API tools faq
paste
sabasNL

ComboFix.txt 4-8-2012

sabasNL
Aug 4th, 2012
21
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 29.81 KB | None | 0 0
raw download clone embed print report
  1. ComboFix 12-08-04.02 - Bas 04-08-2012 18:08:32.4.8 - x64 NETWORK
  2. Microsoft Windows 7 Ultimate 6.1.7601.1.1252.31.1043.18.8174.6679 [GMT 2:00]
  3. Gestart vanuit: e:\users\Bas\Desktop\ComboFix.exe
  4. gebruikte Opdracht switches :: e:\users\Bas\Desktop\CFScript.txt
  5. AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
  6. AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
  7. SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
  8. SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
  9. SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
  10. * Nieuw herstelpunt werd aangemaakt
  11. .
  12. FILE ::
  13. "c:\users\Bas\AppData\Local\Temp\006D4AA.tmp"
  14. "c:\users\Bas\AppData\Local\Temp\007FFF6.tmp"
  15. "c:\windows\SysWOW64\Drivers\X6va008"
  16. .
  17. .
  18. (((((((((((((((((((((((((((((((((( Andere Verwijderingen )))))))))))))))))))))))))))))))))))))))))))))))))
  19. .
  20. .
  21. .
  22. ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
  23. .
  24. .
  25. -------\Legacy_X6VA006
  26. -------\Legacy_X6VA007
  27. -------\Legacy_X6VA008
  28. -------\Service_X6va006
  29. -------\Service_X6va007
  30. -------\Service_X6va008
  31. .
  32. .
  33. (((((((((((((((((((( Bestanden Gemaakt van 2012-07-04 to 2012-08-04 ))))))))))))))))))))))))))))))
  34. .
  35. .
  36. 2012-08-04 16:11 . 2012-08-04 16:11 -------- d-----w- c:\users\Default\AppData\Local\temp
  37. 2012-08-04 16:03 . 2012-08-04 16:03 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DC757F2F-719C-4534-81F6-1759F9376B14}\offreg.dll
  38. 2012-08-04 15:48 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DC757F2F-719C-4534-81F6-1759F9376B14}\mpengine.dll
  39. 2012-08-01 22:07 . 2012-08-02 20:57 -------- d-----w- c:\users\Bas\AppData\Roaming\wargaming.net
  40. 2012-07-31 13:43 . 2012-07-31 13:43 -------- d-----w- c:\programdata\ATI
  41. 2012-07-31 13:43 . 2012-07-31 13:43 -------- d-----w- c:\program files (x86)\AMD APP
  42. 2012-07-30 11:54 . 2012-07-30 11:54 -------- d-----w- c:\users\Bas\AppData\Roaming\MotioninJoy
  43. 2012-07-30 00:10 . 2011-12-07 17:42 328712 ----a-w- c:\windows\system32\MijFrc.dll
  44. 2012-07-29 19:52 . 2012-07-29 19:59 -------- d-----w- c:\users\Bas\AppData\Roaming\GetRightToGo
  45. 2012-07-29 19:37 . 2012-07-29 19:37 -------- d-----w- c:\users\Bas\AppData\Roaming\Malwarebytes
  46. 2012-07-29 19:37 . 2012-07-29 19:37 -------- d-----w- c:\programdata\Malwarebytes
  47. 2012-07-29 19:37 . 2012-07-03 11:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
  48. 2012-07-29 18:40 . 2012-07-29 18:40 -------- d-----w- c:\program files\CCleaner
  49. 2012-07-24 21:30 . 2012-07-24 21:30 -------- d-----w- c:\users\Bas\AppData\Roaming\RoboForm
  50. 2012-07-24 21:29 . 2012-07-24 21:29 -------- d-----w- c:\programdata\RoboForm
  51. 2012-07-24 21:28 . 2012-07-03 16:21 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
  52. 2012-07-24 21:28 . 2012-07-03 16:21 355856 ----a-w- c:\windows\system32\drivers\aswSP.sys
  53. 2012-07-24 21:28 . 2012-07-03 16:21 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
  54. 2012-07-24 21:28 . 2012-07-03 16:21 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
  55. 2012-07-24 21:28 . 2012-07-03 16:21 958400 ----a-w- c:\windows\system32\drivers\aswSnx.sys
  56. 2012-07-24 21:28 . 2012-07-03 16:21 71064 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
  57. 2012-07-24 21:28 . 2012-07-03 16:21 41224 ----a-w- c:\windows\avastSS.scr
  58. 2012-07-24 21:28 . 2012-07-03 16:21 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
