arribarri

6 oktober 2012

ok bedankt dan voor je hulp!

6 oktober 2012

Ok hartstikke bedankt. kun je nu met zekerheid zeggen dat hier niks meer aan de hand is of dat er iets anders aan de hand is?

6 oktober 2012

sorry 2 x gepost

6 oktober 2012

Ik weet het natuurlijk niet zeker maar wel verdacht, omdat het alleen gebeurt als ik me weer eens inlog op de pc van mijn moeder en verder nergens. op mijn telefoon gebeurt er niks en op de laptop ook niet.

ik heb hier de .txt van emsisoft.

Emsisoft Emergency Kit - Versie 2.0

Laatste Update: 10/6/2012 11:49:34 AM

Scaninstellingen:

Scantype: Diepe scan

Objecten: Rootkits, Geheugen, Sporen, C:\, D:\, F:\

Scan archieven: Aan

ADS Scan: Aan

Scan gestart: 10/6/2012 11:50:30 AM

c:\program files (x86)\imesh applications\imesh Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\images Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\html Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\html\error.html Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\html\loading.html Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\discoveryhelper.dll Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\imwebcontrol.dll Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\imesh.exe Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\lame_enc.dll Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\license.txt Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\resourcesloc.dll Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\shw32.dll Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\default.skn Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\default.xml Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\images\defartwork.jpg Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\images\taflogo.png Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\images\togologo.png Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\settings.xml Ontdekt: Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\updateinst.exe Ontdekt: Trace.File.imesh!E1

Key: hkey_local_machine\software\imesh Ontdekt: Trace.Registry.imesh!E1

Key: hkey_local_machine\software\trymedia systems Ontdekt: Trace.Registry.trymedia!E1

Key: hkey_local_machine\software\trymedia systems\activemark software Ontdekt: Trace.Registry.trymedia!E1

C:\Users\User\Downloads\VDownloaderInstaller.exe Ontdekt: Riskware.Win32.InstallCore.AMN!E1

C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\crossriderapp4479@crossrider.com\install.rdf Ontdekt: Trojan-Downloader.JS.LilyJade!E2

C:\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll Ontdekt: Adware.Win32.Yontoo.AMN!E1

C:\Program Files (x86)\Giant Savings\Uninstall.exe -> $PLUGINSDIR\closebrowsers.exe Ontdekt: AdWare.Agent!E2

C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarApp.dll Ontdekt: Riskware.Win32.Toolbar.Babylon.AMN!E1

C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarsrv.exe Ontdekt: Riskware.Win32.Toolbar.Babylon.AMN!E1

Gescand 840829

Gevonden 29

Scan geëindigd: 10/6/2012 2:01:07 PM

Scantijd: 2:10:37

C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarApp.dll Verwijderd Riskware.Win32.Toolbar.Babylon.AMN!E1

C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarsrv.exe Verwijderd Riskware.Win32.Toolbar.Babylon.AMN!E1

C:\Program Files (x86)\Giant Savings\Uninstall.exe -> $PLUGINSDIR\closebrowsers.exe Verwijderd AdWare.Agent!E2

C:\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll Verwijderd Adware.Win32.Yontoo.AMN!E1

C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\crossriderapp4479@crossrider.com\install.rdf Verwijderd Trojan-Downloader.JS.LilyJade!E2

C:\Users\User\Downloads\VDownloaderInstaller.exe Verwijderd Riskware.Win32.InstallCore.AMN!E1

Key: hkey_local_machine\software\trymedia systems Verwijderd Trace.Registry.trymedia!E1

Key: hkey_local_machine\software\trymedia systems\activemark software Verwijderd Trace.Registry.trymedia!E1

Key: hkey_local_machine\software\imesh Verwijderd Trace.Registry.imesh!E1

c:\program files (x86)\imesh applications\imesh Verwijderd Trace.File.imesh!E1

Verwijderd 10

c:\program files (x86)\imesh applications\imesh In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\images In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\html In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\html\error.html In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\html\loading.html In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\discoveryhelper.dll In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\imwebcontrol.dll In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\imesh.exe In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\lame_enc.dll In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\license.txt In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\resourcesloc.dll In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\shw32.dll In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\default.skn In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\default.xml In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\images\defartwork.jpg In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\images\taflogo.png In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\images\togologo.png In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\skins\settings.xml In quarantaine Trace.File.imesh!E1

c:\program files (x86)\imesh applications\imesh\updateinst.exe In quarantaine Trace.File.imesh!E1

In quarantaine 20

5 oktober 2012

hallo,

ik heb nu een tijdje gekeken hoe het ging en het is nu zo dat de keylogger nu ook mijn hotmail gekraakt heeft.

