gdi32.dll

2014-04-19 22:33:59 ----A---- C:\windows\SYSWOW64\qedit.dll

2014-04-19 22:33:59 ----A---- C:\windows\system32\qedit.dll

2014-04-19 22:33:50 ----A---- C:\windows\SYSWOW64\cryptdlg.dll

2014-04-19 22:33:50 ----A---- C:\windows\system32\cryptdlg.dll

2014-04-19 22:33:40 ----A---- C:\windows\SYSWOW64\PresentationCFFRasterizerNative_v0300.dll

2014-04-19 22:33:40 ----A---- C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2014-04-19 22:33:39 ----AH---- C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2014-04-19 22:33:39 ----A---- C:\windows\SYSWOW64\wow32.dll

2014-04-19 22:33:39 ----A---- C:\windows\SYSWOW64\setup16.exe

2014-04-19 22:33:39 ----A---- C:\windows\SYSWOW64\ntvdm64.dll

2014-04-19 22:33:39 ----A---- C:\windows\SYSWOW64\KernelBase.dll

2014-04-19 22:33:39 ----A---- C:\windows\SYSWOW64\kernel32.dll

2014-04-19 22:33:39 ----A---- C:\windows\SYSWOW64\instnm.exe

2014-04-19 22:33:39 ----A---- C:\windows\system32\wow64win.dll

2014-04-19 22:33:39 ----A---- C:\windows\system32\wow64cpu.dll

2014-04-19 22:33:39 ----A---- C:\windows\system32\wow64.dll

2014-04-19 22:33:39 ----A---- C:\windows\system32\winsrv.dll

2014-04-19 22:33:39 ----A---- C:\windows\system32\ntvdm64.dll

2014-04-19 22:33:39 ----A---- C:\windows\system32\KernelBase.dll

2014-04-19 22:33:39 ----A---- C:\windows\system32\kernel32.dll

2014-04-19 22:33:39 ----A---- C:\windows\system32\conhost.exe

2014-04-19 22:33:38 ----AH---- C:\windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2014-04-19 22:33:38 ----AH---- C:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2014-04-19 22:33:38 ----A---- C:\windows\SYSWOW64\user.exe

