Log m.b.t rare verwijslinks

• 

  Jack

  27-02-2013 00:23

  Ik heb sinds kort verwijslinks bij allerlei sites van ‘coupon dropdown’.

  Heb een systeemherstel gedaan van 3 weken gedaan, maar tot daar wil ik het gaan.

  Heb al add-ons gekeken bij Firefox, maar ik zie het daar ook niet staan

  Hier is m'n log:

  Bedankt alvast!

  Logfile of random's system information tool 1.09 (written by random/random)

  Run by Jacky at 2013-02-27 00:07:02

  Microsoft® Windows Vista™ Home Premium Service Pack 2

  System drive C: has 31 GB (10%) free of 299 GB

  Total RAM: 3071 MB (49% free)

  Logfile of Trend Micro HijackThis v2.0.4

  Scan saved at 0:07:19, on 27-2-2013

  Platform: Windows Vista SP2 (WinNT 6.00.1906)

  MSIE: Internet Explorer v7.00 (7.00.6002.18005)

  Boot mode: Normal

  Running processes:

  C:\Windows\system32\Dwm.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\Explorer.EXE

  C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe

  C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

  C:\Windows\RtHDVCpl.exe

  C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe

  C:\Windows\System32\rundll32.exe

  C:\Windows\WindowsMobile\wmdSync.exe

  C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  C:\Program Files\Rainmeter\Rainmeter.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\Program Files\Internet Explorer\iexplore.exe

  C:\Windows\system32\conime.exe

  C:\Windows\system32\SearchFilterHost.exe

  C:\Users\Jacky\Desktop\RSIT.exe

  C:\Program Files\Trend Micro\HijackThis\Jacky.exe

  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=1&o=vp32&d=1208&m=aspire_x1700

  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

  O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

  O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

  O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: “C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe” -s

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: %windir%\WindowsMobile\wmdSync.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKLM\..\Run: C:\Program Files\AVG\AVG10\avgtray.exe

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft LifeCam\LifeExp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: “C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesHelper.exe /s

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  O4 - HKCU\..\Run: “C:\Users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe” /c

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  O4 - Startup: Rainmeter (2).lnk = C:\Program Files\Rainmeter\Rainmeter.exe

  O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

  O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

  O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra ‘Tools’ menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

  O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra ‘Tools’ menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe

  O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)

  O16 - DPF: Yahoo! Word Racer - http://origin.games.yahoo.net/games/clients/y/wt1_x.cab

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab

  O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab

  O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.13.0.cab

  O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldnl-nl.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

  O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

  O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

  O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

  O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

  O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

  O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

  O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

  O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe

  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

  O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

  O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

  O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

  O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

  O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

  –

  End of file - 12946 bytes

  ======Scheduled tasks folder======

  C:\Windows\tasks\1-klik Onderhoud.job

  C:\Windows\tasks\Adobe Flash Player Updater.job

  C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-213022234-2777563534-4171869386-1000Core.job

  C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-213022234-2777563534-4171869386-1000UA.job

  =========Mozilla firefox=========

  ProfilePath - C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default

  prefs.js - “browser.search.suggest.enabled” - false

  prefs.js - “browser.search.useDBForOrder” - true

  prefs.js - “browser.startup.homepage” - “www.google.nl”

  prefs.js - “extensions.enabledItems” - “{3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1423, {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12, {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13, {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15, {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16, {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19, {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21, {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22, {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26, {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29, {20a82645-c095-46ed-80e3-08825760534b}:1.1, firefox@tvunetworks.com:2, 4, 9, 1, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.19”

  prefs.js - “keyword.URL” - “http://www.samenc.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=peBfhbuR&q=”

  “{20a82645-c095-46ed-80e3-08825760534b}”=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

  “{1E73965B-8B48-48be-9C8D-68B920ABC1C4}”=C:\Program Files\AVG\AVG10\Firefox4\

  “Description”=Adobe® Flash® Player 11.6.602.171 Plugin

  “Path”=C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll

  “Description”=Adobe Shockwave Player

  “Path”=C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll

  “Description”=DivX Web Player

  “Path”=C:\Program Files\DivX\DivX Web Player\npdivx32.dll

  “Description”=DivX® Player Plugin for VOD Content

  “Path”=C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll

  “Description”=

  “Path”=C:\Windows\system32\npdeployJava1.dll

  “Description”=Oracle® Next Generation Java™ Plug-In

  “Path”=C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

  “Description”=Ag Player Plugin

  “Path”=C:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll

  “Description”=Office Live Update v1.5

  “Path”=C:\Program Files\Microsoft\Office Live\npOLW.dll

  “Description”=Windows Presentation Foundation plug-in for Mozilla browsers

  “Path”=C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

  “Description”=TVU Web Player Plugin

  “Path”=C:\Windows\system32\TVUAx\npTVUAx.dll

  “Description”=RealPlayer™ LiveConnect-Enabled Plug-In

  “Path”=C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll

  “Description”=RealJukebox Netscape Plugin

  “Path”=C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll

  “Description”=6.0.12.69

  “Path”=C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll

  “Description”=Veetle TV Core

  “Path”=C:\Program Files\Veetle\plugins\npVeetle.dll

  “Description”=Veetle TV Player

  “Path”=C:\Program Files\Veetle\Player\npvlc.dll

  “Description”=Handles PDFs in-place in Firefox

  “Path”=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

  C:\Program Files\Mozilla Firefox\extensions\

  {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

  {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

  C:\Program Files\Mozilla Firefox\components\

  binary.manifest

  browsercomps.dll

  C:\Program Files\Mozilla Firefox\plugins\

  npdivx32.dll

  npDivxPlayerPlugin.dll

  npdnu.dll

  npdnupdater2.dll

  nppdf32.dll

  npwachk.dll

  C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\

  firefox@tvunetworks.com

  toolbar@ask.com

  C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\searchplugins\

  askcom.xml

  google-search.xml

  ======Registry dump======

  Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  BitComet Helper - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll

  AVG Safe Search - C:\Program Files\AVG\AVG10\avgssie.dll

  Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll

  Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  Google Toolbar Helper - c:\program files\google\googletoolbar1.dll

  Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll

  Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

  {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll

  {2C688203-7EB3-4327-9995-1CB417BA23F9} - BS.Player ControlBar - C:\Program Files\BS.Player ControlBar\BSToolbar.dll

  “Acer Empowering Technology Monitor”=C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  “EmpoweringTechnology”=C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe

  “eDataSecurity Loader”=C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

  “PCMMediaSharing”=C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe

  “RtHDVCpl”=C:\Windows\RtHDVCpl.exe

  “WarReg_PopUp”=C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe

  “00PCTFW”=C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe

  “NvCplDaemon”=C:\Windows\system32\NvCpl.dll

  “NvMediaCenter”=C:\Windows\system32\NvMcTray.dll

  “Windows Mobile-based device management”=C:\Windows\WindowsMobile\wmdSync.exe

  “NeroFilterCheck”=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

  “KiesTrayAgent”=C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  “AVG_TRAY”=C:\Program Files\AVG\AVG10\avgtray.exe

  “LifeCam”=C:\Program Files\Microsoft LifeCam\LifeExp.exe

  “Adobe ARM”=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

  “SunJavaUpdateSched”=C:\Program Files\Common Files\Java\Java Update\jusched.exe

  “ehTray.exe”=C:\Windows\ehome\ehTray.exe

  “TomTomHOME.exe”=C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

  “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  “KiesHelper”=C:\Program Files\Samsung\Kies\KiesHelper.exe

  “KiesTrayAgent”=C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  “KiesPDLR”=C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  “Google Update”=C:\Users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe

  “WMPNSCFG”=C:\Program Files\Windows Media Player\WMPNSCFG.exe

  C:\Program Files\AIM\aim.exe

  C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe

  C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe

  C:\Program Files\Casema\casema.exe

  C:\Program Files\DAEMON Tools Lite\daemon.exe

  C:\Program Files\DriverMax\devices.exe

  C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

  C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

  C:\Program Files\Skype\Phone\Skype.exe

  C:\PROGRA~1\WinZip\WZQKPICK.EXE

  C:\Users\Jacky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

  OneNote 2007 Schermopname en Snel starten.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  Rainmeter (2).lnk - C:\Program Files\Rainmeter\Rainmeter.exe

  “EnableLUA”=0

  “dontdisplaylastusername”=0

  “legalnoticecaption”=

  “legalnoticetext”=

  “shutdownwithoutlogon”=1

  “undockwithoutlogon”=1

  “EnableUIADesktopToggle”=0

  “NoDrives”=0

  “NoDrives”=0

  “BindDirectlyToPropertySetStorage”=0

  “C:\Program Files\PPMate\ppmate.exe”=“C:\Program Files\PPMate\ppmate.exe:*:Enabled:PPMate”

