aaaido

9 april 2012

Nogmaals dank voor jullie heldere en goede hulp

9 april 2012

Heb jullie advies opgevolgd en ook Service Pack 1 geinstalleerd. Hopen dat het nu allemaal clean blijft

8 april 2012

Opgelost

Hartelijk bedankt voor de snelle hulp! Waardeer ik enorm

8 april 2012

ComboFix 12-04-07.03 - Bol 08-04-2012 21:31:38.2.4 - x64

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.31.1043.18.4095.2442 [GMT 2:00]

Gestart vanuit: c:\users\Bol\Downloads\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Bol\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\codec-info

c:\codec-info\codec_info.html

c:\program files (x86)\Premiumplay Codec-C

c:\program files (x86)\Premiumplay Codec-C\appAPIinternalWrapper.js

c:\program files (x86)\Premiumplay Codec-C\fb.js

c:\program files (x86)\Premiumplay Codec-C\jquery.js

c:\program files (x86)\Premiumplay Codec-C\json.js

c:\program files (x86)\Premiumplay Codec-C\Premiumplay Codec-C.dll

c:\program files (x86)\Premiumplay Codec-C\Premiumplay Codec-C.exe

c:\program files (x86)\Premiumplay Codec-C\Premiumplay Codec-C.ico

c:\program files (x86)\Premiumplay Codec-C\Premiumplay Codec-C.ini

c:\program files (x86)\Premiumplay Codec-C\Premiumplay Codec-CGui.exe

c:\program files (x86)\Premiumplay Codec-C\Premiumplay Codec-CInstaller.log

c:\program files (x86)\Premiumplay Codec-C\Uninstall.exe

c:\programdata\Premium

c:\users\Bol\AppData\Local\Premiumplay Codec-C

c:\users\Bol\AppData\Local\Premiumplay Codec-C\Chrome\Premiumplay Codec-C.crx

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\burnlib.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\dsp_sps.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\enc_aacplus.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\enc_flac.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\enc_flake.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\enc_lame.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\enc_vorbis.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\enc_wav.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\enc_wma.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\gen_crasher.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\gen_dropbox.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\gen_ff.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\gen_hotkeys.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\gen_jumpex.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\gen_ml.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\gen_orgler.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\gen_tray.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\gen_undo.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_avi.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_cdda.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_dshow.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_flac.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_flv.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_linein.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_midi.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_mkv.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_mod.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_mp3.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_mp4.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_nsv.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_swf.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_vorbis.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_wav.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_wave.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_wm.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\in_wv.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_addons.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_autotag.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_bookmarks.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_dash.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_disc.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_history.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_impex.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_local.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_nowplaying.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_online.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_orb.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_playlists.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_plg.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_pmp.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_rg.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_transcode.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ml_wire.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\ombrowser.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\out_disk.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\out_ds.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\out_wave.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\playlist.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\pmp_activesync.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\pmp_ipod.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\pmp_njb.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\pmp_p4s.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\pmp_usb.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\tagz.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\vis_avs.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\vis_milk2.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\vis_nsfs.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\winamp.lng

c:\users\Bol\AppData\Local\Temp\WLZB0C7.tmp\winampa.lng

c:\users\Bol\AppData\Roaming\jdv50pd.log

c:\windows\SysWow64\dll

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-03-08 to 2012-04-08 ))))))))))))))))))))))))))))))

.

2012-04-08 19:46 . 2012-04-08 19:46 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-04-08 10:12 . 2012-04-08 10:12 -------- d-----w- c:\users\Bol\AppData\Roaming\Malwarebytes

2012-04-08 10:12 . 2012-04-08 10:12 -------- d-----w- c:\programdata\Malwarebytes

2012-04-08 10:12 . 2012-04-08 10:12 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-04-08 10:12 . 2011-12-10 13:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-04-05 20:33 . 2012-04-05 20:33 -------- d-----w- c:\program files\Microsoft Silverlight

2012-04-05 20:33 . 2012-04-05 20:33 -------- d-----w- c:\program files (x86)\Microsoft Silverlight

2012-04-05 20:27 . 2012-04-05 20:27 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-04-05 20:27 . 2012-04-05 20:27 -------- d-----w- c:\program files (x86)\Java

2012-04-05 20:02 . 2012-04-05 20:02 -------- d-----w- c:\windows\SysWow64\wbem\en-US

2012-04-05 20:02 . 2012-04-05 20:02 -------- d-----w- c:\windows\system32\wbem\en-US

2012-04-05 19:16 . 2012-04-05 19:16 -------- d--h--w- c:\windows\msdownld.tmp

2012-04-05 19:13 . 2012-04-05 19:13 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2012-03-31 15:10 . 2012-03-31 15:10 -------- d-----w- c:\programdata\InstallMate

2012-03-18 14:31 . 2012-03-18 14:31 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll

2012-03-18 14:31 . 2012-03-18 14:31 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-05 20:27 . 2011-05-02 22:10 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-02-27 07:30 . 2011-09-28 08:53 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

.