2014-04-19 22:33:36 ----A---- C:\windows\system32\drivers\ntfs.sys

2014-04-19 22:33:25 ----A---- C:\windows\SYSWOW64\certutil.exe

2014-04-19 22:33:25 ----A---- C:\windows\system32\certutil.exe

2014-04-19 22:33:22 ----A---- C:\windows\SYSWOW64\certenc.dll

2014-04-19 22:33:22 ----A---- C:\windows\system32\certenc.dll

2014-04-19 22:33:12 ----A---- C:\windows\SYSWOW64\wscript.exe

2014-04-19 22:33:12 ----A---- C:\windows\SYSWOW64\scrrun.dll

2014-04-19 22:33:12 ----A---- C:\windows\SYSWOW64\cscript.exe

2014-04-19 22:33:12 ----A---- C:\windows\system32\wscript.exe

2014-04-19 22:33:12 ----A---- C:\windows\system32\scrrun.dll

2014-04-19 22:33:12 ----A---- C:\windows\system32\drivers\dxgmms1.sys

2014-04-19 22:33:12 ----A---- C:\windows\system32\drivers\dxgkrnl.sys

2014-04-19 22:33:12 ----A---- C:\windows\system32\cscript.exe

2014-04-19 22:33:12 ----A---- C:\windows\system32\cdd.dll

2014-04-19 22:32:47 ----A---- C:\windows\SYSWOW64\DWrite.dll

2014-04-19 22:32:47 ----A---- C:\windows\system32\DWrite.dll

2014-04-19 22:32:40 ----A---- C:\windows\SYSWOW64\WindowsCodecs.dll

2014-04-19 22:32:40 ----A---- C:\windows\system32\WindowsCodecs.dll

2014-04-19 22:32:34 ----A---- C:\windows\SYSWOW64\nshwfp.dll

2014-04-19 22:32:34 ----A---- C:\windows\SYSWOW64\FWPUCLNT.DLL

2014-04-19 22:32:34 ----A---- C:\windows\system32\nshwfp.dll

2014-04-19 22:32:34 ----A---- C:\windows\system32\IKEEXT.DLL

2014-04-19 22:32:34 ----A---- C:\windows\system32\FWPUCLNT.DLL

2014-04-19 22:32:31 ----A---- C:\windows\system32\scavengeui.dll

2014-04-19 20:27:57 ----D---- C:\windows\temp

2014-04-19 20:27:51 ----A---- C:\ComboFix.txt

2014-04-19 20:16:19 ----A---- C:\windows\zip.exe

2014-04-19 20:16:19 ----A---- C:\windows\SWSC.exe

2014-04-19 20:16:19 ----A---- C:\windows\SWREG.exe

2014-04-19 20:16:19 ----A---- C:\windows\sed.exe

2014-04-19 20:16:19 ----A---- C:\windows\PEV.exe

2014-04-19 20:16:19 ----A---- C:\windows\NIRCMD.exe

2014-04-19 20:16:19 ----A---- C:\windows\MBR.exe

2014-04-19 20:16:19 ----A---- C:\windows\grep.exe

2014-04-19 20:14:53 ----D---- C:\Qoobox

2014-04-19 20:14:03 ----D---- C:\windows\erdnt

2014-04-19 02:55:30 ----D---- C:\windows\Microsoft Antimalware

2014-04-16 11:16:16 ----A---- C:\windows\SYSWOW64\javaws.exe

2014-04-16 11:16:13 ----A---- C:\windows\SYSWOW64\WindowsAccessBridge-32.dll

2014-04-16 11:16:13 ----A---- C:\windows\SYSWOW64\javaw.exe

2014-04-16 11:16:13 ----A---- C:\windows\SYSWOW64\java.exe

2014-04-15 09:16:15 ----D---- C:\Program Files (x86)\Microsoft OneDrive

2014-04-15 09:15:57 ----D---- C:\ProgramData\Microsoft OneDrive

2014-03-29 13:38:56 ----D---- C:\Program Files (x86)\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2014-04-21 16:51:34 ----RD---- C:\Program Files

2014-04-21 16:49:06 ----D---- C:\Users\Simon Derbaix\AppData\Roaming\Skype

2014-04-21 16:46:49 ----D---- C:\windows\Microsoft.NET

2014-04-21 16:46:32 ----RSD---- C:\windows\assembly

2014-04-21 16:46:10 ----D---- C:\Users\Simon Derbaix\AppData\Roaming\Spotify

2014-04-21 15:40:24 ----D---- C:\windows\system32\config

2014-04-21 15:29:08 ----D---- C:\windows\System32

2014-04-21 15:29:08 ----D---- C:\windows\inf

2014-04-21 15:29:08 ----A---- C:\windows\system32\PerfStringBackup.INI

2014-04-21 15:28:18 ----A---- C:\windows\SYSWOW64\log.txt

2014-04-21 15:26:17 ----D---- C:\windows\system32\Tasks

2014-04-21 15:25:39 ----A---- C:\IFRToolLog.txt

2014-04-21 15:24:35 ----D---- C:\Users\Simon Derbaix\AppData\Roaming\.strongvpn

2014-04-21 15:24:05 ----D---- C:\Windows

2014-04-21 15:24:05 ----D---- C:\Config.Msi

2014-04-21 13:25:00 ----D---- C:\windows\winsxs

2014-04-21 13:25:00 ----D---- C:\windows\system32\catroot

2014-04-21 09:08:00 ----SHD---- C:\windows\Installer

2014-04-21 09:07:55 ----D---- C:\ProgramData\Microsoft Help

2014-04-21 08:55:28 ----SHD---- C:\System Volume Information

2014-04-20 19:44:08 ----D---- C:\windows\SysWOW64

2014-04-20 19:44:08 ----D---- C:\Program Files\Internet Explorer

2014-04-20 19:44:08 ----D---- C:\Program Files (x86)\Internet Explorer

2014-04-20 19:38:15 ----D---- C:\Users\Simon Derbaix\AppData\Roaming\uTorrent

2014-04-20 19:38:15 ----D---- C:\Users\Simon Derbaix\AppData\Roaming\FileZilla

2014-04-20 19:37:50 ----D---- C:\windows\Panther

2014-04-20 19:37:50 ----D---- C:\windows\Logs

2014-04-20 19:37:50 ----D---- C:\windows\debug

2014-04-20 19:37:49 ----D---- C:\windows\Minidump

2014-04-20 19:34:44 ----D---- C:\Program Files (x86)

