Archief - Trage Laptop

Laptop doet de laatste tijd enorm traag, heb zelf al wat opgeruimd maar het is toch nog niet volledig in orde, kun je even mn logs checken?

Bedankt!



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:00:39, on 5/04/2012
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18639)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\conime.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HP | MSN
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Bienvenue sur Facebook. Connectez-vous, inscrivez-vous ou découvrez !
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HP | MSN
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = HP | MSN
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: LimeWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2520824598-192507237-3364110249-1048\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?')
O4 - Global Startup: DFX.lnk = C:\Program Files\DFX\DFX.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm924YYBE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: In weblog opnemen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &In weblog opnemen met Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/CursorManiaInitialSetup1.0.1.1.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Windows\system32\mfevtps.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: QuestScan Service - Unknown owner - C:\ProgramData\QuestScan\questscan129.exe (file missing)
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe

--
End of file - 9748 bytes

Start HijackThis op en kies voor 'Do a system scan only'
Selecteer alleen de items die hieronder zijn genoemd:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Bienvenue sur Facebook. Connectez-vous, inscrivez-vous ou découvrez*!
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - Global Startup: DFX.lnk = C:\Program Files\DFX\DFX.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZCxdm924YYBE
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.1.cab
O23 - Service: QuestScan Service - Unknown owner - C:\ProgramData\QuestScan\questscan129.exe (file missing)






Sluit alle vensters behalve HijackThis
Klik op 'Fix checked' om de items te verwijderen.

Download de Emsisoft Emergency Kit naar het bureaublad en pak het ZIP bestand uit.

• Open de map "EmsisoftEmergencyKit" en dubbelklik op "Start.exe"
• Klik nu op "Emergency Kit Scanner" u krijg nu een melding dat het is aanbevolen om eerst te updaten sta dit toe door te klikken op "Ja"
  
  
• Als de update gereed is en de melding "Update process is succesvol afgerond" verschijnt klikt u op "menu" en dan op "Scan PC"
• Selecteer de optie "Diep" als deze niet standaard al zo is ingesteld.
• Klik Nu op de knop "Scan" en doe verder niets op de computer tijdens het scannen, deze scan kan een geruime tijd in beslag nemen dus wacht dit geduldig af.
• Het venster met de waarschuwing over een verhoogd risico kunt u sluiten als de scan gereed is.
  
  
  
• Zorg ervoor dat alle gevonden items zijn aangevinkt en druk dan op de knop "verwijder geselecteerde" u zal nu de volgende melding krijgen maar klik hier op "Ja"
  
  
• Als het verwijderen gereed is klikt u op de knop "View report" en selecteert u het tekstbestand van deze scan met de naam zoals: a2scan_110730-111615.txt
• Plaats de inhoud van dit LOG bestand straks in uw volgende bericht.
• Herstart nu de computer.

Emsisoft Emergency Kit - Versie 1.0
Laatste Update: 9/04/2012 17:16:35

Scaninstellingen:

Scantype: Diepe Scan
Objecten: Geheugen, Sporen, Cookies, C:\, D:\
Scan archieven: Aan
Heuristieken: Uit
ADS Scan: Aan

Scan gestart: 9/04/2012 17:18:26

Value: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> DisplayName Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> URL Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> DisplayName Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> URL Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin --> Description Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin --> FriendlyName Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin --> LoadBehavior Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin --> Description Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin --> FriendlyName Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin --> LoadBehavior Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\sources --> f3PopularScreensavers Ontdekt: Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_USERS\Tom\software\microsoft\internet explorer\urlsearchhooks --> {00a6faf6-072e-44cf-8957-5838f569a31d} Ontdekt: Trace.Registry.MyWebSearchToobar!A2
Key: HKEY_LOCAL_MACHINE\software\microsoft\office\outlook\addins\mywebsearch.outlookaddin Ontdekt: Trace.Registry.MyWebSearchToobar!A2
Key: HKEY_LOCAL_MACHINE\software\microsoft\office\word\addins\mywebsearch.outlookaddin Ontdekt: Trace.Registry.MyWebSearchToobar!A2
Value: HKEY_CLASSES_ROOT\CLSID\{3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} --> AppID Ontdekt: Trace.Registry.dl.tvunetworks.com!A2
Value: HKEY_CLASSES_ROOT\CLSID\{3EA4FA88-E0BE-419A-A732-9B79B87A6ED0}\InprocServer32 --> ThreadingModel Ontdekt: Trace.Registry.dl.tvunetworks.com!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} --> AppID Ontdekt: Trace.Registry.dl.tvunetworks.com!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EA4FA88-E0BE-419A-A732-9B79B87A6ED0}\InprocServer32 --> ThreadingModel Ontdekt: Trace.Registry.dl.tvunetworks.com!A2
Key: HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\QuestScan Service Ontdekt: Trace.Registry.Zwangi!A2
C:\Users\sara\AppData\Roaming\Microsoft\Windows\Cookies\sara@doubleclick[1].txt Ontdekt: Trace.TrackingCookie.doubleclick!A2
C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Cookies\Low\tom@metriweb[2].txt Ontdekt: Trace.TrackingCookie.metriweb!A2
C:\HP\BIN\EndProcess.exe Ontdekt: Riskware.Win32.KillApp!A2
C:\Program Files\Propellerhead\Reason\Propellerhead Recycle 2.1\Patch & Keygen.exe Ontdekt: Trojan.Kazy!IK
C:\Users\Muziek\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LSQ5GH9A\afr[1].htm Ontdekt: AdWare.JS.Pornpop!IK
C:\Users\sara\Documents\LimeWire\Saved\Grayson Capps - If You Knew My Mind.wma Ontdekt: Virus.WMA.Wimad!IK
C:\Users\sara\Documents\LimeWire\Saved\oud\Bloc party - Banquet.mp3 Ontdekt: Trojan-Downloader.WMA.GetCodec!IK
C:\Users\sara\Documents\LimeWire\Saved\oud\butch amelie(Club MIX).mp3 Ontdekt: Trojan-Downloader.WMA.GetCodec!IK
C:\Users\Tom\AppData\Local\Temp\Rar$EX01.049\Virtual_ DJ_ 5.2_with_ Skins_Effects_Samples\SoundEffect\MultiFlangerOption.dll Ontdekt: Trojan-Proxy.AMKD!IK
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0C6HI531\upgrade[1].cab/$0\questscan.exe Ontdekt: BHO.Win32.Zwangi!IK
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9KBPL5BZ\upgrade[1].cab/$0\questscan.exe Ontdekt: Application.SuspectCRC!IK

Gescand

Bestanden: 381403
Sporen: 464493
Cookies: 90
Processen: 80

Gevonden

Bestanden: 11
Sporen: 19
Cookies: 2
Processen: 0
Registersleutels: 0

Scan Geëindigd: 9/04/2012 21:46:28
Scantijd: 4:28:02

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9KBPL5BZ\upgrade[1].cab/$0\questscan.exe Verwijderd Application.SuspectCRC!IK
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0C6HI531\upgrade[1].cab/$0\questscan.exe Verwijderd BHO.Win32.Zwangi!IK
C:\Users\Tom\AppData\Local\Temp\Rar$EX01.049\Virtual_ DJ_ 5.2_with_ Skins_Effects_Samples\SoundEffect\MultiFlangerOption.dll Verwijderd Trojan-Proxy.AMKD!IK
C:\Users\sara\Documents\LimeWire\Saved\oud\Bloc party - Banquet.mp3 Verwijderd Trojan-Downloader.WMA.GetCodec!IK
C:\Users\sara\Documents\LimeWire\Saved\oud\butch amelie(Club MIX).mp3 Verwijderd Trojan-Downloader.WMA.GetCodec!IK
C:\Users\sara\Documents\LimeWire\Saved\Grayson Capps - If You Knew My Mind.wma Verwijderd Virus.WMA.Wimad!IK
C:\Users\Muziek\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LSQ5GH9A\afr[1].htm Verwijderd AdWare.JS.Pornpop!IK
C:\Program Files\Propellerhead\Reason\Propellerhead Recycle 2.1\Patch & Keygen.exe Verwijderd Trojan.Kazy!IK
C:\HP\BIN\EndProcess.exe Verwijderd Riskware.Win32.KillApp!A2
C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Cookies\Low\tom@metriweb[2].txt Verwijderd Trace.TrackingCookie.metriweb!A2
C:\Users\sara\AppData\Roaming\Microsoft\Windows\Cookies\sara@doubleclick[1].txt Verwijderd Trace.TrackingCookie.doubleclick!A2
Key: HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\QuestScan Service Verwijderd Trace.Registry.Zwangi!A2
Value: HKEY_CLASSES_ROOT\CLSID\{3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} --> AppID Verwijderd Trace.Registry.dl.tvunetworks.com!A2
Value: HKEY_CLASSES_ROOT\CLSID\{3EA4FA88-E0BE-419A-A732-9B79B87A6ED0}\InprocServer32 --> ThreadingModel Verwijderd Trace.Registry.dl.tvunetworks.com!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} --> AppID Verwijderd Trace.Registry.dl.tvunetworks.com!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EA4FA88-E0BE-419A-A732-9B79B87A6ED0}\InprocServer32 --> ThreadingModel Verwijderd Trace.Registry.dl.tvunetworks.com!A2
Value: HKEY_USERS\Tom\software\microsoft\internet explorer\urlsearchhooks --> {00a6faf6-072e-44cf-8957-5838f569a31d} Verwijderd Trace.Registry.MyWebSearchToobar!A2
Key: HKEY_LOCAL_MACHINE\software\microsoft\office\outlook\addins\mywebsearch.outlookaddin Verwijderd Trace.Registry.MyWebSearchToobar!A2
Key: HKEY_LOCAL_MACHINE\software\microsoft\office\word\addins\mywebsearch.outlookaddin Verwijderd Trace.Registry.MyWebSearchToobar!A2
Value: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> DisplayName Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> URL Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> DisplayName Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} --> URL Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin --> Description Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin --> FriendlyName Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin --> LoadBehavior Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin --> Description Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin --> FriendlyName Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin --> LoadBehavior Verwijderd Trace.Registry.MyWebSearch Toolbar!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\sources --> f3PopularScreensavers Verwijderd Trace.Registry.MyWebSearch Toolbar!A2

Verwijderd

Bestanden: 9
Sporen: 19
Cookies: 2

Download ComboFix van één van deze locaties:

Link 1
Link 2


* BELANGRIJK !!! Sla ComboFix.exe op je Bureaublad op.
>>Hier<< kunt u lezen hoe u Combofix dient te gebruiken.





1. Schakel alle antivirus- en antispywareprogramma's uit, want anders kunnen ze misschien conflicteren met ComboFix.

* (hier of hier 2. Het kan voorkomen dat de computer meerdere malen opnieuw gestart moet worden, dit is normaal.
3. Dubbelklik op "Combofix.exe" om de tool te starten.
4. Klik niet in het scherm van Combofix als deze actief is, hierdoor kan de 'tool' vastlopen.

* Noot !!! Als er een error wordt getoond met de melding "Illegal operation attempted on a registery key that has been marked for deletion." herstart dan de computer.

5. Wanneer ComboFix klaar is, zal het het een logbestand voor je maken. Post de inhoud van dit logbestand (te vinden als C:\ComboFix.txt) in je volgende bericht.

