Computer - Spyware

Pepplays.com en Musics247.com-opgelost

Gestart door Toby op 26 mar 2019, 19:41 20 berichten 3.977 keer gelezen
Toby Startte dit onderwerp 26 mar 2019, 19:41 Het Soete Land Van Waes 966 berichten
Mijn desktop HP is meer dan waarschijnlijk besmet met de adware Pepplays.com en Musics247.com. Het lijken me bijzonder gevaarlijke spullen aangezien ze in staat zijn betalingen uit te voeren met een VISA kaart. Hoe ze aan het nummer van die kaart geraakt zijn, weet ik niet.
In ieder geval heb ik prijs bij de afrekening van mijn VISA kaart. Gelukkig nog geen torenhoge bedragen, maar toch verontrustend.

Hoe pak ik deze zaak best aan ? Ik laat momenteel MBAM draaien en ADWCleaner. Het resultaat laat ik weten zodra de scans beëindigd zijn.

Doe ik er best aan mijn VISA kaart te blokkeren ?
Warning: most messages of this kind, could be sent by an oldtimer Acer Aspire 7530 laptop or even an older Lenovo T500 laptop, both proudly and pretty fast using Linux Mint 21.1 "Vera" Cinnamon 64 bits operating system.
Give it a try too !
Toby Startte dit onderwerp 26 mar 2019, 20:20 Het Soete Land Van Waes 966 berichten
Kaart is intussen al geblokkeerd uiteraard ...
ADWCleaner gaf een infectie op die intussen verwijderd werd door het programma zelf, nl. PUP.Optional.PCProtect.

MBAM is nog aan het scannen.
Warning: most messages of this kind, could be sent by an oldtimer Acer Aspire 7530 laptop or even an older Lenovo T500 laptop, both proudly and pretty fast using Linux Mint 21.1 "Vera" Cinnamon 64 bits operating system.
Give it a try too !
Toby Startte dit onderwerp 26 mar 2019, 21:03 Het Soete Land Van Waes 966 berichten
MBAM gaf als infectie aan : PUP.Opional.Reimage.
Is intussen ook verwijderd.
Warning: most messages of this kind, could be sent by an oldtimer Acer Aspire 7530 laptop or even an older Lenovo T500 laptop, both proudly and pretty fast using Linux Mint 21.1 "Vera" Cinnamon 64 bits operating system.
Give it a try too !
Sony 27 mar 2019, 12:04 Boom 5.235 berichten
Toby,

kijk ook eens bij Een programma verwijderen
In de rubriek spyware kunt je lezen hoe je FRST logs kunt maken
en aanbieden op het forum:
viewtopic.php?f=43&t=197564

Sony
I Afbeelding SeniorenNet
Toby Startte dit onderwerp 31 mar 2019, 22:03 Het Soete Land Van Waes 966 berichten
Sony schreef: ↑
27 mar 2019, 12:04
 Toby,
kijk ook eens bij Een programma verwijderen
In de rubriek spyware kunt je lezen hoe je FRST logs kunt maken
en aanbieden op het forum:
viewtopic.php?f=43&t=197564
Sony
Een scan met Farbar is uitgevoerd en hierbij de twee logbestanden.

Scanresultaten van Farbar Recovery Scan Tool (FRST) (x64) Versie: 17.03.2019
Gestart door Administrator (Beheerder) op GDB-PC (31-03-2019 21:42:24)
Gestart vanaf C:\Users\Administrator\Downloads
Geladen Profielen: Administrator (Beschikbare Profielen: GDB & Administrator)
Platform: Windows 10 Home Versie 1803 17134.648 (X64) Taal: Nederlands (Nederland)
Standaardbrowser: Chrome
Boot Modus: Normal
Handleiding voor Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processen (gefilterd) =================

(Als een item is opgenomen in de fixlist, zal het proces worden gesloten. Het bestand zal niet worden verplaatst.)

(Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\vsserv.exe
(Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender VPN\BdVpnService.exe
(Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe
(Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe
(Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe
(Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe
(Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe
() [Bestand niet getekend] C:\ProgramData\eaZyLink\eaZySvr.exe
(SEIKO EPSON Corporation -> Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Malwarebytes Corporation -> Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe
(Reason Software Company Inc. -> Reason Software Company Inc.) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe
(Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\updatesrv.exe
(Malwarebytes Corporation -> Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Zetes nv/sa -> ) C:\ProgramData\eaZyLink\eaZyLink.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Bitdefender SRL -> Bitdefender) C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Reason Software Company Inc. -> Reason Software Company Inc.) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe
(Malwarebytes Corporation -> Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Cambridge Silicon Radio Ltd. -> ) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe
(Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender VPN\BdVpnApp.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe
(Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
(Piriform Software Ltd -> Piriform Software Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe
(Kaspersky Lab -> AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe
(Hewlett-Packard Company -> Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Bitdefender SRL -> Bitdefender) C:\Program Files\Bitdefender\Bitdefender Security\bdagent.exe
() [Bestand niet getekend] C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19021.18010.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) [Bestand niet getekend] C:\Program Files\WindowsApps\Microsoft.WindowsStore_11811.1001.27.0_x64__8wekyb3d8bbwe\WinStore.App.exe
() [Bestand niet getekend] C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19011.11311.0_x64__8wekyb3d8bbwe\Music.UI.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() [Bestand niet getekend] C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19021.10411.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Register (gefilterd) ===========================

(Als een item is opgenomen in de fixlist, zal het registeritem worden teruggezet naar de standaardwaarden of verwijderd. Het bestand zal niet worden verplaatst.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Run: [CsrHCRPServer] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrHCRPServer.exe [1134288 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
HKLM\...\Run: [CsrAudioguiCtrl] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrAudioguiCtrl.exe [511696 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
HKLM\...\Run: [CsrSyncMLServer] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe [244944 2012-03-22] (Cambridge Silicon Radio Ltd. -> )
HKLM\...\Run: [vksts] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\vksts.exe [25792 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
HKLM\...\Run: [HarmonyUserStartup] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\HarmonyUserStartup.exe [39128 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
HKLM\...\Run: [CSRHarmonySkypePlugin] => C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe [146656 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
HKLM\...\Run: [TrayApplication] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\TrayApplication.exe [529616 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
HKLM\...\Run: [BdVpnApp] => C:\Program Files\Bitdefender\Bitdefender VPN\BdVpnApp.exe [95032 2019-02-25] (Bitdefender SRL -> Bitdefender)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133216 2017-03-23] (Wondershare Technology Co.,Ltd -> Wondershare)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [110008 2015-07-06] (CyberLink Corp. -> CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [499640 2015-07-06] (CyberLink Corp. -> CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [265656 2015-06-15] (CyberLink Corp. -> CyberLink Corp.)
HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\Run: [Kaspersky Software Updater] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe [1565000 2016-11-26] (Kaspersky Lab -> AO Kaspersky Lab)
HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [22488952 2019-03-11] (Piriform Software Ltd -> Piriform Software Ltd)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.86\Installer\chrmstp.exe [2019-03-23] (Google LLC -> Google Inc.)
HKLM\Software\...\Authentication\Credential Providers: [{5355DA8C-FE32-49b4-A567-A67535C86592}] -> C:\Program Files\CSR\CSR Harmony Wireless Software Stack\BLEtokenCredentialProvider.dll [2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
HKLM\Software\...\Authentication\Credential Providers: [{538C240D-3DEE-4032-AB4C-08A3A6EB0861}] -> C:\Program Files (x86)\CyberLink\YouCam\CLCredProv\x64\CLCredProv.dll [2015-06-15] (CyberLink Corp. -> CyberLink)

==================== Internet (gefilterd) ====================

(Als een item is opgenomen in de fixlist en een registeritem is, wordt het verwijderd of hersteld naar de standaard.)

Hosts: Er is meer dan één item in Hosts. Zie Hosts deel van Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 0.0.0.0
Tcpip\..\Interfaces\{2949313b-94af-4f31-b611-b53a4cc701e1}: [DhcpNameServer] 192.168.1.1 0.0.0.0