2014-04-20 19:33:21 ----A---- C:\windows\SYSWOW64\PerfStringBackup.INI

2014-04-20 17:34:34 ----D---- C:\windows\system32\catroot2

2014-04-20 12:01:11 ----D---- C:\Program Files (x86)\Windows Media Player

2014-04-20 12:01:10 ----D---- C:\windows\SYSWOW64\nl-NL

2014-04-20 12:01:10 ----D---- C:\windows\system32\nl-NL

2014-04-20 12:01:10 ----D---- C:\Program Files\Windows Media Player

2014-04-20 12:01:09 ----D---- C:\windows\SYSWOW64\migration

2014-04-20 12:01:09 ----D---- C:\windows\SYSWOW64\en-US

2014-04-20 12:01:08 ----D---- C:\windows\system32\migration

2014-04-20 12:01:08 ----D---- C:\windows\system32\en-US

2014-04-20 12:01:08 ----D---- C:\windows\PolicyDefinitions

2014-04-20 12:01:08 ----D---- C:\windows\AppPatch

2014-04-20 12:01:05 ----D---- C:\windows\system32\drivers

2014-04-20 12:01:04 ----D---- C:\Program Files\Windows Defender

2014-04-20 12:01:04 ----D---- C:\Program Files (x86)\Windows Defender

2014-04-20 12:00:56 ----D---- C:\Program Files\Windows Journal

2014-04-20 12:00:45 ----D---- C:\windows\system32\DriverStore

2014-04-20 11:58:21 ----D---- C:\Program Files (x86)\Microsoft Silverlight

2014-04-20 11:49:40 ----D---- C:\Program Files (x86)\Microsoft Application Virtualization Client

2014-04-20 11:37:15 ----SD---- C:\ProgramData\Microsoft

2014-04-20 11:12:49 ----D---- C:\ProgramData\Skype

2014-04-20 11:12:48 ----RD---- C:\Program Files (x86)\Skype

2014-04-19 23:46:06 ----D---- C:\Program Files\Microsoft Silverlight

2014-04-19 20:24:15 ----A---- C:\windows\system.ini

2014-04-19 20:24:07 ----D---- C:\$Recycle.Bin

2014-04-19 20:24:03 ----D---- C:\windows\system32\drivers\etc

2014-04-19 20:21:43 ----D---- C:\ProgramData

2014-04-19 20:20:07 ----D---- C:\windows\SYSWOW64\drivers

2014-04-19 20:20:07 ----D---- C:\Program Files (x86)\Common Files

2014-04-16 11:16:30 ----D---- C:\ProgramData\Oracle

2014-04-16 11:16:13 ----D---- C:\Program Files (x86)\Java

2014-04-14 19:02:23 ----D---- C:\xampp

2014-04-14 18:55:36 ----D---- C:\Program Files (x86)\ShopEx

2014-04-12 10:49:29 ----D---- C:\windows\Prefetch

2014-03-31 09:35:08 ----N---- C:\windows\system32\MpSigStub.exe

2014-03-31 03:51:02 ----A---- C:\windows\system32\MRT.exe

2014-03-30 14:15:00 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service

2014-03-24 14:37:02 ----D---- C:\Users\Simon Derbaix\AppData\Roaming\Tencent

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\windows\system32\DRIVERS\iaStor.sys [2011-11-29 568600]

R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-21 213888]

R1 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2012-01-05 14652768]

R1 SABI;SAMSUNG Kernel Driver For Windows 7; \??\C:\windows\system32\Drivers\SABI.sys [2011-06-13 13824]

R1 VWiFiFlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2011-01-25 60416]

R3 acpials;ALS Sensor Filter; C:\windows\system32\DRIVERS\acpials.sys [2009-07-14 9728]