  59. 2012-07-24 18:33 . 2012-07-24 18:33 -------- d-----w- c:\users\Bas\AppData\Roaming\Leadertech
  60. 2012-07-24 18:31 . 2012-07-24 18:31 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
  61. 2012-07-24 18:31 . 2012-07-24 18:31 -------- d-----w- c:\programdata\LogiShrd
  62. 2012-07-24 18:30 . 2012-07-24 18:32 -------- d-----w- c:\program files\Logitech Gaming Software
  63. 2012-07-24 18:30 . 2012-07-24 18:30 -------- d-----w- c:\users\Bas\AppData\Roaming\Logitech
  64. 2012-07-24 18:30 . 2012-07-24 18:30 -------- d-----w- c:\users\Bas\AppData\Roaming\Logishrd
  65. 2012-07-23 17:14 . 2012-07-23 20:40 -------- d-----w- c:\users\Bas\AppData\Local\FalloutNV
  66. 2012-07-23 17:13 . 2012-07-23 17:13 -------- d-----w- c:\users\Bas\AppData\Local\FOMM
  67. 2012-07-20 13:59 . 2012-07-20 13:59 -------- d-----w- c:\program files (x86)\Common Files\Overwolf
  68. 2012-07-19 16:03 . 2012-07-19 16:03 -------- d-----w- c:\users\Bas\AppData\Local\ArmA 2
  69. 2012-07-18 20:40 . 2012-07-18 20:40 66728 ----a-w- c:\windows\system32\drivers\vrtaucbl.sys
  70. 2012-07-18 17:35 . 2012-07-18 17:37 -------- d-----w- c:\users\Bas\AppData\Local\Ubisoft Game Launcher
  71. 2012-07-18 16:20 . 2012-07-18 16:20 -------- d-----w- c:\programdata\Solidshield
  72. 2012-07-18 16:15 . 2012-07-18 16:15 -------- d-----w- c:\users\Bas\AppData\Roaming\Ubisoft
  73. 2012-07-18 15:17 . 2012-07-18 15:17 -------- d-----w- c:\program files (x86)\Ubisoft
  74. 2012-07-17 19:02 . 2012-03-17 12:08 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{19E021E9-EEBD-442E-ADEC-FF5F568ABC29}\gapaengine.dll
  75. .
  76. .
  77. .
  78. ((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
  79. .
  80. 2012-08-02 23:20 . 2012-04-01 12:20 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
  81. 2012-08-02 23:20 . 2012-03-17 18:24 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
  82. 2012-07-31 19:04 . 2012-03-17 13:00 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
  83. 2012-07-31 19:04 . 2012-03-16 20:25 283304 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
  84. 2012-07-31 19:03 . 2012-03-16 20:25 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
  85. 2012-07-30 00:07 . 2012-03-24 20:08 466456 ----a-w- c:\windows\system32\wrap_oal.dll
  86. 2012-07-30 00:07 . 2012-03-24 20:08 122904 ----a-w- c:\windows\system32\OpenAL32.dll
  87. 2012-07-30 00:06 . 2012-03-24 20:08 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
  88. 2012-07-30 00:06 . 2012-03-24 20:08 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
  89. 2012-07-03 16:21 . 2012-03-17 11:54 285328 ----a-w- c:\windows\system32\aswBoot.exe
  90. 2012-06-29 10:04 . 2012-03-18 10:14 9133488 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
  91. 2012-06-11 18:59 . 2012-06-11 18:59 10248192 ----a-w- c:\windows\system32\drivers\atikmdag.sys
  92. 2012-06-11 18:35 . 2012-06-11 18:35 70144 ----a-w- c:\windows\system32\coinst_8.98.dll
  93. 2012-06-11 18:29 . 2012-04-06 02:10 24826368 ----a-w- c:\windows\system32\atio6axx.dll
  94. 2012-06-11 18:00 . 2012-06-11 18:00 20467712 ----a-w- c:\windows\SysWow64\atioglxx.dll
  95. 2012-06-11 17:25 . 2012-06-11 17:25 163840 ----a-w- c:\windows\system32\atiapfxx.exe
  96. 2012-06-11 17:24 . 2012-02-15 03:18 924160 ----a-w- c:\windows\SysWow64\aticfx32.dll
  97. 2012-06-11 17:23 . 2012-02-15 03:17 1090560 ----a-w- c:\windows\system32\aticfx64.dll
  98. 2012-06-11 17:20 . 2012-06-11 17:20 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
  99. 2012-06-11 17:19 . 2012-06-11 17:19 532992 ----a-w- c:\windows\system32\atieclxx.exe
  100. 2012-06-11 17:19 . 2012-06-11 17:19 239616 ----a-w- c:\windows\system32\atiesrxx.exe
  101. 2012-06-11 17:17 . 2012-06-11 17:17 120320 ----a-w- c:\windows\system32\atitmm64.dll