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-2136469052-3984601998-3441907689-500\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-2136469052-3984601998-3441907689-500 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src ... 02&pc=UE00
SearchScopes: HKU\S-1-5-21-2136469052-3984601998-3441907689-500 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src ... 02&pc=UE00
BHO: Bitdefender Wallet -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender Security\pmbxie.dll [2019-03-04] (Bitdefender SRL -> Bitdefender)
BHO-x32: Bitdefender Wallet -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender Security\Antispam32\pmbxie.dll [2019-03-04] (Bitdefender SRL -> Bitdefender)
Toolbar: HKLM - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender Security\pmbxie.dll [2019-03-04] (Bitdefender SRL -> Bitdefender)
Toolbar: HKLM-x32 - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender Security\Antispam32\pmbxie.dll [2019-03-04] (Bitdefender SRL -> Bitdefender)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2011-01-19] (Skype Technologies SA -> Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2ughqukf.default [2019-03-31]
FF NetworkProxy: Mozilla\Firefox\Profiles\2ughqukf.default -> type", 0
FF HKLM\...\Firefox\Extensions: [bdwtwe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff.xpi
FF Extension: (Bitdefender Wallet) - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff.xpi [2019-03-04]
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbext
FF Extension: (Bitdefender Antispam Toolbar) - C:\Program Files\Bitdefender\Bitdefender Security\bdtbext [2018-05-14] [Verouderd] [niet getekend]
FF HKLM-x32\...\Firefox\Extensions: [bdwtwe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdtbext
FF Plugin: @videolan.org/vlc,version=3.0.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-01-10] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-01-10] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-01-10] (VideoLAN -> VideoLAN)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-28] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-28] (Google Inc -> Google LLC)

Chrome:
=======
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default [2019-03-31]
CHR Extension: (Presentaties) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-07-20]
CHR Extension: (Documenten) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-07-20]
CHR Extension: (Google Drive) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-07-20]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-07-20]
CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2019-03-13]
CHR Extension: (Spreadsheets) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-07-20]
CHR Extension: (Bitdefender Wallet) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gannpgaobkkhmpomoijebaigcapoeebl [2018-12-04]
CHR Extension: (Offline Documenten) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-23]
CHR Extension: (Flash Control) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hloblpeplfiajnfdengendhdnpmdgagn [2018-07-20]
CHR Extension: (Betalingen via Chrome Web Store) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-07-20]
CHR Extension: (Gmail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-07-20]
CHR Extension: (Chrome Media Router) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-03-18]
CHR Extension: (Password Checkup) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pncabnpcffmalkkjpajodfhijclecjno [2019-03-04]
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\System Profile [2019-03-31]
CHR HKLM-x32\...\Chrome\Extension: [gannpgaobkkhmpomoijebaigcapoeebl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (gefilterd) ====================

(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)

S3 AfVpnService; C:\Program Files\Bitdefender\Bitdefender VPN\vpnservice.exe [322432 2018-10-25] (AnchorFree Inc -> AnchorFree Inc.)
R2 BDAuxSrv; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [779152 2019-03-04] (Bitdefender SRL -> Bitdefender)
R2 BDProtSrv; C:\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe [779152 2019-03-04] (Bitdefender SRL -> Bitdefender)
R2 bdredline; C:\Program Files\Common Files\Bitdefender\SetupInformation\Bitdefender RedLine\bdredline.exe [2195320 2018-09-29] (Bitdefender SRL -> Bitdefender)
R2 BdVpnService; C:\Program Files\Bitdefender\Bitdefender VPN\bdvpnservice.exe [96568 2019-02-25] (Bitdefender SRL -> Bitdefender)
R2 BtSwitcherService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe [64216 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
R2 CSRBtAudioService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe [465624 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
R2 CsrBtOBEXService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe [1041616 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
R2 CsrBtService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe [825032 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
R2 eaZyLink; C:\ProgramData\eaZyLink\eaZySvr.exe [518656 2017-05-04] () [Bestand niet getekend]
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [144560 2012-05-17] (SEIKO EPSON Corporation -> Seiko Epson Corporation)
R3 ksu; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe [1565000 2016-11-26] (Kaspersky Lab -> AO Kaspersky Lab)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [452576 2016-02-09] (Malwarebytes Corporation -> Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [901088 2016-02-09] (Malwarebytes Corporation -> Malwarebytes Corporation)
R2 ProductAgentService; C:\Program Files\Bitdefender Agent\ProductAgentService.exe [1293936 2018-11-15] (Bitdefender SRL -> Bitdefender)
R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [297240 2018-07-18] (Reason Software Company Inc. -> Reason Software Company Inc.)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender Security\updatesrv.exe [114192 2019-03-04] (Bitdefender SRL -> Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender Security\vsserv.exe [816616 2019-03-04] (Bitdefender SRL -> Bitdefender)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1806.18062-0\NisSrv.exe [3925648 2018-06-26] (Microsoft Corporation -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1806.18062-0\MsMpEng.exe [100080 2018-06-26] (Microsoft Corporation -> Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000