ComboFix 12-04-10.01 - sara 10/04/2012 19:28:06.1.2 - x86
Microsoft® Windows Vista&#8482; Home Premium 6.0.6001.1.1252.32.1043.18.3068.1270 [GMT 2:00]
Gestart vanuit: c:\users\sara\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Aanwezig AV is actief
.
.
.
(((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\sara\Documents\~WRL0003.tmp
.
.
(((((((((((((((((((( Bestanden Gemaakt van 2012-03-10 to 2012-04-10 ))))))))))))))))))))))))))))))
.
.
2012-04-10 14:35 . 2004-02-06 23:48 331263 ----a-w- c:\windows\LOOP.exe
2012-04-10 13:58 . 2012-04-10 13:58 -------- d-----w- c:\users\sara\AppData\Local\FalloutNV
2012-04-10 12:33 . 2012-03-14 02:15 6582328 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ABAA7A41-4FF5-416B-8090-153D5FC29B00}\mpengine.dll
2012-04-08 17:54 . 2012-04-08 17:54 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2012-04-08 17:54 . 2012-04-08 17:54 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2012-04-08 17:54 . 2012-04-08 17:54 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2012-04-08 17:54 . 2012-04-08 17:54 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2012-04-08 17:54 . 2012-04-08 17:54 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2012-04-08 17:54 . 2012-04-08 17:54 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2012-04-08 17:54 . 2012-04-08 17:54 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2012-04-07 16:33 . 2012-04-07 16:33 -------- d-----w- c:\users\sara\AppData\Roaming\Line 6
2012-04-07 16:33 . 2012-04-07 16:33 -------- d-----w- c:\programdata\Line 6
2012-04-07 16:32 . 2012-04-07 16:32 -------- d-----w- c:\program files\Common Files\Propellerhead Software
2012-04-07 16:30 . 2012-04-07 16:30 -------- d-----w- c:\program files\CodeMeter
2012-04-05 21:36 . 2012-04-05 21:36 338432 ------w- c:\windows\system32\REX Shared Library.dll
2012-04-05 21:36 . 2012-04-05 21:36 406528 ----a-w- c:\windows\system32\ReWire.dll
2012-04-05 21:24 . 2012-04-10 15:44 -------- d-----w- c:\program files\Propellerhead
2012-04-05 21:20 . 2012-04-05 21:20 -------- d-----w- c:\users\Tom.PC_van_sara\AppData\Local\DFX
2012-04-05 21:13 . 2012-04-10 14:36 -------- d-----w- c:\programdata\Propellerhead Software
2012-04-05 21:13 . 2012-04-10 14:36 -------- d-----w- c:\users\sara\AppData\Roaming\Propellerhead Software
2012-04-05 21:13 . 2012-04-08 02:58 -------- d-----w- c:\programdata\AVG Secure Search
2012-04-05 21:13 . 2012-04-05 21:13 -------- d-----w- c:\program files\Common Files\AVG Secure Search
2012-04-05 21:13 . 2012-04-08 02:57 -------- d-----w- c:\program files\AVG Secure Search
2012-04-05 21:12 . 2012-04-05 21:12 -------- d--h--w- c:\programdata\Common Files
2012-04-05 21:12 . 2012-04-05 21:12 -------- d-----w- c:\program files\PowerISO
2012-04-05 16:46 . 2012-04-05 16:46 388096 ----a-r- c:\users\sara\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-04-05 16:46 . 2012-04-05 16:46 -------- d-----w- c:\program files\Trend Micro
2012-04-05 16:21 . 2011-03-02 11:43 175616 ----a-w- c:\windows\system32\unrar.dll
2012-04-05 16:21 . 2012-04-05 16:23 -------- d-----w- c:\program files\K-Lite Codec Pack
2012-04-05 14:19 . 2012-04-05 14:19 -------- d-----w- c:\program files\CCleaner
2012-04-04 15:35 . 2012-04-04 15:35 -------- d-----w- c:\users\sara\AppData\Local\DFX
2012-04-04 15:35 . 2012-04-04 15:35 -------- d-----w- c:\users\Tom\AppData\Roaming\vlc
2012-04-04 15:35 . 2012-04-04 15:35 -------- d-----w- c:\users\Muziek\AppData\Roaming\vlc
2012-04-04 15:35 . 2012-04-04 15:35 -------- d-----w- c:\users\Gast
2012-04-04 15:35 . 2012-04-04 15:35 -------- d-----w- c:\users\Administrator
2012-04-04 15:35 . 2012-04-04 15:35 -------- d-----w- c:\programdata\DFX
2012-04-04 15:34 . 2012-04-04 15:34 -------- d-----w- c:\program files\Common Files\DFX
2012-04-04 15:34 . 2012-04-05 15:45 -------- d-----w- c:\program files\DFX
2012-03-15 10:33 . 2012-03-15 10:37 -------- d-----w- c:\users\muziek.PC_van_sara.012
2012-03-12 20:12 . 2012-01-06 01:27 346536 ----a-w- c:\program files\Internet Explorer\winmm.dll
.
.
.
((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 07:18 . 2009-10-03 14:24 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-09 06:06 . 2012-02-09 06:06 112096 ----a-w- c:\windows\system32\drivers\scdemu.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-04-08 02:57 1869152 ----a-w- c:\program files\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-03-28 10:11 1196936 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-03-28 1196936]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll" [2012-04-08 1869152]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-03-28 1196936]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\P4EXPCheckoutOverlay]
@="{80E008A4-EAE7-4867-AEB0-1A245F070F25}"
[HKEY_CLASSES_ROOT\CLSID\{80E008A4-EAE7-4867-AEB0-1A245F070F25}]
2009-12-18 15:14 860160 ----a-w- c:\program files\Perforce\p4exp.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\P4EXPSyncdOverlay]
@="{ADF262C1-E8FE-49BE-AD63-F77CD4A6CCD9}"
[HKEY_CLASSES_ROOT\CLSID\{ADF262C1-E8FE-49BE-AD63-F77CD4A6CCD9}]
2009-12-18 15:14 860160 ----a-w- c:\program files\Perforce\p4exp.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\P4EXPUpdateOverlay]
@="{C550CDA2-37D7-4838-A9D7-65ECB1EB5AB2}"
[HKEY_CLASSES_ROOT\CLSID\{C550CDA2-37D7-4838-A9D7-65ECB1EB5AB2}]
2009-12-18 15:14 860160 ----a-w- c:\program files\Perforce\p4exp.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-04-05 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-14 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-14 92704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-06-27 442467]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-06-25 468264]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-01 554288]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2008-03-14 136512]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2012-02-09 312376]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-04-08 982880]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
CodeMeter Control Center.lnk - c:\program files\CodeMeter\Runtime\bin\CodeMeterCC.exe [2011-7-6 6904208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 21:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2008-04-15 11:42 70912 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 14:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPUsageTracking]
2007-10-17 14:07 36864 ----a-w- c:\program files\HP\HP UT\bin\hppusg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-01-16 16:22 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 12:28 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
2008-09-29 06:07 124240 ----a-w- c:\program files\McAfee\VirusScan Enterprise\shstat.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2008-03-25 02:28 144784 ----a-w- c:\program files\Java\jre1.6.0_06\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToolBoxFX]
2008-02-20 11:31 53248 ----a-w- c:\program files\HP\ToolboxFX\bin\HPTLBXFX.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2007-12-24 13:55 222504 ------w- c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-12-01 15:51 328056 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe [2008-06-27 77824]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
Inhoud van de 'Gedeelde Taken' map
.
2012-04-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 08:32]
.
2012-04-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 08:32]
.
.
------- Bijkomende Scan -------
.
uStart Page = hxxp://www.facebook.com/?ref=hp
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=nl_be&c=83&bd=Pavilion&pf=cnnb
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 195.130.131.130 195.130.130.2
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\10.2.0\ViProtocol.dll
.
- - - - ORPHANS VERWIJDERD - - - -
.
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
MSConfigStartUp-AppleSyncNotifier - c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
MSConfigStartUp-DivXUpdate - c:\program files\DivX\DivX Update\DivXUpdate.exe
MSConfigStartUp-HPPQVideo - c:\program files\HP\ScheduledLaunch\HP Color LaserJet CP2020 Series\bin\hppschlnch.exe -r SOFTWARE\Hewlett-Packard\ScheduledLaunch\CLJ_CP2020_Series -f PQOptimizerVideo.xml
MSConfigStartUp-LightScribe Control Panel - c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-Authorizer_is1 - c:\program files\Propellerhead\Authorizer\Uninstall Authorizer\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-04-10 19:44
Windows 6.0.6001 Service Pack 1 NTFS
.
scannen van verborgen processen ...
.
scannen van verborgen autostart items ...
.
scannen van verborgen bestanden ...
.
Scan succesvol afgerond
verborgen bestanden: 0
.
**************************************************************************
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Voltooingstijd: 2012-04-10 19:48:00
ComboFix-quarantined-files.txt 2012-04-10 17:47
.
Pre-Run: 95.264.096.256 bytes beschikbaar
Post-Run: 96.919.449.600 bytes beschikbaar
.
- - End Of File - - D6132EA9D967B4B80DEE0B2DC5C3DDD3

Even terzijde, laptop is hiernet tijdens het opstarten blijven hangen op het HP opstartscherm, tweede keer opstarten lukte wel maar datum en uur zijn veranderd naar 31/12/00 en 23.00... Maar hij is wel minder traag!

Ik zie meerdere gebruikers ( Sara / Tom ) !

GenericAskToolbar kan je verwijderen via software.

Download TDSSKStarter naar het bureaublad.

"TDSSKStarter.exe" gebruiken:

• Sluit nu eerst alle nog openstaande programmavensters!
  • Windows 2000 en Windows XP: start het tool middels dubbelklik op "TDSSKStarter.exe".
  • Windows Vista en Windows 7: start het tool middels rechtsklik op "TDSSKStarter.exe" en dan kiezen voor Als Administrator uitvoeren.
• Vervolgens zal een CMD-venster gestart worden en wanneer de scan gereed is weer automatisch sluiten.
• Post nu de inhoud van het geopende kladblokbestand in het volgende bericht.

Inderdaad, Maar 'Tom' gebruikt de laptop sporadisch, hoogstens enkele keren per maand en enkel om muziek te beluisteren en films te bekijken, niets schadelijk (hopelijk)...

GenericAskToolbar is blijkbaar niet te vinden bij software...