((((((((((((((((((((((((((((( SnapShot@2012-04-08_12.19.46 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-07-14 04:54 . 2012-04-08 19:48 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-07-14 04:54 . 2012-04-08 12:19 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-07-14 04:54 . 2012-04-08 19:48 98304 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-07-14 04:54 . 2012-04-08 12:19 98304 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-07-14 04:54 . 2012-04-08 12:19 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-07-14 04:54 . 2012-04-08 19:48 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2010-06-08 18:17 . 2012-04-08 19:27 53254 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2009-07-14 05:10 . 2012-04-08 19:27 30652 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2010-06-08 17:43 . 2012-04-08 19:27 14858 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3257472996-498828906-1456225210-1001_UserData.bin

+ 2012-04-08 19:48 . 2012-04-08 19:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2012-04-08 12:18 . 2012-04-08 12:18 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2012-04-08 12:18 . 2012-04-08 12:18 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2012-04-08 19:48 . 2012-04-08 19:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2009-07-14 09:16 . 2012-04-08 10:28 701326 c:\windows\system32\perfh013.dat

+ 2009-07-14 09:16 . 2012-04-08 19:31 701326 c:\windows\system32\perfh013.dat

- 2009-07-14 02:36 . 2012-04-08 10:28 615810 c:\windows\system32\perfh009.dat

+ 2009-07-14 02:36 . 2012-04-08 19:31 615810 c:\windows\system32\perfh009.dat

+ 2009-07-14 09:16 . 2012-04-08 19:31 133358 c:\windows\system32\perfc013.dat

- 2009-07-14 09:16 . 2012-04-08 10:28 133358 c:\windows\system32\perfc013.dat

- 2009-07-14 02:36 . 2012-04-08 10:28 106190 c:\windows\system32\perfc009.dat

+ 2009-07-14 02:36 . 2012-04-08 19:31 106190 c:\windows\system32\perfc009.dat

- 2009-07-14 05:01 . 2012-04-08 12:17 471216 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 05:01 . 2012-04-08 19:46 471216 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

- 2009-07-14 02:34 . 2012-04-05 22:06 9961472 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT

+ 2009-07-14 02:34 . 2012-04-08 13:26 9961472 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\Bol\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\Bol\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\users\Bol\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Logitech Vid"="c:\program files (x86)\Logitech\Vid HD\Vid.exe" [2011-01-13 6129496]

"Facebook Update"="c:\users\Bol\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-11-07 137536]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-06 102400]

"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]

"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2010-07-12 74752]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-01-25 421160]

"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-03-01 190808]

"KORG USB-MIDI Driver"="c:\program files (x86)\KORG\KORG USB-MIDI Driver\EsHelper2.exe" [2011-03-29 393616]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

c:\users\Bol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Bol\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\permham]

c:\windows\system32\config\systemprofile\AppData\Local\permham.dll [bU]

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Updateservice (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-18 136176]

R2 Icecast-trunk;Icecast-trunk Streaming Media Server;c:\program files (x86)\Icecast2 Win32\icecastService.exe [2008-05-24 417792]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-18 136176]

R3 KORGUMDS;KORG USB-MIDI Driver for Windows;c:\windows\system32\Drivers\KORGUM64.SYS [x]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]

R3 RDID1098;UA-1G;c:\windows\system32\Drivers\rdwm1098.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]

S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2009-12-08 5009920]

S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-04-01 428640]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [x]

S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]

S3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]

S3 RL_DJIF;usb-audio.de driver for Reloop Digital Jockey Interface;c:\windows\system32\Drivers\rldjifu.sys [x]

S3 RL_DJIF_WDM;Digital Jockey Interface WDM Audio;c:\windows\system32\drivers\rldjifa.sys [x]

S3 RL_DJIFM;Digital Jockey Interface WDM Midi Device;c:\windows\system32\drivers\rldjifm.sys [x]

S3 RTL8167;Realtek 8167 NT-stuurprogramma;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

.

