~ Verslag van ZHPDiag v2014.5.9.58 - Nicolas Coolman (9-5-2014) ~ Gelanceerd door Guido (9-5-2014 20:53:34) ~ Het adres van de website : http://nicolascoolman.webs.com ~ Gratis supportforum voor desinfectie : http://nicolascoolman.webs.com/apps/links/ ~ Vertaald door de gebruiker ~ Staat van de versie : ~ Lijst wit : Ingeschakeld door het programma ~ Tot misbruik van bevoegdheden : OK ~ Gebruikersaccountbeheer (UAC) : Activate by user ---\\ Internet-browsers MSIE: Internet Explorer v11.0.9600.17105 MFIE: Mozilla Firefox 26.0 GCIE: Google Chrome v34.0.1847.131 (Defaut) ---\\ Windows productinformatie ~ Langage: Néerlandais Windows 8.1, 64-bit (Build 9600) Windows Server License Manager Script : OK Software Protection Service (Protection logicielle) : OK Key Management Service client information : KO Windows Automatic Updates : OK Windows Activation Technologies : OK ---\\ Software om het systeem te beveiligen Malwarebytes Anti-Malware versie 2.0.1.1004 Spybot - Search & Destroy v2.2.25 Windows Defender W8 ---\\ Systeem optimalisatie software CCleaner v4.10 ---\\ Delen van software PeerToPeer Vuze v4.8.1.2 =>P2P.Azureus ---\\ Software die extra aandacht behoeft Adobe Flash Player 11 Plugin Adobe Reader XI ---\\ Informatie over het systeem ~ Processor: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 6035 MB (57% free) System Restore: Activé (Enable) System drive C: has 272 GB (61%) free of 441 GB ---\\ Verbinding met het systeem-modus ~ Computer Name: LAPTOP_MAAS ~ User Name: Guido ~ All Users Names: HomeGroupUser$, Guido, Gast, elektrik, Administrator, ~ Unselected Option: None Logged in as Administrator ---\\ Omgevingsvariabelen ~ System Unit : C:\ ~ %AppZHP% : C:\Users\Guido\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\Guido\AppData\Roaming\ ~ %Desktop% : C:\Users\Guido\Desktop\ ~ %Favorites% : C:\Users\Guido\Favorites\ ~ %LocalAppData% : C:\Users\Guido\AppData\Local\ ~ %StartMenu% : C:\Users\Guido\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Overzicht vaste en verwisselbare stations C: Hard drive, Flash drive, Thumb drive (Free 272 Go of 441 Go) D: CD-ROM drive (Not Inserted) ---\\ Staat van het Windows Beveiligingscentrum [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified ~ Security Center: 44 Legitimates Filtered in 00mn 00s ---\\ Zoeken naar bepaalde algemene bestanden [MD5.81394C91B7B5A7C799E249AE82491F13] - (.Microsoft Corporation - Windows Verkenner.) (.4-3-2014 - 13:25:49.) -- C:\Windows\Explorer.exe [2373784] [MD5.48CFA7BE561A7BE144C29BB912055016] - (.Microsoft Corporation - Windows Toepassing Opstarten.) (.22-8-2013 - 10:58:29.) -- C:\Windows\System32\Wininit.exe [144384] [MD5.65C36A29A131A3A5D64B29FAC4EF6DD6] - (.Microsoft Corporation - Internetuitbreidingen voor Win32.) (.22-2-2014 - 10:11:56.) -- C:\Windows\System32\wininet.dll [2262016] [MD5.306EB21E5B480AE9065EA55AC8C35936] - (.Microsoft Corporation - Toepassing Windows-aanmelden.) (.22-2-2014 - 10:45:48.) -- C:\Windows\System32\Winlogon.exe [562176] [MD5.AFCAB4DC692CCE37E283B00E2D7B438F] - (.Microsoft Corporation - Software Licensing-bibliotheek.) (.21-12-2013 - 09:54:07.) -- C:\Windows\System32\sppcomapi.dll [447488] [MD5.239268BAB58EAE9A3FF4E08334C00451] - (.Microsoft Corporation - Ondersteunend functiestuurprogramma van WinSock.) (.22-8-2013 - 14:25:35.) -- C:\Windows\system32\Drivers\AFD.sys [567296] [MD5.74B14192CF79A72F7536B27CB8814FBD] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22-8-2013 - 13:43:41.) -- C:\Windows\system32\Drivers\atapi.sys [26464] [MD5.2FA6510E33F7DEFEC03658B74101A9B9] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22-8-2013 - 12:40:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [88576] [MD5.C6796EA22B513E3457514D92DCDB1A3D] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22-8-2013 - 09:46:35.) -- C:\Windows\system32\Drivers\Cdrom.sys [164352] [MD5.A03F362C5557E238CBFA914689C77248] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.6-3-2014 - 10:22:50.) -- C:\Windows\system32\Drivers\DfsC.sys [134144] [MD5.03909BDBFF0DCACCABF2B2D4ADEE44DC] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.22-8-2013 - 12:38:38.) -- C:\Windows\system32\Drivers\HDAudBus.sys [78336] [MD5.84CFC5EFA97D0C965EDE1D56F116A541] - (.Microsoft Corporation - i8042-poortstuurprogramma.) (.22-8-2013 - 