  “vidc.mrle”=msrle32.dll

  “vidc.msvc”=msvidc32.dll

  “msacm.imaadpcm”=imaadp32.acm

  “msacm.msg711”=msg711.acm

  “msacm.msgsm610”=msgsm32.acm

  “msacm.msadpcm”=msadp32.acm

  “midimapper”=midimap.dll

  “wavemapper”=msacm32.drv

  “VIDC.UYVY”=msyuv.dll

  “VIDC.YUY2”=msyuv.dll

  “VIDC.YVYU”=msyuv.dll

  “VIDC.IYUV”=iyuv_32.dll

  “VIDC.I420”=msh263.drv

  “VIDC.YVU9”=tsbyuv.dll

  “msacm.l3acm”=C:\Windows\System32\l3codeca.acm

  “vidc.cvid”=iccvid.dll

  “vidc.DIVX”=DivX.dll

  “vidc.yv12”=DivX.dll

  “msacm.ac3filter”=ac3filter.acm

  “vidc.ffds”=ff_vfw.dll

  “msacm.divxa32”=DivXa32.acm

  “wave”=wdmaud.drv

  “midi”=wdmaud.drv

  “mixer”=wdmaud.drv

  “aux”=wdmaud.drv

  “msacm.siren”=sirenacm.dll

  “MSVideo8”=VfWWDM32.dll

  “wave2”=wdmaud.drv

  “mixer2”=wdmaud.drv

  “wave1”=wdmaud.drv

  “mixer1”=wdmaud.drv

  “wave3”=wdmaud.drv

  “mixer3”=wdmaud.drv

  ======List of files/folders created in the last 1 month======

  2013-02-27 00:07:02 —-D—- C:\rsit

  2013-02-26 22:39:26 —-D—- C:\Program Files\ESET

  2013-02-26 22:29:32 —-A—- C:\AdwCleaner.txt

  2013-02-26 22:29:23 —-A—- C:\AdwCleaner.txt

  2013-02-19 19:34:44 —-D—- C:\Program Files\Mozilla Firefox(39)

  2013-02-01 01:20:24 —-D—- C:\Program Files\TornTV.com

  ======List of files/folders modified in the last 1 month======

  2013-02-26 23:21:37 —-D—- C:\Windows\temp

  2013-02-26 23:21:37 —-D—- C:\Windows\System32

  2013-02-26 23:21:35 —-A—- C:\Windows\system32\FlashPlayerApp.exe

  2013-02-26 22:39:33 —-D—- C:\Windows\system32\drivers

  2013-02-26 22:39:28 —-SD—- C:\Windows\Downloaded Program Files

  2013-02-26 22:39:26 —-RD—- C:\Program Files

  2013-02-26 22:27:31 —-AD—- C:\ProgramData\TEMP

  2013-02-26 22:11:04 —-D—- C:\Program Files\Malwarebytes' Anti-Malware

  2013-02-26 22:10:48 —-D—- C:\Windows\Prefetch

  2013-02-26 22:08:12 —-A—- C:\Windows\system32\PerfStringBackup.INI

  2013-02-26 22:08:11 —-D—- C:\Windows\inf

  2013-02-26 22:07:10 —-SHD—- C:\Windows\Installer

  2013-02-26 22:07:10 —-D—- C:\Windows\system32\drivers\AVG

  2013-02-26 22:07:00 —-SHD—- C:\System Volume Information

  2013-02-26 22:04:55 —-D—- C:\Windows\system32\catroot2

  2013-02-26 22:01:12 —-D—- C:\Program Files\PC Tools Firewall Plus

  2013-02-26 22:00:30 —-D—- C:\Windows\system32\Msdtc

  2013-02-26 22:00:28 —-D—- C:\Windows\system32\wbem

  2013-02-26 22:00:28 —-D—- C:\Windows

  2013-02-26 21:58:48 —-D—- C:\Windows\system32\config

  2013-02-26 21:58:38 —-D—- C:\Windows\Tasks

  2013-02-26 21:58:38 —-D—- C:\Windows\system32\Tasks

  2013-02-26 21:58:38 —-D—- C:\Windows\system32\spool

  2013-02-26 21:58:38 —-D—- C:\Windows\system32\CodeIntegrity

  2013-02-26 21:58:37 —-D—- C:\Users\Jacky\AppData\Roaming\vlc

  2013-02-26 21:58:37 —-D—- C:\Users\Jacky\AppData\Roaming\Rainmeter

  2013-02-26 21:58:37 —-D—- C:\Users\Jacky\AppData\Roaming\Mozilla

  2013-02-26 21:58:34 —-D—- C:\Program Files\Winamp

  2013-02-26 21:58:34 —-D—- C:\Program Files\Opera

  2013-02-26 21:58:34 —-D—- C:\Program Files\Mozilla Maintenance Service

  2013-02-26 21:58:34 —-D—- C:\Program Files\Mozilla Firefox

  2013-02-26 21:58:33 —-D—- C:\Program Files\Full Tilt Poker

  2013-02-26 21:58:31 —-D—- C:\Windows\registration

  2013-02-25 22:57:32 —-D—- C:\Users\Jacky\AppData\Roaming\Skype

  2013-02-13 22:20:30 —-D—- C:\Windows\Minidump

  2013-02-05 03:36:14 —-D—- C:\Downloads

  2013-02-04 02:51:15 —-A—- C:\Windows\NeroDigital.ini

  2013-01-30 15:58:13 —-D—- C:\Users\Jacky\AppData\Roaming\Belastingdienst

  ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

  R0 AVGIDSEH;AVGIDSEH; C:\Windows\system32\DRIVERS\AVGIDSEH.Sys

  R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx86.sys

  R0 Lbd;Lbd; C:\Windows\system32\DRIVERS\Lbd.sys

  R0 nvstor32;nvstor32; C:\Windows\system32\DRIVERS\nvstor32.sys

  R0 PSDFilter;PSDFilter; C:\Windows\system32\DRIVERS\psdfilter.sys

  R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys

  R0 UBHelper;UBHelper; C:\Windows\system32\drivers\UBHelper.sys

  R1 Avgldx86;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx86.sys

  R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx86.sys

  R1 Avgtdix;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdix.sys

  R1 pctgntdi;pctgntdi; \??\C:\Windows\System32\drivers\pctgntdi.sys

  R2 int15;int15; \??\C:\Windows\system32\drivers\int15.sys

  R2 PCTAppEvent;PCTAppEvent Driver; \??\C:\Windows\system32\drivers\PCTAppEvent.sys

  R2 PSDNServ;PSDNServ; C:\Windows\system32\DRIVERS\PSDNServ.sys

  R2 psdvdisk;PSDVdisk; C:\Windows\system32\DRIVERS\PSDVdisk.sys

  R2 RMCAST;RMCAST (Pgm)-protocolstuurprogramma; C:\Windows\system32\DRIVERS\RMCAST.sys

  R2 tvicport;tvicport; \??\C:\Windows\system32\drivers\tvicport.sys

  R2 zntport;zntport; \??\C:\Windows\system32\drivers\zntport.sys

  R3 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys

  R3 AVGIDSFilter;AVGIDSFilter; C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys

  R3 AVGIDSShim;AVGIDSShim; C:\Windows\system32\DRIVERS\AVGIDSShim.Sys

  R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS

  R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys

  R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver; C:\Windows\System32\Drivers\nx6000.sys

  R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys

  R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys

  R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys

  R3 pctplfw;pctplfw; \??\C:\Windows\System32\drivers\pctplfw.sys

  R3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS

  R3 SFilter;PCTools Driver; C:\Windows\system32\DRIVERS\pctfw.sys

  R3 usbaudio;Stuurprogramma voor USB-audio (WDM); C:\Windows\system32\drivers\usbaudio.sys

  R3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys

  S3 au8b8hd9;au8b8hd9; C:\Windows\system32\drivers\au8b8hd9.sys

  S3 catchme;catchme; \??\C:\ComboFix\catchme.sys

  S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys

  S3 dgderdrv;dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys

  S3 drmkaud;Microsoft Kernel DRM-audiodecoder; C:\Windows\system32\drivers\drmkaud.sys

  S3 HdAudAddService;Microsoft 1.1 UAA Functiestuurprogramma voor High Definition Audio-service; C:\Windows\system32\drivers\HdAudio.sys

  S3 MSKSSRV;Microsoft Streaming Service-proxy; C:\Windows\system32\drivers\MSKSSRV.sys

  S3 MSPCLOCK;Microsoft Streaming Clock-proxy; C:\Windows\system32\drivers\MSPCLOCK.sys

  S3 MSPQM;Microsoft Streaming Kwaliteitsbeheer Proxy; C:\Windows\system32\drivers\MSPQM.sys

  S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-conversieprogramma; C:\Windows\system32\drivers\MSTEE.sys

  S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys

  S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys

  S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys

  S3 PD0620VID;Creative WebCam Instant; C:\Windows\system32\DRIVERS\P0620Vid.sys

  S3 Revoflt;Revoflt; C:\Windows\system32\DRIVERS\revoflt.sys

  S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys

  S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys

  S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys

  S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys

  S3 usb_rndisx;USB RNDIS-adapter; C:\Windows\system32\DRIVERS\usb8023x.sys

  S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys

  S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys

  S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys

  S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys

  ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

  R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

  R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

  R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG10\avgwdsvc.exe

  R2 BUNAgentSvc;NTI Backup Now 5 Agent Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