Inhoud van de 'Gedeelde Taken' map

.

2012-04-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3257472996-498828906-1456225210-1001Core.job

- c:\users\Bol\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-07 20:59]

.

2012-04-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3257472996-498828906-1456225210-1001UA.job

- c:\users\Bol\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-07 20:59]

.

2012-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-18 06:15]

.

2012-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-10-18 06:15]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-11-28 18:01 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\Bol\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\Bol\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 97792 ----a-w- c:\users\Bol\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

.

------- Bijkomende Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.nl/

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Bol\AppData\Roaming\Mozilla\Firefox\Profiles\nakyz3wh.default\

FF - prefs.js: keyword.URL - hxxp://www.samenc.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=5iQMwxPL&q=

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 54848

FF - prefs.js: network.proxy.type - 4

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

.

- - - - ORPHANS VERWIJDERD - - - -

.

AddRemove-Premiumplay Codec-C - c:\program files (x86)\Premiumplay Codec-C\Uninstall.exe

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-3257472996-498828906-1456225210-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{95E213F9-F738-5AB1-602D-D175B6F86448}*]

"iahcddpeamihmmmepo"=hex:6a,61,6c,62,63,69,6d,66,62,6b,64,66,6a,66,61,64,6d,6e,

67,63,00,00

"hanjfnjhgnbopaod"=hex:6a,61,6c,62,6f,6c,61,62,6b,65,70,65,6f,6f,66,6f,62,6e,

6a,64,00,00

"ialdggdpmdecigniik"=hex:63,61,66,62,69,6c,00,00

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files\AVAST Software\Avast\AvastSvc.exe

c:\programdata\TVersity\Media Server\MediaServer.exe

.

**************************************************************************

.

Voltooingstijd: 2012-04-08 22:01:53 - machine werd herstart

ComboFix-quarantined-files.txt 2012-04-08 20:01

ComboFix2.txt 2012-04-08 12:26

.

Pre-Run: 109.330.325.504 bytes beschikbaar

Post-Run: 109.025.468.416 bytes beschikbaar

.

- - End Of File - - D64047F03F274A80A101B33710ECED78

8 april 2012

ComboFix 12-04-07.03 - Bol 08-04-2012 14:05:38.1.4 - x64

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.31.1043.18.4095.2157 [GMT 2:00]

Gestart vanuit: c:\users\Bol\Downloads\ComboFix.exe

AV: avast! Antivirus *Disabled/Outdated* {C37D8F93-0602-E43C-40AA-47DAD597F308}

SP: avast! Antivirus *Disabled/Outdated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}

SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\config.bin

c:\config.bin\F64584268A22527

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\burnlib.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\dsp_sps.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\enc_aacplus.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\enc_flac.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\enc_flake.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\enc_lame.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\enc_vorbis.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\enc_wav.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\enc_wma.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\gen_crasher.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\gen_dropbox.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\gen_ff.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\gen_hotkeys.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\gen_jumpex.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\gen_ml.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\gen_orgler.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\gen_tray.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\gen_undo.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_avi.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_cdda.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_dshow.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_flac.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_flv.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_linein.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_midi.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_mkv.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_mod.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_mp3.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_mp4.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_nsv.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_swf.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_vorbis.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_wav.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_wave.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_wm.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\in_wv.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_addons.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_autotag.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_bookmarks.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_dash.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_disc.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_history.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_impex.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_local.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_nowplaying.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_online.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_orb.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_playlists.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_plg.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_pmp.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_rg.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_transcode.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ml_wire.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\ombrowser.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\out_disk.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\out_ds.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\out_wave.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\playlist.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\pmp_activesync.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\pmp_ipod.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\pmp_njb.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\pmp_p4s.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\pmp_usb.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\tagz.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\vis_avs.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\vis_milk2.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\vis_nsfs.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\winamp.lng

c:\users\Bol\AppData\Local\Temp\WLZACB3.tmp\winampa.lng

c:\users\Bol\AppData\Roaming\Adobe\plugs

c:\users\Bol\AppData\Roaming\Adobe\shed

c:\users\Bol\AppData\Roaming\rw1mvu68.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-03-08 to 2012-04-08 ))))))))))))))))))))))))))))))

.

2012-04-08 12:17 . 2012-04-08 12:17 -------- d-----w- c:\users\Default\AppData\Local\temp