12:39:15.) -- C:\Windows\system32\Drivers\i8042prt.sys [107520] [MD5.B7342B3C58E91107F6E946A93D9D4EFD] - (.Microsoft Corporation - IP Network Address Translator.) (.27-11-2013 - 13:02:29.) -- C:\Windows\system32\Drivers\IpNat.sys [142848] [MD5.C997E6A37BA8915224B3FB5024A34F69] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.6-3-2014 - 10:20:23.) -- C:\Windows\system32\Drivers\MRxSmb.sys [402944] [MD5.0217532E19A748F0E5D569307363D5FD] - (.Microsoft Corporation - MBT Transport driver.) (.22-8-2013 - 12:37:02.) -- C:\Windows\system32\Drivers\netBT.sys [282624] [MD5.1C80517BE6836A812F6A9B99B8321351] - (.Microsoft Corporation - NT-bestandssysteemstuurprogramma.) (.20-3-2014 - 04:41:24.) -- C:\Windows\system32\Drivers\ntfs.sys [2013016] [MD5.764B1121867B2D9B31C491668AC72B2B] - (.Microsoft Corporation - Stuurprogramma voor parallelle poort.) (.22-8-2013 - 12:40:02.) -- C:\Windows\system32\Drivers\Parport.sys [94208] [MD5.BBB6272B7F46C4640A8CDB8A70C3450F] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.22-8-2013 - 12:35:51.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [120832] [MD5.680C1DAE268B6FB67FA21B389A8B79EF] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.30-9-2013 - 05:02:01.) -- C:\Windows\system32\Drivers\rdpdr.sys [195584] [MD5.FFF28F9F6823EB1756C60F1649560BBF] - (.Microsoft Corporation - TDI Translation Driver.) (.22-8-2013 - 14:25:35.) -- C:\Windows\system32\Drivers\tdx.sys [107520] [MD5.3595FBDF25F8BA6256072D103937D7D6] - (.Microsoft Corporation - Volume Shadow Copy-stuurprogramma.) (.22-2-2014 - 16:44:13.) -- C:\Windows\system32\Drivers\volsnap.sys [311640] ~ Generic Processes: Scanned in 00mn 01s ---\\ Status van de verborgen bestanden (verborgen/totaal) ~ Mes images (My Pictures) : 2/1485 ~ Mes musiques (My Musics) : 4/311 ~ Mes Videos (My Videos) : 2/259 ~ Mes Favoris (My Favorites) : 1/525 ~ Mes Documents (My Documents) : 1/2314 ~ Mon Bureau (My Desktop) : 3/134 ~ Menu demarrer (Programs) : 1/39 ~ Hidden Files: Scanned in 00mn 15s ---\\ Gestarte processen [MD5.8B485AC47C446C9FBEA8641DA36D35DC] - (.TeamViewer GmbH - TeamViewer 8.) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe [12641632] [PID.5380] [MD5.48C3EBD6D5E52AFCB1A0FA9B7F9802FA] - (.Apple Inc. - iCloud.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720] [PID.4784] [MD5.799BCC829F48F19C5689478179060435] - (.Apple Inc. - Apple Photostreams Uploader Executable.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720] [PID.8116] [MD5.A7810B302294793DE88542AAE177D1B1] - (.ArcSoft Inc. - ArcSoft Connect Daemon.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424] [PID.6400] [MD5.79C28DDF889C26FDD6162F796FD49BC4] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.3972] [MD5.47833576F0BEE0AD7B45109982B769BD] - (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe [59720] [PID.3736] [MD5.FF2CE3EC0F87A69B2F61EF9D89514800] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504] [PID.2404] [MD5.542459D16B416D054161007FC9B1246E] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [841032] [PID.2296] [MD5.05BE9A378036323EC42CCD3F9BB03266] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7872000] [PID.8048] ~ Processes Running: Scanned in 00mn 00s ---\\ Google Chrome, start, zoeken, extensies (G0, G1, G2) C:\Users\Guido\AppData\Local\Google\Chrome\User Data\Default\Preferences G0 - GCSP: Preference [User Data\Default][HomePage] http://www.nu.nl G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Winkel v.0.2 (Activé) G2 - GCE: Preference [User Data\Default] [mfffpogegjflfpflabcdkioaeobkgjik] GaiaAuthExtension v.0.0.1, (Activé) G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé) ---\\ Google Chrome extensie map ~ Google Lines Browser: 12 Legitimates Filtered in 00mn 08s ---\\ Mozilla Firefox, Plugins, start, zoeken, extensies (P2, M0, M1, M2, M3) C:\Users\Guido\AppData\Roaming\Mozilla\Firefox\Profiles\3hzkzdgm.default\prefs.js C:\Users\Guido\AppData\Roaming\Mozilla\Firefox\Profiles\meh32jrn.default\prefs.js (.not file.) ~ Firefox Browser: 5 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, proxybeheer (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse van lijnen F0, F1, F2, F3 - IniFiles, Autoloading programma's F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts-bestand omleiding (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 