Zijn er mogelijkheden om dit zsm op te lossen?

21 september 2012

Hallo,

niet dat ik direct merk. ik ga nu proberen om mijn origin in te loggen en kijken of de jonge rus er nog in kan.

Hartelijk dank voor je hulp.

21 september 2012

hijack this logje

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 15:50:41, on 21-9-2012

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16448)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe

C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe

C:\Program Files (x86)\uTorrent\uTorrent.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\AVG Secure Search\vprot.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe

c:\Users\User\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll

O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\IPS\IPSBHO.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.0.0.7\AVG Secure Search_toolbar.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

O3 - Toolbar: (no name) - !{51dd3535-abea-484a-b1cf-06ab7b092c0c} - (no file)

O3 - Toolbar: (no name) - !{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\coIEPlg.dll

O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.0.0.7\AVG Secure Search_toolbar.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "D:\Arwin\mine\hamachi-2-ui.exe" --auto-start

O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

O4 - HKLM\..\Run: [ROC_ROC_NT] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Free YouTube Download - C:\Users\User\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://verkopen.marktplaats.nl/js/widgets/imageUploader/aurigma/5_7_24_0/ImageUploader5.cab

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab

O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - http://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} - https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.66.2.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{EFAD5D6F-F8CA-448B-8A6A-E0BAB146A5FC}: NameServer = 10.93.88.1

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll

O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\13.0.0\ViProtocol.dll

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - D:\Arwin\mine\hamachi-2.exe

O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe

O23 - Service: Hotspot Shield Service (hshld) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe

O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe

O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE

O23 - Service: Hotspot Shield Monitoring Service (HssWd) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe

O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

O23 - Service: Online Games Manager (ogmservice) - RealNetworks, Inc. - C:\Program Files (x86)\Online Games Manager\ogmservice.exe

O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

O23 - Service: TunngleService - Tunngle.net GmbH - C:\Program Files (x86)\Tunngle\TnglCtrl.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: Updater Service - Acer - C:\Program Files\Acer\Acer Updater\UpdaterService.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: vToolbarUpdater13.0.0 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.0.0\ToolbarUpdater.exe

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 13038 bytes

logje van combofix.

ComboFix 12-09-20.03 - User 21-09-2012 15:32:49.2.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.6142.4009 [GMT 2:00]

Gestart vanuit: c:\users\User\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\User\Desktop\CFScript.txt

AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\found.000

c:\found.000\file0000.chk

c:\programdata\120C

c:\programdata\120C\{A6364166-2C4B-41AA-A0F3-9B529200774F}.swf

c:\users\User\AppData\Local\sabnzbd

c:\users\User\AppData\Local\sabnzbd\admin\history1.db

c:\users\User\AppData\Local\sabnzbd\admin\running.sab

c:\users\User\AppData\Local\sabnzbd\logs\sabnzbd.log

c:\users\User\AppData\Local\sabnzbd\sabnzbd.ini

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-08-21 to 2012-09-21 ))))))))))))))))))))))))))))))

.