  R2 eDataSecurity Service;eDataSecurity Service; C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

  R2 ETService;Empowering Technology Service; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

  R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe

  R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe

  R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS32.exe

  R2 NTIBackupSvc;NTI Backup Now 5 Backup Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

  R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

  R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe

  R2 PCToolsFirewallPlus;PC Tools Firewall Plus; C:\Program Files\PC Tools Firewall Plus\FWService.exe

  R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe

  R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe

  R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  R2 simptcp;@%SystemRoot%\system32\simptcp.dll,-200; C:\Windows\System32\tcpsvcs.exe

  R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

  R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe

  R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe

  R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

  R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

  R3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe

  R3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

  S2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

  S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

  S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe

  S2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe

  S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

  S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

  S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

  S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

  —————–EOF—————–

  # AdwCleaner v2.113 - Verslag gemaakt op 26/02/2013 om 22:29:32

  # Geactualiseerd op 23/02/2013 door Xplode

  # Besturingssysteem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)

  # Gebruiker : Jacky - PC_VAN_JACKY

  # Opstarten Modus : Normale modus

  # Gelanceerd vanaf : C:\Users\Jacky\Desktop\adwcleaner.exe

  # Optie

  ***** *****

  ***** *****

  File Aanwezig : C:\Program Files\Mozilla Firefox\plugins\npdnu.dll

  File Aanwezig : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll

  File Aanwezig : C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\searchplugins\Askcom.xml

  Map Aanwezig : C:\Program Files\Common Files\Software Update Utility

  Map Aanwezig : C:\Program Files\TornTV.com

  Map Aanwezig : C:\Users\Jacky\AppData\Local\AskToolbar

  Map Aanwezig : C:\Users\Jacky\AppData\LocalLow\AskToolbar

  Map Aanwezig : C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com

  Map Aanwezig : C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\jetpack

  Map Aanwezig : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

  ***** *****

  Sleutel Aanwezig : HKCU\Software\1ClickDownload

  Sleutel Aanwezig : HKCU\Software\APN

  Sleutel Aanwezig : HKCU\Software\AppDataLow\AskToolbarInfo

  Sleutel Aanwezig : HKCU\Software\AppDataLow\Software\AskToolbar

  Sleutel Aanwezig : HKCU\Software\Ask.com

  Sleutel Aanwezig : HKCU\Software\AskToolbar

  Sleutel Aanwezig : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

  Sleutel Aanwezig : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

  Sleutel Aanwezig : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

  Sleutel Aanwezig : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\1ClickDownload

  Sleutel Aanwezig : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility

  Sleutel Aanwezig : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

  Sleutel Aanwezig : HKCU\Software\Softonic

  Sleutel Aanwezig : HKLM\Software\APN

  Sleutel Aanwezig : HKLM\Software\AskToolbar

  Sleutel Aanwezig : HKLM\Software\AVG Secure Search

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\AppID\dnu.EXE

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\dnUpdate

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1

  Sleutel Aanwezig : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

  Sleutel Aanwezig : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

  Sleutel Aanwezig : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

  Sleutel Aanwezig : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf

  Sleutel Aanwezig : HKLM\SOFTWARE\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla

  Sleutel Aanwezig : HKLM\Software\Iminent

  Sleutel Aanwezig : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

  Sleutel Aanwezig : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar

  Sleutel Aanwezig : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5BAE2ED018083A4C8DA86D6E3F4B024

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E

  Sleutel Aanwezig : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

  Sleutel Aanwezig : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

  Sleutel Aanwezig : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload

  Sleutel Aanwezig : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility

  Sleutel Aanwezig : HKU\S-1-5-21-213022234-2777563534-4171869386-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

  ***** *****

  -\\ Internet Explorer v7.0.6002.18005

  Het register bevat geen enkele ongeoorloofde invoer.

  -\\ Mozilla Firefox v15.0 (en-US)

  File : C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\prefs.js

  Aanwezig : user_pref(“browser.search.defaultengine”, “Ask.com”);

  Aanwezig : user_pref(“browser.search.defaultenginename”, “Ask.com”);

  Aanwezig : user_pref(“browser.search.order.1”, “Ask.com”);

  Aanwezig : user_pref(“extensions.asktb.InstallDir”, “C:\\Program Files\\Ask.com\\”);

  Aanwezig : user_pref(“extensions.asktb.build”, “19379”);

  Aanwezig : user_pref(“extensions.asktb.cbid”, “EV”);

  Aanwezig : user_pref(“extensions.asktb.config-updated”, true);

  Aanwezig : user_pref(“extensions.asktb.default-channel-url-mask”, "hxxp://nl.ask.com/web?q={query}&qsrc={qsrc}&

  Aanwezig : user_pref(“extensions.asktb.dtid”, “YYYYYYYYNL”);

  Aanwezig : user_pref(“extensions.asktb.ff-original-keyword-url”, "hxxp://www.samenc.com/search/?ie=UTF-8&oe=UTF

  Aanwezig : user_pref(“extensions.asktb.fresh-install”, false);

  Aanwezig : user_pref(“extensions.asktb.guid”, “F2D27D2C-25AB-413A-BB09-244C5185B314”);

  Aanwezig : user_pref(“extensions.asktb.hxxp-header-whitelist-hosts”, "[\“static-dev.en.dev.ask.com\”, \"ask.com

  Aanwezig : user_pref(“extensions.asktb.if”, “su”);

  Aanwezig : user_pref(“extensions.asktb.l”, “dis”);

  Aanwezig : user_pref(“extensions.asktb.last-config-req”, “1356219313372”);

  Aanwezig : user_pref(“extensions.asktb.locale”, “nl_NL”);

  Aanwezig : user_pref(“extensions.asktb.location”, “The Hague,ZH,Netherlands”);

  Aanwezig : user_pref(“extensions.asktb.nero.userName”, “”);

  Aanwezig : user_pref(“extensions.asktb.o”, “101917”);

  Aanwezig : user_pref(“extensions.asktb.overlay-reloaded-using-restart”, true);

  Aanwezig : user_pref(“extensions.asktb.qsrc”, “2871”);

  Aanwezig : user_pref(“extensions.asktb.r”, “6”);

  Aanwezig : user_pref(“extensions.asktb.sa”, “YES”);

  Aanwezig : user_pref(“extensions.asktb.saguid”, “1514A362-B8B2-4749-83DD-A1DAE52EDEA0”);

  Aanwezig : user_pref(“extensions.asktb.search-suggestions-enabled”, true);

  Aanwezig : user_pref(“extensions.asktb.silent-upgrade”, true);

  Aanwezig : user_pref(“extensions.asktb.silent-upgrade-from-pre-newtabs-build”, true);

  Aanwezig : user_pref(“extensions.asktb.themeid”, “”);

  Aanwezig : user_pref(“extensions.asktb.timeinstalled”, “11-10-2011 11:08:19”);

  Aanwezig : user_pref(“extensions.asktb.v”, “3.13.1.100013”);

  Aanwezig : user_pref(“extensions.asktb.version”, “5.13.2.19379”);

  -\\ Opera v12.13.1734.0

  File : C:\Users\Jacky\AppData\Roaming\Opera\Opera\operaprefs.ini

  De file bevat geen enkele ongeoorloofde invoer.

  *************************

  AdwCleaner.txt - -

  AdwCleaner.txt - -

  ########## EOF - C:\AdwCleaner.txt - ##########

  Malwarebytes Anti-Malware 1.70.0.1100

  www.malwarebytes.org

  Databaseversie: v2013.02.26.10

  Windows Vista Service Pack 2 x86 NTFS

  Internet Explorer 7.0.6002.18005

  Jacky :: PC_VAN_JACKY

  26-2-2013 22:30:53

  mbam-log-2013-02-26 (22-30-53).txt

  Scan type: Snelle scan

  Ingeschakelde scan opties: Geheugen | Opstartitems | Register | Bestanden en mappen | Heuristiek/Extra | Heuristiek/Shuriken | PUP | PUM

  Uitgeschakelde scan opties: P2P

  Objecten gescand: 213458

  Verstreken tijd: 7 minuut/minuten, 38 seconde(n)

  Geheugenprocessen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Geheugenmodulen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registersleutels gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerwaarden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Registerdata gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Mappen gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  Bestanden gedetecteerd: 0

  (Geen kwaadaardige objecten gedetecteerd)

  (einde)

  Rapporteren
• 

  Jack

  27-02-2013 01:22

  Ik kom nu pas achter dat het oa. door ‘Torntv’ is gebeurd, maar heb het nu verwijderd en het blijft nog steeds terugkomen..

  Rapporteren
• 

  Ben

  27-02-2013 08:38

  Hallo,

  Voer AdwCleaner nogmaals uit en kies verwijderen.