  102. 2012-06-11 17:17 . 2012-06-11 17:17 21504 ----a-w- c:\windows\system32\atimuixx.dll
  103. 2012-06-11 17:17 . 2012-06-11 17:17 59392 ----a-w- c:\windows\system32\atiedu64.dll
  104. 2012-06-11 17:17 . 2012-06-11 17:17 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
  105. 2012-06-11 17:16 . 2012-06-11 17:16 6301696 ----a-w- c:\windows\SysWow64\atidxx32.dll
  106. 2012-06-11 17:01 . 2012-02-15 02:52 6914560 ----a-w- c:\windows\system32\atidxx64.dll
  107. 2012-06-11 16:51 . 2012-06-11 16:51 4246528 ----a-w- c:\windows\system32\atiumd6a.dll
  108. 2012-06-11 16:45 . 2012-06-11 16:45 51200 ----a-w- c:\windows\system32\aticalrt64.dll
  109. 2012-06-11 16:45 . 2012-06-11 16:45 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
  110. 2012-06-11 16:45 . 2012-02-15 02:34 5480448 ----a-w- c:\windows\SysWow64\atiumdag.dll
  111. 2012-06-11 16:45 . 2012-06-11 16:45 44544 ----a-w- c:\windows\system32\aticalcl64.dll
  112. 2012-06-11 16:45 . 2012-06-11 16:45 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
  113. 2012-06-11 16:45 . 2012-06-11 16:45 15703040 ----a-w- c:\windows\system32\aticaldd64.dll
  114. 2012-06-11 16:43 . 2012-02-15 02:29 4729344 ----a-w- c:\windows\SysWow64\atiumdva.dll
  115. 2012-06-11 16:40 . 2012-06-11 16:40 13277696 ----a-w- c:\windows\SysWow64\aticaldd.dll
  116. 2012-06-11 16:36 . 2012-06-11 16:36 6605824 ----a-w- c:\windows\system32\atiumd64.dll
  117. 2012-06-11 16:27 . 2012-04-06 01:11 539136 ----a-w- c:\windows\system32\atiadlxx.dll
  118. 2012-06-11 16:26 . 2012-06-11 16:26 368640 ----a-w- c:\windows\SysWow64\atiadlxy.dll
  119. 2012-06-11 16:26 . 2012-04-06 01:11 17920 ----a-w- c:\windows\system32\atig6pxx.dll
  120. 2012-06-11 16:26 . 2012-06-11 16:26 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll
  121. 2012-06-11 16:26 . 2012-06-11 16:26 14848 ----a-w- c:\windows\system32\atiglpxx.dll
  122. 2012-06-11 16:26 . 2012-04-06 01:11 41984 ----a-w- c:\windows\system32\atig6txx.dll
  123. 2012-06-11 16:26 . 2012-06-11 16:26 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll
  124. 2012-06-11 16:26 . 2012-06-11 16:26 367616 ----a-w- c:\windows\system32\drivers\atikmpag.sys
  125. 2012-06-11 16:25 . 2012-02-15 02:12 54784 ----a-w- c:\windows\system32\atiuxp64.dll
  126. 2012-06-11 16:25 . 2012-06-11 16:25 42496 ----a-w- c:\windows\SysWow64\atiuxpag.dll
  127. 2012-06-11 16:25 . 2012-06-11 16:25 45056 ----a-w- c:\windows\system32\atiu9p64.dll
  128. 2012-06-11 16:24 . 2012-02-15 02:12 32768 ----a-w- c:\windows\SysWow64\atiu9pag.dll
  129. 2012-06-11 16:24 . 2012-06-11 16:24 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
  130. 2012-06-11 16:23 . 2012-06-11 16:23 56320 ----a-w- c:\windows\system32\atimpc64.dll
  131. 2012-06-11 16:23 . 2012-06-11 16:23 56320 ----a-w- c:\windows\system32\amdpcom64.dll
  132. 2012-06-11 16:23 . 2012-06-11 16:23 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll
  133. 2012-06-11 16:23 . 2012-06-11 16:23 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll
  134. 2012-06-11 11:50 . 2012-06-11 11:50 187392 ----a-w- c:\windows\system32\clinfo.exe
  135. 2012-06-11 11:50 . 2012-06-11 11:50 75264 ----a-w- c:\windows\system32\OpenVideo64.dll
  136. 2012-06-11 11:50 . 2012-06-11 11:50 65024 ----a-w- c:\windows\SysWow64\OpenVideo.dll
  137. 2012-06-11 11:50 . 2012-06-11 11:50 63488 ----a-w- c:\windows\system32\OVDecode64.dll
  138. 2012-06-11 11:50 . 2012-06-11 11:50 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll
  139. 2012-06-11 11:50 . 2012-06-11 11:50 16457728 ----a-w- c:\windows\system32\amdocl64.dll
  140. 2012-06-11 11:49 . 2012-06-11 11:49 13008896 ----a-w- c:\windows\SysWow64\amdocl.dll
  141. 2012-05-27 11:23 . 2012-05-27 11:23 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