21 ---\\ Internet Explorer werkbalken (O3) O3 - Toolbar: Classic Explorer Bar - [HKLM]{553891B7-A0D5-4526-BE18-D3CE461D6310} . (.IvoSoft - Adds classic Windows Explorer features.) -- C:\Program Files\Classic Shell\ClassicExplorer64.dll ~ Toolbar: Scanned in 00mn 00s ---\\ Andere Verwijzigingen gebruikers (O4) O4 - GS\Desktop [Public]: Advanced System Optimizer.lnk . (...) -- C:\Program Files (x86)\Advanced System Optimizer 3\HighestAvailable.exe (.not file.) =>PUP.AdvancedSystemOptimizer O4 - GS\Desktop [Public]: Vuze.lnk . (...) -- C:\Program Files (x86)\Vuze\Azureus.exe (.not file.) =>P2P.Azureus O4 - GS\Program [Public]: Vuze.lnk . (...) -- C:\Program Files (x86)\Vuze\Azureus.exe (.not file.) =>P2P.Azureus O4 - GS\QuickLaunch [Guido]: Vuze.lnk . (...) -- C:\Program Files (x86)\Vuze\Azureus.exe (.not file.) =>P2P.Azureus ~ Global Startup: 4 Legitimates Filtered in 00mn 04s ---\\ Toepassingen gestart door register & bestand (O4) O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Realtek HD Audio configuratie.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe O4 - HKLM\..\Run: [BtTray] . (.Qualcomm Atheros - BtTray.) -- C:\Program Files (x86)\Bluetooth Suite\BtTray.exe O4 - HKLM\..\Run: [BtvStack] . (.Qualcomm Atheros Commnucations - Extension Core.) -- C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe O4 - HKLM\..\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.) O4 - HKLM\..\Run: [egui] . (.ESET - ESET Main GUI.) -- C:\Program Files\ESET\ESET Smart Security\egui.exe O4 - HKLM\..\Run: [RtsCM] . (.Realtek Semiconductor Corp. - Realtek Camera Man.) -- C:\Windows\RTSCM64.exe O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_6EDCE518C8A233D0416BFC46F9B3E04A] . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - HKCU\..\Run: [iCloudServices] . (.Apple Inc. - iCloud.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe O4 - HKCU\..\Run: [ApplePhotoStreams] . (.Apple Inc. - Apple Photostreams Uploader Executable.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe O4 - HKCU\..\Run: [EPSON SX420W Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIGCE.exe =>.Epson Seiko Corporation O4 - HKCU\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe O4 - HKCU\..\Run: [Epson stylus sx 420W (standard)] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIGCE.exe =>.Epson Seiko Corporation O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - Delayed launcher.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe O4 - HKLM\..\Wow6432Node\Run: [Intel AppUp(SM) center] . (.Intel Corporation - Intel Services Manager.) -- C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe O4 - HKLM\..\Wow6432Node\Run: [ArcSoft Connection Service] . (.ArcSoft Inc. - ArcSoft Connect Daemon.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe O4 - HKLM\..\Wow6432Node\Run: [Smart File Advisor] . (.Filefacts.net - Smart File Advisor.) -- C:\Program Files (x86)\Smart File Advisor\sfa.exe O4 - HKLM\..\Wow6432Node\Run: [KiesTrayAgent] . (.Samsung Electronics Co., Ltd. - Kies TrayAgent Application.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe =>.Samsung Electronics Co O4 - HKLM\..\Wow6432Node\Run: [SDTray] . (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =>.Advanced Micro Devices, Inc O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe O4 - HKUS\.DEFAULT\..\Run: [EPSON26BA28 (Epson Stylus SX420W)] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIGCE.exe =>.Epson Seiko Corporation O4 - HKUS\S-1-5-18\..\Run: [EPSON26BA28 (Epson Stylus SX420W)] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIGCE.exe =>.Epson Seiko Corporation O4 - HKUS\S-1-5-21-1229153242-3201741155-1693493588-1001\..\Run: [GoogleChromeAutoLaunch_6EDCE518C8A233D0416BFC46F9B3E04A] . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - HKUS\S-1-5-21-1229153242-3201741155-1693493588-1001\..\Run: [iCloudServices] . (.Apple Inc. - iCloud.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe O4 - HKUS\S-1-5-21-1229153242-3201741155-1693493588-1001\..\Run: [ApplePhotoStreams] . (.Apple Inc. - Apple Photostreams Uploader Executable.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe O4 - HKUS\S-1-5-21-1229153242-3201741155-1693493588-1001\..