  Download zoek.exe naar het bureaublad.

  *Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe

  (hier of hier) kan je lezen hoe je dat doet.

  * Dubbelklik op Zoek.exe om de tool te starten.

  * Windows Vista, 7 en 8 gebruikers dienen de tool als “administrator” uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.

  * Kopieer nu onderstaande Vet gedrukte en plak die in het grote invulvenster:

  * Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkwaardig probleem.

  emptyclsid;

  C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com;f

  C:\Program Files\TornTV.com;f

  au8b8hd9;s

  C:\Windows\system32\drivers\au8b8hd9.sys;f

  C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\searchplugins\Askcom.xml;f

  * Klik op de button "Options" en vink nu de onderstaande opties aan.

  * Standaard Search

  * Auto Clean

  * Empty All Temp

  * Klik nu op de knop "Run script".

  * Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).

  * Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.

  * Post nu de inhoud van het geopende logje in het volgende bericht.

  Gr.Ben

  Rapporteren
• 

  Jack

  27-02-2013 12:57

  Zoek.exe Version 4.0.0.2 Beta Updated 27-02-2013

  Tool run by Jacky on wo 27-02-2013 at 12:43:39,64.

  Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86

  Running in: Normal Mode Internet Access Detected

  ==== Creating Sample_27-02-2013_1246.zip ======================

  Process rundll32.exe killed

  Copied file C:\Users\Jacky\adwcleaner.exe to sample

  sample\adwcleaner.exe renamed to 6D69000BB6FFD6585C9F49720205EB78

  C:\Users\Public\Desktop\sample_27-02-2013_1246.zip created successfully

  ==== Deleting CLSID Registry Keys ======================

  HKEY_USERS\S-1-5-21-213022234-2777563534-4171869386-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} deleted successfully

  ==== Deleting CLSID Registry Values ======================

  ==== Running Processes ======================

  C:\Windows\System32\smss.exe

  C:\Windows\system32\csrss.exe

  C:\Windows\system32\wininit.exe

  C:\Windows\system32\csrss.exe

  C:\Windows\system32\services.exe

  C:\Windows\system32\lsass.exe

  C:\Windows\system32\lsm.exe

  C:\Windows\system32\winlogon.exe

  C:\Windows\system32\nvvsvc.exe

  C:\Windows\system32\SLsvc.exe

  C:\Windows\System32\spoolsv.exe

  C:\Windows\system32\Dwm.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\Explorer.EXE

  C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe

  C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe

  C:\Windows\RtHDVCpl.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\WindowsMobile\wmdSync.exe

  C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  C:\Program Files\AVG\AVG10\avgtray.exe

  C:\Program Files\Common Files\Java\Java Update\jusched.exe

  C:\Windows\ehome\ehtray.exe

  C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

  C:\Windows\ehome\ehmsas.exe

  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

  C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  C:\Program Files\Windows Media Player\wmpnscfg.exe

  C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  C:\Program Files\Rainmeter\Rainmeter.exe

  C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

  C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

  C:\Program Files\AVG\AVG10\avgwdsvc.exe

  C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

  C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

  C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

  C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

  C:\Windows\system32\FsUsbExService.Exe

  C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  C:\Program Files\Microsoft LifeCam\MSCamS32.exe

  C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

  C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

  C:\Windows\system32\IoctlSvc.exe

  C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  C:\Windows\System32\tcpsvcs.exe

  C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

  C:\Windows\System32\TUProgSt.exe

  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

  C:\Windows\system32\SearchIndexer.exe

  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

  C:\Program Files\Windows Media Player\wmpnetwk.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

  C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

  C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

  C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

  C:\Program Files\Common Files\Java\Java Update\jucheck.exe

  C:\Windows\System32\notepad.exe

  C:\Windows\system32\taskeng.exe

  C:\Windows\system32\conime.exe

  C:\Users\Jacky\Desktop\zoek.exe

  C:\Windows\system32\SearchProtocolHost.exe

  C:\Windows\system32\SearchFilterHost.exe

  C:\Windows\system32\svchost.exe -k DcomLaunch

  C:\Windows\system32\svchost.exe -k rpcss

  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

  C:\Windows\system32\svchost.exe -k netsvcs

  C:\Windows\system32\svchost.exe -k LocalService

  C:\Windows\system32\svchost.exe -k NetworkService

  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

  C:\Windows\system32\svchost.exe -k imgsvc

  C:\Windows\System32\svchost.exe -k WerSvcGroup

  C:\Windows\system32\svchost.exe -k WindowsMobile

  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

  ==== Deleting Services ======================

  ==== FireFox Fix ======================

  ProfilePath: C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default

  —- Lines ask.com removed from prefs.js —-

  user_pref(“browser.search.defaultengine”, “Ask.com”);

  user_pref(“browser.search.defaultenginename”, “Ask.com”);

  user_pref(“browser.search.order.1”, “Ask.com”);

  user_pref(“extensions.asktb.InstallDir”, “C:\\Program Files\\Ask.com\\”);

  user_pref(“extensions.asktb.default-channel-url-mask”, “http://nl.ask.com/web?q={query}&qsrc={qsrc}&o={o}&l={l}&dm=lang”);

  user_pref(“extensions.asktb.http-header-whitelist-hosts”, "");

  —- Lines ask.com modified from prefs.js —-

  user_pref(“extensions.installCache”, "");

  —- Lines ask.com removed from user.js —-

  —- Lines asktb removed from prefs.js —-

  user_pref(“extensions.asktb.build”, “19379”);

  user_pref(“extensions.asktb.cbid”, “EV”);

  user_pref(“extensions.asktb.config-updated”, true);

  user_pref(“extensions.asktb.dtid”, “YYYYYYYYNL”);

  user_pref(“extensions.asktb.ff-original-keyword-url”, “http://www.samenc.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=peBfhbuR&q=”);

  user_pref(“extensions.asktb.fresh-install”, false);

  user_pref(“extensions.asktb.guid”, “F2D27D2C-25AB-413A-BB09-244C5185B314”);

  user_pref(“extensions.asktb.if”, “su”);

  user_pref(“extensions.asktb.l”, “dis”);

  user_pref(“extensions.asktb.last-config-req”, “1356219313372”);

  user_pref(“extensions.asktb.locale”, “nl_NL”);

  user_pref(“extensions.asktb.location”, “The Hague,ZH,Netherlands”);

  user_pref(“extensions.asktb.nero.userName”, “”);

  user_pref(“extensions.asktb.o”, “101917”);

  user_pref(“extensions.asktb.overlay-reloaded-using-restart”, true);

  user_pref(“extensions.asktb.qsrc”, “2871”);

  user_pref(“extensions.asktb.r”, “6”);

  user_pref(“extensions.asktb.sa”, “YES”);

  user_pref(“extensions.asktb.saguid”, “1514A362-B8B2-4749-83DD-A1DAE52EDEA0”);

  user_pref(“extensions.asktb.search-suggestions-enabled”, true);

  user_pref(“extensions.asktb.silent-upgrade-from-pre-newtabs-build”, true);

  user_pref(“extensions.asktb.silent-upgrade”, true);

  user_pref(“extensions.asktb.themeid”, “”);

  user_pref(“extensions.asktb.timeinstalled”, “11-10-2011 11:08:19”);

  user_pref(“extensions.asktb.v”, “3.13.1.100013”);

  user_pref(“extensions.asktb.version”, “5.13.2.19379”);

  —- Lines asktb modified from prefs.js —-

  —- Lines asktb removed from user.js —-

  —- FireFox user.js and prefs.js backups —-

  user_27-02-2013_1246_.backup

  prefs_27-02-2013_1246_.backup

  ==== Deleting Files \ Folders ======================

  “C:\Program Files\TornTV.com” not found

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\searchplugins\askcom.xml” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\searchplugins\google-search.xml” deleted

  “C:\Users\Jacky\adwcleaner.exe” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\datastore” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\defaults” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\logs” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\searchplugins” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\content” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\skin” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Fri-10-Jun-2011-21-57-16-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Mon-07-Nov-2011-22-21-19-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Mon-27-Sep-2010-17-54-35-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sat-06-Aug-2011-00-08-24-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sat-20-Nov-2010-23-04-03-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sun-16-Jan-2011-14-45-36-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sun-18-Nov-2012-00-04-49-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sun-20-Mar-2011-23-35-59-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sun-24-Jun-2012-10-12-13-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sun-24-Jun-2012-10-12-17-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Thu-22-Sep-2011-23-50-20-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-04-Jan-2011-19-38-52-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-11-Oct-2011-09-08-31-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-31-May-2011-10-45-40-GMT” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com\defaults\preferences” deleted

  “C:\Users\Jacky\AppData\Local\AskToolbar” deleted

  “C:\Users\Jacky\AppData\LocalLow\AskToolbar” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\jetpack” deleted

  “C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}” deleted

  “C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default\extensions\toolbar@ask.com” deleted

  ==== System Specs ======================

  Windows: Windows Vista Home Premium Edition Service Pack 2 (Build 6002)

  Internet Explorer: 7.0.6002.18005

  Memory (RAM): 3071 MB

  CPU Info: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz

  CPU Speed: 2464,5 MHz

  Sound Card: Luidsprekers (Realtek High Defi |

  Realtek Digital Output (Realtek |

  Realtek Digital Output(Optical) |

  Display Adapters: NVIDIA GeForce 9300 GE | NVIDIA GeForce 9300 GE | RDPDD Chained DD | RDP Encoder Mirror Driver

  Monitors: 1x; SyncMaster T200/T200G,SyncMaster Magic T200/T200G(Digital) |

  Screen Resolution: 1680 X 1050 - 32 bit

  Network: Network Present

  Network Adapters: NVIDIA nForce Networking Controller

  CD / DVD Drives: 2x (E: | G: | ) E: HL-DT-STDVDRAM GH15F | G: YLY I7C9QVKH2

  Ports: COM1 LPT Port NOT Present.