  142. 2012-05-26 23:20 . 2012-03-16 20:25 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
  143. 2012-05-12 11:32 . 2012-05-12 11:34 3130440 ----a-w- c:\windows\SysWow64\pbsvc_blr.exe
  144. 2012-05-10 21:19 . 2012-03-16 19:32 1170400 ----a-w- c:\windows\PE_Rom.dll
  145. .
  146. .
  147. ((((((((((((((((((((((((((((( SnapShot_2012-08-03_15.19.03 )))))))))))))))))))))))))))))))))))))))))
  148. .
  149. - 2009-07-14 04:54 . 2012-08-03 15:18 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
  150. + 2009-07-14 04:54 . 2012-08-04 15:38 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
  151. - 2009-07-14 04:54 . 2012-08-03 15:18 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
  152. + 2009-07-14 04:54 . 2012-08-04 15:38 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
  153. - 2009-07-14 04:54 . 2012-08-03 15:18 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
  154. + 2009-07-14 04:54 . 2012-08-04 15:38 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
  155. - 2012-03-16 16:23 . 2012-08-03 15:19 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
  156. + 2012-03-16 16:23 . 2012-08-04 15:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
  157. - 2012-03-16 16:23 . 2012-08-03 15:19 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
  158. + 2012-03-16 16:23 . 2012-08-04 15:40 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
  159. + 2012-08-04 16:12 . 2012-08-04 16:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
  160. - 2012-08-03 15:18 . 2012-08-03 15:18 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
  161. + 2012-08-04 16:12 . 2012-08-04 16:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
  162. - 2012-08-03 15:18 . 2012-08-03 15:18 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
  163. .
  164. ((((((((((((((((((((((((((((((((((((( Reg Opstartpunten )))))))))))))))))))))))))))))))))))))))))))))))))))
  165. .
  166. .
  167. *Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
  168. REGEDIT4
  169. .
  170. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
  171. @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
  172. [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
  173. 2012-02-14 22:58 94208 ----a-w- c:\users\Bas\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
  174. .
  175. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
  176. @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
  177. [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
  178. 2012-02-14 22:58 94208 ----a-w- c:\users\Bas\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
  179. .
  180. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
  181. @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
  182. [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
  183. 2012-02-14 22:58 94208 ----a-w- c:\users\Bas\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
  184. .
  185. [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
  186. @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
  187. [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
  188. 2012-02-14 22:58 94208 ----a-w- c:\users\Bas\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
  189. .
  190. [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
  191. "AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
  192. "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
  193. "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-06-11 641704]
  194. "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
  195. .
  196. c:\users\Bas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
  197. Dropbox.lnk - c:\users\Bas\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
  198. .
