Rianne86

11 september 2012

Het is allemaal gelukt hoor.

Heel erg bedankt!

10 september 2012

Heb inmiddels ComboFix wel verwijderd.

Maar het lukt me niet om CCleaner te downloaden.

Als ik op de link klik, dan zegt hij dat de webpagina niet kan worden weergegeven.

Heb het een aantal keren geprobeerd, maar het komt er niet voor.

8 september 2012

Ja, veel beter.

Wat een verschil!

Dus dan is het zo weer klaar?

Heel erg bedankt in ieder geval!

7 september 2012

ComboFix 12-09-06.04 - Rianne 07-09-2012 15:18:16.2.4 - x64

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.8190.6421 [GMT 2:00]

Gestart vanuit: c:\users\Rianne\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Rianne\Desktop\CFScript.txt

AV: McAfeeAntivirus en antispyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfeeFirewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfeeAntivirus en antispyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Rianne\AppData\Roaming\Microsoft\Installer\{C94567BB-730D-4E2D-A2B0-6F183C114840}

c:\users\Rianne\AppData\Roaming\Microsoft\Installer\{C94567BB-730D-4E2D-A2B0-6F183C114840}\ARPPRODUCTICON.exe

c:\users\Rianne\AppData\Roaming\Microsoft\Installer\{C94567BB-730D-4E2D-A2B0-6F183C114840}\NewShortcut13_898A12DF4EF443488F69A1D59F52072D.exe

c:\users\Rianne\AppData\Roaming\Microsoft\Installer\{C94567BB-730D-4E2D-A2B0-6F183C114840}\NewShortcut14_1129D48DE0FD4013BFA17F72F353F4C7.exe

c:\users\Rianne\AppData\Roaming\Microsoft\Installer\{C94567BB-730D-4E2D-A2B0-6F183C114840}\NewShortcut15_47B2F4DB75A5498CBFFDFC7643F32CAB.exe

c:\users\Rianne\AppData\Roaming\Microsoft\Installer\{C94567BB-730D-4E2D-A2B0-6F183C114840}\NewShortcut16_DD2B05E53ADE4B04A7B3420695FF99EC.exe

c:\users\Rianne\AppData\Roaming\Microsoft\Installer\{C94567BB-730D-4E2D-A2B0-6F183C114840}\NewShortcut2_F240D938CE9E468EB268EBA8ACCA3926.exe

c:\users\Rianne\AppData\Roaming\Microsoft\Installer\{C94567BB-730D-4E2D-A2B0-6F183C114840}\NewShortcut5_D9E1C46F67064D7E92475E00CE2FBF02.exe

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-08-07 to 2012-09-07 ))))))))))))))))))))))))))))))

.

2012-09-07 13:28 . 2012-09-07 13:33 -------- d-----w- c:\users\Rianne\AppData\Local\temp

2012-09-07 13:28 . 2012-09-07 13:28 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2012-09-07 13:28 . 2012-09-07 13:28 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-09-07 10:57 . 2012-09-07 10:57 -------- d-----w- c:\users\Rianne\AppData\Roaming\Malwarebytes

2012-09-07 10:56 . 2012-09-07 10:56 -------- d-----w- c:\programdata\Malwarebytes

2012-09-07 10:56 . 2012-09-07 10:56 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-09-07 10:56 . 2012-07-03 11:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-06 21:57 . 2012-09-06 21:57 388096 ----a-r- c:\users\Rianne\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-09-06 21:57 . 2012-09-06 21:57 -------- d-----w- c:\program files (x86)\Trend Micro

2012-08-27 15:37 . 2012-08-28 18:24 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

2012-08-16 07:47 . 2012-07-04 14:33 2769408 ----a-w- c:\windows\system32\win32k.sys

2012-08-15 20:02 . 2012-05-11 16:34 788480 ----a-w- c:\windows\system32\localspl.dll

2012-08-15 20:02 . 2012-05-11 15:57 623616 ----a-w- c:\windows\SysWow64\localspl.dll

2012-08-15 20:02 . 2012-06-29 16:20 648192 ----a-w- c:\windows\system32\netapi32.dll

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-08-28 18:24 . 2010-09-14 12:54 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-08-16 07:40 . 2006-11-02 12:35 62134624 ----a-w- c:\windows\system32\mrt.exe

2012-08-05 08:09 . 2012-04-24 08:19 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-08-05 08:09 . 2011-05-17 08:06 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

.