  Mouse: 3 Button Wheel Mouse Present

  Hard Disks: C: 291,5GB | D: 291,5GB

  Hard Disks - Free: C: 32,0GB | D: 122,9GB

  Manufacturer *: American Megatrends Inc.

  BIOS Info: AT/AT COMPATIBLE | 09/12/08 | ACRSYS - 20080912

  Time Zone: West-Europa (standaardtijd)

  Motherboard *: Acer Aspire X1700

  Sun Java version: 1.6.0_35

  Country: Nederland

  Language: NLD

  ==== Files Recently Created / Modified ======================

  ====== C:\Windows ====

  ====== C:\Users\Jacky\AppData\Local\Temp ====

  2013-02-26 23:37:01 C90FFA4142A3E94EEC74FE8EB26BF794 44853328 —-a-w- C:\Users\Jacky\AppData\Local\Temp\SHSetup.exe

  ====== C:\Windows\system32 =====

  ====== C:\Windows\system32\drivers =====

  ====== C:\Windows\Tasks ======

  ====== C:\Windows\Temp ======

  ======= C:\Program Files =====

  ======= C: =====

  2013-02-26 21:29:32 0DED64FF895FAA7DF0263158E93A2DF2 11135 —-a-w- C:\AdwCleaner.txt

  2013-02-26 21:29:23 1993121CF6796743A42F4E15AA846380 11074 —-a-w- C:\AdwCleaner.txt

  ====== C:\Users\Jacky\AppData\Roaming ======

  ====== C:\Users\Jacky ======

  ====== C: exe-files ==

  2013-02-27 00:18:40 6B110E925294547A7D288F26DA19D199 179687 —-a-w- C:\Windows\0AC0F1B261C74B6EACEF58FCC0B94835.TMP\WiseCustomCalla18.exe

  2013-02-26 23:37:36 3EA9770BD2DC4F270E00AEDA2B6D640E 180902 —-a-w- C:\Windows\0AC0F1B261C74B6EACEF58FCC0B94835.TMP\WiseCustomCalla22.exe

  2013-02-26 23:37:01 C90FFA4142A3E94EEC74FE8EB26BF794 44853328 —-a-w- C:\Users\Jacky\AppData\Local\temp\SHSetup.exe

  2013-02-26 23:06:26 69CA82A7482A00D8EE063D2B97FC4338 781383 —-a-w- C:\Users\Jacky\Desktop\RSIT.exe

  2013-02-26 21:12:54 6D69000BB6FFD6585C9F49720205EB78 594019 —-a-w- C:\Users\Jacky\Downloads\adwcleaner.exe

  2013-02-26 21:10:19 74E337FFEB2B34043F8499D2F3DE03A8 59784 —-atw- C:\Users\Jacky\AppData\Local\Google\Update\1.3.21.135\GoogleUpdateOnDemand.exe

  2013-02-26 21:10:19 376ECCCE33C2C232112DE830E3C81763 59784 —-atw- C:\Users\Jacky\AppData\Local\Google\Update\1.3.21.135\GoogleUpdateBroker.exe

  2013-02-26 21:10:16 984CC93BB0EF86A0B4825269D8379D81 774424 —-a-w- C:\Users\Jacky\AppData\Local\Google\Update\1.3.21.135\GoogleUpdateSetup.exe

  2013-02-26 21:06:13 B676429E44F2F8ACC3BAE7C89F46B212 281480 —-atw- C:\Users\Jacky\AppData\Local\Google\Update\1.3.21.135\GoogleCrashHandler64.exe

  2013-02-26 21:05:41 BECDDA0990DEBD72A30096533521AD73 213384 —-atw- C:\Users\Jacky\AppData\Local\Google\Update\1.3.21.135\GoogleCrashHandler.exe

  2013-02-26 21:04:59 506708142BC63DABA64F2D3AD1DCD5BF 116648 —-atw- C:\Users\Jacky\AppData\Local\Google\Update\1.3.21.135\GoogleUpdate.exe

  2013-02-26 21:04:52 984CC93BB0EF86A0B4825269D8379D81 774424 —-a-w- C:\Users\Jacky\AppData\Local\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.21.135\GoogleUpdateSetup.exe

  2013-02-21 15:35:24 73BE2813C0517F625CAF29F8124A5E39 4260472 —-a-w- C:\Program Files\AVG\AVG10\avgcremx.exe

  === C: other files ==

  2013-02-27 11:46:11 85CAAB53D218B0434F01759F56C09614 577948 —-a-w- C:\Users\Public\Desktop\sample_27-02-2013_1246.zip

  2013-02-27 11:33:48 43C48039EB12D86C711B16CA12322B96 1156277 —-a-w- C:\ProgramData\AVG10\IDS\quarantine\9b58061a-ffff-ffff-8000-000000000000.zip

  ==== Startup Registry Enabled ======================

  “ehTray.exe”=“C:\Windows\ehome\ehTray.exe”

  “TomTomHOME.exe”=“C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe”

  “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  “KiesHelper”=“C:\Program Files\Samsung\Kies\KiesHelper.exe /s”

  “KiesTrayAgent”=“C:\Program Files\Samsung\Kies\KiesTrayAgent.exe”

  “KiesPDLR”=“C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe”

  “Google Update”=“C:\Users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe /c”

  “WMPNSCFG”=“C:\Program Files\Windows Media Player\WMPNSCFG.exe”

  “Acer Empowering Technology Monitor”=“C:\Program Files\Acer\Empowering Technology\SysMonitor.exe”

  “EmpoweringTechnology”=“C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot”

  “eDataSecurity Loader”=“C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe”

  “PCMMediaSharing”=“C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe”

  “RtHDVCpl”=“RtHDVCpl.exe”

  “WarReg_PopUp”=“C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe”

  “00PCTFW”=“C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe -s”

  “NvCplDaemon”=“RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup”

  “NvMediaCenter”=“RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit”

  “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe”

  “KiesTrayAgent”=“C:\Program Files\Samsung\Kies\KiesTrayAgent.exe”

  “AVG_TRAY”=“C:\Program Files\AVG\AVG10\avgtray.exe”

  “LifeCam”=“C:\Program Files\Microsoft LifeCam\LifeExp.exe”

  “Adobe ARM”=“C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  “SunJavaUpdateSched”=“C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  “Windows Mobile-based device management”=“%windir%\WindowsMobile\wmdSync.exe ”

  “ehTray.exe”=“C:\Windows\ehome\ehTray.exe”

  “TomTomHOME.exe”=“C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe”

  “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  “KiesHelper”=“C:\Program Files\Samsung\Kies\KiesHelper.exe /s”

  “KiesTrayAgent”=“C:\Program Files\Samsung\Kies\KiesTrayAgent.exe”

  “KiesPDLR”=“C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe”

  “Google Update”=“C:\Users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe /c”

  “WMPNSCFG”=“C:\Program Files\Windows Media Player\WMPNSCFG.exe”

  ==== Startup Registry Disabled ======================

  “key”=“SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run”

  “item”=“Aim”

  “hkey”=“HKCU”

  “command”=“\”C:\\Program Files\\AIM\\aim.exe\“ /d locale=en-US”

  “key”=“SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run”

  “item”=“AutoStartNPSAgent”

  “hkey”=“HKCU”

  “command”=“C:\\Program Files\\Samsung\\Samsung New PC Studio\\NPSAgent.exe”

  “key”=“SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run”

  “item”=“BkupTray”

  “hkey”=“HKLM”

  “command”=“\”C:\\Program Files\\NewTech Infosystems\\NTI Backup Now 5\\BkupTray.exe\“”

  “key”=“SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run”

  “item”=“Casema Installatie”

  “hkey”=“HKLM”

  “command”=“\”C:\\Program Files\\Casema\\casema.exe\“”

  “key”=“SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run”

  “item”=“DAEMON Tools Lite”

  “hkey”=“HKCU”

  “command”=“C:\\Program Files\\DAEMON Tools Lite\\daemon.exe -autorun”

  “key”=“SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run”

  “item”=“DriverMax”

  “hkey”=“HKCU”