\Run: [EPSON SX420W Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIGCE.exe =>.Epson Seiko Corporation O4 - HKUS\S-1-5-21-1229153242-3201741155-1693493588-1001\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe O4 - HKUS\S-1-5-21-1229153242-3201741155-1693493588-1001\..\Run: [Epson stylus sx 420W (standard)] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATIGCE.exe =>.Epson Seiko Corporation ~ Application: Scanned in 00mn 00s ---\\ Knoppen op de werkbalk "belangrijkste instrumenten" Internet Explorer (O9) O9 - Extra button: &Verzenden naar OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll =>.Microsoft Corporation O9 - Extra button: Classic IE Settings [64Bits] - {56753E59-AF1D-4FBA-9E15-31557124ADA2} -- Orphan sleutel O9 - Extra button: Send by Bluetooth to [64Bits] - {7815BE26-237D-41A8-A98F-F7BD75F71086} -- Orphan sleutel O9 - Extra button: &Gekoppelde notities van OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll =>.Microsoft Corporation ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Domeinadres van de DNS (O17) wijzigen O17 - HKLM\System\CCS\Services\Tcpip\..\{859C050E-C3EF-4B86-AE18-7E266758C050}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1 =>.Google DNS Redirections O17 - HKLM\System\CCS\Services\Tcpip\..\{CF1BC0AA-F16F-4444-BEF8-35AFE1BB09AD}: DhcpNameServer = 213.197.28.3 213.197.30.28 O17 - HKLM\System\CS1\Services\Tcpip\..\{859C050E-C3EF-4B86-AE18-7E266758C050}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1 =>.Google DNS Redirections O17 - HKLM\System\CS1\Services\Tcpip\..\{CF1BC0AA-F16F-4444-BEF8-35AFE1BB09AD}: DhcpNameServer = 213.197.28.3 213.197.30.28 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.197.28.3 213.197.30.28 ~ Domain: Scanned in 00mn 00s ---\\ Aanvullend Protocol (O18) O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML-viewer.) -- C:\Windows\System32\mshtml.dll O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ AppInit_DLLs waarde en subsleutels Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll ~ Winlogon: Scanned in 00mn 00s ---\\ Lijst van niet-Microsoft NT services die niet uitgeschakeld zijn (O23) O23 - Service: ArcSoft Exchange Service (ADExchange) . (...) - C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe (.not file.) O23 - Service: Import Service (Cashflow) (BankingTools_Import_Service) . (.No owner - Invers.Cwm.BankingToolsImport.) - C:\Program Files (x86)\BankingTools\Cashflow 4\importService\CwmImportService.exe O23 - Service: KMService (KMService) . (...) - C:\WINDOWS\SysWOW64\srvany.exe =>Hijacker.Office O23 - Service: Macrium Reflect Image Mounting Service (ReflectService.exe) . (.No owner - Reflect Service - Enables mounting of image.) - C:\Program Files\Macrium\Reflect\ReflectService.exe O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) . (.Safer-Networking Ltd. - Windows Security Center integration..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe O23 - Service: TwonkyProxy (TwonkyProxy) . (...) - C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe O23 - Service: TwonkyWebDav (TwonkyWebDav) . (...) - C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe ~ Services: 27 Legitimates Filtered in 00mn 04s ---\\ Taken die zijn gepland in de automatische modus (O39) [MD5.00000000000000000000000000000000] [APT] [ASO-System Protector_startup] (...) -- C:\Program Files (x86)\Advanced System Optimizer 3\SystemProtector.exe (.not file.) [0] =>PUP.AdvancedSystemOptimizer [MD5.B3F872166544A864077CC33FC858C7D4] [APT] [{1F275E3F-BBAC-4411-94DF-F7E0FB0F8148}] (.SnoopWare.) -- C:\Users\Guido\Desktop\SnoopyPro.exe [749568] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1ce78a3f30a5b01 [1074] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cf274eb998d745 [1078] O39 - APT: - (..) -- C:\Windows\Tasks\Synaptics TouchPad Enhancements.job [264] ~ Scheduled Task: 20 Legitimates Filtered in 00mn 06s ---\\ Geïnstalleerde software (O42) O42 - Logiciel: Aangifte inkomstenbelasting 2012 - (.Belastingdienst.) [HKLM][64Bits] -- Aangifte inkomstenbelasting 2012 O42 - Logiciel: Aangifte inkomstenbelasting 2013 - (.Belastingdienst.) [HKLM][64Bits] -- Aangifte inkomstenbelasting 2013 O42 - Logiciel: Audioblast - (...) [HKLM][64Bits] -- Audioblast O42 - Logiciel: Cashflow 4.3 - (.BankingTools.) [HKLM][64Bits] -- {387962FD-1BDE-41CB-9DBC-16BBDCD56CA2} O42 - Logiciel: Mollier_4.67_Demo - (.Tadema.) [HKLM][64Bits] -- {2263827D-A6EF-41A2-9037-A06CAB09754F} O42 - Logiciel: Shrink O’Matic - (.UNKNOWN.) [HKLM][64Bits] -- net.tw.air.ShrinkOMatic.7C34F9BA9FAD6689FAABBE85F1F5B46BA5A32DE5.1 O42 - Logiciel: Shrink O’Matic - (.UNKNOWN.) [HKLM][64Bits] -- {5E940FC7-90C4-8583-3DCB-A2C86224B726} ~ Logic: 20 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKCU\Software\FriendlyARM] [HKCU\Software\Invers] [HKCU\Software\PC Unleashed Online] [HKCU\Software\Rename4u] [HKCU\Software\SnoopWare] [HKCU\Software\Softonic] =>Toolbar.Conduit [HKCU\Software\Tadema] [HKLM\Software\Airplane] [HKLM\Software\Wow6432Node\Gillebetts] [HKLM\Software\Wow6432Node\Invers] [HKLM\Software\Wow6432Node\PC Unleashed Online] [HKLM\Software\Wow6432Node\Twonky] ~ Key Software: 354 Legitimates Filtered in 00mn 00s ---\\ 'Inhoud van mappen programma's, ProgramFiles, ProgramData, AppData (O43) O43 - CFD: 21-6-2013 - 16:03:01 - [] ----D C:\Program Files (x86)\Audioblast O43 - CFD: 29-5-2013 - 21:19:31 - [] ----D C:\Program Files (x86)\BankingTools O43 - CFD: 11-3-2013 - 19:14:07 - [] ----D C:\Program Files (x86)\Belastingdienst O43 - CFD: 1-12-2013 - 11:55:56 - [] ----D C:\Program Files (x86)\Tadema O43 - CFD: 30-1-2013 - 18:00:28 - [] ----D C:\Program Files (x86)\Twonky O43 - CFD: 21-7-2013 - 17:48:53 - [] ----D C:\Program Files (x86)\USB CCID O43 - CFD: 24-8-2013 - 23:58:38 - [] ----D C:\Program Files (x86)\Common Files\PS O43 - CFD: 4-11-2013 - 21:49:54 - [] ----D C:\ProgramData\Ad-Aware Browsing Protection O43 - CFD: 16-1-2013 - 23:47:17 - [] ----D C:\ProgramData\BankingTools O43 - CFD: 12-1-2014 - 21:08:12 - [] ----D C:\ProgramData\ClassicShell O43 - CFD: 10-2-2013 - 15:39:21 - [] ----D C:\ProgramData\PC Unleashed Online O43 - CFD: 23-3-2013 - 18:44:25 - [] -SH-D C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} O43 - CFD: 29-5-2013 - 21:18:53 - [] ----D C:\Users\Guido\AppData\Roaming\BankingTools O43 - CFD: 24-3-2014 - 17:49:16 - [] ----D C:\Users\Guido\AppData\Roaming\Belastingdienst O43 - CFD: 9-5-2014 - 13:27:30 - [] ----D C:\Users\Guido\AppData\Roaming\ClassicShell O43 - CFD: 10-2-2013 - 15:20:16 - [] ----D C:\Users\Guido\AppData\Roaming\PC Unleashed Online O43 - CFD: 9-5-2014 - 19:26:55 - [] ----D C:\Users\Guido\AppData\Local\7F6EA247-8379-452A-91A9-E875F9DAEE5D.aplzod O43 - CFD: 4-2-2013 - 17:07:33 - [] ----D C:\Users\Guido\AppData\Local\Bram_van_Oploo O43 - CFD: 21-6-2013 - 16:03:01 - [0] ----D C:\Users\Guido\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Audioblast O43 - CFD: 3-5-2014 - 22:47:57 - [0] ----D C:\Users\Guido\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free Registry Cleaner O43 - CFD: 17-10-2013 - 18:21:07 - [] ----D C:\Users\Guido\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ROCKEY200 Driver ~ Program Folder: 254 Legitimates Filtered in 00mn 01s ---\\ Meest recente bestanden gewijzigd of gemaakt op Windows en System32 (O44) O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 3-5-2014 - 18:16:00 ---A- . (...) -- C:\autoexec.bat [0] O44 - LFC:[MD5.9A75EAA08E67E197D5B4A873DA936882] - 4-5-2014 - 00:13:19 ---A- . (...) -- C:\Windows\System32\ASOROSet.bin [1660] O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 5-5-2014 - 09:39:16 ---A- . (...) -- C:\Windows\zoek-delete.exe [24064] O44 - LFC:[MD5.19D15EE8B8826AB7734F4699FDCEF202] - 5-5-2014 - 09:57:29 ---A- . (...) -- C:\zoek-results.log [37377] O44 - LFC:[MD5.75015B517064A9AD4BEA787181C3CA34] - 9-5-2014 - 19:35:15 ---A- . (...) -- C:\formatter.log [1575307] ~ Files: 33 Legitimates Filtered in 01mn 06s ---\\ Laatste bestanden die zijn gemaakt in Windows Prefetcher (O45) O45 - LFCP:[MD5.4CD625AC5B04AD273533418F88D0109F] - 3-5-2014 - 23:23:29 ---A- - C:\Windows\Prefetch\ADVANCED SYSTEM OPTIMIZER 3.5-F55BFA79.pf =>PUP.AdvancedSystemOptimizer O45 - LFCP:[MD5.2AB1B519905E89449F3D57A0686D9C61] - 3-5-2014 - 23:23:28 ---A- - C:\Windows\Prefetch\ADVANCED SYSTEM OPTIMIZER 3.5-F55EF8CE.pf =>PUP.AdvancedSystemOptimizer O45 - LFCP:[MD5.C8CBAAC6B76473959586CA9C824F1579] - 4-5-2014 - 12:08:59 ---A- - C:\Windows\Prefetch\AZUREUS.EXE-B2EC3F05.pf =>P2P.Azureus O45 - LFCP:[MD5.83D13E55C3EC5E1D6FE5233A0592E94F] - 3-5-2014 - 21:03:05 ---A- - C:\Windows\Prefetch\PARETOLOGIC PC HEALTH ADVISOR-B7856C75.pf =>Rogue.PCHealthAdvisor O45 - LFCP:[MD5.376AABFD3E7B35DC2FDF7A26365C5FFD] - 3-5-2014 - 18:15:25 ---A- - C:\Windows\Prefetch\SHSETUP.EXE-E492EC77.pf =>Crapware.SpyHunter O45 - LFCP:[MD5.64361593373D6AD8DE2E1FEF5935FF59] - 3-5-2014 - 21:18:31 ---A- - C:\Windows\Prefetch\SOFTONICDOWNLOADER_FOR_DLL-FI-343C2836.pf =>Toolbar.Conduit O45 - LFCP:[MD5.08236839D4FC7666216CFC354CA913A8] - 7-5-2014 - 19:06:58 ---A- - C:\Windows\Prefetch\SOFTONICDOWNLOADER_FOR_SUPER--04D81920.pf =>Toolbar.Conduit O45 - LFCP:[MD5.96DBB6F989BDB1CC7E9973AA525EBDDE] - 7-5-2014 - 19:07:58 ---A- - C:\Windows\Prefetch\SOFTONICDOWNLOADER_FOR_SUPER--A4C5B502.pf =>Toolbar.Conduit O45 - LFCP:[MD5.3A6A53E091E974B93269C2C21F7562F5] - 3-5-2014 - 18:15:00 ---A- - C:\Windows\Prefetch\SPYHUNTER-INSTALLER.EXE-38224D17.pf =>Crapware.SpyHunter O45 - LFCP:[MD5.9FF7BEF0D59F3D1354978F9E6DD42283] - 3-5-2014 - 18:16:00 ---A- - C:\Windows\Prefetch\SPYHUNTER4.EXE-3B4E3201.pf =>Crapware.SpyHunter ~ Prefetcher: 10 Legitimates Filtered in 00mn 00s ---\\ Activiteiten en functies bij het opstarten van Windows Verkenner (O46) O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\Microsoft Office\Office14\GROOVEEX.DLL O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\Microsoft Office\Office14\GROOVEEX.DLL ~ ShellExecuteHooks: Scanned in 00mn 00s ---\\ Opsomming van het register sleutels PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "DisableCAD"=1 O55 - MWPS:[HKLM\...\Policies\System] - "EnableLinkedConnections"=1 ~ MWPS: 20 Legitimates Filtered in 00mn 00s ---\\ Opsomming van de registersleutel PoliciesExplorer (CÖKVI) (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s ---\\ Overzicht van de drivers (SDL) (O58) O58 - SDL:13-8-2013 - 00:25:46 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys [17624] O58 - SDL:10-1-2013 - 16:00:50 ---A- . (...) -- C:\Windows\System32\Drivers\psmounterex.sys [57464] O58 - SDL:27-7-2012 - 21:00:04 ---A- . (.Windows (R) Win 7 DDK provider - HID Radio Switch mini driver for USB Fx2 Device.) -- C:\Windows\System32\Drivers\RadioHIDMini.sys [23408] O58 - SDL:22-8-2013 - 13:43:32 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x64.) -- C:\Windows\System32\Drivers\stexstor.sys [31072] O58 - SDL:18-4-2013 - 11:09:20 ---A- . (...) -- C:\Windows\SysWOW64\FsUsbExDisk.Sys [37344] ~ Drivers: 84 Legitimates Filtered in 00mn 03s ---\\ Meest recente bestanden gewijzigd of gemaakt (gebruiker) (O61) O61 - LFC: 3-5-2014 - 20:55:58 ---A- . (...) -- C:\Users\Guido\Downloads\adwcleaner.exe [1310621] O61 - LFC: 3-5-2014 - 20:55:59 ---A- . (...) -- C:\Users\Guido\Downloads\EFRCSetup.exe [981869] O61 - LFC: 3-5-2014 - 20:56:00 ---A- . (...) -- C:\Users\Guido\Downloads\RSITx64.exe [935175] O61 - LFC: 3-5-2014 - 20:56:00 ---A- . (.ParetoLogic Inc..) -- C:\Users\Guido\Downloads\ParetoLogic PC Health Advisor_nl.exe [5239920] =>Rogue.PCHealthAdvisor O61 - LFC: 4-5-2014 - 20:55:59 ---A- . (...) -- C:\Users\Guido\Downloads\DLLSuite_Setup.exe [16578402] O61 - LFC: 4-5-2014 - 20:56:00 ---A- . (...) -- C:\Users\Guido\Downloads\RSITx64 (1).exe [935175] O61 - LFC: 5-5-2014 - 20:55:40 ---A- . (.SQLite Development Team.) -- C:\Users\Guido\AppData\Local\Microsoft\Windows\INetCache\IE\VRK358FR\SQLite3_300700200[1].dll [536576] O61 - LFC: 5-5-2014 - 20:55:57 ---A- . (...) -- C:\Users\Guido\Desktop\zoek.exe [1285120] O61 - LFC: 5-5-2014 - 20:55:58 ---A- . (...) -- C:\Users\Guido\Downloads\adwcleaner (1).exe [1316991] O61 - LFC: 5-5-2014 - 20:56:00 ---A- . (...) -- C:\Users\Guido\Downloads\zoek.exe [1285120] O61 - LFC: 7-5-2014 - 20:55:39 ---A- . (...) -- C:\Users\Guido\AppData\Local\Google\Chrome\User Data\nacl_validation_cache.bin [272] O61 - LFC: 7-5-2014 - 20:56:00 ---A- . (.Softonic.) -- C:\Users\Guido\Downloads\SoftonicDownloader_for_super-copy-paste (1).exe [386896] =>Toolbar.Conduit O61 - LFC: 7-5-2014 - 20:56:00 ---A- . (.Softonic.) -- C:\Users\Guido\Downloads\SoftonicDownloader_for_super-copy-paste.exe [386896] =>Toolbar.Conduit O61 - LFC: 9-5-2014 - 20:55:46 ---A- . (...) -- C:\Users\Guido\AppData\Local\Microsoft\Windows\Sqm\Manifest\Sqm10238.bin [272048] O61 - LFC: 9-5-2014 - 20:56:00 ---A- . (.C. Ghisler & Co..) -- C:\Users\Guido\Downloads\tcmdpocketarm.exe [404704] O61 - LFC: 9-5-2014 - 20:56:00 ---A- . (.C. Ghisler & Co..) -- C:\Users\Guido\Downloads\tcmdwince.exe [1236912] ~ 40 Fichiers temporaires (Temporary files) ~ 2 Fichiers