((((((((((((((((((((((((((((( SnapShot@2012-09-07_12.24.25 )))))))))))))))))))))))))))))))))))))))))

.

- 2009-11-08 16:31 . 2012-09-07 11:16 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-11-08 16:31 . 2012-09-07 13:29 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-11-08 16:31 . 2012-09-07 13:29 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-11-08 16:31 . 2012-09-07 11:16 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-11-08 16:31 . 2012-09-07 11:16 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-11-08 16:31 . 2012-09-07 13:29 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2012-09-07 10:49 . 2012-09-07 10:49 5966 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SACore\Cache\DA39A3EE5E6B4B0D3255BFEF95601890AFD80709\FAB6E1F06D907E0EE3CA0B5F77752457622A59C9\FAB6E1F06D907E0EE3CA0B5F77752457622A59C9\Data.dat

+ 2012-09-07 13:12 . 2012-09-07 13:12 5966 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SACore\Cache\DA39A3EE5E6B4B0D3255BFEF95601890AFD80709\FAB6E1F06D907E0EE3CA0B5F77752457622A59C9\FAB6E1F06D907E0EE3CA0B5F77752457622A59C9\Data.dat

- 2012-09-07 10:49 . 2012-09-07 10:49 4666 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SACore\Cache\DA39A3EE5E6B4B0D3255BFEF95601890AFD80709\D5485EFFDBC7A8150BD38C04CE8D76A5D72E646F\D5485EFFDBC7A8150BD38C04CE8D76A5D72E646F\Data.dat

+ 2012-09-07 13:12 . 2012-09-07 13:12 4666 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SACore\Cache\DA39A3EE5E6B4B0D3255BFEF95601890AFD80709\D5485EFFDBC7A8150BD38C04CE8D76A5D72E646F\D5485EFFDBC7A8150BD38C04CE8D76A5D72E646F\Data.dat

- 2012-09-07 12:23 . 2012-09-07 12:23 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2012-09-07 13:29 . 2012-09-07 13:29 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2012-09-07 13:29 . 2012-09-07 13:29 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2012-09-07 12:23 . 2012-09-07 12:23 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2008-01-21 08:09 . 2012-09-07 12:31 677188 c:\windows\system32\perfh013.dat

- 2008-01-21 08:09 . 2012-09-07 11:22 677188 c:\windows\system32\perfh013.dat

- 2006-11-02 12:46 . 2012-09-07 11:22 596036 c:\windows\system32\perfh009.dat

+ 2006-11-02 12:46 . 2012-09-07 12:31 596036 c:\windows\system32\perfh009.dat

- 2008-01-21 08:09 . 2012-09-07 11:22 130218 c:\windows\system32\perfc013.dat

+ 2008-01-21 08:09 . 2012-09-07 12:31 130218 c:\windows\system32\perfc013.dat

+ 2006-11-02 12:46 . 2012-09-07 12:31 104110 c:\windows\system32\perfc009.dat

- 2006-11-02 12:46 . 2012-09-07 11:22 104110 c:\windows\system32\perfc009.dat

- 2011-02-12 00:28 . 2012-09-07 12:22 409268 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2011-02-12 00:28 . 2012-09-07 13:28 409268 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

- 2011-04-16 12:10 . 2012-09-07 12:22 2230404 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3331473449-2364365953-721630395-1000-8192.dat

+ 2011-04-16 12:10 . 2012-09-07 13:28 2230404 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3331473449-2364365953-721630395-1000-8192.dat

- 2011-04-16 12:10 . 2012-09-07 12:22 34063456 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3331473449-2364365953-721630395-1000-4096.dat

+ 2011-04-16 12:10 . 2012-09-07 13:28 34063456 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3331473449-2364365953-721630395-1000-4096.dat

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-07-29 16:52 121392 ----a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-08 68856]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"PCMMediaSharing"="c:\program files (x86)\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2008-05-20 204908]

"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2012-03-21 1675160]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files (x86)\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2008-05-20 269448]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]

.