R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® + High Speed Virtuele adapter; C:\windows\system32\DRIVERS\AMPPAL.sys [2013-04-11 164832]

R3 clwvd;CyberLink WebCam Virtual Driver; C:\windows\system32\DRIVERS\clwvd.sys [2012-02-16 31216]

R3 ETD;Samsung PS/2 Port Input Device; C:\windows\system32\DRIVERS\ETD.sys [2012-10-09 325488]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2012-05-15 4035816]

R3 IntcDAud;Intel® Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-06 331264]

R3 irstrtdv;Intel® Rapid Start Technology Driver; C:\windows\system32\DRIVERS\irstrtdv.sys [2012-02-07 26504]

R3 iwdbus;IWD Bus Enumerator; C:\windows\system32\DRIVERS\iwdbus.sys [2011-12-20 25496]

R3 MBAMProtector;MBAMProtector; \??\C:\windows\system32\drivers\mbam.sys [2013-04-04 25928]

R3 MEIx64;Intel® Management Engine Interface ; C:\windows\system32\DRIVERS\HECIx64.sys [2012-07-17 62784]

R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series adapter stuurprogramma onder Windows 7 64 Bit; C:\windows\system32\DRIVERS\Netwsw00.sys [2013-05-08 11524096]

R3 RTL8167;Realtek 8167 NT Driver; C:\windows\system32\DRIVERS\Rt64win7.sys [2011-11-23 648808]

R3 rusb3hub;Renesas Electronics USB 3.0 Hub Driver (Version 3.0); C:\windows\system32\DRIVERS\rusb3hub.sys [2013-02-08 114568]

R3 rusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver (Version 3.0); C:\windows\system32\DRIVERS\rusb3xhc.sys [2011-10-08 216064]

R3 Sftfs;Sftfs; C:\windows\system32\DRIVERS\Sftfslh.sys [2013-06-26 767144]

R3 Sftplay;Sftplay; C:\windows\system32\DRIVERS\Sftplaylh.sys [2013-06-26 273576]

R3 Sftredir;Sftredir; C:\windows\system32\DRIVERS\Sftredirlh.sys [2013-06-26 28840]

R3 Sftvol;Sftvol; C:\windows\system32\DRIVERS\Sftvollh.sys [2013-06-26 23208]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys [2011-01-25 18432]

S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® + High Speed Protocol; C:\windows\system32\DRIVERS\amppal.sys [2013-04-11 164832]

S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]

S3 BthEnum;Bluetooth-stuurprogramma voor aanvraagblok; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 41984]

S3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]

S3 BTHPORT;Stuurprogramma voor Bluetooth-poort; C:\windows\System32\Drivers\BTHport.sys [2012-07-07 552960]

S3 BTHUSB;USB-stuurprogramma voor Bluetooth-radio; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]

S3 btmaudio;Intel Bluetooth Audio Service; C:\windows\system32\drivers\btmaud.sys [2011-11-30 51712]

S3 btmaux;Intel Bluetooth Auxiliary Service; C:\windows\system32\DRIVERS\btmaux.sys [2011-11-30 94720]

S3 btmhsf;btmhsf; C:\windows\system32\DRIVERS\btmhsf.sys [2011-11-30 747008]

S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\windows\system32\DRIVERS\ssudbus.sys [2014-01-23 108800]

S3 Dot4;MS IEEE-1284.4 Driver; C:\windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]

S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\windows\system32\DRIVERS\Dot4Prt.sys [2010-11-21 19968]

S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]

S3 droidpad;DroidPad Joystick; C:\windows\system32\DRIVERS\droidpad.sys [2012-12-25 21320]

S3 ibtfltcoex;ibtfltcoex; C:\windows\system32\DRIVERS\iBtFltCoex.sys [2012-02-14 60928]

S3 intaud_WaveExtensible;Intel WiDi Audio Device; C:\windows\system32\drivers\intelaud.sys [2011-12-20 34200]

S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12352]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]

S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]

S3 SBIOSIO;SBIOSIO; \??\C:\Users\SIMOND~1\AppData\Local\Temp\__Samsung_Update\SBIOSIO64.sys []