23:34:39.0135 5924 TDSS rootkit removing tool 2.7.28.0 Apr 10 2012 16:54:05
23:34:39.0137 5924 ============================================================
23:34:39.0137 5924 Current date / time: 2000/12/31 23:34:39.0137
23:34:39.0137 5924 SystemInfo:
23:34:39.0137 5924
23:34:39.0137 5924 OS Version: 6.0.6001 ServicePack: 1.0
23:34:39.0137 5924 Product type: Workstation
23:34:39.0137 5924 ComputerName: PC_VAN_SARA
23:34:39.0137 5924 UserName: sara
23:34:39.0137 5924 Windows directory: C:\Windows
23:34:39.0137 5924 System windows directory: C:\Windows
23:34:39.0137 5924 Processor architecture: Intel x86
23:34:39.0137 5924 Number of processors: 2
23:34:39.0137 5924 Page size: 0x1000
23:34:39.0137 5924 Boot type: Normal boot
23:34:39.0137 5924 ============================================================
23:34:43.0778 5924 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
23:34:43.0785 5924 \Device\Harddisk0\DR0:
23:34:43.0802 5924 MBR used
23:34:43.0802 5924 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1BED77C1
23:34:43.0802 5924 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1BED7800, BlocksNum 0x12EC800
23:34:44.0012 5924 Initialize success
23:34:44.0012 5924 ============================================================
23:34:44.0066 4976 ============================================================
23:34:44.0066 4976 Scan started
23:34:44.0066 4976 Mode: Auto (DCExact ); SigCheck; TDLFS; Silent;
23:34:44.0066 4976 ============================================================
23:34:47.0774 4976 Accelerometer (3b10711ad8656c097e0d16a41b29c54c) C:\Windows\system32\DRIVERS\Accelerometer.sys
23:34:48.0440 4976 ACPI (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
23:34:48.0851 4976 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
23:34:49.0474 4976 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
23:34:50.0020 4976 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
23:34:50.0525 4976 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
23:34:51.0197 4976 AeLookupSvc (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
23:34:52.0340 4976 AESTFilters (3b1b2ee9df189f6bbb080bf393d1b2ee) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\aestsrv.exe
23:34:52.0714 4976 AFD (48eb99503533c27ac6135648e5474457) C:\Windows\system32\drivers\afd.sys
23:34:53.0340 4976 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
23:34:53.0705 4976 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
23:34:54.0025 4976 ALG (a1545b731579895d8cc44fc0481c1192) C:\Windows\System32\alg.exe
23:34:54.0301 4976 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
23:34:54.0963 4976 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
23:34:55.0657 4976 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
23:34:55.0928 4976 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
23:34:56.0453 4976 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
23:34:56.0682 4976 Appinfo (c6d704c7f0434dc791aac37cac4b6e14) C:\Windows\System32\appinfo.dll
23:34:56.0864 4976 Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
23:34:57.0273 4976 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
23:34:57.0697 4976 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
23:34:58.0071 4976 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
23:34:58.0573 4976 atapi (0d83c87a801a3dfcd1bf73893fe7518c) C:\Windows\system32\drivers\atapi.sys
23:34:58.0805 4976 AudioEndpointBuilder (42076e29aafa0830a2c5d4e310f58dd1) C:\Windows\System32\Audiosrv.dll
23:34:58.0925 4976 Audiosrv (42076e29aafa0830a2c5d4e310f58dd1) C:\Windows\System32\Audiosrv.dll
23:34:59.0439 4976 BCM43XV (8c74f7814028140c9518d2b59f9410b6) C:\Windows\system32\DRIVERS\bcmwl6.sys
23:35:00.0516 4976 BCM43XX (8c74f7814028140c9518d2b59f9410b6) C:\Windows\system32\DRIVERS\bcmwl6.sys
23:35:01.0114 4976 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
23:35:01.0449 4976 BFE (8582e233c346aefe759833e8a30dd697) C:\Windows\System32\bfe.dll
23:35:02.0471 4976 BITS (02ed7b4dbc2a3232a389106da7515c3d) C:\Windows\system32\qmgr.dll
23:35:03.0247 4976 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
23:35:05.0166 4976 bowser (8153396d5551276227fa146900f734e6) C:\Windows\system32\DRIVERS\bowser.sys
23:35:06.0066 4976 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
23:35:06.0687 4976 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
23:35:06.0942 4976 Browser (a3629a0c4226f9e9c72faaeebc3ad33c) C:\Windows\System32\browser.dll
23:35:07.0545 4976 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
23:35:08.0269 4976 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
23:35:08.0829 4976 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
23:35:09.0313 4976 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
23:35:09.0827 4976 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
23:35:11.0215 4976 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
23:35:11.0833 4976 cdrom (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
23:35:12.0237 4976 CertPropSvc (87c2d0377b23e2d8a41093c2f5fb1a5b) C:\Windows\System32\certprop.dll
23:35:12.0590 4976 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
23:35:12.0816 4976 CLFS (0703b9dee7eec6d6370edebd43d0f5c2) C:\Windows\system32\CLFS.sys
23:35:13.0248 4976 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:35:13.0571 4976 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:35:13.0871 4976 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
23:35:14.0228 4976 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
23:35:14.0879 4976 CodeMeter.exe (1c15404ea8fc42dab8a7b3765ed53e58) C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe
23:35:15.0656 4976 Com4QLBEx (a94146208170d78906c93ee39cebdd9f) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
23:35:15.0927 4976 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
23:35:16.0120 4976 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
23:35:16.0551 4976 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
23:35:17.0463 4976 CryptSvc (6de363f9f99334514c46aec02d3e3678) C:\Windows\system32\cryptsvc.dll
23:35:18.0161 4976 DcomLaunch (301ae00e12408650baddc04dbc832830) C:\Windows\system32\rpcss.dll
23:35:18.0521 4976 DfsC (a3e9fa213f443ac77c7746119d13feec) C:\Windows\system32\Drivers\dfsc.sys
23:35:19.0363 4976 DFSR (fa3463f25f9cc9c3bcf1e7912feff099) C:\Windows\system32\DFSR.exe
23:35:21.0195 4976 Dhcp (43a988a9c10333476cb5fb667cbd629d) C:\Windows\System32\dhcpcsvc.dll
23:35:21.0343 4976 disk (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
23:35:21.0439 4976 Dnscache (4805d9a6d281c7a7defd9094dec6af7d) C:\Windows\System32\dnsrslvr.dll
23:35:21.0720 4976 dot3svc (5af620a08c614e24206b79e8153cf1a8) C:\Windows\System32\dot3svc.dll
23:35:21.0911 4976 DPS (a622e888f8aa2f6b49e9bc466f0e5def) C:\Windows\system32\dps.dll
23:35:22.0243 4976 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
23:35:22.0436 4976 DXGKrnl (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
23:35:22.0797 4976 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
23:35:23.0108 4976 EapHost (c0b95e40d85cd807d614e264248a45b9) C:\Windows\System32\eapsvc.dll
23:35:23.0535 4976 Ecache (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
23:35:23.0797 4976 ehRecvr (9be3744d295a7701eb425332014f0797) C:\Windows\ehome\ehRecvr.exe
23:35:23.0978 4976 ehSched (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe
23:35:24.0244 4976 ehstart (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll
23:35:24.0500 4976 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
23:35:24.0992 4976 EMDMgmt (70b1a86df0c8ead17d2bc332edae2c7c) C:\Windows\system32\emdmgmt.dll
23:35:25.0352 4976 enecir (4cd6b056c5fd9e97c06fe74c81479517) C:\Windows\system32\DRIVERS\enecir.sys
23:35:25.0783 4976 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
23:35:25.0895 4976 EventSystem (3cb3343d720168b575133a0a20dc2465) C:\Windows\system32\es.dll
23:35:26.0088 4976 exfat (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
23:35:26.0254 4976 ezSharedSvc (42f721c52eef2d6df9372a53813a83ef) C:\Windows\System32\ezsvc7.dll
23:35:26.0447 4976 ezSharedSvc ( UnsignedFile.Multi.Generic ) - warning
23:35:26.0447 4976 ezSharedSvc - detected UnsignedFile.Multi.Generic (1)
23:35:26.0539 4976 fastfat (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
23:35:26.0703 4976 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
23:35:26.0870 4976 fdPHost (6629b5f0e98151f4afdd87567ea32ba3) C:\Windows\system32\fdPHost.dll
23:35:26.0972 4976 FDResPub (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
23:35:27.0191 4976 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
23:35:27.0246 4976 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
23:35:27.0344 4976 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
23:35:27.0533 4976 FltMgr (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
23:35:27.0645 4976 FontCache3.0.0.0 (c9be08664611ddaf98e2331e9288b00b) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
23:35:27.0778 4976 fssfltr (b74b0578fd1d3f897e95f2a2b69ea051) C:\Windows\system32\DRIVERS\fssfltr.sys
23:35:28.0029 4976 fsssvc (45b52394f9624237f33a8a3d73c0b221) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
23:35:28.0426 4976 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
23:35:28.0511 4976 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
23:35:28.0580 4976 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
23:35:28.0855 4976 gpsvc (d9f1113d9401185245573350712f92fc) C:\Windows\System32\gpsvc.dll
23:35:29.0572 4976 gupdate (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe
23:35:29.0766 4976 gupdatem (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files\Google\Update\GoogleUpdate.exe
23:35:30.0423 4976 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
23:35:30.0857 4976 HDAudBus (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
23:35:31.0055 4976 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
23:35:31.0297 4976 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
23:35:31.0428 4976 hidserv (8fa640195279ace21bea91396a0054fc) C:\Windows\System32\hidserv.dll
23:35:31.0760 4976 HidUsb (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
23:35:31.0951 4976 hkmsvc (d8ad255b37da92434c26e4876db7d418) C:\Windows\system32\kmsvc.dll
23:35:32.0118 4976 HP Health Check Service (d13e6bfd7e9189d26a42e94cb2447044) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
23:35:32.0140 4976 HP Health Check Service ( UnsignedFile.Multi.Generic ) - warning
23:35:32.0140 4976 HP Health Check Service - detected UnsignedFile.Multi.Generic (1)
23:35:32.0213 4976 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
23:35:32.0326 4976 hpdskflt (24f3f496c18efc234777723a67a85f81) C:\Windows\system32\DRIVERS\hpdskflt.sys
23:35:32.0583 4976 HpqKbFiltr (35956140e686d53bf676cf0c778880fc) C:\Windows\system32\DRIVERS\HpqKbFiltr.sys
23:35:32.0833 4976 hpqwmiex (d50fdad1e57aa60f1973cfc77d905f0e) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
23:35:33.0065 4976 HPSLPSVC (14229263aa19c704e0d6d2e7404a8455) C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL
23:35:33.0127 4976 HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