  “command”=“\”C:\\Program Files\\DriverMax\\devices.exe\“ -agent”

  “key”=“SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run”

  “item”=“Malwarebytes Anti-Malware (reboot)”

  “hkey”=“HKLM”

  “command”=“\”C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe\“ /runcleanupscript”

  “key”=“SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run”

  “item”=“PlusService”

  “hkey”=“HKLM”

  “command”=“C:\\Program Files\\Yuna Software\\Messenger Plus!\\PlusService.exe”

  “key”=“SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run”

  “item”=“Skype”

  “hkey”=“HKCU”

  “command”=“\”C:\\Program Files\\Skype\\Phone\\Skype.exe\“ /minimized /regrun”

  “path”=“C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WinZip Quick Pick.lnk”

  “backup”=“C:\\Windows\\pss\\WinZip Quick Pick.lnk.CommonStartup”

  “backupExtension”=“.CommonStartup”

  “command”=“C:\\PROGRA~1\\WinZip\\WZQKPICK.EXE ”

  “item”=“WinZip Quick Pick”

  ==== Startup Folders ======================

  2010-07-28 16:15:03 1119 —-a-w- C:\users\Jacky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Schermopname en Snel starten.lnk

  2010-05-01 09:24:04 1690 —-a-w- C:\users\Jacky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter (2).lnk

  ==== Task Scheduler Jobs ======================

  C:\Windows\tasks\Adobe Flash Player Updater.job –a—— C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

  C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-213022234-2777563534-4171869386-1000UA.job –a—— C:\Users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe

  ==== Firefox Extensions ======================

  ProfilePath: C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default

  - TVU Web Player - %ProfilePath%\extensions\firefox@tvunetworks.com

  - Microsoft .NET Framework Assistant - %ProfilePath%\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi

  AppDir: C:\Program Files\Mozilla Firefox

  - Undetermined - %AppDir%\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

  - Undetermined - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

  - BS.Player ControlBar - %AppDir%\extensions\BSToolbar@toolbarnet.com

  ==== Firefox Plugins ======================

  Profilepath: C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default

  E64819B6014A93E2503BB52419A0F6F3 - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll - Shockwave Flash

  E0FF893763BA82BAABB869A351F0C455 - C:\Users\Jacky\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll - Google Update

  F647D0BEA553C1D0C251CE07DA6A5511 - C:\Program Files\Adobe\Reader 10.0\Reader\browser\nppdf32.dll - Adobe Acrobat

  F647D0BEA553C1D0C251CE07DA6A5511 - C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll - Adobe Acrobat

  DB988B4550DB9BCE86F9199D961057FC - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll - Adobe Acrobat

  0D71354BF758537E6289AED18F7F85A7 - C:\Users\Jacky\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll - Google Talk Plugin Video Accelerator

  1FB3BA0F4D45A301CEFEA82BB3E6C65A - C:\Users\Jacky\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin

  7B000D95ABFE622F17709D36AF44FBD3 - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll - Java(TM) Platform SE 6 U35

  6CD3A99DCEDE9C2D7D3BFBF6D4902F5F - C:\Windows\system32\npdeployJava1.dll - Java Deployment Toolkit 6.0.350.10

  8FE7BA502945BE735D09D5703BD76FDA - C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll - Shockwave for Director / Shockwave for Director

  F950066F07AD4952B291BF712BA40367 - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll - Winamp Application Detector

  36A0F250C766D27BFE5A953C1A65B696 - C:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll - Silverlight Plug-In

  24E990B1E6D55428001843CF7217DD81 - C:\Program Files\Microsoft\Office Live\npOLW.dll - Microsoft Office Live Plug-in for Firefox / Microsoft Office Live Plug-in for Firefox

  8E9A08E2092B3E1ADFF3C46BC1A5124B - C:\Windows\system32\TVUAx\npTVUAx.dll - TVU Web Player for FireFox

  3152EC8D9F60C4A5AE76FE20D90E10D7 - C:\Program Files\Veetle\plugins\npVeetle.dll - Veetle TV Core

  8E753B080E0A0CF0B4651187D414059F - C:\Program Files\Veetle\Player\npvlc.dll - Veetle TV Player

  323FE218DAC089EED70CA55E6C1C2F1D - C:\Program Files\Mozilla Firefox\plugins\npdnu.dll - downloadUpdater

  DBE8C34758DA614F35AE7011284406BB - C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll - downloadUpdater2

  EA85C911C213873A975A5988ED19A66B - C:\Windows\system32\Adobe\Director\np32dsw.dll - Shockwave for Director / Shockwave for Director

  9E448F221E741DD0ACCB381190D01B3E - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll - RealJukebox NS Plugin

  5DB82B8C515C875AE58E1B8B5997416B - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll - RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit)

  2CDA67C1309CA966D8EFEE4EE0D6CA92 - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll - RealPlayer Version Plugin

  8DA8393E2DA65CCF27F480316AE127F9 - C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll - DivX Player Netscape Plugin

  8DA8393E2DA65CCF27F480316AE127F9 - C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll - DivX Player Netscape Plugin

  D19163C4794227D953AF0F136A59DE85 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll - DivX Web Player

  D19163C4794227D953AF0F136A59DE85 - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll - DivX Web Player

  AB87EEFFD18F2BAAFC274E7075EA6C67 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation

  64CE864482A941C006AC430640DE4DB3 - C:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrlui.dll - Microsoft® Silverlight

  DFCAB29E8FD38F95650CC1E203E8D318 - C:\Windows\system32\npmproxy.dll - Microsoft® Windows® Operating System

  ==== Chrome Look ======================

  HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

  jbpkiefagocgkmemidfngdkamloieekf - C:\Program Files\TornTV.com\torn11.crx

  jmfkcklnlgedgbglfkkgedjfmejoahla - C:\Program Files\AVG\AVG10\Chrome\safesearch.crx

  ==== Set IE to Default ======================

  Old Values:

  “Start Page”=“http://www.google.nl/”

  “Start Page”=“http://homepage.acer.com/rdr.aspx?b=ACAW&l=0413&s=1&o=vp32&d=1208&m=aspire_x1700”

  New Values:

  “Start Page”=“http://www.google.nl/”

  “Start Page”=“http://go.microsoft.com/fwlink/?LinkId=69157”

  ==== All HKCU SearchScopes ======================

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

  “DefaultScope”=“{67A2568C-7A0A-4EED-AECC-B5405DE63B64}”

  {0633EE93-D776-472f-A0FF-E1416B8B2E3A} @ieframe.dll,-12512 Url=“http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC”

  {67A2568C-7A0A-4EED-AECC-B5405DE63B64} Google Url=“http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW”

  {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url=“http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}”

  {AC854C16-CA1E-43f1-8513-0D2F36C726ED} Google Url=“http://www.samenc.com/search/?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&rls=peBfhbuR”

  {CCC7A320-B3CA-4199-B1A6-9F516DD69829} AVG Secure Search Url=“http://search.avg.com/?d=4d5272a1&i=23&tp=chrome&q={searchTerms}&lng={language}&nt=1”

  ==== Deleting Registry Keys ======================

  HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf deleted successfully

  ==== HijackThis Entries ======================

  O1 - Hosts: ::1 localhost

  O1 - Hosts: 74.125.45.100 4-open-davinci.com

  O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com

  O1 - Hosts: 74.125.45.100 privatesecuredpayments.com

  O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com

  O1 - Hosts: 74.125.45.100 getantivirusplusnow.com

  O1 - Hosts: 74.125.45.100 secure-plus-payments.com

  O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com

  O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com

  O1 - Hosts: 74.125.45.100 www.getavplusnow.com

  O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com

  O1 - Hosts: 74.125.45.100 urs.microsoft.com

  O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com

  O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com

  O1 - Hosts: 74.125.45.100 paysoftbillsolution.com

  O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com

  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll

  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll

  O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

  O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

  O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.415.1646\swg.dll

  O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll

  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

  O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\SysMonitor.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot

  O4 - HKLM\..\Run: C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe

  O4 - HKLM\..\Run: RtHDVCpl.exe

  O4 - HKLM\..\Run: C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe

  O4 - HKLM\..\Run: “C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe” -s

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

  O4 - HKLM\..\Run: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

  O4 - HKLM\..\Run: %windir%\WindowsMobile\wmdSync.exe

  O4 - HKLM\..\Run: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

  O4 - HKLM\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKLM\..\Run: C:\Program Files\AVG\AVG10\avgtray.exe

  O4 - HKLM\..\Run: “C:\Program Files\Microsoft LifeCam\LifeExp.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe”

  O4 - HKLM\..\Run: “C:\Program Files\Common Files\Java\Java Update\jusched.exe”

  O4 - HKCU\..\Run: C:\Windows\ehome\ehTray.exe

  O4 - HKCU\..\Run: “C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe”

  O4 - HKCU\..\Run: “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesHelper.exe /s