===================== Drivers (gefilterd) ======================

(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)

R3 aftap0901; C:\WINDOWS\System32\drivers\aftap0901.sys [48624 2017-11-29] (AnchorFree Inc -> The OpenVPN Project)
R1 atc; C:\WINDOWS\System32\DRIVERS\atc.sys [1423680 2019-03-04] (Bitdefender SRL -> BitDefender S.R.L. Bucharest, ROMANIA)
R2 BdDci; C:\WINDOWS\System32\DRIVERS\bddci.sys [367096 2019-03-04] (Bitdefender SRL -> Bitdefender)
S0 bdelam; C:\WINDOWS\System32\drivers\bdelam.sys [23032 2018-04-19] (Microsoft Windows Early Launch Anti-malware Publisher -> Bitdefender)
R0 bdprivmon; C:\WINDOWS\System32\DRIVERS\bdprivmon.sys [45728 2018-10-17] (Bitdefender SRL -> © Bitdefender SRL)
R1 BDVEDISK; C:\WINDOWS\system32\DRIVERS\bdvedisk.sys [96448 2018-04-27] (Bitdefender SRL -> BitDefender)
S2 CDRPDACC; C:\Program Files (x86)\Quintessential Media Player\cdrpdacc.sys [5273 2007-01-25] (Arrowkey) [Bestand niet getekend]
S3 CsrBtPort; C:\WINDOWS\system32\DRIVERS\CsrBtPort.sys [2784968 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
S3 csrpan; C:\WINDOWS\System32\drivers\csrpan.sys [39616 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
S3 csrserial; C:\WINDOWS\system32\DRIVERS\csrserial.sys [61128 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
S3 csrusb; C:\WINDOWS\System32\Drivers\csrusb.sys [47296 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
S3 csrusbfilter; C:\WINDOWS\System32\Drivers\csrusbfilter.sys [23752 2012-03-22] (Cambridge Silicon Radio Ltd. -> Cambridge Silicon Radio Limited)
R1 ElRawDisk; C:\WINDOWS\system32\drivers\rsdrvx64.sys [26024 2009-02-12] (EldoS Corporation -> EldoS Corporation)
R0 Gemma; C:\WINDOWS\System32\DRIVERS\Gemma.sys [374632 2019-03-04] (Bitdefender SRL -> BitDefender S.R.L. Bucharest, ROMANIA)
R0 gzflt; C:\WINDOWS\System32\DRIVERS\gzflt.sys [201000 2019-03-04] (Bitdefender SRL -> BitDefender LLC)
S3 HPEWSFXBULK; C:\WINDOWS\system32\drivers\hpfx64bulk.sys [29240 2015-10-27] (Hewlett-Packard Company -> Hewlett Packard)
R2 Ignis; C:\WINDOWS\System32\DRIVERS\ignis.sys [196352 2018-12-12] (Bitdefender SRL -> Bitdefender)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [27008 2016-02-09] (Malwarebytes Corporation -> Malwarebytes Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_desktop_ref4wu.inf_amd64_eacf5ffe3df9c8a0\nvlddmkm.sys [16936560 2017-11-09] (NVIDIA Corporation -> NVIDIA Corporation)
R0 trufos; C:\WINDOWS\System32\DRIVERS\trufos.sys [610640 2019-03-04] (Bitdefender SRL -> Bitdefender)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46592 2018-06-26] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [340008 2018-06-26] (Microsoft Windows -> Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [151184 2016-07-15] (NGO -> MBB)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [59944 2018-06-26] (Microsoft Windows -> Microsoft Corporation)
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2018-09-20] (Zemana Ltd. -> Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2018-07-07] (Zemana Ltd. -> Zemana Ltd.)
S1 epp; \??\F:\EMSISOFTEMERGENCYKIT\BIN64\epp.sys [X]
S1 SASDIFSV; \??\F:\Superantispyware\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\F:\Superantispyware\SASKUTIL64.SYS [X]

==================== NetSvcs (gefilterd) ===================

(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)


==================== Een maand (aangemaakt) ========

(Als een item is opgenomen in de fixlist, wordt de map of het bestand verplaatst.)