23:35:33.0127 4976 HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
23:35:33.0268 4976 hpsrv (6d0ac28c5bd8d8495f83f5929a45e559) C:\Windows\system32\Hpservice.exe
23:35:33.0456 4976 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
23:35:33.0803 4976 HSF_DPV (ec36f1d542ed4252390d446bf6d4dfd0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
23:35:34.0262 4976 HTTP (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
23:35:34.0556 4976 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
23:35:34.0662 4976 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
23:35:34.0814 4976 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
23:35:34.0974 4976 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
23:35:35.0030 4976 IDriverT ( UnsignedFile.Multi.Generic ) - warning
23:35:35.0031 4976 IDriverT - detected UnsignedFile.Multi.Generic (1)
23:35:35.0235 4976 idsvc (7b630acaed64fef0c3e1cf255cb56686) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
23:35:35.0472 4976 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
23:35:35.0583 4976 IKEEXT (a3bc480a2bf8aa8e4dabd2d5dce0afac) C:\Windows\System32\ikeext.dll
23:35:35.0872 4976 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
23:35:36.0008 4976 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
23:35:36.0165 4976 IPBusEnum (9ac218c6e6105477484c6fdbe7d409a4) C:\Windows\system32\ipbusenum.dll
23:35:36.0289 4976 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:35:36.0487 4976 iphlpsvc (6a35d233693edc29a12742049bc5e37f) C:\Windows\System32\iphlpsvc.dll
23:35:36.0672 4976 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
23:35:36.0779 4976 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
23:35:36.0914 4976 iPod Service (49918803b661367023bf325cf602afdc) C:\Program Files\iPod\bin\iPodService.exe
23:35:37.0127 4976 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
23:35:37.0255 4976 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
23:35:37.0471 4976 iScsiPrt (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
23:35:37.0606 4976 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
23:35:37.0716 4976 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
23:35:37.0825 4976 JMCR (da971cfc625d13636e04c405948e9d62) C:\Windows\system32\DRIVERS\jmcr.sys
23:35:38.0142 4976 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
23:35:38.0383 4976 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
23:35:38.0618 4976 KeyIso (a911ecac81f94adeafbe8e3f7873edb0) C:\Windows\system32\lsass.exe
23:35:38.0966 4976 KSecDD (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
23:35:39.0253 4976 KtmRm (8078f8f8f7a79e2e6b494523a828c585) C:\Windows\system32\msdtckrm.dll
23:35:39.0466 4976 LanmanServer (1925e63c91cf1610ae41bfd539062079) C:\Windows\System32\srvsvc.dll
23:35:39.0834 4976 LanmanWorkstation (2ae2e1628c5d3f1c0a46a67c9fa1df15) C:\Windows\System32\wkssvc.dll
23:35:40.0510 4976 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
23:35:40.0668 4976 lltdsvc (2d5a428872f1442631d0959a34abff63) C:\Windows\System32\lltdsvc.dll
23:35:40.0806 4976 lmhosts (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
23:35:40.0949 4976 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
23:35:40.0983 4976 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
23:35:41.0014 4976 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
23:35:41.0157 4976 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
23:35:41.0272 4976 McAfeeEngineService (c3d7e3dcc470d0a5230a485549f21908) C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
23:35:41.0399 4976 McAfeeFramework (4cd3ee64736b4d156dac5c1d6eb60c24) C:\Program Files\McAfee\Common Framework\FrameworkService.exe
23:35:41.0515 4976 McShield (291adfcb72658349a929b903bc47f8ea) C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
23:35:41.0644 4976 McTaskManager (9df3a434657512b31549f8d20affad5f) C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
23:35:41.0860 4976 Mcx2Svc (aef9babb8a506bc4ce0451a64aaded46) C:\Windows\system32\Mcx2Svc.dll
23:35:42.0131 4976 MDM (7cf1b716372b89568ae4c0fe769f5869) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
23:35:42.0217 4976 MDM ( UnsignedFile.Multi.Generic ) - warning
23:35:42.0217 4976 MDM - detected UnsignedFile.Multi.Generic (1)
23:35:42.0452 4976 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
23:35:42.0583 4976 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
23:35:42.0766 4976 mfeapfk (d0813cf480e3d38a265f3be86522bf3b) C:\Windows\system32\drivers\mfeapfk.sys
23:35:43.0163 4976 mfeavfk (04440cc0f5f89933babd585cc5f2f70e) C:\Windows\system32\drivers\mfeavfk.sys
23:35:43.0379 4976 mfebopk (f6e257c31e0c354a2ed22bf5026c2466) C:\Windows\system32\drivers\mfebopk.sys
23:35:43.0750 4976 mfehidk (79fae8ce9a478f79b74873a810c8227e) C:\Windows\system32\drivers\mfehidk.sys
23:35:44.0162 4976 mferkdet (f21bf10a3784e52eec925bb5f7d3fffa) C:\Windows\system32\drivers\mferkdet.sys
23:35:44.0580 4976 mfetdik (f2d4d0f8e230257a0be36df803b549d1) C:\Windows\system32\drivers\mfetdik.sys
23:35:44.0835 4976 mfevtp (b87b41f2c05788f04a3b487902803fd2) C:\Windows\system32\mfevtps.exe
23:35:44.0965 4976 MMCSS (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
23:35:45.0193 4976 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
23:35:45.0448 4976 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
23:35:45.0648 4976 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
23:35:45.0728 4976 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
23:35:46.0003 4976 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
23:35:46.0222 4976 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
23:35:46.0367 4976 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
23:35:46.0608 4976 MpsSvc (d1639ba315b0d79dec49a4b0e1fb929b) C:\Windows\system32\mpssvc.dll
23:35:46.0857 4976 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
23:35:47.0036 4976 MRxDAV (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
23:35:47.0236 4976 mrxsmb (5734a0f2be7e495f7d3ed6efd4b9f5a1) C:\Windows\system32\DRIVERS\mrxsmb.sys
23:35:47.0603 4976 mrxsmb10 (6b5fa5adfacac9dbbe0991f4566d7d55) C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:35:47.0985 4976 mrxsmb20 (5c80d8159181c7abf1b14ba703b01e0b) C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:35:48.0225 4976 msahci (f70590424eefbf5c27a40c67afdb8383) C:\Windows\system32\drivers\msahci.sys
23:35:48.0706 4976 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
23:35:48.0861 4976 MSDTC (fd7520cc3a80c5fc8c48852bb24c6ded) C:\Windows\System32\msdtc.exe
23:35:49.0022 4976 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
23:35:49.0242 4976 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
23:35:49.0314 4976 MSiSCSI (85466c0757a23d9a9aecdc0755203cb2) C:\Windows\system32\iscsiexe.dll
23:35:49.0555 4976 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
23:35:49.0780 4976 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
23:35:49.0863 4976 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
23:35:49.0967 4976 MsRPC (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
23:35:50.0090 4976 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
23:35:50.0142 4976 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
23:35:50.0218 4976 Mup (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
23:35:50.0307 4976 napagent (c43b25863fbd65b6d2a142af3ae320ca) C:\Windows\system32\qagentRT.dll
23:35:50.0510 4976 NativeWifiP (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
23:35:50.0843 4976 NDIS (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
23:35:50.0937 4976 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
23:35:51.0115 4976 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
23:35:51.0228 4976 NdisWan (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
23:35:51.0371 4976 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
23:35:51.0549 4976 Net Driver HPZ12 (2969d26eee289be7422aa46fc55f4e38) C:\Windows\system32\HPZinw12.dll
23:35:51.0642 4976 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
23:35:51.0642 4976 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
23:35:51.0696 4976 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
23:35:52.0055 4976 netbt (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
23:35:52.0240 4976 Netlogon (a911ecac81f94adeafbe8e3f7873edb0) C:\Windows\system32\lsass.exe
23:35:52.0426 4976 Netman (c8052711daecc48b982434c5116ca401) C:\Windows\System32\netman.dll
23:35:52.0730 4976 netprofm (2ef3bbe22e5a5acd1428ee387a0d0172) C:\Windows\System32\netprofm.dll
23:35:52.0928 4976 NetTcpPortSharing (0ad5876ef4e9eb77c8f93eb5b2fff386) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
23:35:53.0086 4976 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
23:35:53.0468 4976 NlaSvc (2997b15415f9bbe05b5a4c1c85e0c6a2) C:\Windows\System32\nlasvc.dll
23:35:53.0733 4976 Npfs (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
23:35:53.0957 4976 nsi (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:\Windows\system32\nsisvc.dll
23:35:54.0085 4976 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
23:35:54.0283 4976 Ntfs (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
23:35:54.0492 4976 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
23:35:54.0578 4976 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
23:35:54.0738 4976 NVENETFD (1657f3fbd9061526c14ff37e79306f98) C:\Windows\system32\DRIVERS\nvm60x32.sys
23:35:54.0881 4976 NVHDA (f972dc046c374a9e02f2dfbe74ebb203) C:\Windows\system32\drivers\nvhda32v.sys
23:35:55.0920 4976 nvlddmkm (6c1c07916a4fed3e26bf399f07370986) C:\Windows\system32\DRIVERS\nvlddmkm.sys
23:35:56.0547 4976 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
23:35:56.0750 4976 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
23:35:56.0870 4976 nvsvc (029df21eb9fc3ff0d628278774c99dc0) C:\Windows\system32\nvvsvc.exe
23:35:56.0993 4976 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
23:35:57.0375 4976 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
23:35:57.0732 4976 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
23:35:58.0061 4976 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
23:35:58.0316 4976 p2pimsvc (5de1a3972fd3112c75eb17bdcf454169) C:\Windows\system32\p2psvc.dll
23:35:58.0483 4976 p2psvc (5de1a3972fd3112c75eb17bdcf454169) C:\Windows\system32\p2psvc.dll
23:35:58.0711 4976 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
23:35:58.0872 4976 partmgr (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
23:35:59.0222 4976 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
23:35:59.0560 4976 PcaSvc (c6276ad11f4bb49b58aa1ed88537f14a) C:\Windows\System32\pcasvc.dll
23:35:59.0875 4976 pci (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
23:36:00.0062 4976 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
23:36:00.0297 4976 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
23:36:00.0538 4976 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
23:36:00.0914 4976 pla (b1689df169143f57053f795390c99db3) C:\Windows\system32\pla.dll
23:36:01.0212 4976 PlugPlay (78f975cb6d18265be6f492edb2d7bc7b) C:\Windows\system32\umpnpmgr.dll