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

  O4 - HKCU\..\Run: C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

  O4 - HKCU\..\Run: “C:\Users\Jacky\AppData\Local\Google\Update\GoogleUpdate.exe” /c

  O4 - HKCU\..\Run: C:\Program Files\Windows Media Player\WMPNSCFG.exe

  O4 - Startup: OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

  O4 - Startup: Rainmeter (2).lnk = C:\Program Files\Rainmeter\Rainmeter.exe

  O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

  O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

  O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

  O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

  O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra ‘Tools’ menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

  O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

  O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra ‘Tools’ menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

  O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe

  O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)

  O16 - DPF: Yahoo! Word Racer - http://origin.games.yahoo.net/games/clients/y/wt1_x.cab

  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab

  O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab

  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab

  O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab

  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

  O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.13.0.cab

  O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUpldnl-nl.cab

  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll

  O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

  O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

  O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe

  O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

  O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

  O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

  O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe

  O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

  O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe

  O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe

  O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe

  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

  O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)

  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

  O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

  O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

  O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

  O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe

  O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

  O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

  O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

  O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

  O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

  ==== Empty IE Cache ======================

  C:\Users\Jacky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

  C:\Users\Jacky\AppData\Local\temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully

  C:\Users\Jacky\AppData\Local\temp\Temporary Internet Files\Content.IE5 emptied successfully

  C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

  C:\Windows\serviceprofiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

  C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

  C:\Users\Jacky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

  C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

  ==== Empty FireFox Cache ======================

  C:\users\Jacky\AppData\Local\Mozilla\Firefox\Profiles\kvmxwwf3.default\Cache emptied successfully

  ==== Empty Chrome Cache ======================

  No Chrome User Data found

  ==== Empty All Flash Cache ======================

  Flash Cache Emptied Successfully

  ==== Empty All Java Cache ======================

  Java Cache cleared successfully

  After Reboot

  ==== Empty Temp Folders ======================

  C:\Windows\Temp successfully emptied

  C:\Users\Jacky\AppData\Local\Temp successfully emptied

  ==== Empty Recycle Bin ======================

  C:\$RECYCLE.BIN successfully emptied

  ==== Deleting Files / Folders ======================

  “C:\Users\Jacky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat” not found

  “C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat” not found

  Rapporteren
• 

  Ben

  27-02-2013 14:04

  Hallo,

  Heb je zelf die Hosts ingesteld?

  Download de Junkware Removal Tool by Thisisu naar je bureaublad

  *Het is aanbevolen om beveiligingssoftware tijdelijk uit te schakelen, deze kan namelijk conflicteren met JRT.exe

  *Windows XP: Start de tool doormiddel van dubbelklik.

  *Windows Vista/7/8: Rechtsklik JRT.exe en kies voor “Uitvoeren als administrator”.

  *De tool zal daarna je systeem scannen.

  *De scan kan afhankelijk van je systeemspecificaties soms vrij lang duren, wacht geduldig af.

  *Als de scan voltooid is zal een logje (JRT.txt) op je bureaublad opgeslagen worden en automatisch openen.

  *Post de inhoud van deze log in je volgende bericht.

  Gr.Ben

  Rapporteren
• 

  Jack

  27-02-2013 14:36

  Wat/welke hosts ?

  Weet niet wat ze zijn en hoe ik het mogelijk kon instellen..

  Dit is m'n log van JRT:

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  Junkware Removal Tool (JRT) by Thisisu

  Version: 4.6.5 (02.18.2013:1)

  OS: Windows Vista (TM) Home Premium x86

  Ran by Jacky on wo 27-02-2013 at 14:29:33,91

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  ~~~ Services

  ~~~ Registry Values

  Successfully repaired: hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName

  Successfully repaired: hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL

  ~~~ Registry Keys

  Successfully deleted: hkey_current_user\software\1clickdownload

  Successfully deleted: hkey_local_machine\software\iminent

  Successfully deleted: hkey_current_user\software\softonic

  Successfully deleted: hkey_current_user\software\sweetim

  Successfully deleted: hkey_local_machine\software\sweetim

  Successfully deleted: hkey_local_machine\software\classes\appid\dnu.exe

  Successfully deleted: hkey_local_machine\software\classes\dnupdate

  Successfully deleted: hkey_local_machine\software\classes\dnupdater.downloaduibrowser

  Successfully deleted: hkey_local_machine\software\classes\dnupdater.downloaduibrowser.1

  Successfully deleted: hkey_local_machine\software\classes\dnupdater.downloadupdcontroller

  Successfully deleted: hkey_local_machine\software\classes\dnupdater.downloadupdcontroller.1

  Successfully deleted: hkey_local_machine\software\classes\installer\features\a28b4d68debaa244eb686953b7074fef

  Successfully deleted: hkey_local_machine\software\classes\installer\products\a28b4d68debaa244eb686953b7074fef

  Successfully deleted: hkey_local_machine\software\classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9

  Successfully deleted: hkey_current_user\software\microsoft\internet explorer\searchscopes\{6a1806cd-94d4-4689-ba73-e35ea1ea9990}

  Successfully deleted: “hkey_current_user\software\apn”

  Successfully deleted: “hkey_current_user\software\appdatalow\asktoolbarinfo”

  Successfully deleted: “hkey_current_user\software\appdatalow\software\asktoolbar”

  Successfully deleted: “hkey_current_user\software\ask.com”

  Successfully deleted: “hkey_current_user\software\asktoolbar”

  Successfully deleted: “hkey_local_machine\software\apn”

  Successfully deleted: “hkey_local_machine\software\asktoolbar”

  Successfully deleted: “hkey_local_machine\software\classes\appid\genericasktoolbar.dll”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\0cfe535c35f99574e8340bfa75bf92c2”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\0e12f736682067fde4d1158d5940a82e”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\120dfadeb50841f408f04d2a278f9509”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\1a24b5bb8521b03e0c8d908f5abc0ae6”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\261f213d1f55267499b1f87d0cc3bcf7”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\2b0d56c4f4c46d844a57ffed6f0d2852”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\49d4375fe41653242aea4c969e4e65e0”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\6aa0923513360135b272e8289c5f13fa”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\6f7467af8f29c134cbbab394eccfde96”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\741b4adf27276464790022c965ab6da8”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\7de196b10195f5647a2b21b761f3de01”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\922525dcc5199162f8935747ca3d8e59”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\9d4f5849367142e4685ed8c25e44c5ed”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\a5875b04372c19545beb90d4d606c472”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\a876d9e80b896ec44a8620248cc79296”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\b66ffab725b92594c986de826a867888”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\bcda179d619b91648538e3394cac94cc”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\d677b1a9671d4d4004f6f2a4469e86ea”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\dd1402a9dd4215a43abde169a41afa0e”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\e36e114a0ead2ad46b381d23ad69cddf”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\components\ef8e618db3aedfbb384561b5c548f65e”

  Successfully deleted: “hkey_local_machine\software\microsoft\windows\currentversion\installer\userdata\s-1-5-18\products\a28b4d68debaa244eb686953b7074fef”

  Failed to delete: “hkey_local_machine\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\scheduled update for ask toolbar”

  ~~~ Files

  Successfully deleted: “C:\Program Files\mozilla firefox\plugins\npdnu.dll”

  Successfully deleted: “C:\Program Files\mozilla firefox\plugins\npdnupdater2.dll”

  ~~~ Folders

  Successfully deleted: “C:\Program Files\Common Files\software update utility”

  ~~~ FireFox

  Successfully deleted: C:\Users\Jacky\AppData\Roaming\mozilla\firefox\profiles\kvmxwwf3.default\user.js

  Emptied folder: C:\Users\Jacky\AppData\Roaming\mozilla\firefox\profiles\kvmxwwf3.default\minidumps

  ~~~ Event Viewer Logs were cleared

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  Scan was completed on wo 27-02-2013 at 14:32:38,80

  End of JRT log

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  Rapporteren
• 

  Jack

  27-02-2013 14:42

  Ohw ik was nog vergeten te vermelden dat ik ‘Torntv’ toch wel had gezien bij de Add-ons en het nu hebt uitgeschakeld.

  Dacht ik vermeld het nog ff bij..

  Rapporteren
• 

  Ben

  27-02-2013 14:45

  Hallo,

  Oke netjes.

  Doen we nog een keer zoek.exe:

  *Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe

  (hier of hier) kan je lezen hoe je dat doet.

  * Dubbelklik op Zoek.exe om de tool te starten.

  * Windows Vista, 7 en 8 gebruikers dienen de tool als “administrator” uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.

  * Kopieer nu onderstaande Vet gedrukte en plak die in het grote invulvenster:

  * Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkwaardig probleem.

  resethosts;

  emptyclsid;

  * Klik op de button "Options" en vink nu de onderstaande opties aan.

  * Auto Clean

  * Klik nu op de knop "Run script".

  * Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).

  * Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.

  * Post nu de inhoud van het geopende logje in het volgende bericht.

  Vertel hoe het hierna staat met je probleem.