2072-04-03 11:13 . 2008-03-21 12:46 607296 ------w- c:\program files (x86)\Microsoft Games\Age of Empires III\deformerdllyD.dll

2012-09-21 13:39 . 2012-09-21 13:39 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-09-19 15:00 . 2012-09-19 15:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-09-19 15:00 . 2012-09-07 15:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-12 19:34 . 2012-09-12 19:34 -------- d-----w- c:\users\User\AppData\Local\AVG Secure Search

2012-09-12 19:34 . 2012-09-12 19:34 -------- d-----w- c:\programdata\AVG Secure Search

2012-09-12 19:34 . 2012-09-12 19:33 30568 ----a-w- c:\windows\system32\drivers\avgtpx64.sys

2012-09-12 19:34 . 2012-09-12 19:34 -------- d-----w- c:\program files (x86)\AVG Secure Search

2012-09-12 19:34 . 2012-09-12 19:34 -------- d-----w- c:\program files (x86)\Common Files\AVG Secure Search

2012-09-12 19:33 . 2012-09-12 19:34 -------- d-----w- c:\users\User\AppData\Roaming\avg

2012-09-12 19:33 . 2012-09-12 20:01 -------- d-----w- c:\users\User\AppData\Roaming\Systweak

2012-09-12 19:33 . 2012-08-29 14:24 19368 ----a-w- c:\windows\system32\roboot64.exe

2012-09-12 04:36 . 2012-08-22 18:12 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-09-12 04:36 . 2012-07-04 20:26 41472 ----a-w- c:\windows\system32\drivers\RNDISMP.sys

2012-09-12 04:36 . 2012-08-02 17:58 574464 ----a-w- c:\windows\system32\d3d10level9.dll

2012-09-12 04:36 . 2012-08-02 16:57 490496 ----a-w- c:\windows\SysWow64\d3d10level9.dll

2012-09-12 04:36 . 2012-08-22 18:12 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-09-12 04:36 . 2012-08-22 18:12 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-09-12 04:36 . 2012-08-22 18:12 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

2012-09-11 17:49 . 2012-09-11 17:49 -------- d-----w- c:\users\User\AppData\Roaming\MusicNet

2012-09-11 17:49 . 2012-09-15 15:04 -------- d-----w- c:\users\User\AppData\Local\iMesh

2012-09-11 17:48 . 2012-09-13 07:24 -------- d-----w- c:\program files (x86)\iMesh Applications

2012-09-07 14:11 . 2012-09-07 14:12 -------- d-----w- c:\program files (x86)\Catan

2012-08-23 12:14 . 2012-08-23 12:14 -------- d-----w- c:\users\User\AppData\Roaming\AlawarEntertainment

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-09-18 14:03 . 2012-01-02 15:26 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

2012-09-18 14:03 . 2011-02-25 23:01 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr

2012-09-12 17:14 . 2011-02-26 22:39 64462936 ----a-w- c:\windows\system32\MRT.exe

2012-09-08 13:43 . 2012-01-02 15:26 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0

2012-08-15 00:18 . 2012-07-18 12:38 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-08-15 00:18 . 2012-07-18 12:38 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-07-24 20:11 . 2012-07-24 20:11 41704 ----a-w- c:\windows\system32\drivers\hssdrv6.sys

2012-07-24 20:11 . 2012-07-24 20:11 38632 ----a-w- c:\windows\system32\drivers\taphss.sys

2012-07-18 18:15 . 2012-08-15 12:55 3148800 ----a-w- c:\windows\system32\win32k.sys

2012-07-18 13:43 . 2012-07-18 13:43 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

2012-07-06 02:17 . 2012-08-15 09:21 37536 ----a-w- c:\windows\system32\drivers\NISx64\1308000.00E\srtspx64.sys

2012-07-06 02:17 . 2012-08-15 09:21 737952 ----a-w- c:\windows\system32\drivers\NISx64\1308000.00E\srtsp64.sys

2012-07-05 20:06 . 2012-07-18 12:39 772544 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-07-04 22:16 . 2012-08-15 12:55 73216 ----a-w- c:\windows\system32\netapi32.dll

2012-07-04 22:13 . 2012-08-15 12:55 59392 ----a-w- c:\windows\system32\browcli.dll

2012-07-04 22:13 . 2012-08-15 12:55 136704 ----a-w- c:\windows\system32\browser.dll

2012-07-04 21:14 . 2012-08-15 12:55 41984 ----a-w- c:\windows\SysWow64\browcli.dll

2012-06-29 10:04 . 2012-07-18 07:37 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{22216181-D7D7-4849-A938-4F03043471C7}\mpengine.dll

2012-06-29 04:55 . 2012-08-15 20:48 17809920 ----a-w- c:\windows\system32\mshtml.dll

2012-06-29 04:09 . 2012-08-15 20:48 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-06-29 03:56 . 2012-08-15 20:48 2312704 ----a-w- c:\windows\system32\jscript9.dll

2012-06-29 03:49 . 2012-08-15 20:48 1346048 ----a-w- c:\windows\system32\urlmon.dll

2012-06-29 03:49 . 2012-08-15 20:48 1392128 ----a-w- c:\windows\system32\wininet.dll

2012-06-29 03:48 . 2012-08-15 20:48 1494528 ----a-w- c:\windows\system32\inetcpl.cpl

2012-06-29 03:47 . 2012-08-15 20:48 237056 ----a-w- c:\windows\system32\url.dll

2012-06-29 03:45 . 2012-08-15 20:48 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-06-29 03:44 . 2012-08-15 20:48 816640 ----a-w- c:\windows\system32\jscript.dll

2012-06-29 03:43 . 2012-08-15 20:48 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-06-29 03:42 . 2012-08-15 20:48 2144768 ----a-w- c:\windows\system32\iertutil.dll

2012-06-29 03:40 . 2012-08-15 20:48 96768 ----a-w- c:\windows\system32\mshtmled.dll

2012-06-29 03:39 . 2012-08-15 20:48 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-06-29 03:35 . 2012-08-15 20:48 248320 ----a-w- c:\windows\system32\ieui.dll

2012-06-29 00:16 . 2012-08-15 20:48 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-06-29 00:09 . 2012-08-15 20:48 1129472 ----a-w- c:\windows\SysWow64\wininet.dll

2012-06-29 00:08 . 2012-08-15 20:48 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-06-29 00:04 . 2012-08-15 20:48 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-06-29 00:00 . 2012-08-15 20:48 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-09-16 13:12 . 2012-04-21 11:59 3623592 ----a-w- c:\program files (x86)\Common Files\ApnToolbarInstaller.exe

2011-09-16 13:12 . 2012-04-21 11:59 143240 ----a-w- c:\program files (x86)\Common Files\ApnStub.exe

2010-01-26 09:11 . 2012-07-23 13:56 444283 ----a-w- c:\program files\Common Files\WinPcapNmap.exe

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]

2012-09-12 19:33 1756616 ----a-w- c:\program files (x86)\AVG Secure Search\13.0.0.7\AVG Secure Search_toolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\13.0.0.7\AVG Secure Search_toolbar.dll" [2012-09-12 1756616]

.

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]

[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:41 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]

"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-10-06 393216]

"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-07-31 896400]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"LogMeIn Hamachi Ui"="d:\arwin\mine\hamachi-2-ui.exe" [2012-08-29 1996200]

"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-09-12 959944]

"ROC_ROC_NT"="c:\program files (x86)\AVG Secure Search\ROC_ROC_NT.exe" [2012-09-12 856160]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update-service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-20 136176]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-15 250056]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-20 136176]

R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe [2012-04-19 736104]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-02-18 51712]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-02-26 1255736]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1308000.00E\SYMDS64.SYS [2011-07-25 451192]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1308000.00E\SYMEFA64.SYS [2012-05-22 1129120]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2012-09-12 30568]

S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120919.001\BHDrvx64.sys [2012-08-31 1385120]

S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1308000.00E\ccSetx64.sys [2012-06-07 167072]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-08-20 270912]

S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys [2012-07-24 41704]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120920.002\IDSvia64.sys [2012-09-01 513184]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1308000.00E\Ironx64.SYS [2012-04-18 190072]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1308000.00E\SYMNETS.SYS [2012-04-18 405624]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-10-26 204288]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-06-11 361984]

S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]

S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [2010-11-09 21992]

S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\arwin\mine\hamachi-2.exe [2012-08-29 2369960]

S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2012-04-05 8704]

S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\openvpnas.exe [2012-08-03 476016]

S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2012-08-03 387440]

S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe [2012-06-16 138272]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-08-12 62208]

S2 ogmservice;Online Games Manager;c:\program files (x86)\Online Games Manager\ogmservice.exe [2012-06-08 521344]

S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2012-02-03 793048]

S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-08-13 3064000]

S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]

S2 vToolbarUpdater13.0.0;vToolbarUpdater13.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.0.0\ToolbarUpdater.exe [2012-09-12 711112]

S2 yksvc;Marvell Yukon Service;c:\windows\System32\svchost.exe [2009-07-14 27136]

S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-10-26 10496512]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-10-26 326656]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-02-23 95760]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-09-09 138912]

S3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;c:\windows\system32\DRIVERS\RTL85n64.sys [2010-03-23 2061856]

S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 31232]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-09-28 395264]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

Inhoud van de 'Gedeelde Taken' map

.

2012-09-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-18 00:18]

.

2012-09-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-20 10:56]

.

2012-09-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-20 10:56]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2009-09-10 13:44 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VDownloader"="c:\program files\VDownloader\VDownloader.exe" [2012-07-17 881664]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.google.nl/

uLocal Page = c:\windows\SYSTEM32\blank.htm

uInternet Settings,ProxyOverride = <local>

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Free YouTube Download - c:\users\User\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

TCP: DhcpNameServer = 212.54.40.25 212.54.35.25

TCP: Interfaces\{EFAD5D6F-F8CA-448B-8A6A-E0BAB146A5FC}: NameServer = 10.93.88.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\13.0.0\ViProtocol.dll

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

Toolbar-!{51dd3535-abea-484a-b1cf-06ab7b092c0c} - (no file)

Toolbar-!{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]

"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.8.0.14\diMaster.dll\" /prefetch:1"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_5891ae0.dll"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-1653913758-1519129782-4275150660-1000\Software\SecuROM\License information*]

"datasecu"=hex:cf,84,98,64,f0,f7,7a,16,f1,ba,9c,ca,67,1e,70,1e,72,58,0c,8f,07,

ba,4f,f5,fb,07,c4,87,d5,ba,c9,28,0a,a6,e0,24,a6,a1,ec,b9,b0,e4,e1,51,eb,37,\

"rkeysecu"=hex:19,57,10,fa,ad,2e,12,9d,09,8d,d8,dc,d6,c9,77,4a

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files (x86)\Hotspot Shield\HssWPR\hsssrv.exe

c:\windows\SysWOW64\PnkBstrA.exe

.

**************************************************************************

.

Voltooingstijd: 2012-09-21 15:46:04 - machine werd herstart

ComboFix-quarantined-files.txt 2012-09-21 13:46

ComboFix2.txt 2012-09-20 13:38

.

Pre-Run: 56.150.679.552 bytes beschikbaar

Post-Run: 56.128.851.968 bytes beschikbaar

.

- - End Of File - - 81D070B4927482F5CAA3B13031F3DAA1

20 september 2012

Hallo,

Allereerst, Kape bedankt voor je snelle reactie.

Ik heb hier een logje van de combofix en een logje van de hijackthis.

ComboFix 12-09-20.01 - User 20-09-2012 15:05:54.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.6142.4111 [GMT 2:00]

Gestart vanuit: c:\users\User\Desktop\ComboFix.exe

AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Nieuw herstelpunt werd aangemaakt

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Common Files\Acer GameZone online.ico

c:\program files (x86)\Complitly

c:\program files (x86)\Complitly\chrome\ComplitlyChrome.crx

c:\program files (x86)\Complitly\FireFoxExtensionWithFF8Fix.exe

c:\program files (x86)\Complitly\FireFoxUninstaller.exe

c:\program files (x86)\Complitly\InstTracker.exe

c:\program files (x86)\Complitly\support@Complitly.com\chrome.manifest

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\appIcon.png

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\browserOverlay.xul

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\options.js

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\options.xul

c:\program files (x86)\Complitly\support@Complitly.com\chrome\content\utils.js

c:\program files (x86)\Complitly\support@Complitly.com\defaults\preferences\predictad.js