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\windows\system32\DRIVERS\ssudmdm.sys [2014-01-23 206080]

S3 tapstrong;StrongVPN Adapter; C:\windows\system32\DRIVERS\tapstrong.sys [2013-08-13 35520]

S3 TsUsbFlt;TsUsbFlt; C:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

S3 TsUsbGD;Remote Desktop Generic USB Device; C:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]

S3 usbscan;Stuurprogramma voor USB-scanner; C:\windows\system32\drivers\usbscan.sys [2013-07-03 42496]

S3 WinUsb;SAMSUNG Android USB Driver; C:\windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-09-23 65192]

R2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® + High Speed Service; C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2013-04-11 772064]

R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2012-02-22 1014096]

R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2012-02-22 1104208]

R2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® + High Speed Security Service; C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2012-09-12 135984]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]

R2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2013-04-22 822504]

R2 EvtEng;Intel® PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2013-05-08 621296]

R2 HPSLPSVC;HP Network Devices Support; C:\windows\system32\svchost.exe [2011-03-01 27648]

R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-02-02 628448]

R2 Intel® ME Service;Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [2012-02-08 128280]

R2 irstrtsv;Intel® Rapid Start Technology Service; C:\windows\SysWOW64\irstrtsv.exe [2012-02-06 193536]

R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [2012-02-08 161560]

R2 LMS;Intel® Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe [2012-02-08 277784]

R2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]

R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]

R2 mysql;mysql; C:\xampp\mysql\bin\mysqld --defaults-file=C:\xampp\mysql\bin\my.ini mysql []

R2 Net Driver HPZ12;Net Driver HPZ12; C:\windows\System32\svchost.exe [2011-03-01 27648]

R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\System32\svchost.exe [2011-03-01 27648]

R2 RegSrvc;Intel® PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2013-05-08 149744]

R2 SamsungDeviceConfigurationWinService;SamsungDeviceConfiguration; C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe [2012-02-13 31624]

R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-06-26 523944]

R2 StrongVPN Service;StrongVPN Service; C:\Program Files (x86)\StrongVPN\StrongService.exe [2014-02-25 94704]

R2 SWUpdateService;SW Update Service; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [2013-10-21 3018800]

R2 TeamViewer9;TeamViewer 9; C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [2014-02-17 4915040]

R2 UNS;Intel® Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-02-08 363800]

R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 2292096]

R3 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2012-02-22 1304912]

R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-06-26 207528]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]

S2 gupdate;Google Update-service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-23 116648]

S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12 257928]

S3 cphs;Intel® Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2012-02-03 274200]

S3 gupdatem;Google Update-service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-23 116648]

S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\windows\system32\IEEtwCollector.exe [2014-03-01 111616]

S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-03-29 119408]

S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2013-05-08 273136]

S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]

S3 SwitchBoard;Adobe SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2013-02-13 1255736]

S4 aspnet_state;ASP.NET-statusservice; C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]

S4 NetMsmqActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 NetPipeActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 NetTcpActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------

Hallo,

1. Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe (hier en hier) kan je lezen hoe je dat doet.
   Download Zoek.exe naar het bureaublad (niet de .zip- of .rar-versie).
   
   • 
     
   • Wanneer Internet Explorer of een andere browser of virusscanner melding geeft dat dit bestand onveilig zou zijn kun je negeren, dit is namelijk een onterechte waarschuwing.
     
   • Dubbelklik op Zoek.exe om de tool te starten.
     
   • Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
     
   • Kopieer nu onderstaande code en plak die in het grote invulvenster:
     
   • Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.
     

 
autoclean;
emptyfolderscheck;delete 
emptyclsid;
{0B5B235B-6861-4591-92EE-D5C358C61A0B};c
uninstall-list;

• 
  
• De optie "Scan All Users" staat standaard aangevinkt.
  
• Klik nu op de knop "Run script".
  
• Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
  
• Mocht er geen logje verschijnen, start zoek.exe dan opnieuw en klik op de knop zoek-results.log, de log verschijnt dan alsnog.
  
• Post het geopende logje in het volgende bericht als bijlage.