--- Andere Services/Drivers In Geheugen ---

.

*Deregistered* - mfeavfk01

.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

Themes

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2008-07-29 16:53 50736 ----a-w- c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Acer Empowering Technology Monitor"="c:\program files\Acer\Empowering Technology\SysMonitor.exe" [2009-08-11 319488]

"EmpoweringTechnology"="c:\program files\Acer\Empowering Technology\Framework.Launcher.exe" [2009-08-11 323584]

"eDataSecurity Loader"="c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSloader.exe" [2008-07-29 561200]

"RtHDVCpl"="RAVCpl64.exe" [2008-05-20 6296064]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"OEM Upgrade DVD"="c:\oem\Upgrade Kit\DVDMainStart.Launcher.exe" [2009-09-24 410968]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

uLocal Page = c:\windows\system32\blank.htm

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=1&o=vp64&d=1109&m=aspire_m5201

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: &Verzenden naar OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.0.1

CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-3331473449-2364365953-721630395-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:ee,21,f8,dd,93,b5,b8,c7,b9,49,bf,f9,38,15,9d,92,ab,02,d2,ad,4b,bb,bb,

d3,50,4b,2c,58,c9,8b,47,e9,e5,85,6c,23,42,5a,ca,c5,bc,20,fb,21,a4,b5,e2,10,\

"??"=hex:fb,d7,be,8a,d1,68,10,c0,e5,47,5c,5a,da,5e,78,26

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]

@Denied: (A 2) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]

@="Shockwave Flash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]

@Denied: (A 2) (Everyone)

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]

@="FlashBroker"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]

"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

c:\program files (x86)\McAfee\SiteAdvisor\McSACore.exe

c:\windows\SysWOW64\rundll32.exe

c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

c:\windows\SysWOW64\PnkBstrA.exe

c:\windows\SysWOW64\PnkBstrB.exe

c:\program files (x86)\CyberLink\Shared Files\RichVideo.exe

c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

c:\program files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSMSNLoader32.exe

.

**************************************************************************

.

Voltooingstijd: 2012-09-07 15:36:34 - machine werd herstart

ComboFix-quarantined-files.txt 2012-09-07 13:36

ComboFix2.txt 2012-09-07 12:29

.

Pre-Run: 192.548.392.960 bytes beschikbaar

Post-Run: 192.353.501.184 bytes beschikbaar

.

- - End Of File - - 130023E052A19FD11EC99D8667CDA342

7 september 2012

De log van ComboFix.

ComboFix 12-09-06.04 - Rianne 07-09-2012 14:11:33.1.4 - x64

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.31.1043.18.8190.6517 [GMT 2:00]

Gestart vanuit: c:\users\Rianne\Desktop\ComboFix.exe

AV: McAfeeAntivirus en antispyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfeeFirewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfeeAntivirus en antispyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\Windows

c:\programdata\windows\ii33.dat

c:\programdata\Windows\msxx.dat

c:\programdata\Windows\vvve.dat

c:\users\Rianne\AppData\Roaming\.#

c:\users\Rianne\AppData\Roaming\.#\MBX@1374@3B2928.###

c:\users\Rianne\AppData\Roaming\.#\MBX@1374@3B2958.###

c:\users\Rianne\AppData\Roaming\.#\MBX@1374@3B2988.###

c:\users\Rianne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1 .lnk

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-08-07 to 2012-09-07 ))))))))))))))))))))))))))))))

.

2012-09-07 12:22 . 2012-09-07 12:22 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp