doodles

19 januari 2013

Ik heb win 7 draaien op mijn laptop.

Laatst had ik een trojan, die inmiddels weg is.

Sindsdien krijg ik geen toegang meer op de c schijf.

ook mijn gebruikersaccount is weg, ik heb alleen de admin account nog draaien.

Snap niet wat er gebeurt is.

Is er nog hoop ? of toch maar verse install ?

groeten

28 december 2012

ZO zijn we weer.

Gedaan, hierbij de logfile, waarbij ik wil opmerken dat chrome niet lekker opstart.

ComboFix 12-12-28.02 - Acer 28-12-2012 19:59:18.2.3 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.4091.2259 [GMT 1:00]

Gestart vanuit: c:\users\Acer\Desktop\ComboFix.exe

gebruikte Opdracht switches :: c:\users\Acer\Desktop\cfscript.txt

AV: ESET NOD32 Antivirus 5.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 5.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\system32\drivers\ewtsouyq.sys"

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\SysWow64\DEBUG.log

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_ewtsouyq

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-11-28 to 2012-12-28 ))))))))))))))))))))))))))))))

.

2012-12-28 19:17 . 2012-12-28 19:17 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-12-27 16:21 . 2012-12-27 16:21 388096 ----a-r- c:\users\Acer\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-12-27 16:21 . 2012-12-27 16:21 -------- d-----w- c:\program files (x86)\Trend Micro

2012-12-27 11:16 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2012-12-27 11:16 . 2012-12-27 11:16 -------- d-----w- c:\program files\iPod

2012-12-27 11:16 . 2012-12-27 11:16 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2012-12-27 11:16 . 2012-12-27 11:16 -------- d-----w- c:\program files\iTunes

2012-12-27 11:16 . 2012-12-27 11:16 -------- d-----w- c:\program files (x86)\iTunes

2012-12-24 13:56 . 2012-12-24 13:56 -------- d-----w- c:\program files (x86)\Qualcomm Atheros

2012-12-24 13:55 . 2012-11-22 19:51 3831808 ----a-w- c:\windows\system32\drivers\athrx.sys

2012-12-24 13:55 . 2012-11-22 19:51 3831808 ------w- c:\windows\system32\athrx.sys

2012-12-24 13:55 . 2012-12-24 13:56 -------- d-----w- c:\programdata\Qualcomm Atheros

2012-12-24 13:54 . 2012-08-29 16:48 243712 ----a-w- c:\windows\system32\drivers\RtsUStor.sys

2012-12-24 13:54 . 2011-11-10 15:54 9882112 ----a-w- c:\windows\SysWow64\RtsUStoricon.dll

2012-12-24 13:50 . 2012-12-24 13:50 -------- d-----w- c:\program files\Broadcom

2012-12-24 13:49 . 2012-12-24 13:49 -------- d-----w- c:\windows\Dell

2012-12-24 13:42 . 2012-08-28 12:27 58536 ----a-w- c:\windows\system32\drivers\usbfilter.sys

2012-12-24 08:16 . 2012-12-24 08:16 -------- d-----w- c:\program files (x86)\VS Revo Group

2012-12-22 17:02 . 2012-12-22 17:02 -------- d-----w- C:\test

2012-12-21 08:21 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll

2012-12-21 08:21 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2012-12-21 08:21 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll

2012-12-21 08:21 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

2012-12-14 22:44 . 2012-12-14 22:44 -------- d-----w- c:\windows\Migration

2012-12-12 22:34 . 2012-11-14 05:52 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-12-12 22:33 . 2012-11-14 06:06 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll

2012-12-12 22:33 . 2012-11-14 02:01 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll

2012-12-12 22:33 . 2012-11-14 02:00 387584 ----a-w- c:\program files (x86)\Internet Explorer\jsdbgui.dll

2012-12-12 22:33 . 2012-11-14 06:06 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll

2012-12-12 22:33 . 2012-11-14 07:06 17811968 ----a-w- c:\windows\system32\mshtml.dll

2012-12-12 22:33 . 2012-11-14 06:32 10925568 ----a-w- c:\windows\system32\ieframe.dll

2012-12-12 06:51 . 2012-11-22 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys

2012-12-12 06:51 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll

2012-12-12 06:51 . 2012-11-09 04:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-12-12 06:49 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll

2012-12-12 06:49 . 2012-11-02 05:11 376832 ----a-w- c:\windows\SysWow64\dpnet.dll

2012-12-11 19:52 . 2012-12-13 19:40 -------- d-----w- c:\users\Acer\AppData\Roaming\tor

2012-11-29 19:55 . 2012-11-29 19:55 -------- d-----w- c:\program files (x86)\Common Files\Atheros

2012-11-29 19:54 . 2012-11-29 19:55 -------- d-----w- c:\program files (x86)\Bluetooth Suite

.

((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-12 22:37 . 2011-01-07 17:58 67413224 ----a-w- c:\windows\system32\MRT.exe

2012-12-12 13:11 . 2012-05-11 18:59 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-12-12 13:11 . 2011-05-20 04:02 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-30 14:54 . 2012-11-30 14:54 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

2012-11-30 14:54 . 2012-11-30 14:54 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-11-30 14:54 . 2012-11-30 14:54 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-11-17 15:01 . 2012-11-17 15:01 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

2012-11-17 15:01 . 2012-11-17 15:01 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

2012-11-17 15:01 . 2012-11-17 15:01 744448 ----a-w- c:\windows\system32\WUDFx.dll

2012-11-17 15:01 . 2012-11-17 15:01 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

2012-11-17 15:01 . 2012-11-17 15:01 229888 ----a-w- c:\windows\system32\WUDFHost.exe

2012-11-17 15:01 . 2012-11-17 15:01 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

2012-11-17 15:01 . 2012-11-17 15:01 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

2012-11-17 15:00 . 2012-11-17 15:00 9728 ----a-w- c:\windows\system32\Wdfres.dll

2012-11-17 15:00 . 2012-11-17 15:00 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2012-11-17 15:00 . 2012-11-17 15:00 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

2012-11-17 14:59 . 2012-11-17 14:59 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll

2012-11-17 14:59 . 2012-11-17 14:59 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll

2012-11-17 14:59 . 2012-11-17 14:59 226816 ----a-w- c:\windows\system32\dhcpcore6.dll

2012-11-17 14:59 . 2012-11-17 14:59 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll

2012-11-17 14:58 . 2012-11-17 14:58 70656 ----a-w- c:\windows\system32\nlaapi.dll

2012-11-17 14:58 . 2012-11-17 14:58 569344 ----a-w- c:\windows\system32\iphlpsvc.dll

2012-11-17 14:58 . 2012-11-17 14:58 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

2012-11-17 14:58 . 2012-11-17 14:58 303104 ----a-w- c:\windows\system32\nlasvc.dll

2012-11-17 14:58 . 2012-11-17 14:58 216576 ----a-w- c:\windows\system32\ncsi.dll

2012-11-17 14:58 . 2012-11-17 14:58 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-11-17 14:58 . 2012-11-17 14:58 52224 ----a-w- c:\windows\SysWow64\nlaapi.dll

2012-11-17 14:58 . 2012-11-17 14:58 246272 ----a-w- c:\windows\system32\netcorehc.dll

2012-11-17 14:58 . 2012-11-17 14:58 18944 ----a-w- c:\windows\SysWow64\netevent.dll

2012-11-17 14:58 . 2012-11-17 14:58 18944 ----a-w- c:\windows\system32\netevent.dll

2012-11-17 14:58 . 2012-11-17 14:58 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll

2012-11-17 14:58 . 2012-11-17 14:58 156672 ----a-w- c:\windows\SysWow64\ncsi.dll

2012-11-17 14:57 . 2012-11-17 14:57 62976 ----a-w- c:\windows\system32\TSWbPrxy.exe

2012-11-17 14:57 . 2012-11-17 14:57 54272 ----a-w- c:\windows\system32\MsRdpWebAccess.dll

2012-11-17 14:57 . 2012-11-17 14:57 37376 ----a-w- c:\windows\SysWow64\tsgqec.dll

2012-11-17 14:57 . 2012-11-17 14:57 3174912 ----a-w- c:\windows\system32\rdpcorets.dll

2012-11-17 14:57 . 2012-11-17 14:57 269312 ----a-w- c:\windows\SysWow64\aaclient.dll

2012-11-17 14:57 . 2012-11-17 14:57 243200 ----a-w- c:\windows\system32\rdpudd.dll

2012-11-17 14:57 . 2012-11-17 14:57 228864 ----a-w- c:\windows\system32\rdpendp_winip.dll

2012-11-17 14:57 . 2012-11-17 14:57 19456 ----a-w- c:\windows\system32\drivers\rdpvideominiport.sys

2012-11-17 14:57 . 2012-11-17 14:57 192000 ----a-w- c:\windows\SysWow64\rdpendp_winip.dll

2012-11-17 14:57 . 2012-11-17 14:57 15360 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll

2012-11-17 14:57 . 2012-11-17 14:57 1123840 ----a-w- c:\windows\system32\mstsc.exe

2012-11-17 14:57 . 2012-11-17 14:57 1048064 ----a-w- c:\windows\SysWow64\mstsc.exe

2012-11-17 14:57 . 2012-11-17 14:57 4916224 ----a-w- c:\windows\SysWow64\mstscax.dll

2012-11-17 14:57 . 2012-11-17 14:57 57856 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys

2012-11-17 14:57 . 2012-11-17 14:57 5773824 ----a-w- c:\windows\system32\mstscax.dll

2012-11-17 14:57 . 2012-11-17 14:57 46592 ----a-w- c:\windows\SysWow64\MsRdpWebAccess.dll

2012-11-17 14:57 . 2012-11-17 14:57 44032 ----a-w- c:\windows\system32\tsgqec.dll

2012-11-17 14:57 . 2012-11-17 14:57 43520 ----a-w- c:\windows\system32\TsUsbGDCoInstaller.dll

2012-11-17 14:57 . 2012-11-17 14:57 384000 ----a-w- c:\windows\system32\wksprt.exe

2012-11-17 14:57 . 2012-11-17 14:57 322560 ----a-w- c:\windows\system32\aaclient.dll

2012-11-17 14:57 . 2012-11-17 14:57 18432 ----a-w- c:\windows\system32\wksprtPS.dll

2012-11-17 14:57 . 2012-11-17 14:57 16896 ----a-w- c:\windows\SysWow64\wksprtPS.dll

2012-11-17 14:57 . 2012-11-17 14:57 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2012-11-17 14:57 . 2012-11-17 14:57 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2012-11-17 14:57 . 2012-11-17 14:57 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2012-11-17 14:57 . 2012-11-17 14:57 458712 ----a-w- c:\windows\system32\drivers\cng.sys

2012-11-17 14:57 . 2012-11-17 14:57 340992 ----a-w- c:\windows\system32\schannel.dll

2012-11-17 14:57 . 2012-11-17 14:57 307200 ----a-w- c:\windows\system32\ncrypt.dll

2012-11-17 14:57 . 2012-11-17 14:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll

2012-11-17 14:57 . 2012-11-17 14:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2012-11-17 14:57 . 2012-11-17 14:57 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2012-11-17 14:57 . 2012-11-17 14:57 1448448 ----a-w- c:\windows\system32\lsasrv.dll

2012-11-17 14:57 . 2012-11-17 14:57 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll

2012-11-17 14:53 . 2012-11-17 14:53 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

2012-11-17 14:52 . 2012-11-17 14:52 245760 ----a-w- c:\windows\system32\OxpsConverter.exe

2012-11-08 17:24 . 2012-12-28 08:04 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D6A18B8A-003C-4E72-BA98-0ECBF02D5F20}\mpengine.dll

2012-11-07 20:10 . 2012-11-07 20:11 108008 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll

2012-11-07 20:10 . 2012-11-07 20:11 289768 ----a-w- c:\windows\system32\javaws.exe

2012-11-07 20:10 . 2012-11-07 20:11 189416 ----a-w- c:\windows\system32\javaw.exe

2012-11-07 20:10 . 2012-11-07 20:11 916456 ----a-w- c:\windows\system32\deployJava1.dll

2012-11-07 20:10 . 2012-11-07 20:11 1034216 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-11-07 20:10 . 2012-11-07 20:11 188904 ----a-w- c:\windows\system32\java.exe

2012-10-04 16:40 . 2012-12-12 06:50 44032 ----a-w- c:\windows\apppatch\acwow64.dll

.

((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2010-05-27 02:40 120176 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IncrediMail"="c:\program files (x86)\IncrediMail\bin\IncMail.exe" [2012-08-14 366576]

"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

R0 sptd;sptd; [x]

R2 AODDriver4.01;AODDriver4.01; [x]

R2 BrcmMgmtAgent;Broadcom Management Agent;c:\program files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe [2012-08-02 204288]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936]

R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]

R3 AVFSFilter;AVFSFilter;c:\windows\system32\DRIVERS\avfsfilter.sys [x]

R3 cpuz134;cpuz134;c:\users\Acer\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x]

R3 esgiguard;esgiguard;c:\program files (x86)\Enigma Software Group\SpyHunter\esgiguard.sys [2011-03-02 13088]

R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-05-27 305520]

R3 PCDSRVC{11725DDC-8233B918-06020101}_0;PCDSRVC{11725DDC-8233B918-06020101}_0 - PCDR Kernel Mode Service Helper Driver; [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-11-17 19456]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-11-17 57856]

R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-05 1255736]

R4 AdobeActiveFileMonitor10.0;Adobe Active File Monitor V10;c:\program files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [2011-09-14 169624]

R4 AdobeActiveFileMonitor11.0;Adobe Active File Monitor V11;c:\program files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [2012-09-23 171600]

R4 CyberLink PowerDVD 11.0 Monitor Service;CyberLink PowerDVD 11.0 Monitor Service;c:\program files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe [2011-03-31 70952]

R4 CyberLink PowerDVD 11.0 Service;CyberLink PowerDVD 11.0 Service;c:\program files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServer.exe [2011-03-31 312616]

R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [2012-04-11 82560]

S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [2012-04-11 42624]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2012-08-10 56336]

S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2012-03-14 209768]

S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2012-03-14 148528]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-03 22576]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-03 20016]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-03 60464]

S2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2011/12/06 20:06];c:\program files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl [2011-04-12 09:16 148976]

S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-09-16 169312]

S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-09-28 239616]

S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-01-20 76448]

S2 CLHNServiceForPowerDVD;CLHNServiceForPowerDVD;c:\program files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe [2011-04-20 83240]

S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-06-22 321104]

S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2012-03-07 913144]

S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2012-03-14 137144]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-06-11 868896]

S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]

S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2012-09-07 2464400]

S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2012-04-05 255376]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-02-18 462632]

S2 nlsX86cc;NLS Service;c:\windows\SysWOW64\NLSSRV32.EXE [2011-01-12 68928]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-06-28 255744]

S2 ntk_PowerDVD;ntk_PowerDVD;c:\program files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys [2011-04-20 75248]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2012-04-05 255376]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]

S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-01-20 28832]

S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2012-09-04 433976]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928]

S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2011-01-08 82816]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2012-08-29 243712]

S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2012-08-28 58536]

.

Inhoud van de 'Gedeelde Taken' map

.

2012-12-28 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-11 13:11]

.

2012-12-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-03 23:07]

.

2012-12-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-03 23:07]

.

2012-12-28 c:\windows\Tasks\Updater.job

- c:\programdata\WombatUpdater\WombatUpdater.exe [2010-12-30 09:26]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2010-05-27 02:42 137584 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2012-03-07 4081008]

"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-01-20 615584]

"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-01-20 379552]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]

.

------- Bijkomende Scan -------

.

uStart Page = hxxp://www.nu.nl/

mWindow Title = Microsoft Internet Explorer

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Download with PodWorks Platinum - c:\program files (x86)\ImTOO\PodWorks Platinum\upod_link.HTM

IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1 188.142.0.6 188.142.0.22

.

- - - - ORPHANS VERWIJDERD - - - -

.

Toolbar-Locked - (no file)

WebBrowser-{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - (no file)

WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)

WebBrowser-{1392B8D2-5C05-419F-A8F6-B9F15A596612} - (no file)

ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)

ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]

"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl"

.

--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.032"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.ani"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.bay"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="PhotoViewer.FileAssoc.Bitmap"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.bw"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.cs1"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.cur"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.dcx"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.dib"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.djv"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.djvu"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.emf"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.erf"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.fff"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.fpx"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="PhotoViewer.FileAssoc.Gif"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.icl"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.icn"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.ico"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Winamp.File.iff"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.ilbm"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.int"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.inta"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.iw4"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.j2c"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.j2k"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.jfif"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.jif"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.jp2"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.jpc"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.jpg"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.jpk"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.jpx"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.lbm"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.mos"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.pbm"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.pcd"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.pct"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.pcx"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.pgm"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.pic"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.pict"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.pix"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="PhotoViewer.FileAssoc.Png"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.ppm"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.psd"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.psp"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.ras"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Winamp.File.raw"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.rgb"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.rgba"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.rle"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.rsb"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.sgi"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="Google.PhotoViewer.3.0"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.tga"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.thm"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="PhotoViewer.FileAssoc.Tiff"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]

@Denied: (2) (S-1-5-21-2988280475-2932619533-408335912-1001)

@Denied: (2) (LocalSystem)

"Progid"="PhotoViewer.FileAssoc.Tiff"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.ttc"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.ttf"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.wbm"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.wbmp"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.wmf"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.xbm"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.xif"

.

[HKEY_USERS\S-1-5-21-2988280475-2932619533-408335912-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee 9.0.xpm"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andere Aktieve Processen ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe

c:\windows\SysWOW64\IoctlSvc.exe

.

**************************************************************************

.

Voltooingstijd: 2012-12-28 20:29:20 - machine werd herstart

ComboFix-quarantined-files.txt 2012-12-28 19:29

ComboFix2.txt 2012-12-28 11:39

.

Pre-Run: 81.292.201.984 bytes beschikbaar

Post-Run: 80.776.126.464 bytes beschikbaar

.

- - End Of File - - 7F86D362BDC5889CE95959A0B6813F31

28 december 2012

nee, vrees van niet

28 december 2012

hoi,

probleem lijkt opgelost, dankjewel.

Hier is de log file:

ComboFix 12-12-28.01 - Acer 28-12-2012 12:12:57.1.3 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.31.1043.18.4091.2464 [GMT 1:00]

Gestart vanuit: c:\users\Acer\Desktop\ComboFix.exe

AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\WinPCap

c:\program files (x86)\WinPCap\install.log

c:\program files (x86)\WinPCap\rpcapd.exe

c:\programdata\1349546409.bdinstall.bin

c:\programdata\7510b656b7a215785982239197361ace_c

c:\programdata\QuestScan

c:\programdata\Windows

c:\programdata\windows\lmbd.dll

c:\programdata\windows\msxx.dat

c:\programdata\windows\vvve.dat

c:\programdata\windows\wjdj.dat

c:\windows\IsUn0413.exe

c:\windows\SysWow64\Packet.dll

c:\windows\SysWow64\pthreadVC.dll

c:\windows\SysWow64\URTTemp

c:\windows\SysWow64\URTTemp\regtlib.exe

c:\windows\SysWow64\wpcap.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

-------\Service_NPF

.

(((((((((((((((((((( Bestanden Gemaakt van 2012-11-28 to 2012-12-28 ))))))))))))))))))))))))))))))

.

2012-12-28 11:28 . 2012-12-28 11:28 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-12-27 20:10 . 2012-12-27 20:10 -------- d-----w- c:\users\Acer\Nieuwe map