c:\program files (x86)\Complitly\support@Complitly.com\install.rdf

c:\program files (x86)\Complitly\System.Data.SQLite.dll

c:\program files (x86)\Complitly\unins000.dat

c:\program files (x86)\Complitly\unins000.exe

c:\program files (x86)\DealPly

c:\program files (x86)\DealPly\DealPly.crx

c:\program files (x86)\DealPly\DealPly.xpi

c:\program files (x86)\DealPly\DealPlyIE.dll

c:\program files (x86)\DealPly\DealPlyTune.dll

c:\program files (x86)\DealPly\DealPlyUpdate.exe

c:\program files (x86)\DealPly\DealPlyUpdate.log

c:\program files (x86)\DealPly\DealPlyUpdateRun.exe

c:\program files (x86)\DealPly\icon.ico

c:\program files (x86)\DealPly\uninst.exe

c:\programdata\Amazon.ico

c:\programdata\MercadoLivre.ico

c:\programdata\windows

c:\programdata\windows\msxx.dat

c:\programdata\windows\vvve.dat

c:\programdata\Windows\wjdj.dat

c:\users\User\AppData\Roaming\.#

c:\users\User\AppData\Roaming\Akytdu

c:\users\User\AppData\Roaming\Akytdu\osli.iho

c:\users\User\AppData\Roaming\Ammay

c:\users\User\AppData\Roaming\Ammay\beaza.ipg

c:\users\User\AppData\Roaming\Byaty

c:\users\User\AppData\Roaming\Byaty\logy.exc

c:\users\User\AppData\Roaming\Byhyfi

c:\users\User\AppData\Roaming\Byhyfi\vewem.yrf

c:\users\User\AppData\Roaming\Dexe

c:\users\User\AppData\Roaming\Dexe\yztym.byt

c:\users\User\AppData\Roaming\Ebgovy

c:\users\User\AppData\Roaming\Ebgovy\iply.ume

c:\users\User\AppData\Roaming\Exxao

c:\users\User\AppData\Roaming\Exxao\lyynz.hiz

c:\users\User\AppData\Roaming\Fezev

c:\users\User\AppData\Roaming\Fezev\egxeg.bao

c:\users\User\AppData\Roaming\Huupq

c:\users\User\AppData\Roaming\Huupq\zere.uza

c:\users\User\AppData\Roaming\Icpeul

c:\users\User\AppData\Roaming\Icpeul\avbue.rye

c:\users\User\AppData\Roaming\Ifyl

c:\users\User\AppData\Roaming\Ifyl\ovav.dud

c:\users\User\AppData\Roaming\Igin

c:\users\User\AppData\Roaming\Igin\miik.uhz

c:\users\User\AppData\Roaming\Ilha

c:\users\User\AppData\Roaming\Ilha\feky.imu

c:\users\User\AppData\Roaming\Inwyo

c:\users\User\AppData\Roaming\Inwyo\yxwew.wuu

c:\users\User\AppData\Roaming\Ipuc

c:\users\User\AppData\Roaming\Ipuc\qiump.aco

c:\users\User\AppData\Roaming\Irti

c:\users\User\AppData\Roaming\Irti\puxay.ehb

c:\users\User\AppData\Roaming\Kyok

c:\users\User\AppData\Roaming\Kyok\upxa.uqc

c:\users\User\AppData\Roaming\Loewuh

c:\users\User\AppData\Roaming\Loewuh\miifp.qai

c:\users\User\AppData\Roaming\Lovaeb

c:\users\User\AppData\Roaming\Lovaeb\tupyx.gob

c:\users\User\AppData\Roaming\Memo

c:\users\User\AppData\Roaming\Memo\ycos.soi

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\chrome.manifest

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\funmoods.css

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\funmoods.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\arwDwn.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ae.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\bg.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ch.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cn.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cz.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\de.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\eg.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\en.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\es.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\fr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\gr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\he.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\il.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\it.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ja.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\jp.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\nl.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\no.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pl.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pt.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ro.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ru.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sa.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\se.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sv.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\tr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ua.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\us.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\help_16.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\home.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\logo.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\privecy_16_hot.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\imgs\tellafriend.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\loader.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\mtstart.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\tmplt.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\content\uninsthk.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\chrome.manifest

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\funmoods.css

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\funmoods.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\images\pref.jpg