cookies (Cookies files) ~ Files: 38 Legitimates Filtered in 00mn 25s ---\\ Lijst van cleaning tools (CLAB) (O63) O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman O63 - Logiciel: RSIT - (.random/random.) ~ ADS: Scanned in 00mn 00s ---\\ Bestandsassociaties mogelijk aangepast (O67) O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) ~ FASS Keys: 11 Legitimates Filtered in 00mn 00s ---\\ Startmenu Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Zoek "infecties in internetbrowsers (SBI) (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - http://www.google.com ~ Keys: Scanned in 00mn 00s ---\\ Geeft een opsomming van bestanden Crack & Keygen (KKF) (O82) C:\Users\Guido\Documents\Vuze Downloads\Nitro PDF Professional v6.2.0.44(x86 and x64)+keygen\Nitro PDF Professional v6.2.0.44(x86 and x64)+keygen.exe =>.Crack,Keygen C:\Users\Guido\Macrium Reflect 5.1.5299 Setup + KeyGen.rar =>.Crack,Keygen ~ Files: Scanned in 00mn 40s ---\\ Bepaalde zoekopdracht in de hoofdmap van het systeem (SPRF) (O84) [MD5.3D9D274E419DFA3B63B1C5378521C267] [SPRF][6-2-2014] (...) -- C:\Users\Guido\Desktop\cc_20140206_184634.reg [230304] [MD5.46DFDF85B9DD37BADDB98D21C7E48711] [SPRF][22-5-2013] (.Make The Cut, LLC. - Ring Tone and Text Tone creation software for the iPhone and other devices.) -- C:\Users\Guido\Desktop\iRinger.exe [4815840] [MD5.4E8323D2CC75190444464F9AE08181FC] [SPRF][24-8-2013] (.www.hellopdf.com - Free PDF to Word Doc Converter Setup.) -- C:\Users\Guido\Desktop\pdf2wordsetup.exe [1128916] [MD5.4FF655D3E6856222AB20FC2639E06687] [SPRF][19-9-2011] (...) -- C:\Users\Guido\Desktop\SD-Flasher.exe [10754048] [MD5.412F5A9D6F8E9EBFAD2E06A134C98FDF] [SPRF][30-4-2014] (.TODO: <公司名> - TODO: <文件说明>.) -- C:\Users\Guido\Desktop\SetUpdateXML-7EN.exe [434176] [MD5.B3F872166544A864077CC33FC858C7D4] [SPRF][7-10-2002] (.SnoopWare - Ring 3 application for gathering USB filter output.) -- C:\Users\Guido\Desktop\SnoopyPro.exe [749568] [MD5.99531C6FB75AAC19FB81EB8AB230A8F2] [SPRF][30-4-2014] (...) -- C:\Users\Guido\Desktop\u-boot_udsd.bin [262144] [MD5.2ED2319F3DE13495AAA49B70A1467055] [SPRF][5-5-2014] (...) -- C:\Users\Guido\Desktop\zoek.exe [1285120] ~ Files: 11 Legitimates Filtered in 00mn 00s ---\\ Lijst van uitzonderingen in de firewall (FirewallRules) (O87) O87 - FAEL: "{5DBF0FEF-6865-4F3B-A5EC-4D8EE1C03577}" | In - Private - P17 - TRUE | .(.Azureus Software, Inc - No Comment.) -- C:\Program Files\Vuze\Azureus.exe =>P2P.Azureus O87 - FAEL: "{88252958-7BE9-4EDA-9D2E-75E536380C71}" | In - Private - P6 - TRUE | .(.Azureus Software, Inc - No Comment.) -- C:\Program Files\Vuze\Azureus.exe =>P2P.Azureus ~ Firewall: 2 Legitimates Filtered in 00mn 02s ---\\ Geeft een opsomming van de essentiële gegevens van de naamruimte (MNS) (O92) O92 - MNS: - {1CF1260C-4DD0-4ebb-811F-33C572699FDE} O92 - MNS: - {374DE290-123F-4565-9164-39C4925E467B} O92 - MNS: - {3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA} O92 - MNS: - {A0953C92-50DC-43bf-BE83-3742FED03C9C} O92 - MNS: - {A8CDFF1C-4878-43be-B5FD-F8091C1C60D0} O92 - MNS: - {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} O92 - MNS: iCloud-foto's - {F0D63F85-37EC-4097-B30D-61B4A8917118} ~ MNS: 7 Legitimates Filtered in 00mn 00s ---\\ Algemene toestand van niet-Microsoft services (GSR) (SR = Running, SS = gestopt) SS - | Auto 10-7-1658 0 | (ADExchange) . (...) - C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe SS - | Demand 3-10-2013 279000 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe SS - | Auto 21-2-2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 21-2-2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Auto 10-7-1658 0 | (KMService) . (...) - C:\WINDOWS\system32\srvany.exe =>Hijacker.Office SS - | Demand 27-12-2013 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe SS - | Demand 22-8-2013 37768 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 18-3-2010 113152 | (ACDaemon) . (.ArcSoft Inc..) - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe SR - | Auto 21-12-2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe SR - | Auto 13-12-2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe SR - | Auto 12-2-2014 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe SR - | Auto 31-10-2012 231040 | (AtherosSvc) . (.Qualcomm Atheros