2019-03-31 21:42 - 2019-03-31 21:42 - 000013787 ____C C:\Users\Administrator\Downloads\Addition.txt
2019-03-31 21:40 - 2019-03-31 21:43 - 000024014 ____C C:\Users\Administrator\Downloads\FRST.txt
2019-03-31 21:39 - 2019-03-31 21:39 - 002434048 ____C (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2019-03-31 21:38 - 2019-03-31 21:38 - 000009512 ____C C:\Users\Administrator\Contacts\Desktop\Documents\cc_20190331_213832.reg
2019-03-31 00:39 - 2019-03-31 00:39 - 000000355 ____C C:\Users\Administrator\Contacts\Desktop\Documents\Prullenbak - Snelkoppeling.lnk
2019-03-27 22:07 - 2019-03-27 22:07 - 000000000 ___DC C:\Users\Administrator\AppData\Local\WhatsApp
2019-03-23 21:02 - 2019-03-23 21:03 - 000000193 ____C C:\WINDOWS\WORDPAD.INI
2019-03-22 21:02 - 2019-03-22 21:02 - 000000000 ___DC C:\ProgramData\eaZyLink
2019-03-22 21:01 - 2019-03-22 21:01 - 001527808 ____C C:\Users\Administrator\Downloads\eazylink_1.4.4.msi
2019-03-19 10:55 - 2019-03-19 17:10 - 000001281 ____C C:\Users\Public\Desktop\LibreOffice 6.2.lnk
2019-03-19 10:55 - 2019-03-19 10:56 - 000000000 __SDC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 6.2
2019-03-18 00:58 - 2019-03-18 00:58 - 000018190 ____C C:\Users\Administrator\Contacts\Desktop\Documents\cc_20190317_235821.reg
2019-03-18 00:53 - 2019-03-18 00:53 - 021205512 ____C (Piriform Software Ltd) C:\Users\Administrator\Downloads\ccsetup555.exe
2019-03-14 01:36 - 2019-03-06 17:39 - 000720536 ____C (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2019-03-14 01:36 - 2019-03-06 17:37 - 001616608 ____C (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2019-03-14 01:36 - 2019-03-06 17:36 - 001047352 ____C (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2019-03-14 01:36 - 2019-03-06 17:19 - 000058368 ____C (Microsoft Corporation) C:\WINDOWS\system32\mf3216.dll
2019-03-14 01:36 - 2019-03-06 17:17 - 012730368 ____C (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2019-03-14 01:36 - 2019-03-06 17:17 - 000810496 ____C C:\WINDOWS\system32\MBR2GPT.EXE
2019-03-14 01:36 - 2019-03-06 17:17 - 000116736 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys
2019-03-14 01:36 - 2019-03-06 17:14 - 001180672 ____C (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2019-03-14 01:36 - 2019-03-06 17:14 - 000522240 ____C (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2019-03-14 01:36 - 2019-03-06 17:14 - 000488448 ____C (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
2019-03-14 01:36 - 2019-03-06 17:13 - 004053504 ____C (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2019-03-14 01:36 - 2019-03-06 17:13 - 001856512 ____C (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2019-03-14 01:36 - 2019-03-06 17:13 - 001662976 ____C (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2019-03-14 01:36 - 2019-03-06 17:13 - 001364992 ____C (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2019-03-14 01:36 - 2019-03-06 17:12 - 001180672 ____C (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2019-03-14 01:36 - 2019-03-06 14:18 - 000918032 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2019-03-14 01:36 - 2019-03-06 14:18 - 000607744 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2019-03-14 01:36 - 2019-03-06 14:10 - 000044544 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf3216.dll
2019-03-14 01:36 - 2019-03-06 14:09 - 011919360 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2019-03-14 01:36 - 2019-03-06 14:06 - 000425472 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll
2019-03-14 01:36 - 2019-03-06 14:05 - 004054016 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2019-03-14 01:36 - 2019-03-06 14:05 - 001586176 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2019-03-14 01:36 - 2019-03-06 14:04 - 001471488 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2019-03-14 01:36 - 2019-03-06 14:04 - 000423936 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2019-03-14 01:36 - 2019-03-06 13:59 - 001008640 ____C (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2019-03-14 01:36 - 2019-03-06 11:29 - 001035040 ____C (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2019-03-14 01:36 - 2019-03-06 11:16 - 002822456 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2019-03-14 01:36 - 2019-03-06 11:16 - 001457032 ____C (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2019-03-14 01:36 - 2019-03-06 11:16 - 001188000 ____C (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2019-03-14 01:36 - 2019-03-06 11:16 - 000776792 ____C (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2019-03-14 01:36 - 2019-03-06 11:16 - 000722744 ____C (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2019-03-14 01:36 - 2019-03-06 11:16 - 000566568 ____C (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2019-03-14 