23:36:01.0354 4976 Pml Driver HPZ12 (bafc9706bdf425a02b66468ab2605c59) C:\Windows\system32\HPZipm12.dll
23:36:01.0483 4976 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
23:36:01.0483 4976 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
23:36:01.0738 4976 PNRPAutoReg (5de1a3972fd3112c75eb17bdcf454169) C:\Windows\system32\p2psvc.dll
23:36:01.0807 4976 PNRPsvc (5de1a3972fd3112c75eb17bdcf454169) C:\Windows\system32\p2psvc.dll
23:36:02.0112 4976 PolicyAgent (47b8f37aa18b74d8c2e1bc1a7a2c8f8a) C:\Windows\System32\ipsecsvc.dll
23:36:02.0441 4976 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
23:36:02.0802 4976 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
23:36:03.0048 4976 ProfSvc (b627e4fc8585e8843c5905d4d3587a90) C:\Windows\system32\profsvc.dll
23:36:03.0161 4976 ProtectedStorage (a911ecac81f94adeafbe8e3f7873edb0) C:\Windows\system32\lsass.exe
23:36:03.0318 4976 PSched (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
23:36:03.0631 4976 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
23:36:04.0056 4976 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
23:36:04.0291 4976 QPCapSvc (26f65f22527515990532209baff78dea) C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
23:36:04.0435 4976 QPSched (511e9ddc22a63e5109c7f221f85deb3d) C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
23:36:04.0716 4976 QWAVE (e9ecae663f47e6cb43962d18ab18890f) C:\Windows\system32\qwave.dll
23:36:04.0980 4976 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
23:36:05.0315 4976 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
23:36:05.0619 4976 RasAuto (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:\Windows\System32\rasauto.dll
23:36:05.0803 4976 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
23:36:06.0138 4976 RasMan (6e7c284fc5c4ec07ad164d93810385a6) C:\Windows\System32\rasmans.dll
23:36:06.0335 4976 RasPppoe (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
23:36:06.0597 4976 RasSstp (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
23:36:06.0701 4976 rdbss (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
23:36:06.0912 4976 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
23:36:07.0116 4976 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
23:36:07.0246 4976 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
23:36:07.0511 4976 RDPWD (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
23:36:07.0677 4976 Recovery Service for Windows (431723f23d0e065bef502389e8ffdc10) C:\Windows\SMINST\BLService.exe
23:36:07.0839 4976 RemoteAccess (bcdd6b4804d06b1f7ebf29e53a57ece9) C:\Windows\System32\mprdim.dll
23:36:08.0011 4976 RemoteRegistry (cc4e32400f3c7253400cf8f3f3a0b676) C:\Windows\system32\regsvc.dll
23:36:08.0206 4976 RpcLocator (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
23:36:08.0501 4976 RpcSs (301ae00e12408650baddc04dbc832830) C:\Windows\system32\rpcss.dll
23:36:08.0756 4976 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
23:36:08.0931 4976 RTL8169 (2fc33077f85d7dc0d03678c06d43898c) C:\Windows\system32\DRIVERS\Rtlh86.sys
23:36:09.0098 4976 s1039bus (d259d085f215b57b7170dc2d0b646b2a) C:\Windows\system32\DRIVERS\s1039bus.sys
23:36:09.0393 4976 s1039mdfl (4d2b6621b5913e8b1cbb650a6037b8a2) C:\Windows\system32\DRIVERS\s1039mdfl.sys
23:36:09.0678 4976 s1039mdm (8149799844ab2e91ea92e9cad4224254) C:\Windows\system32\DRIVERS\s1039mdm.sys
23:36:10.0014 4976 s1039mgmt (5e91068b3f5e003b83d8a99dc0c76e2c) C:\Windows\system32\DRIVERS\s1039mgmt.sys
23:36:10.0298 4976 s1039nd5 (df54dbf1c4105d2074d07929f6ba91aa) C:\Windows\system32\DRIVERS\s1039nd5.sys
23:36:10.0590 4976 s1039obex (1bc084b0708d42e29e2222346149e52f) C:\Windows\system32\DRIVERS\s1039obex.sys
23:36:10.0924 4976 s1039unic (2e8ccb7bf5b1eb34bcf4ebf880b3e11c) C:\Windows\system32\DRIVERS\s1039unic.sys
23:36:11.0250 4976 SamSs (a911ecac81f94adeafbe8e3f7873edb0) C:\Windows\system32\lsass.exe
23:36:11.0361 4976 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
23:36:11.0503 4976 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
23:36:11.0741 4976 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
23:36:11.0882 4976 SCardSvr (11387e32642269c7e62e8b52c060b3c6) C:\Windows\System32\SCardSvr.dll
23:36:12.0077 4976 SCDEmu (52402149e66200c2c2bda115bca757d6) C:\Windows\system32\drivers\SCDEmu.sys
23:36:12.0379 4976 Schedule (7b587b8a6d4a99f79d2902d0385f29bd) C:\Windows\system32\schedsvc.dll
23:36:12.0545 4976 SCPolicySvc (87c2d0377b23e2d8a41093c2f5fb1a5b) C:\Windows\System32\certprop.dll
23:36:12.0662 4976 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
23:36:12.0791 4976 SDRSVC (716313d9f6b0529d03f726d5aaf6f191) C:\Windows\System32\SDRSVC.dll
23:36:12.0992 4976 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
23:36:13.0125 4976 seclogon (fd5199d4d8a521005e4b5ee7fe00fa9b) C:\Windows\system32\seclogon.dll
23:36:13.0193 4976 SENS (a9bbab5759771e523f55563d6cbe140f) C:\Windows\system32\sens.dll
23:36:13.0325 4976 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
23:36:13.0571 4976 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
23:36:13.0753 4976 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
23:36:13.0969 4976 SessionEnv (d2193326f729b163125610dbf3e17d57) C:\Windows\system32\sessenv.dll
23:36:14.0133 4976 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
23:36:14.0287 4976 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
23:36:14.0448 4976 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
23:36:14.0801 4976 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
23:36:14.0880 4976 SharedAccess (e1499bd0ff76b1b2fbbf1af339d91165) C:\Windows\System32\ipnathlp.dll
23:36:15.0169 4976 ShellHWDetection (1e3fdb80e40a3ce645f229dfbdfb7694) C:\Windows\System32\shsvcs.dll
23:36:15.0352 4976 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
23:36:15.0495 4976 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
23:36:15.0584 4976 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
23:36:15.0745 4976 slsvc (0ba91e1358ad25236863039bb2609a2e) C:\Windows\system32\SLsvc.exe
23:36:16.0165 4976 SLUINotify (7c6dc44ca0bfa6291629ab764200d1d4) C:\Windows\system32\SLUINotify.dll
23:36:16.0350 4976 Smb (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
23:36:16.0526 4976 SNMPTRAP (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
23:36:16.0810 4976 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
23:36:16.0951 4976 Spooler (3665f79026a3f91fbca63f2c65a09b19) C:\Windows\System32\spoolsv.exe
23:36:17.0391 4976 srv (2252aef839b1093d16761189f45af885) C:\Windows\system32\DRIVERS\srv.sys
23:36:17.0975 4976 srv2 (b7ff59408034119476b00a81bb53d5d1) C:\Windows\system32\DRIVERS\srv2.sys
23:36:18.0317 4976 srvnet (2accc9b12af02030f531e6cca6f8b76e) C:\Windows\system32\DRIVERS\srvnet.sys
23:36:18.0750 4976 SSDPSRV (03d50b37234967433a5ea5ba72bc0b62) C:\Windows\System32\ssdpsrv.dll
23:36:19.0000 4976 SstpSvc (6f1a32e7b7b30f004d9a20afadb14944) C:\Windows\system32\sstpsvc.dll
23:36:19.0300 4976 STacSV (ec9c5f6c0f58446545d839bc11a3692b) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe
23:36:19.0546 4976 STHDA (21cc262ab5f42f7a6b91dc7304c2f267) C:\Windows\system32\DRIVERS\stwrt.sys
23:36:19.0935 4976 StillCam (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys
23:36:20.0167 4976 stisvc (7dd08a597bc56051f320da0baf69e389) C:\Windows\System32\wiaservc.dll
23:36:20.0368 4976 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
23:36:20.0545 4976 swprv (b36c7cdb86f7f7a8e884479219766950) C:\Windows\System32\swprv.dll
23:36:20.0740 4976 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
23:36:20.0930 4976 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
23:36:21.0097 4976 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
23:36:21.0195 4976 SynTP (bf7aa84d5af0faa0978c840e63b17dbf) C:\Windows\system32\DRIVERS\SynTP.sys
23:36:21.0587 4976 SysMain (8710a92d0024b03b5fb9540df1f71f1d) C:\Windows\system32\sysmain.dll
23:36:21.0850 4976 TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
23:36:22.0006 4976 TapiSrv (680916bb09ee0f3a6aca7c274b0d633f) C:\Windows\System32\tapisrv.dll
23:36:22.0180 4976 TBS (cb05822cd9cc6c688168e113c603dbe7) C:\Windows\System32\tbssvc.dll
23:36:22.0372 4976 Tcpip (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
23:36:22.0699 4976 Tcpip6 (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
23:36:22.0864 4976 tcpipreg (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
23:36:23.0254 4976 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
23:36:23.0470 4976 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
23:36:23.0685 4976 tdx (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
23:36:23.0883 4976 TermDD (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
23:36:24.0116 4976 TermService (d605031e225aaccbceb5b76a4f1603a6) C:\Windows\System32\termsrv.dll
23:36:24.0292 4976 Themes (1e3fdb80e40a3ce645f229dfbdfb7694) C:\Windows\system32\shsvcs.dll
23:36:24.0508 4976 THREADORDER (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
23:36:24.0696 4976 TrkWks (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:\Windows\System32\trkwks.dll
23:36:24.0916 4976 TrustedInstaller (16613a1bad034d4ecf957af18b7c2ff5) C:\Windows\servicing\TrustedInstaller.exe
23:36:25.0097 4976 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
23:36:25.0329 4976 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
23:36:25.0568 4976 tunnel (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS\tunnel.sys
23:36:25.0823 4976 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
23:36:26.0078 4976 udfs (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
23:36:26.0261 4976 UI0Detect (ecef404f62863755951e09c802c94ad5) C:\Windows\system32\UI0Detect.exe
23:36:26.0470 4976 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
23:36:26.0599 4976 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
23:36:26.0820 4976 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
23:36:26.0912 4976 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
23:36:27.0024 4976 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
23:36:27.0145 4976 upnphost (68308183f4ae0be7bf8ecd07cb297999) C:\Windows\System32\upnphost.dll
23:36:27.0375 4976 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys
23:36:27.0683 4976 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
23:36:27.0911 4976 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
23:36:28.0044 4976 usbehci (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
23:36:28.0240 4976 usbhub (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
23:36:28.0583 4976 usbohci (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys
23:36:29.0120 4976 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
23:36:29.0500 4976 USBSTOR (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:36:29.0858 4976 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
23:36:30.0214 4976 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
23:36:30.0654 4976 UxSms (032a0acc3909ae7215d524e29d536797) C:\Windows\System32\uxsms.dll
23:36:30.0915 4976 vds (b13bc395b9d6116628f5af47e0802ac4) C:\Windows\System32\vds.exe
23:36:31.0162 4976 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
23:36:31.0378 4976 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
23:36:31.0590 4976 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
23:36:31.0711 4976 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
23:36:31.0861 4976 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
23:36:31.0944 4976 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
23:36:32.0208 4976 volmgrx (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
23:36:32.0488 4976 volsnap (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
23:36:33.0067 4976 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
23:36:33.0481 4976 VSS (d5fb73d19c46ade183f968e13f186b23) C:\Windows\system32\vssvc.exe
23:36:33.0888 4976 vToolbarUpdater10.2.0 (3080f1f093869a19fb3d1f0226c73809) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.2.0\ToolbarUpdater.exe
23:36:34.0133 4976 W32Time (1cf9206966a8458cda9a8b20df8ab7d3) C:\Windows\system32\w32time.dll
23:36:34.0614 4976 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
23:36:34.0807 4976 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
23:36:34.0975 4976 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
23:36:35.0296 4976 wcncsvc (f3a5c2e1a6533192b070d06ecf6be796) C:\Windows\System32\wcncsvc.dll
23:36:35.0623 4976 WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
23:36:35.0812 4976 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
23:36:35.0899 4976 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
23:36:36.0156 4976 WdiServiceHost (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
23:36:36.0261 4976 WdiSystemHost (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
23:36:36.0517 4976 WebClient (cf9a5f41789b642db967021de06a2713) C:\Windows\System32\webclnt.dll
23:36:36.0813 4976 Wecsvc (ae3736e7e8892241c23e4ebbb7453b60) C:\Windows\system32\wecsvc.dll
23:36:37.0035 4976 wercplsupport (670ff720071ed741206d69bd995ea453) C:\Windows\System32\wercplsupport.dll
23:36:37.0198 4976 WerSvc (fd1965aaa112c6818a30ab02742d0461) C:\Windows\System32\WerSvc.dll
23:36:37.0354 4976 winachsf (5c7bdcf5864db00323fe2d90fa26a8a2) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
23:36:37.0672 4976 WinDefend (4575aa12561c5648483403541d0d7f2b) C:\Program Files\Windows Defender\mpsvc.dll
23:36:37.0926 4976 Winmgmt (00b79a7c984678f24cf052e5beb3a2f5) C:\Windows\system32\wbem\WMIsvc.dll
23:36:38.0343 4976 WinRM (7cfe68bdc065e55aa5e8421607037511) C:\Windows\system32\WsmSvc.dll
23:36:38.0633 4976 Wlansvc (275f4346e569df56cfb95243bd6f6ff0) C:\Windows\System32\wlansvc.dll
23:36:38.0910 4976 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
23:36:39.0226 4976 wmiApSrv (aba4cf9f856d9a3a25f4ddd7690a6e9d) C:\Windows\system32\wbem\WmiApSrv.exe
23:36:39.0607 4976 WMPNetworkSvc (3978704576a121a9204f8cc49a301a9b) C:\Program Files\Windows Media Player\wmpnetwk.exe
23:36:39.0840 4976 WPCSvc (5d94cd167751294962ba238d82dd1bb8) C:\Windows\System32\wpcsvc.dll
23:36:39.0991 4976 WPDBusEnum (396d406292b0cd26e3504ffe82784702) C:\Windows\system32\wpdbusenum.dll
23:36:40.0375 4976 WpdUsb (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys
23:36:40.0704 4976 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
23:36:40.0881 4976 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
23:36:41.0019 4976 wscsvc (683dd16b590372f2c9661d277f35e49c) C:\Windows\system32\wscsvc.dll
23:36:41.0156 4976 WSDPrintDevice (4422ac5ed8d4c2f0db63e71d4c069dd7) C:\Windows\system32\DRIVERS\WSDPrint.sys
23:36:41.0405 4976 wuauserv (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll
23:36:41.0760 4976 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
23:36:41.0898 4976 wudfsvc (575a4190d989f64732119e4114045a4f) C:\Windows\System32\WUDFSvc.dll
23:36:42.0017 4976 MBR (0x1B8) (85d751f0e41b8e520aee8c07a8da777b) \Device\Harddisk0\DR0
23:36:42.0256 4976 Boot (0x1200) (19681b6a001fc27b7dafdb8ed8ce4818) \Device\Harddisk0\DR0\Partition0
23:36:42.0261 4976 Boot (0x1200) (5fc039b6b638b30338063ef2f480cd1e) \Device\Harddisk0\DR0\Partition1
23:36:42.0265 4976 ============================================================
23:36:42.0265 4976 Scan finished
23:36:42.0265 4976 ============================================================
23:36:43.0144 3116 Deinitialize success
.
==============================================
System Restore Point Check:
.
TDSSKiller Starter Restore Point Created Succesfully
==============================================
Registry Export
.
HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\GloballyOpenPorts\List
HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List
==============================================
EOF