  199. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
  200. "ConsentPromptBehaviorAdmin"= 0 (0x0)
  201. "ConsentPromptBehaviorUser"= 3 (0x3)
  202. "EnableLUA"= 0 (0x0)
  203. "EnableUIADesktopToggle"= 0 (0x0)
  204. "PromptOnSecureDesktop"= 0 (0x0)
  205. .
  206. [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  207. Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
  208. .
  209. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
  210. @="Service"
  211. .
  212. R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
  213. R2 gupdate;Google Update-service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-22 116648]
  214. R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944]
  215. R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 250056]
  216. R3 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe [2012-03-30 131912]
  217. R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
  218. R3 e.dentifier2;SmartCard Reader ABN AMRO e.dentifier2;c:\windows\system32\DRIVERS\aabed2.sys [2008-03-20 28672]
  219. R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-22 116648]
  220. R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2011-11-10 115272]
  221. R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 40832]
  222. R3 OverwolfUpdaterService;Overwolf Updater Service;c:\program files (x86)\Overwolf\OverwolfUpdater.exe [2012-07-15 18360]
  223. R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]
  224. R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]
  225. R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2010-01-14 29472]
  226. R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
  227. R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]
  228. R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
  229. R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
  230. R3 TunngleService;TunngleService;d:\program files\Tunngle\TnglCtrl.exe [2012-06-01 736104]
  231. R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
  232. R3 VLAN;Realtek Virtual Miniport Driver for VLAN (NDIS 6.2);c:\windows\system32\DRIVERS\RtVLAN60.sys [2010-01-14 29472]
  233. R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-19 1255736]
  234. R3 WinRing0_1_2_0;WinRing0_1_2_0;d:\program files\Game Booster 3\Driver\WinRing0x64.sys [2010-11-01 14544]
  235. S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
  236. S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]
  237. S1 aswSnx;aswSnx; [x]
  238. S1 aswSP;aswSP; [x]
  239. S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
  240. S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-06-11 239616]
  241. S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [2010-11-03 918144]
  242. S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [2010-12-02 915584]
  243. S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2010-10-21 586880]
  244. S2 aswFsBlk;aswFsBlk; [x]
  245. S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-07-03 71064]
  246. S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\program files\LogMeIn Hamachi\hamachi-2.exe [2012-06-27 2369960]
  247. S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2010-01-14 32544]
  248. S2 TeamViewer7;TeamViewer 7;d:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-03-19 2666880]
  249. S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2012-06-11 10248192]
  250. S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2012-06-11 367616]
  251. S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-02-23 95760]
  252. S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-02-24 99384]
  253. S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [2012-07-18 66728]
  254. S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 22408]
  255. S3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;c:\windows\system32\DRIVERS\LGSHidFilt.Sys [2012-02-07 66328]
  256. S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-24 16008]
  257. S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 84864]
  258. S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
  259. S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-04-21 471144]
  260. S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-02-24 203320]
  261. S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 31232]
  262. .
  263. .
  264. Inhoud van de 'Gedeelde Taken' map
  265. .
  266. 2012-08-04 c:\windows\Tasks\Adobe Flash Player Updater.job
  267. - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 23:20]
  268. .
  269. 2012-07-29 c:\windows\Tasks\avast! Emergency Update.job
  270. - c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-24 16:21]
  271. .
  272. 2012-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  273. - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-22 17:04]
  274. .
  275. 2012-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  276. - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-22 17:04]
  277. .
  278. 2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2001550640-3423300443-1715644720-1000Core.job
  279. - c:\users\Bas\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-18 12:27]
  280. .
  281. 2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2001550640-3423300443-1715644720-1000UA.job
  282. - c:\users\Bas\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-18 12:27]
  283. .
  284. .
  285. --------- X64 Entries -----------
  286. .
  287. .
  288. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
  289. @="{472083B0-C522-11CF-8763-00608CC02F24}"
  290. [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
  291. 2012-07-03 16:21 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
  292. .
  293. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
  294. @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
  295. [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
  296. 2012-02-14 22:58 97792 ----a-w- c:\users\Bas\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
  297. .
  298. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
  299. @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
  300. [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
  301. 2012-02-14 22:58 97792 ----a-w- c:\users\Bas\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
  302. .
  303. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
  304. @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
  305. [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
  306. 2012-02-14 22:58 97792 ----a-w- c:\users\Bas\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
  307. .