Commnucations.) - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe SR - | Auto 3-4-2014 33280 | (BankingTools_Import_Service) . (...) - C:\Program Files (x86)\BankingTools\Cashflow 4\importService\CwmImportService.exe SR - | Auto 30-8-2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe SR - | Auto 12-9-2013 1337752 | (ekrn) . (.ESET.) - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe SR - | Auto 31-1-2012 395776 | (EPSON_Device_Control_Log_Service_TMS) . (.SEIKO EPSON CORPORATION.) - C:\Program Files\epson\portcommunicationservice_tms\DeviceControlLog.exe SR - | Auto 14-9-2009 166400 | (EPSON_EB_RPCV4_04) . (.SEIKO EPSON CORPORATION.) - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.exe SR - | Auto 14-9-2009 128512 | (EPSON_PM_RPCV4_04) . (.SEIKO EPSON CORPORATION.) - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.exe SR - | Auto 31-1-2012 584192 | (EPSON_Port_Communication_Service_TMS) . (.SEIKO EPSON CORPORATION.) - C:\Program Files\epson\portcommunicationservice_tms\PCSVC.exe SR - | Auto 9-7-2012 7168 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe SR - | Auto 15-1-2013 128896 | (Intel(R) ME Service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe SR - | Demand 21-2-2014 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe SR - | Auto 15-1-2013 165760 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe SR - | Auto 13-7-2012 769432 | (NAUpdate) . (.Nero AG.) - C:\Program Files (x86)\Nero\Update\NASvc.exe SR - | Auto 12-1-2011 68928 | (nlsX86cc) . (.Nalpeiron Ltd..) - C:\windows\SysWOW64\NLSSRV32.exe SR - | Auto 10-1-2013 302200 | (ReflectService.exe) . (...) - C:\Program Files\Macrium\Reflect\ReflectService.exe SR - | Demand 15-10-2013 3921880 | (SDScannerService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe SR - | Auto 20-9-2013 1042272 | (SDUpdateService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe SR - | Auto 13-9-2013 171416 | (SDWSCService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe SR - | Auto 1-3-2013 18592 | (SMA.Multicasting.IGMP.QuerierService.exe) . (.Microsoft.) - C:\Program Files (x86)\SMA\Sunny Explorer\SMA.Multicasting.IGMP.QuerierService.exe SR - | Auto 7-2-2014 5093216 | (TeamViewer8) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe SR - | Auto 24-9-2012 545608 | (TwonkyProxy) . (...) - C:\Program Files (x86)\Twonky\TwonkyServer\twonkyproxy.exe SR - | Auto 24-9-2012 553800 | (TwonkyServer) . (.PacketVideo.) - C:\Program Files (x86)\Twonky\TwonkyServer\twonkystarter.exe SR - | Auto 24-9-2012 275272 | (TwonkyWebDav) . (...) - C:\Program Files (x86)\Twonky\TwonkyServer\twonkywebdav.exe SR - | Demand 10-7-1658 0 | (WdNisSvc) . (...) - C:\Program Files (x86)\Windows Defender\NisSrv.exe SR - | Demand 10-7-1658 0 | (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe SR - | Auto 10-7-1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation SR - | Auto 31-10-2012 323584 | (ZAtheros Bt and Wlan Coex Agent) . (.Atheros.) - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe ~ Services: Scanned in 00mn 07s ---\\ Onderzoek gelijktijdige op de Master Boot Record (MBR) (O80) Run by Guido at 9-5-2014 20:57:48 ~ OS 64 not supported by MBR tool ~ MBR: 0 Legitimates Filtered in 00mn 00s ---\\ Onderzoek de Master Boot Record op Infecties (MBRCheck) (O80) Written by ad13, http://ad13.geekstog Run by Guido at 9-5-2014 20:57:50 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 02s ---\\ Extra scan (O88) Database Version : 13045 - (9-5-2014) Clés trouvées (Keys found) : 2 Valeurs trouvées (Values found) : 4 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 [HKLM\SYSTEM\CurrentControlSet\Services\KMService] =>Hijacker.Office^ [HKCU\Software\Softonic] =>Toolbar.Conduit ~ Additionnel Scan: 440371 Items scanned in 00mn 15s ---\\ Samenvatting van detecties gevonden op uw werkstation http://nicolascoolman.webs.com/apps/blog/show/29357530-pup-advancedsystemoptimizer =>PUP.AdvancedSystemOptimizer http://nicolascoolman.webs.com/apps/blog/show/29626487-hijacker-office =>Hijacker.Office http://nicolascoolman.byethost7.com/wordpress/toolbar-conduit/ =>Toolbar.Conduit http://nicolascoolman.webs.com/apps/blog/show/26609241-crapware-spyhunter =>Crapware.SpyHunter ~ MSI: 4 link(s) detected in 00mn 00s ~ 870 Legitimates filtered by white list End of the scan (569 lines in 04mn 32s)(2)