Download OTL naar je Bureaublad

• Dubbelklik op OTL.com om het programma te openen. Zorg ervoor dat all andere vensters gesloten zijn, en laat het programma ongestoord zijn werk doen.
• Zet een vinkje bij Scan All Users.
• Klik op de knop Quick Scan. Verander de instellingen van OTL niet, tenzij ik je hiervoor specifiek instructies geef. De scan zal niet heel erg lang duren.
  • Er zullen twee Kladblok-vensters geopend worden wanneer de scan klaar is. OTL.Txt en Extras.Txt. Deze bestanden zijn opgeslagen in dezelfde locatie als OTL.
  • Kopieer (Bewerken->Alles selecteren, Bewerken->Kopiëren) en plak (Bewerken->Alles selecteren, Bewerken->Plakken) de inhoud van deze twee bestanden één voor één in je volgende bericht.

OTL Extras logfile created on: 12/04/2012 17:13:46 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\sara\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000813 | Country: België | Language: NLB | Date Format: d/MM/yyyy

3,00 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 50,56% Memory free
6,22 Gb Paging File | 4,70 Gb Available in Paging File | 75,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 223,42 Gb Total Space | 70,57 Gb Free Space | 31,58% Space Free | Partition Type: NTFS
Drive D: | 9,46 Gb Total Space | 1,69 Gb Free Space | 17,86% Space Free | Partition Type: NTFS
Drive E: | 6,41 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: PC_VAN_SARA | User Name: sara | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe" = C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe:*:Enabled:CodeMeter Runtime Server -- (WIBU-SYSTEMS AG)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{410F6F2C-8081-427F-A3DC-78A7692ED7BD}" = lport=2869 | protocol=6 | dir=in | app=system |
"{843F1894-AEF4-49AF-A5BA-E842B62FF320}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{BC05F2D7-DE10-488F-B396-C416C70448A9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1AEEA392-11C2-4933-84A2-5B151AC86102}" = protocol=17 | dir=in | app=c:\program files\mcafee\common framework\frameworkservice.exe |
"{3609634E-29CA-483C-83EE-1AEF4BAE7ADC}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{3745D3A0-E25F-4E32-BDD5-78E2ADB3436B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{43E68DEC-83C2-495F-8E8C-296BF98FC68D}" = protocol=6 | dir=in | app=c:\program files\codemeter\runtime\bin\codemeter.exe |
"{45975FF3-98DE-44C6-ACC7-0D8C78363786}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{4E71961F-F6F7-41AD-9B2B-0AD90F5DE1B6}" = dir=in | app=c:\program files\hp\quickplay\qp.exe |
"{50FDED15-243C-4539-8E24-21601BB2504B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{529286CE-E874-4F8D-B86F-EF2A5FA9AE15}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{52AC668A-8EC2-44CF-BE9C-CCB2CAACF2A2}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{60937F2B-C0BA-45C3-8826-8BB36C253AAF}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{676C6881-976A-4E88-AAAB-1FD7C7C111F5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{69A8BF41-AF4E-4725-9878-034C4C747552}" = protocol=17 | dir=in | app=c:\windows\system32\spoolsv.exe |
"{6C887A07-0DCB-479B-A9A1-0C0FDEED67CB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{75FAB5A4-128E-46E7-97E1-B0E5C587571A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{87BE492E-2513-4EB0-BFEF-A7D1663F8292}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{9B16C82A-3708-410B-851C-BF2EB2750294}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{A1723490-66AD-4B6F-898F-C6515E0E96F3}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe |
"{AE516235-3421-48DD-B4D7-A4DAAC7A610E}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{AF297AD8-0F1E-4E35-96BC-4C3BFC259A50}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{B4C6B0EA-4F0E-441A-986B-7649BFE50143}" = dir=in | app=c:\program files\codemeter\runtime\bin\codemeter.exe |
"{C7BFB97C-1276-4684-A663-7BEC1A10564E}" = protocol=17 | dir=in | app=c:\program files\codemeter\runtime\bin\codemeter.exe |
"{D345933C-D27F-4D52-B87E-15079F0253EA}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{DFABD626-B040-4074-A379-7A14EFA1F5A0}" = protocol=6 | dir=in | app=c:\windows\system32\spoolsv.exe |
"{E87840CD-9A1A-463F-9503-41603BEF8F46}" = protocol=6 | dir=in | app=c:\program files\mcafee\common framework\frameworkservice.exe |
"TCP Query User{157C944E-BE67-4BFC-B992-275AFF35702E}C:\program files\wolfenstein - enemy territory\et.exe" = protocol=6 | dir=in | app=c:\program files\wolfenstein - enemy territory\et.exe |
"TCP Query User{48987406-ECDC-4993-86C5-6F32F49B0BE3}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"TCP Query User{4C72C7AB-1F4B-41D9-A397-8C1C39F011B0}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"TCP Query User{6D3D8713-85A3-4871-8866-7A59566F436D}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{81D60392-0AAD-4078-BB3F-B14CB237F5DD}C:\program files\hp\toolboxfx\bin\hptlbxfx.exe" = protocol=6 | dir=in | app=c:\program files\hp\toolboxfx\bin\hptlbxfx.exe |
"TCP Query User{93248311-1B9C-4C45-B553-1E9A6916D21C}C:\program files\hp\hp ut\bin\hppusg.exe" = protocol=6 | dir=in | app=c:\program files\hp\hp ut\bin\hppusg.exe |
"TCP Query User{ACBA8F39-EC8F-4CD8-97B5-EAC0EEBA280A}C:\program files\hp\toolboxfx\bin\hptlbxfx.exe" = protocol=6 | dir=in | app=c:\program files\hp\toolboxfx\bin\hptlbxfx.exe |
"TCP Query User{D291955B-605F-4D82-B1CA-9BA6F339357D}C:\program files\hp\hp ut\bin\hppusg.exe" = protocol=6 | dir=in | app=c:\program files\hp\hp ut\bin\hppusg.exe |
"TCP Query User{DBA01E8A-915E-472B-81A3-D7A17DEF1C61}C:\program files\ea games\kingdoms of amalur reckoning\reckoning.exe" = protocol=6 | dir=in | app=c:\program files\ea games\kingdoms of amalur reckoning\reckoning.exe |
"UDP Query User{1642D7A2-0DDB-4481-8FAF-C94283FBB688}C:\program files\hp\toolboxfx\bin\hptlbxfx.exe" = protocol=17 | dir=in | app=c:\program files\hp\toolboxfx\bin\hptlbxfx.exe |
"UDP Query User{1FD59BD9-966E-48E1-A154-B15B1BCDBC4E}C:\program files\wolfenstein - enemy territory\et.exe" = protocol=17 | dir=in | app=c:\program files\wolfenstein - enemy territory\et.exe |
"UDP Query User{691BCADF-0EF9-487A-B86E-3837AC9DDFBE}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"UDP Query User{77E2EF24-8053-4F31-BC4D-4EF83BCD5DAA}C:\program files\hp\hp ut\bin\hppusg.exe" = protocol=17 | dir=in | app=c:\program files\hp\hp ut\bin\hppusg.exe |
"UDP Query User{843AE1C3-BABB-4C4E-8B45-808404C8EBE9}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe |
"UDP Query User{9CC20078-E05E-4FFD-B394-AFFBE49BE158}C:\program files\hp\hp ut\bin\hppusg.exe" = protocol=17 | dir=in | app=c:\program files\hp\hp ut\bin\hppusg.exe |
"UDP Query User{D68A49B7-7AC9-43D6-AE49-DD8BD34A24A8}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{DA5E5D56-0D77-4488-B934-E42A3397F207}C:\program files\ea games\kingdoms of amalur reckoning\reckoning.exe" = protocol=17 | dir=in | app=c:\program files\ea games\kingdoms of amalur reckoning\reckoning.exe |
"UDP Query User{F3834B0D-731E-48F0-9F5E-A759D1CE67EB}C:\program files\hp\toolboxfx\bin\hptlbxfx.exe" = protocol=17 | dir=in | app=c:\program files\hp\toolboxfx\bin\hptlbxfx.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0960BA8A-8A03-4FB0-9D28-9028F1414827}" = ProtectSmart Hard Drive Protection
"{0BC1A5B2-79A1-4716-B3E5-4071E9AB6F43}" = HP Photosmart C4500 All-In-One Driver 12.0 Rel .4
"{0D76888D-7B55-4D71-8D35-F0D66F2B588F}" = hppTLBXFXCP2020
"{0E49A356-E4F2-4A3F-8243-2FF7A2588066}" = Authorizer Ignition Key Support
"{101738D7-D805-37A9-BB91-1F2C351782BF}" = Microsoft .NET Framework 3.5 Language Pack SP1 - nld
"{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}" = McAfee VirusScan Enterprise
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 3.4
"{1BD6AE96-4742-4498-9D03-9451C7E5A214}" = Windows Live aanmeldhulp
"{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}" = Adobe Shockwave Player
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live - Hulpprogramma voor uploaden
"{228C6B46-64E2-404E-898A-EF0830603EF4}" = HPNetworkAssistant
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check
"{2617FA1F-0C04-3ABB-AF64-7D5B6620C341}" = Microsoft .NET Framework 4 Client Profile NLD Language Pack
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{2869F5EA-93C3-48E5-80DF-DB696BC84A91}" = Windows Live Mail
"{2D130C13-D6F7-4AAA-866D-17B825456D2D}" = hppusgCP2020
"{30DAA715-5032-40F9-A0AE-95C9AEBB3E3F}" = HP QuickTouch 1.00 D2
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32061277-9F45-4C3B-8299-D106D5A502ED}" = Windows Live Movie Maker
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{340F521E-3576-4E1A-B75C-EB0ACF751379}" = HP Wireless Assistant
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 D1
"{35CA031C-D3CD-4A28-8D9B-C71466C4F045}" = Windows Live Writer
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Vista
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.7
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{48D0B1A3-11AC-4A87-AFB2-2002CCB88B34}" = PS_AIO_04_C4580_Software_Min
"{5158F1F5-FA1B-4D49-B546-55A5004B89BD}" = Microsoft Works
"{51E5C397-0AA0-48DD-9CB6-7259AFFDFB0A}" = HP Easy Setup - Frontend
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{67692AC8-CB30-472E-88CF-805657AE3E9C}" = Perforce Visual Components
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{6FEC9863-5EF2-4A07-9D0B-CA81B47E3F59}" = Windows Live Photo Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7CD3C794-FFE1-4FB9-BB11-0BCBFDA701B3}" = hppPQVideoCP2020
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87A9A9A9-FAB7-4224-9328-0FA2058C0FD5}" = Network
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89B6F63A-7E0C-424A-9D39-C4EF59E96D78}" = hppQFolderCP2020
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0413-0000-0000000FF1CE}" = Microsoft Office Access MUI (Dutch) 2007
"{90120000-0015-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0413-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Dutch) 2007
"{90120000-0016-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0413-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Dutch) 2007
"{90120000-0018-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0413-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Dutch) 2007
"{90120000-0019-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0413-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Dutch) 2007
"{90120000-001A-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0413-0000-0000000FF1CE}" = Microsoft Office Word MUI (Dutch) 2007
"{90120000-001B-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUS_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_PROPLUS_{2C95E7EE-FEA7-4B3A-A6E5-DF90A88B816A}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0413-0000-0000000FF1CE}" = Compatibiliteitspakket voor het 2007 Microsoft Office system
"{90120000-002C-0413-0000-0000000FF1CE}" = Microsoft Office Proofing (Dutch) 2007
"{90120000-0044-0413-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Dutch) 2007
"{90120000-0044-0413-0000-0000000FF1CE}_PROPLUS_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0413-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Dutch) 2007
"{90120000-006E-0413-0000-0000000FF1CE}_PROPLUS_{1D12BC91-360E-424C-97C4-813651313660}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00AF-0413-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (Dutch)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0413-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9822E9CD-1AF6-4060-AEA0-0D58DC0E4AE8}" = hppManualsCP2020
"{9CCCFD9C-248F-47FE-9496-1680E3E5C163}" = Scan
"{9E2CCD5E-1990-4EF2-9B61-32F0BBACC29B}" = HP Active Support Library
"{A5F39441-3414-4db2-9A71-0BA8AB3CB16A}" = HP Color LaserJet CP2020 Series 1.0
"{A638557B-1F13-40A0-9627-C892FBCA6960}" = McAfee Agent
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC13BA3A-336B-45a4-B3FE-2D3058A7B533}" = Toolbox
"{AC76BA86-7AD7-1043-7B44-A81200000003}" = Adobe Reader 8.1.2 - Nederlands
"{B16DA0F8-26BC-4FFC-9363-1D9F3E6C3E21}" = HP Customer Experience Enhancements
"{B19E35D4-A530-4F2B-BF74-ACB2223DE20B}" = hpzTLBXFX
"{B8169E45-8E23-430B-91D1-EC64540C8ED0}" = HP User Guides 0103
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C20C2630-B3A7-44BA-BDD0-31E256AE490E}" = Windows Live Call
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CAEB2BE8-EF9E-4BFE-8165-3B54B62AF6CF}" = Windows Live Family Safety
"{CC38A00D-7EED-46CE-9281-D1D97B81F22A}" = Windows Live Messenger
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D8AC1EB5-E8B0-44A0-B113-899407188A2F}" = hppFonts
"{E333CA5F-00ED-4EEF-90E5-6A33A8FE969F}" = HP Help and Support
"{E34F703A-1C9D-4B1F-ABBE-D7E8800B860D}" = Windows Live Sync
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{EB5A3E9D-91CF-4C97-B816-72DE0625ACA3}" = Windows Live Essentials
"{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AVG Secure Search" = AVG Security Toolbar
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 WLAN-adapter
"CCleaner" = CCleaner
"DFX" = DFX
"Google Chrome" = Google Chrome
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"Kingdoms of Amalur Reckoning_is1" = Kingdoms of Amalur Reckoning
"KLiteCodecPack_is1" = K-Lite Codec Pack 8.6.0 (Basic)
"Line 6 Uninstaller" = Line 6 Uninstaller
"Microsoft .NET Framework 3.5 Language Pack SP1 - nld" = Taalpakket voor Microsoft .NET Framework 3.5 SP1 - NL
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile NLD Language Pack" = Taalpakket voor Microsoft .NET Framework 4 Client Profile - NLD
"NVIDIA Drivers" = NVIDIA Drivers
"PhotoScape" = PhotoScape
"PowerISO" = PowerISO
"PROPLUS" = Microsoft Office Professional Plus 2007
"Reason4_is1" = Reason 4.0
"Reason5_is1" = Reason 5.0.1
"Reason6.0_32_is1" = Reason 6.0.1
"ReCycle_is1" = ReCycle 2.1.2
"Shop for HP Supplies" = Shop for HP Supplies
"Stellarium_is1" = Stellarium 0.10.3
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.1
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2520824598-192507237-3364110249-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/10/2010 8:59:12 | Computer Name = PC_van_sara | Source = WinMgmt | ID = 10
Description =

Error - 1/10/2010 17:36:30 | Computer Name = PC_van_sara | Source = EventSystem | ID = 4621
Description =

Error - 2/10/2010 3:26:33 | Computer Name = PC_van_sara | Source = WinMgmt | ID = 10
Description =

Error - 2/10/2010 3:33:24 | Computer Name = PC_van_sara | Source = LoadPerf | ID = 3012
Description =

Error - 2/10/2010 3:33:24 | Computer Name = PC_van_sara | Source = LoadPerf | ID = 3012
Description =

Error - 3/10/2010 3:58:12 | Computer Name = PC_van_sara | Source = WinMgmt | ID = 10
Description =

Error - 3/10/2010 9:43:11 | Computer Name = PC_van_sara | Source = WinMgmt | ID = 10
Description =

Error - 4/10/2010 12:11:08 | Computer Name = PC_van_sara | Source = WinMgmt | ID = 10
Description =

Error - 5/10/2010 13:24:47 | Computer Name = PC_van_sara | Source = WinMgmt | ID = 10
Description =

Error - 6/10/2010 1:47:50 | Computer Name = PC_van_sara | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 10/04/2012 13:35:40 | Computer Name = PC_van_sara | Source = Service Control Manager | ID = 7030
Description =

Error - 10/04/2012 13:43:56 | Computer Name = PC_van_sara | Source = Service Control Manager | ID = 7030
Description =

Error - 31/12/2000 18:01:13 | Computer Name = PC_van_sara | Source = HTTP | ID = 15016
Description =

Error - 31/12/2000 18:02:17 | Computer Name = PC_van_sara | Source = DCOM | ID = 10016
Description =

Error - 31/12/2000 18:02:56 | Computer Name = PC_van_sara | Source = Service Control Manager | ID = 7000
Description =

Error - 31/12/2000 20:24:49 | Computer Name = PC_van_sara | Source = Service Control Manager | ID = 7031
Description =

Error - 1/01/2001 19:04:11 | Computer Name = PC_van_sara | Source = HTTP | ID = 15016
Description =

Error - 1/01/2001 19:04:34 | Computer Name = PC_van_sara | Source = W32Time | ID = 39452706
Description = De tijdsprovider heeft gedetecteerd dat de systeemtijd met +355840121
seconden gewijzigd dient te worden. De tijdsservice wijzigt de systeemtijd echter
niet meer dan +54000 seconden. Controleer of de tijd en de tijdzone juist zijn,
en dat de tijdsbron time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->65.55.21.20:123)
juist werkt.