Zoek.exe logbestand plaatsen

• Voeg het logbestand met de naam "Zoek-results.log" als bijlage toe aan het volgende bericht. (Dit logbestand kunt u tevens terug vinden op de systeemschijf als C:\\Zoek-results.log.)
  
• Hoe u een bijlage kunt toevoegen aan het bericht leest u hier.

[*]Ga naar de site van ESET Online Scanner.

Klik op de knop “Run ESET Online Scanner”

In een apart scherm krijg je de vraag om EsetSmartInstaller te downloaden

Klik op de link van esetsmartinstaller_enu.exe en dan start de download automatisch op.

Kies voor “Download” van dit bestand.

Klik op “uitvoeren” van dit bestand esetsmartinstaller_enu.exe

Zet een vinkje bij “YES, I accept the Terms of Use”

Klik op “Start”

Klik op "Advanced settings"

Zet een vinkje bij de volgende opties:

• 
  
• Remove found threats
  
• Scan archives
  
• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth technology
  

Klik op “Start”

De computer wordt nu gescand. Dit kan best lang duren, heb dus geduld.

Je mag het venster sluiten wanneer de scan klaar is.

Post het geopende logje in het volgende bericht als bijlage. Dit logje vind je op de locatie C:\\Program Files\\Eset\\EsetOnlineScanner\\log.txt

Zo, beide tools hebben hun ding gedaan. De logjes kan je als bijlage vinden!

log Eset.txt

zoek-results.txt

Hallo,

1. Ga naar Start - Configuratiescherm - Software en deïnstalleer volgende programma's:
   
   • My Free Codec

[*]Download MalwareBytes Anti-Malware bij voorkeur naar het bureaublad.

• 
  
• Dubbelklik op mbam-setup-2.0.exe om de installatie van Malwarebytes Anti-Malware te starten.
  
• Volg de verdere aanwijzingen, de volledige installatieprocedure kunt u nalezen op de volgende link - Malwarebytes Anti-Malware installeren.
  

• 
  
• Klik vervolgens op de knop Scan nu om een bedreigingsscan uit te voeren.
  
• Er zal nu gecontroleerd worden op beschikbare updates, klik hier op "Nu bijwerken als er beschikbare updates zijn.
  
• De scan wordt nu automatisch gestart,wanneer de scan gereed is en er bedreigingen zijn gedetecteerd krijgt u hier een overzicht van.
  
• Wanneer er geen bedreigingen zijn gedetecteerd klikt u na de scan op Bekijk gedetailleerd logboek.
  
  • 
    
  • Klik vervolgens op de knop Acties toepassen, bij de melding dat uw computer opnieuw opgestart moet worden klikt u op Nee.
    
  • Klik vervolgens op de knop Bekijk gedetailleerd logboek en klik op de knop exporteer en kies de optie tekstbestand (*.txt).
    
  • Geef vervolgens een bestandsnaam op voor het opslaan van het logbestand, bijvoorbeeld MBAM Scanlog en klik vervolgens op de knop Opslaan.
    
  • Dit bestand zal standaard op uw bureaublad worden opgeslagen.
    

MalwareBytes' Anti-Malware logbestand plaatsen

• 
  
• Voeg het logbestand wat u zojuist heeft opgeslagen als bijlage toe aan het volgende bericht. (Dit logbestand kunt u tevens terug vinden in Malwarebytes Anti-Malware bij Historie > Programmalogboeken)
  
• Plaats de inhoud van dit logbestand in het volgende bericht.
  

Hey Mako,

Ik heb MBAM 1.75 Pro op de PC staan met een up to date library. Wil je dat ik 2.0 download?

Snel eens een scan gedaan met 1.75 en dat leverde niks op. Maar het leverde ook niks op toen de PC besmet was dus weet ik niet zeker als het betrouwbaar is.