  308. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
  309. @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
  310. [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
  311. 2012-02-14 22:58 97792 ----a-w- c:\users\Bas\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
  312. .
  313. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
  314. @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
  315. [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
  316. 2012-06-20 17:02 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
  317. .
  318. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
  319. @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
  320. [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
  321. 2012-06-20 17:02 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
  322. .
  323. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
  324. @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
  325. [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
  326. 2012-06-20 17:02 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
  327. .
  328. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
  329. @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
  330. [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
  331. 2012-06-20 17:02 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
  332. .
  333. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  334. "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
  335. "Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2012-05-21 6868280]
  336. "combofix"="c:\combofix\CF12687.3XE" [2010-11-20 345088]
  337. .
  338. ------- Bijkomende Scan -------
  339. .
  340. uLocal Page = c:\windows\system32\blank.htm
  341. mLocal Page = c:\windows\SysWOW64\blank.htm
  342. uInternet Settings,ProxyOverride = *.local
  343. IE: E&xporteren naar Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
  344. .
  345. .
  346. --------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
  347. .
  348. [HKEY_USERS\S-1-5-21-2001550640-3423300443-1715644720-1000\Software\SecuROM\License information*]
  349. "datasecu"=hex:2c,44,85,5a,07,da,1e,4a,01,d0,2e,59,3d,0a,a6,7c,32,23,74,70,4d,
  350. ea,55,3b,9b,08,cb,54,8f,6f,8c,32,ab,95,12,c3,9f,1b,d8,25,fc,c4,77,05,ff,5a,\
  351. "rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
  352. .
  353. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
  354. @Denied: (A 2) (Everyone)
  355. @="FlashBroker"
  356. "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101"
  357. .
  358. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
  359. "Enabled"=dword:00000001
  360. .
  361. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
  362. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe"
  363. .
  364. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
  365. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  366. .
  367. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
  368. @Denied: (A 2) (Everyone)
  369. @="Shockwave Flash Object"
  370. .
  371. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
  372. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
  373. "ThreadingModel"="Apartment"
  374. .
  375. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
  376. @="0"
  377. .
  378. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
  379. @="ShockwaveFlash.ShockwaveFlash.11"
  380. .
  381. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  382. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
  383. .
  384. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
  385. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  386. .
  387. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
  388. @="1.0"
  389. .
  390. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  391. @="ShockwaveFlash.ShockwaveFlash"
  392. .
  393. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
  394. @Denied: (A 2) (Everyone)
  395. @="Macromedia Flash Factory Object"
  396. .
  397. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
  398. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
  399. "ThreadingModel"="Apartment"
  400. .
  401. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
  402. @="FlashFactory.FlashFactory.1"
  403. .
  404. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
  405. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
  406. .
  407. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
  408. @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
  409. .
  410. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
  411. @="1.0"
  412. .
  413. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
  414. @="FlashFactory.FlashFactory"
  415. .
  416. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
  417. @Denied: (A 2) (Everyone)
  418. @="IFlashBroker4"
  419. .
  420. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
  421. @="{00020424-0000-0000-C000-000000000046}"
  422. .
  423. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  424. @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
  425. "Version"="1.0"
  426. .
  427. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
  428. @Denied: (A) (Users)
  429. @Denied: (A) (Everyone)
  430. @Allowed: (B 1 2 3 4 5) (S-1-5-20)
  431. "BlindDial"=dword:00000000
  432. .
  433. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
  434. @Denied: (Full) (Everyone)
  435. .
  436. ------------------------ Andere Aktieve Processen ------------------------
  437. .
  438. c:\program files\AVAST Software\Avast\AvastSvc.exe
  439. c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
  440. c:\windows\SysWOW64\PnkBstrA.exe
  441. d:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
  442. .
  443. **************************************************************************
  444. .
  445. Voltooingstijd: 2012-08-04 18:20:04 - machine werd herstart
  446. ComboFix-quarantined-files.txt 2012-08-04 16:20
  447. ComboFix2.txt 2012-08-03 15:22
  448. ComboFix3.txt 2012-08-01 18:25
  449. .
  450. Pre-Run: 105.263.677.440 bytes beschikbaar
  451. Post-Run: 104.769.851.392 bytes beschikbaar
  452. .
  453. - - End Of File - - D2A75161C91DB75E304456FB77F22F84
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!