Error - 1/01/2001 19:05:13 | Computer Name = PC_van_sara | Source = DCOM | ID = 10016
Description =

Error - 1/01/2001 19:05:45 | Computer Name = PC_van_sara | Source = Service Control Manager | ID = 7000
Description =


< End of report >

OTL logfile created on: 12/04/2012 17:13:46 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\sara\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000813 | Country: België | Language: NLB | Date Format: d/MM/yyyy

3,00 Gb Total Physical Memory | 1,51 Gb Available Physical Memory | 50,56% Memory free
6,22 Gb Paging File | 4,70 Gb Available in Paging File | 75,52% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 223,42 Gb Total Space | 70,57 Gb Free Space | 31,58% Space Free | Partition Type: NTFS
Drive D: | 9,46 Gb Total Space | 1,69 Gb Free Space | 17,86% Space Free | Partition Type: NTFS
Drive E: | 6,41 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: PC_VAN_SARA | User Name: sara | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/12 17:13:19 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\sara\Downloads\OTL.com
PRC - [2012/04/09 22:28:49 | 001,224,176 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2012/04/08 04:57:36 | 000,918,880 | ---- | M] () -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.2.0\ToolbarUpdater.exe
PRC - [2012/04/08 04:57:28 | 000,982,880 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012/04/05 18:40:45 | 002,424,192 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2012/02/09 08:06:48 | 000,312,376 | ---- | M] (Power Software Ltd) -- C:\Program Files\PowerISO\PWRISOVM.EXE
PRC - [2011/07/06 04:30:00 | 006,904,208 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files\CodeMeter\Runtime\bin\CodeMeterCC.exe
PRC - [2011/07/06 04:30:00 | 002,304,912 | ---- | M] (WIBU-SYSTEMS AG) -- C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe
PRC - [2008/10/29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/09/29 08:07:00 | 000,143,088 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
PRC - [2008/09/29 08:07:00 | 000,067,904 | ---- | M] (McAfee, Inc.) -- C:\Windows\System32\mfevtps.exe
PRC - [2008/09/29 08:07:00 | 000,062,800 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
PRC - [2008/09/29 08:07:00 | 000,026,672 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
PRC - [2008/09/29 08:07:00 | 000,019,456 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
PRC - [2008/06/27 17:53:08 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe
PRC - [2008/06/27 17:43:24 | 000,221,273 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe
PRC - [2008/06/27 17:42:06 | 000,442,467 | ---- | M] (IDT, Inc.) -- C:\Program Files\IDT\WDM\sttray.exe
PRC - [2008/04/26 01:15:26 | 000,361,808 | ---- | M] () -- C:\Windows\SMINST\BLService.exe
PRC - [2008/03/14 04:00:00 | 000,226,624 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
PRC - [2008/03/14 04:00:00 | 000,136,512 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\UdaterUI.exe
PRC - [2008/03/14 04:00:00 | 000,103,744 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe
PRC - [2008/03/14 04:00:00 | 000,091,456 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\McTray.exe


========== Modules (No Company Name) ==========

MOD - [2012/04/09 22:28:48 | 000,444,400 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.152\ppgooglenaclpluginchrome.dll
MOD - [2012/04/09 22:28:46 | 003,915,248 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.152\pdf.dll
MOD - [2012/04/09 22:27:21 | 000,122,880 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.152\avutil-51.dll
MOD - [2012/04/09 22:27:20 | 000,220,672 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.152\avformat-53.dll
MOD - [2012/04/09 22:27:19 | 001,747,456 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.152\avcodec-53.dll
MOD - [2012/04/09 21:42:11 | 008,743,584 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
MOD - [2012/04/08 04:57:28 | 000,982,880 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2012/04/01 14:28:40 | 004,052,480 | ---- | M] () -- C:\Users\sara\AppData\Local\Google\Chrome\User Data\SwiftShader\1.0.0.1\libglesv2.dll
MOD - [2012/04/01 14:28:40 | 000,100,864 | ---- | M] () -- C:\Users\sara\AppData\Local\Google\Chrome\User Data\SwiftShader\1.0.0.1\libegl.dll
MOD - [2012/03/12 22:12:40 | 000,049,064 | ---- | M] () -- C:\Program Files\Common Files\DFX\Dlls\dfxShared32.dll
MOD - [2012/02/12 11:37:15 | 000,063,488 | ---- | M] () -- C:\Users\sara\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2011/11/02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/11/02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/11/18 22:17:14 | 000,052,224 | ---- | M] () -- C:\Users\sara\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2008/06/25 22:36:26 | 000,259,480 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapEngine.dll
MOD - [2008/06/25 22:36:26 | 000,120,216 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLSchMgr.dll
MOD - [2008/06/25 22:36:26 | 000,038,184 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvcps.dll
MOD - [2008/06/25 22:36:22 | 000,345,384 | ---- | M] () -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLTinyDB.dll
MOD - [2005/08/22 15:38:16 | 003,264,512 | ---- | M] () -- C:\Program Files\McAfee\Common Framework\cryptocme2.dll
MOD - [2001/01/02 01:07:19 | 000,052,736 | ---- | M] () -- C:\Users\sara\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/04/08 04:57:36 | 000,918,880 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.2.0\ToolbarUpdater.exe -- (vToolbarUpdater10.2.0)
SRV - [2011/07/06 04:30:00 | 002,304,912 | ---- | M] (WIBU-SYSTEMS AG) [Auto | Running] -- C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe -- (CodeMeter.exe)
SRV - [2008/09/29 08:07:00 | 000,143,088 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe -- (McShield)
SRV - [2008/09/29 08:07:00 | 000,067,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\System32\mfevtps.exe -- (mfevtp)
SRV - [2008/09/29 08:07:00 | 000,062,800 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe -- (McTaskManager)
SRV - [2008/09/29 08:07:00 | 000,019,456 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe -- (McAfeeEngineService)
SRV - [2008/06/27 17:53:08 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe -- (AESTFilters)
SRV - [2008/06/27 17:43:24 | 000,221,273 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe -- (STacSV)
SRV - [2008/04/26 01:15:26 | 000,361,808 | ---- | M] () [Auto | Running] -- C:\Windows\SMINST\BLService.exe -- (Recovery Service for Windows)
SRV - [2008/03/14 04:00:00 | 000,103,744 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework)
SRV - [2008/02/03 12:00:00 | 000,129,992 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\System32\ezsvc7.dll -- (ezSharedSvc)
SRV - [2008/01/21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\sara\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012/02/09 08:06:40 | 000,112,096 | ---- | M] (Power Software Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2010/05/10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/03/01 12:43:16 | 000,098,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1039bus.sys -- (s1039bus) Sony Ericsson Device 1039 driver (WDM)
DRV - [2010/03/01 12:43:12 | 000,124,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1039mdm.sys -- (s1039mdm)
DRV - [2010/03/01 12:43:12 | 000,117,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1039mgmt.sys -- (s1039mgmt) Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM)
DRV - [2010/03/01 12:43:12 | 000,113,904 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1039obex.sys -- (s1039obex)
DRV - [2010/03/01 12:43:12 | 000,014,960 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1039mdfl.sys -- (s1039mdfl)
DRV - [2010/03/01 12:43:10 | 000,123,504 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1039unic.sys -- (s1039unic) Sony Ericsson Device 1039 USB Ethernet Emulation (WDM)
DRV - [2010/03/01 12:43:10 | 000,025,456 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1039nd5.sys -- (s1039nd5) Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS)
DRV - [2010/02/17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2008/09/29 08:07:00 | 000,340,592 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2008/09/29 08:07:00 | 000,090,360 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2008/09/29 08:07:00 | 000,074,648 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2008/09/29 08:07:00 | 000,064,432 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2008/09/29 08:07:00 | 000,062,704 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfetdik.sys -- (mfetdik)
DRV - [2008/09/29 08:07:00 | 000,042,424 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2008/07/08 12:16:26 | 000,096,856 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2008/06/27 17:44:18 | 000,380,928 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2008/05/14 04:09:00 | 007,443,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008/05/14 04:09:00 | 000,043,552 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2008/05/02 15:59:40 | 000,122,368 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/03/27 12:12:12 | 000,024,424 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hpdskflt.sys -- (hpdskflt)
DRV - [2008/03/27 12:11:34 | 000,034,664 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)
DRV - [2008/01/24 15:23:12 | 000,052,736 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2008/01/21 04:23:21 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2007/06/18 17:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2006/11/02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = HP | MSN
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrerource?}
IE - HKLM\..\SearchScopes\{40E2677F-473F-4BFF-A4B6-82924EED02B4}: "URL" = http://nb.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913938
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrerource?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{D95BD335-A858-403A-9BA3-3BD7AAC4DEB4}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1547&query={searchTerms}&invocationType=tb50hpcnnbie7-nl-be


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Upgrade to Google Chrome
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Bienvenue sur Facebook. Connectez-vous, inscrivez-vous ou découvrez !
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Upgrade to Google Chrome
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Upgrade to Google Chrome
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrerource?}
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=LMW2&o=16050&src=crm&q={searchTerms}&locale=nl_EU
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\SearchScopes\{40E2677F-473F-4BFF-A4B6-82924EED02B4}: "URL" = http://nb.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913938
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrerource?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_nlBE306
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={E8AEBAC3-3B43-4654-B474-898255DF0039}&mid=4b75dbc0b17e47d0a9d2d157aa0e0149-e314554ede4cf84fe880be9404f577aff6941cf3&lang=nl&ds=st011&pr=sa&d=2012-04-05 23:13:09&v=10.0.0.7&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\SearchScopes\{9EE7695B-F048-4E80-9BCF-8E2CD4EA5D81}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\SearchScopes\{D95BD335-A858-403A-9BA3-3BD7AAC4DEB4}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1547&query={searchTerms}&invocationType=tb50hpcnnbie7-nl-be
IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.1: C:\Users\sara\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\10.2.0.3\ [2012/04/08 04:58:02 | 000,000,000 | ---D | M]