  Gr.Ben

  Rapporteren
• 

  Jack

  27-02-2013 14:55

  Hallo,

  Ik heb op dit moment geen problemen meer met die rare verwijslinks van ‘Coupondropdown’

  Bedankt voor al je hulp Ben

  Hier is m'n log:

  Zoek.exe Version 4.0.0.2 Beta Updated 27-02-2013

  Tool run by Jacky on wo 27-02-2013 at 14:46:34,56.

  Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86

  Running in: Normal Mode Internet Access Detected

  ==== Reset Hosts File ======================

  # Copyright © 1993-2006 Microsoft Corp.

  #

  # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

  #

  # This file contains the mappings of IP addresses to host names. Each

  # entry should be kept on an individual line. The IP address should

  # be placed in the first column followed by the corresponding host name.

  # The IP address and the host name should be separated by at least one

  # space.

  #

  # Additionally, comments (such as these) may be inserted on individual

  # lines or following the machine name denoted by a ‘#’ symbol.

  #

  # For example:

  #

  # 102.54.94.97 rhino.acme.com # source server

  # 38.25.63.10 x.acme.com # x client host

  127.0.0.1 localhost

  ::1 localhost

  ==== Firefox Extensions ======================

  ProfilePath: C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default

  - TVU Web Player - %ProfilePath%\extensions\firefox@tvunetworks.com

  - Microsoft .NET Framework Assistant - %ProfilePath%\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi

  AppDir: C:\Program Files\Mozilla Firefox

  - Undetermined - %AppDir%\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

  - Undetermined - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

  - BS.Player ControlBar - %AppDir%\extensions\BSToolbar@toolbarnet.com

  ==== Firefox Plugins ======================

  Profilepath: C:\Users\Jacky\AppData\Roaming\Mozilla\Firefox\Profiles\kvmxwwf3.default

  E64819B6014A93E2503BB52419A0F6F3 - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll - Shockwave Flash

  E0FF893763BA82BAABB869A351F0C455 - C:\Users\Jacky\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll - Google Update

  F647D0BEA553C1D0C251CE07DA6A5511 - C:\Program Files\Adobe\Reader 10.0\Reader\browser\nppdf32.dll - Adobe Acrobat

  F647D0BEA553C1D0C251CE07DA6A5511 - C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll - Adobe Acrobat

  DB988B4550DB9BCE86F9199D961057FC - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll - Adobe Acrobat

  0D71354BF758537E6289AED18F7F85A7 - C:\Users\Jacky\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll - Google Talk Plugin Video Accelerator

  1FB3BA0F4D45A301CEFEA82BB3E6C65A - C:\Users\Jacky\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin

  7B000D95ABFE622F17709D36AF44FBD3 - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll - Java(TM) Platform SE 6 U35

  6CD3A99DCEDE9C2D7D3BFBF6D4902F5F - C:\Windows\system32\npdeployJava1.dll - Java Deployment Toolkit 6.0.350.10

  8FE7BA502945BE735D09D5703BD76FDA - C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll - Shockwave for Director / Shockwave for Director

  F950066F07AD4952B291BF712BA40367 - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll - Winamp Application Detector

  36A0F250C766D27BFE5A953C1A65B696 - C:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll - Silverlight Plug-In

  24E990B1E6D55428001843CF7217DD81 - C:\Program Files\Microsoft\Office Live\npOLW.dll - Microsoft Office Live Plug-in for Firefox / Microsoft Office Live Plug-in for Firefox

  8E9A08E2092B3E1ADFF3C46BC1A5124B - C:\Windows\system32\TVUAx\npTVUAx.dll - TVU Web Player for FireFox

  3152EC8D9F60C4A5AE76FE20D90E10D7 - C:\Program Files\Veetle\plugins\npVeetle.dll - Veetle TV Core

  8E753B080E0A0CF0B4651187D414059F - C:\Program Files\Veetle\Player\npvlc.dll - Veetle TV Player

  323FE218DAC089EED70CA55E6C1C2F1D - C:\Program Files\Mozilla Firefox\plugins\npdnu.dll - downloadUpdater

  DBE8C34758DA614F35AE7011284406BB - C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll - downloadUpdater2

  EA85C911C213873A975A5988ED19A66B - C:\Windows\system32\Adobe\Director\np32dsw.dll - Shockwave for Director / Shockwave for Director

  9E448F221E741DD0ACCB381190D01B3E - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll - RealJukebox NS Plugin

  5DB82B8C515C875AE58E1B8B5997416B - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll - RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit)

  2CDA67C1309CA966D8EFEE4EE0D6CA92 - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll - RealPlayer Version Plugin

  8DA8393E2DA65CCF27F480316AE127F9 - C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll - DivX Player Netscape Plugin

  8DA8393E2DA65CCF27F480316AE127F9 - C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll - DivX Player Netscape Plugin

  D19163C4794227D953AF0F136A59DE85 - C:\Program Files\DivX\DivX Web Player\npdivx32.dll - DivX Web Player

  D19163C4794227D953AF0F136A59DE85 - C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll - DivX Web Player

  AB87EEFFD18F2BAAFC274E7075EA6C67 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation

  DFCAB29E8FD38F95650CC1E203E8D318 - C:\Windows\system32\npmproxy.dll - Microsoft® Windows® Operating System

  64CE864482A941C006AC430640DE4DB3 - C:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrlui.dll - Microsoft® Silverlight

  ==== Chrome Look ======================

  HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

  jmfkcklnlgedgbglfkkgedjfmejoahla - C:\Program Files\AVG\AVG10\Chrome\safesearch.crx

  ==== Set IE to Default ======================

  Old Values:

  “Start Page”=“http://www.google.nl/”

  New Values:

  “Start Page”=“http://www.google.nl/”

  ==== All HKCU SearchScopes ======================

  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

  “DefaultScope”=“{67A2568C-7A0A-4EED-AECC-B5405DE63B64}”

  {0633EE93-D776-472f-A0FF-E1416B8B2E3A} @ieframe.dll,-12512 Url=“http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC”

  {67A2568C-7A0A-4EED-AECC-B5405DE63B64} Google Url=“http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW”

  {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url=“http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}”

  {AC854C16-CA1E-43f1-8513-0D2F36C726ED} Google Url=“http://www.samenc.com/search/?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&rls=peBfhbuR”

  {CCC7A320-B3CA-4199-B1A6-9F516DD69829} AVG Secure Search Url=“http://search.avg.com/?d=4d5272a1&i=23&tp=chrome&q={searchTerms}&lng={language}&nt=1”

  ==== Empty IE Cache ======================

  C:\Users\Jacky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

  C:\Users\Jacky\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully

  C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

  C:\Windows\serviceprofiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

  C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

  C:\Users\Jacky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

  C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

  ==== Empty FireFox Cache ======================

  C:\users\Jacky\AppData\Local\Mozilla\Firefox\Profiles\kvmxwwf3.default\Cache emptied successfully

  ==== Empty Chrome Cache ======================

  No Chrome User Data found

  ==== Empty All Flash Cache ======================

  Flash Cache Emptied Successfully

  ==== Empty All Java Cache ======================

  Java Cache cleared successfully

  After Reboot

  ==== Empty Temp Folders ======================

  C:\Windows\Temp successfully emptied

  C:\Users\Jacky\AppData\Local\Temp successfully emptied

  ==== Empty Recycle Bin ======================

  C:\$RECYCLE.BIN successfully emptied

  ==== Deleting Files / Folders ======================

  “C:\Users\Jacky\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat” not found

  “C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat” not found

  Rapporteren
• 

  Ben

  27-02-2013 15:04

  Hallo,

  Oke dan gaan we opruimen:

  Malwarebytes kan je laten staan en één maal in de week (na te hebben geupdate) je pc mee scannen.

  1. De volgende programma's en bijbehorende log bestanden (waaronder ook je Quarantaine-mappen te vinden op C:/ ) mag je verwijderen.

  • RSIT

  • Junkware Removal

  • AdwCleaner via Deinstallatie functie als je het programma opstart.

  2. Download Ccleaner

  Bij het installeren van de nieuwste Ccleaner wordt nu ook Google Chrome (helaas) mee geinstalleerd.

  Je moet tijdens het installeren een vinkje weg halen, zodat Google Chrome niet geinstalleerd word.

  Installeer CCleaner en start CCleaner op.

  • Klik in de linkse kolom op Cleaner.

  • Klik achtereenvolgens op Analyseren en Opschonen.

  • Klik vervolgens in de linkse kolom op Register en klik op Scan naar problemen.

  • Als er fouten gevonden worden klik je op Herstel geselecteerde problemen en OK.

  • Dan krijg je de vraag om een back-up te maken, klik op JA en kies dan Herstel alle geselecteerde fouten.

  • Sluit hierna CCleaner af.

  Verwijder nog even je systeemherstelpunten en maak een nieuwe aan: http://www.pchelpforum.nl/viewthread.php?tid=24925

  Gr.Ben

  Rapporteren

Dit topic is gesloten, er kunnen geen reacties meer worden geplaatst.