Wat ik wel merk is dat MBAM elke dag connecties tegenhoud. Wat hij vroeger nooit deed. Dit is het logje van vandaag bijvoorbeeld:

2014/04/24 10:53:48 +0800 SIMONDERBAIX-PC Simon Derbaix IP-BLOCK 219.152.25.191 (Type: outgoing, Port: 53999, Process: skype.exe)

2014/04/24 10:53:48 +0800 SIMONDERBAIX-PC Simon Derbaix IP-BLOCK 219.152.25.191 (Type: outgoing, Port: 54000, Process: skype.exe)

2014/04/24 10:53:48 +0800 SIMONDERBAIX-PC Simon Derbaix IP-BLOCK 219.152.25.191 (Type: outgoing, Port: 54001, Process: skype.exe)

2014/04/24 10:53:48 +0800 SIMONDERBAIX-PC Simon Derbaix IP-BLOCK 219.152.25.191 (Type: outgoing, Port: 54002, Process: skype.exe)

2014/04/24 12:48:56 +0800 SIMONDERBAIX-PC (null) MESSAGE Starting protection

2014/04/24 12:48:56 +0800 SIMONDERBAIX-PC (null) MESSAGE Protection started successfully

2014/04/24 12:48:56 +0800 SIMONDERBAIX-PC (null) MESSAGE Starting IP protection

2014/04/24 12:48:59 +0800 SIMONDERBAIX-PC (null) MESSAGE IP Protection started successfully

2014/04/24 13:53:41 +0800 SIMONDERBAIX-PC Simon Derbaix MESSAGE Executing scheduled update: Daily

2014/04/24 13:54:23 +0800 SIMONDERBAIX-PC Simon Derbaix MESSAGE Scheduled update executed successfully: database updated from version v2014.04.23.01 to version v2014.04.24.04

2014/04/24 13:54:23 +0800 SIMONDERBAIX-PC Simon Derbaix MESSAGE Starting database refresh

2014/04/24 13:54:23 +0800 SIMONDERBAIX-PC Simon Derbaix MESSAGE Stopping IP protection

2014/04/24 13:54:24 +0800 SIMONDERBAIX-PC Simon Derbaix MESSAGE IP Protection stopped successfully

2014/04/24 13:54:29 +0800 SIMONDERBAIX-PC Simon Derbaix MESSAGE Database refreshed successfully

2014/04/24 13:54:29 +0800 SIMONDERBAIX-PC Simon Derbaix MESSAGE Starting IP protection

2014/04/24 13:54:32 +0800 SIMONDERBAIX-PC Simon Derbaix MESSAGE IP Protection started successfully

2014/04/24 18:04:36 +0800 SIMONDERBAIX-PC Simon Derbaix IP-BLOCK 219.146.150.170 (Type: outgoing, Port: 50303, Process: skype.exe)

Geen idee als je er iets mee bent...

De Free Codec Pack is ondertussen van de PC af.

Allesinds al heel hard bedankt voor super hulp!

Goeie avond ,

Bedankt voor het logbestand van de geblokkeerde verbindingen, dat is altijd wel handig. Ik zag een gelijkaardig IP adres al terug in een eerder logje van je. MBAM blokkeert een verbinding naar China via Skype. Dit lijkt me niet helemaal in orde en gaan we dus sowieso nog verder aanpakken.

Download OTL naar je bureaublad.

• 
  
• Dubbelklik op "OTL.exe" om de tool te starten.
  
• Wanneer er een melding verschijnt van het gebruikersaccountbeheer klik dan op "Ja / Yes".
  
• Vink bovenin OTL de optie "Scan all users" aan.
  
• Klik nu op de knop "Run Scan" .
  
• Wanneer OTL gereed is zullen er twee log bestanden worden geopend (Deze worden tevens op dezelfde locatie opgeslagen als waar OTL is uitgevoerd).
  
• Voeg beide bestanden nu als bijlage toe aan het volgende bericht.
  

N.B. De scan met de oudere versie van MBAM is op zich wel goed hoor. Al biedt de nieuwste versie uiteraard enkele vernieuwde en verbeterde functies. Lees er ook even dit artikel op na.

Zo, hier zijn de 2 logjes!

OTL.Txt

Op zich is het niet zo raar dat de Chinese adressen bovendrijven omdat ik zelf in China verblijf.

Maar dit is wel de eerste keer dat MBAM deze IP adressen tegenhoud. Vroeger kreeg ik nooit meldingen.

Ondertussen merk ik wel dat mij PC al aanzienlijk beter werkt en zijn er geen voelbare problemen meer.

Extras.Txt