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\arwDwn.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ae.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\bg.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ch.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\cn.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\cz.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\de.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\eg.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\en.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\es.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\fr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\gr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\he.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\il.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\it.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ja.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\jp.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\nl.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\no.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\pl.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\pt.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ro.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ru.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\sa.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\se.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\sv.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\tr.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\ua.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\flgs\us.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\help_16.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\home.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\logo.png

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\privecy_16_hot.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\imgs\tellafriend.gif

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\loader.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\mtstart.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\preferences.xul

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\content\tmplt.js

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\install.rdf

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\META-INF\le_c6a58f26_4d2d_4341_b387_c4f2289b6170.rsa

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\META-INF\le_c6a58f26_4d2d_4341_b387_c4f2289b6170.sf

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\ffxtlbr@funmoods.com\META-INF\manifest.mf

c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\ffxtlbr@funmoods.com\install.rdf

c:\users\User\AppData\Roaming\Niucr

c:\users\User\AppData\Roaming\Niucr\adqud.hia

c:\users\User\AppData\Roaming\Odukf

c:\users\User\AppData\Roaming\Odukf\xeig.yqo

c:\users\User\AppData\Roaming\Riuq

c:\users\User\AppData\Roaming\Riuq\yqifi.ukz

c:\users\User\AppData\Roaming\Roaming

c:\users\User\AppData\Roaming\Roaming\Quest3D\ShipSimExtreme\channels.lst

c:\users\User\AppData\Roaming\Rorake

c:\users\User\AppData\Roaming\Rorake\sofui.oxg

c:\users\User\AppData\Roaming\Tesi

c:\users\User\AppData\Roaming\Tesi\qyatu.ifa

c:\users\User\AppData\Roaming\Toeq

c:\users\User\AppData\Roaming\Toeq\vyybo.oke

c:\users\User\AppData\Roaming\Togehe

c:\users\User\AppData\Roaming\Togehe\edbo.ecv

c:\users\User\AppData\Roaming\Udvy

c:\users\User\AppData\Roaming\Udvy\ogypt.cal

c:\users\User\AppData\Roaming\Ufola

c:\users\User\AppData\Roaming\Ufola\deyf.wee

c:\users\User\AppData\Roaming\Umepgu

c:\users\User\AppData\Roaming\Umepgu\mevax.wit

c:\users\User\AppData\Roaming\Unhuh

c:\users\User\AppData\Roaming\Unhuh\arzer.yfd

c:\users\User\AppData\Roaming\Veulu

c:\users\User\AppData\Roaming\Veulu\cuux.ivi

c:\users\User\AppData\Roaming\Vywy

c:\users\User\AppData\Roaming\Vywy\rukoe.una

c:\users\User\AppData\Roaming\Xaatun

c:\users\User\AppData\Roaming\Xaatun\ceteq.isd

c:\users\User\AppData\Roaming\Xole

c:\users\User\AppData\Roaming\Xole\veixw.nae

c:\users\User\AppData\Roaming\Xozi

c:\users\User\AppData\Roaming\Xozi\quock.sug

c:\users\User\AppData\Roaming\Xyluu

c:\users\User\AppData\Roaming\Xyluu\myobd.eho

c:\users\User\AppData\Roaming\Yvar

c:\users\User\AppData\Roaming\Yvar\qaes.asb

c:\users\User\AppData\Roaming\Zeapa

c:\users\User\AppData\Roaming\Zeapa\ipvy.oga

c:\users\User\AppData\Roaming\Zuaws

c:\users\User\AppData\Roaming\Zuaws\olyh.omx

c:\windows\IsUn0413.exe

c:\windows\SysWow64\Packet.dll

c:\windows\SysWow64\pthreadVC.dll

c:\windows\SysWow64\wpcap.dll

F:\install.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

-------\Service_npf

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-08-20 to 2012-09-20 ))))))))))))))))))))))))))))))

.

2072-04-03 11:13 . 2008-03-21 12:46 607296 ------w- c:\program files (x86)\Microsoft Games\Age of Empires III\deformerdllyD.dll

2012-09-19 15:00 . 2012-09-19 15:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-09-19 15:00 . 2012-09-07 15:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-15 13:52 . 2012-09-15 13:52 -------- d-----w- c:\programdata\120C