[2009/03/28 16:45:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\sara\AppData\Roaming\mozilla\Extensions
[2009/03/28 16:45:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\sara\AppData\Roaming\mozilla\Extensions\[email protected]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{googleearchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{googleearchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.152\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.152\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\sara\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Users\sara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Zoeken = C:\Users\sara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Gmail = C:\Users\sara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/04/10 19:43:50 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Help bij koppelingen) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll ()
O2 - BHO: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\Toolbar\WebBrowser: (LimeWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\McAfee\Common Framework\udaterui.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (Power Software Ltd)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-21-2520824598-192507237-3364110249-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.130.131.130 195.130.130.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DF070C1D-AF03-4ED6-A0C8-99577544C155}: DhcpNameServer = 192.168.1.239 195.238.2.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EAA85227-C36F-4FE0-993A-2A669A9616F8}: DhcpNameServer = 195.130.131.130 195.130.130.2
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\10.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\sara\AppData\Roaming\Microsoft\Windows Photo Gallery\Bureaubladachtergrond van Windows Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\sara\AppData\Roaming\Microsoft\Windows Photo Gallery\Bureaubladachtergrond van Windows Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/10 19:48:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/04/10 19:23:27 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/04/10 19:23:25 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/04/10 19:23:24 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/04/10 19:23:11 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/04/10 19:23:10 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/04/10 19:23:03 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/04/10 15:58:42 | 000,000,000 | ---D | C] -- C:\Users\sara\Documents\My Games
[2012/04/10 15:58:42 | 000,000,000 | ---D | C] -- C:\Users\sara\AppData\Local\FalloutNV
[2012/04/08 19:54:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/04/07 18:33:17 | 000,000,000 | ---D | C] -- C:\Users\sara\AppData\Roaming\Line 6
[2012/04/07 18:33:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Line 6
[2012/04/07 18:33:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Line 6
[2012/04/07 18:32:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Propellerhead Software
[2012/04/07 18:30:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CodeMeter
[2012/04/07 18:30:13 | 000,000,000 | ---D | C] -- C:\Program Files\CodeMeter
[2012/04/05 23:36:04 | 000,338,432 | ---- | C] (Propellerhead Software AB) -- C:\Windows\System32\REX Shared Library.dll
[2012/04/05 23:36:03 | 000,406,528 | ---- | C] (Propellerhead Software AB) -- C:\Windows\System32\ReWire.dll
[2012/04/05 23:24:55 | 000,000,000 | ---D | C] -- C:\Program Files\Propellerhead
[2012/04/05 23:13:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Propellerhead Software
[2012/04/05 23:13:49 | 000,000,000 | ---D | C] -- C:\Users\sara\AppData\Roaming\Propellerhead Software
[2012/04/05 23:13:07 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search
[2012/04/05 23:13:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2012/04/05 23:13:02 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search
[2012/04/05 23:12:56 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012/04/05 23:12:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
[2012/04/05 23:12:09 | 000,000,000 | ---D | C] -- C:\Program Files\PowerISO
[2012/04/05 23:08:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Propellerhead
[2012/04/05 18:46:33 | 000,000,000 | ---D | C] -- C:\Users\sara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012/04/05 18:46:32 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2012/04/05 18:21:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
[2012/04/05 18:21:44 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack
[2012/04/05 16:19:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/04/05 16:19:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/04/04 17:35:42 | 000,000,000 | ---D | C] -- C:\Users\sara\AppData\Local\DFX
[2012/04/04 17:35:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DFX Audio Enhancer
[2012/04/04 17:35:01 | 000,000,000 | ---D | C] -- C:\ProgramData\DFX
[2012/04/04 17:34:53 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DFX
[2012/04/04 17:34:52 | 000,000,000 | ---D | C] -- C:\Program Files\DFX
[2012/03/28 20:01:53 | 000,000,000 | ---D | C] -- C:\Users\sara\Desktop\Cloudy With A Chance Of Meatballs

========== Files - Modified Within 30 Days ==========

[2012/04/12 16:47:00 | 000,001,046 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/12 15:32:51 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/12 15:32:51 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/12 14:00:27 | 000,001,042 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/12 13:39:45 | 002,150,308 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2012/04/12 13:39:45 | 002,075,656 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/04/12 13:39:45 | 001,512,792 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2012/04/12 13:39:45 | 001,490,272 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/04/12 13:39:45 | 000,060,534 | ---- | M] () -- C:\Windows\System32\perfh013.dat
[2012/04/12 13:39:45 | 000,015,062 | ---- | M] () -- C:\Windows\System32\perfc013.dat
[2012/04/10 19:43:50 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/04/10 16:50:39 | 000,000,832 | ---- | M] () -- C:\Users\sara\Desktop\ReCycle.lnk
[2012/04/10 16:01:58 | 000,157,696 | ---- | M] () -- C:\Users\sara\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/04/10 14:48:58 | 000,001,971 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012/04/09 22:08:00 | 000,000,104 | ---- | M] () -- C:\Users\sara\Desktop\Computer.lnk
[2012/04/09 18:08:30 | 000,001,971 | ---- | M] () -- C:\Users\sara\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome (2).lnk
[2012/04/09 17:09:39 | 000,002,481 | ---- | M] () -- C:\Users\sara\Desktop\HiJackThis.lnk
[2012/04/08 05:00:29 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\Reason.lnk
[2012/04/07 18:30:50 | 000,002,020 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk
[2012/04/05 23:36:05 | 000,338,432 | ---- | M] (Propellerhead Software AB) -- C:\Windows\System32\REX Shared Library.dll
[2012/04/05 23:36:03 | 000,406,528 | ---- | M] (Propellerhead Software AB) -- C:\Windows\System32\ReWire.dll
[2012/04/05 23:12:24 | 000,000,764 | ---- | M] () -- C:\Users\Public\Desktop\PowerISO.lnk
[2012/04/04 17:47:06 | 000,000,258 | ---- | M] () -- C:\Users\sara\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

========== Files Created - No Company Name ==========

[2012/04/10 19:23:28 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/04/10 19:23:25 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/04/10 19:23:25 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/04/10 19:23:24 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/04/10 19:23:24 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/04/10 16:50:39 | 000,000,832 | ---- | C] () -- C:\Users\sara\Desktop\ReCycle.lnk
[2012/04/10 16:35:31 | 000,331,263 | ---- | C] () -- C:\Windows\LOOP.exe
[2012/04/09 22:08:00 | 000,000,104 | ---- | C] () -- C:\Users\sara\Desktop\Computer.lnk
[2012/04/09 18:08:30 | 000,001,971 | ---- | C] () -- C:\Users\sara\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome (2).lnk
[2012/04/07 19:21:59 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\Reason.lnk
[2012/04/07 18:30:50 | 000,002,020 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk
[2012/04/05 23:12:24 | 000,000,764 | ---- | C] () -- C:\Users\Public\Desktop\PowerISO.lnk
[2012/04/05 18:46:33 | 000,002,481 | ---- | C] () -- C:\Users\sara\Desktop\HiJackThis.lnk
[2012/04/05 18:21:49 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2012/04/04 17:47:06 | 000,000,258 | ---- | C] () -- C:\Users\sara\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2011/10/16 11:53:08 | 000,000,000 | ---- | C] () -- C:\Users\sara\AppData\Local\{E67EED8E-3BE2-42BB-8678-C0536AE3DA1C}
[2010/11/22 07:30:26 | 000,157,696 | ---- | C] () -- C:\Users\sara\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/18 22:42:03 | 000,008,268 | ---- | C] () -- C:\Users\sara\AppData\Local\d3d9caps.dat

========== LOP Check ==========

[2011/05/12 20:29:56 | 000,000,000 | ---D | M] -- C:\Users\sara\AppData\Roaming\ClickPotatoLite
[2010/03/04 20:06:07 | 000,000,000 | ---D | M] -- C:\Users\sara\AppData\Roaming\Facebook
[2012/04/07 18:33:17 | 000,000,000 | ---D | M] -- C:\Users\sara\AppData\Roaming\Line 6
[2012/04/10 16:36:05 | 000,000,000 | ---D | M] -- C:\Users\sara\AppData\Roaming\Propellerhead Software
[2010/02/01 23:02:42 | 000,000,000 | ---D | M] -- C:\Users\sara\AppData\Roaming\Stellarium
[2001/01/01 07:45:30 | 000,000,000 | ---D | M] -- C:\Users\sara\AppData\Roaming\uTorrent
[2001/01/01 07:45:44 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >

Start OTL

• Plak het volgende onder Custom Scans/Fixes
  
  

  :OTL
  IE - HKU\S-1-5-21-2520824598-192507237-3364110249-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=LMW2&o=16050&src=crm&q={sear chTerms}&locale=nl_EU
  ervices
  
  :Reg
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [emptyflash]
  [createrestorepoint]
  [reboot]

  Klik om te vergroten...

• Klik daarna bovenaan op de knop Run Fix
• Laat het programma ongestoord zijn werk doen. De pc zal na afloop opnieuw opgestart worden.

OTL werd tijdens het scannen afgesloten met de melding dat het programma niet meer werkte, hierna was enkel nog de desktop zonder iconen of startbalk zichtbaar, dus was ik genoodzaakt de laptop opnieuw op te starten. Tijdens dit opstarten bleef hij hangen op een zwart scherm, zonder iets van informatie, na een volgende keer opstarten lukte het wel weer zonder probleem.

Wist niet zeker of ik nog een log moest posten, dus heb het voor alle zekerheid maar gekopieerd.


All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-2520824598-192507237-3364110249-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP-configuratie
De DNS-omzettingscache is leeggemaakt.
C:\Users\sara\Downloads\cmd.bat deleted successfully.
C:\Users\sara\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: foto's
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 18835973 bytes
->Flash cache emptied: 405 bytes

User: Gast
->Temp folder emptied: 0 bytes

User: Muziek
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 42232727 bytes
->Flash cache emptied: 405 bytes

User: muziek.PC_van_sara
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 10767449 bytes
->Flash cache emptied: 523 bytes

User: muziek.PC_van_sara.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 79738394 bytes
->Flash cache emptied: 523 bytes

User: muziek.PC_van_sara.001
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 65679852 bytes
->Flash cache emptied: 523 bytes

User: muziek.PC_van_sara.002
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 77197750 bytes
->Flash cache emptied: 523 bytes

User: muziek.PC_van_sara.003
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 117944550 bytes
->Flash cache emptied: 523 bytes

User: muziek.PC_van_sara.004
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 82448849 bytes
->Flash cache emptied: 582 bytes

User: muziek.PC_van_sara.005
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 35939709 bytes
->Flash cache emptied: 576 bytes

User: muziek.PC_van_sara.006
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 54631927 bytes
->Flash cache emptied: 576 bytes

User: muziek.PC_van_sara.007
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 71557735 bytes
->Flash cache emptied: 576 bytes

User: muziek.PC_van_sara.008
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 45798562 bytes
->Flash cache emptied: 576 bytes

User: muziek.PC_van_sara.009
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 47651014 bytes
->Flash cache emptied: 553 bytes

User: Muziek.PC_van_sara.010
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 59067670 bytes
->Flash cache emptied: 999 bytes

User: Muziek.PC_van_sara.011
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 83328078 bytes
->Flash cache emptied: 3224 bytes

User: muziek.PC_van_sara.012
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Google Chrome cache emptied: 224916749 bytes
->Flash cache emptied: 623 bytes

User: Public
->Temp folder emptied: 0 bytes

User: sara
->Temp folder emptied: 1693133 bytes
->Temporary Internet Files folder emptied: 24821644 bytes
->Java cache emptied: 1545154 bytes
->Google Chrome cache emptied: 478507497 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 108334 bytes

User: Tom
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 89463770 bytes
->Flash cache emptied: 860 bytes

User: Tom.PC_van_sara
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33446817 bytes
->Google Chrome cache emptied: 32119779 bytes
->Apple Safari cache emptied: 5183488 bytes
->Flash cache emptied: 4291 bytes

User: zornik.PC_van_sara
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 40244851 bytes
->Flash cache emptied: 679 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 95364458 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1.831,00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Default

User: Default User

User: foto's
->Flash cache emptied: 0 bytes

User: Gast

User: Muziek
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.000
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.001
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.002
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.003
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.004
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.005
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.006
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.007
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.008
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.009
->Flash cache emptied: 0 bytes

User: Muziek.PC_van_sara.010
->Flash cache emptied: 0 bytes

User: Muziek.PC_van_sara.011
->Flash cache emptied: 0 bytes

User: muziek.PC_van_sara.012
->Flash cache emptied: 0 bytes

User: Public

User: sara
->Flash cache emptied: 0 bytes

User: Tom
->Flash cache emptied: 0 bytes

User: Tom.PC_van_sara
->Flash cache emptied: 0 bytes

User: zornik.PC_van_sara
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb



OTL by OldTimer - Version 3.2.39.2 log created on 04162012_143243

Files\Folders moved on Reboot...
C:\Windows\temp\WFVC5ED.tmp moved successfully.

Registry entries deleted on Reboot...