01:36 - 2019-03-06 11:16 - 000527160 ____C (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2019-03-14 01:36 - 2019-03-06 11:11 - 000493880 ____C (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2019-03-14 01:36 - 2019-03-06 11:10 - 000248880 ____C (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2019-03-14 01:36 - 2019-03-06 11:07 - 001219896 ____C (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2019-03-14 01:36 - 2019-03-06 11:07 - 001023800 ____C (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2019-03-14 01:36 - 2019-03-06 11:07 - 000376120 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2019-03-14 01:36 - 2019-03-06 11:06 - 009084216 ____C (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2019-03-14 01:36 - 2019-03-06 11:06 - 000134968 ____C (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2019-03-14 01:36 - 2019-03-06 11:06 - 000076088 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2019-03-14 01:36 - 2019-03-06 11:05 - 000439224 ____C (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2019-03-14 01:36 - 2019-03-06 11:05 - 000436240 ____C (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2019-03-14 01:36 - 2019-03-06 11:05 - 000159864 ____C (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2019-03-14 01:36 - 2019-03-06 11:04 - 002765856 ____C (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2019-03-14 01:36 - 2019-03-06 11:04 - 000945464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refsv1.sys
2019-03-14 01:36 - 2019-03-06 11:04 - 000628024 ____C (Microsoft Corporation) C:\WINDOWS\system32\dpx.dll
2019-03-14 01:36 - 2019-03-06 11:03 - 007519896 ____C (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2019-03-14 01:36 - 2019-03-06 11:03 - 002719544 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2019-03-14 01:36 - 2019-03-06 11:03 - 002465784 ____C (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2019-03-14 01:36 - 2019-03-06 11:03 - 001921848 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refs.sys
2019-03-14 01:36 - 2019-03-06 11:03 - 000793400 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2019-03-14 01:36 - 2019-03-06 11:03 - 000412984 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2019-03-14 01:36 - 2019-03-06 11:03 - 000375608 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
2019-03-14 01:36 - 2019-03-06 11:02 - 002421048 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2019-03-14 01:36 - 2019-03-06 11:02 - 001257672 ____C (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2019-03-14 01:36 - 2019-03-06 11:02 - 001140480 ____C (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2019-03-14 01:36 - 2019-03-06 11:02 - 000982912 ____C (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2019-03-14 01:36 - 2019-03-06 11:02 - 000626488 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2019-03-14 01:36 - 2019-03-06 10:44 - 025856512 ____C (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2019-03-14 01:36 - 2019-03-06 10:36 - 022716928 ____C (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2019-03-14 01:36 - 2019-03-06 10:36 - 004383744 ____C (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2019-03-14 01:36 - 2019-03-06 10:34 - 004866048 ____C (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2019-03-14 01:36 - 2019-03-06 10:33 - 000046080 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys
2019-03-14 01:36 - 2019-03-06 10:32 - 003399168 ____C (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2019-03-14 01:36 - 2019-03-06 10:32 - 000358912 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys
2019-03-14 01:36 - 2019-03-06 10:31 - 007598592 ____C (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2019-03-14 01:36 - 2019-03-06 10:31 - 002368512 ____C (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2019-03-14 01:36 - 2019-03-06 10:31 - 001826816 ____C (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2019-03-14 01:36 - 2019-03-06 10:31 - 000894464 ____C (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2019-03-14 01:36 - 2019-03-06 10:31 - 000808448 ____C (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2019-03-14 01:36 - 2019-03-06 10:31 - 000353792 ____C (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll
2019-03-14 01:36 - 2019-03-06 10:31 - 000324608 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2019-03-14 01:36 - 2019-03-06 10:31 - 000279552 ____C (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll
2019-03-14 01:36 - 2019-03-06 10:31 - 000266752 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2019-03-14 01:36 - 2019-03-06 10:29 - 002364928 ____C (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2019-03-14 01:36 - 2019-03-06 10:29 - 002174976 ____C (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2019-03-14 01:36 - 2019-03-06 10:29 - 001559552 ____C (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2019-03-14 01:36 - 2019-03-06 10:29 - 000736256 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2019-03-14 01:36 - 2019-03-06 10:28 - 004937728 ____C (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2019-03-14 01:36 - 2019-03-06 10:28 - 001803776 ____C (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2019-03-14 01:36 - 2019-03-06 10:27 - 002224640 ____C (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2019-03-14 01:36 - 2019-03-06 10:27 - 000776192 ____C (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2019-03-14 01:36 - 2019-03-06 10:27 - 000542720 ____C (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2019-03-14 01:36 - 2019-03-06 10:27 - 000507392 ____C (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2019-03-14 01:36 - 2019-03-06 10:26 - 000073216 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\npfs.sys
2019-03-14 01:36 - 2019-03-06 10:26 - 000031232 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msfs.sys
2019-03-14 01:36 - 2019-03-06 10:25 - 000093696 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cdfs.sys
2019-03-14 01:36 - 2019-03-06 08:17 - 001989040 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2019-03-14 01:36 - 2019-03-06 08:17 - 000146712 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2019-03-14 01:36 - 2019-03-06 08:15 - 002253488 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2019-03-14 01:36 - 2019-03-06 08:15 - 000434488 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2019-03-14 01:36 - 2019-03-06 08:14 - 006568528 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-03-14 01:36 - 2019-03-06 08:14 - 000785568 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2019-03-14 01:36 - 2019-03-06 08:14 - 000665224 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2019-03-14 01:36 - 2019-03-06 08:14 - 000450872 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpx.dll
2019-03-14 01:36 - 2019-03-06 08:14 - 000380728 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2019-03-14 01:36 - 2019-03-06 08:13 - 000607248 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2019-03-14 01:36 - 2019-03-06 08:05 - 022018048 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2019-03-14 01:36 - 2019-03-06 07:56 - 019404288 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2019-03-14 01:36 - 2019-03-06 07:53 - 005307392 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2019-03-14 01:36 - 2019-03-06 07:53 - 003711488 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2019-03-14 01:36 - 2019-03-06 07:52 - 005790720 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2019-03-14 01:36 - 2019-03-06 07:52 - 000608768 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2019-03-14 01:36 - 2019-03-06 07:52 - 000261632 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll
2019-03-14 01:36 - 2019-03-06 07:51 - 000561152 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2019-03-14 01:36 - 2019-03-06 07:51 - 000333824 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2019-03-14 01:36 - 2019-03-06 07:50 - 001628160 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2019-03-14 01:36 - 2019-03-06 07:50 - 001347584 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2019-03-14 01:36 - 2019-03-06 07:50 - 000578560 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2019-03-14 01:36 - 2019-03-06 07:49 - 004516352 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2019-03-14 01:36 - 2019-03-06 07:49 - 000318464 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll
2019-03-14 01:36 - 2019-03-06 07:48 - 000669696 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2019-03-14 01:36 - 2019-03-06 07:48 - 000533504 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2019-03-14 01:36 - 2019-02-21 05:26 - 000313344 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd2x40.dll
2019-03-14 01:36 - 2019-02-16 15:02 - 002871304 ____C (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2019-03-14 01:36 - 2019-02-16 15:02 - 001644040 ____C (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2019-03-14 01:36 - 2019-02-16 15:02 - 000808456 ____C (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2019-03-14 01:36 - 2019-02-16 15:02 - 000735752 ____C (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2019-03-14 01:36 - 2019-02-16 15:02 - 000620040 ____C (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2019-03-14 01:36 - 2019-02-16 15:02 - 000460296 ____C (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2019-03-14 01:36 - 2019-02-16 15:02 - 000322568 ____C (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2019-03-14 01:36 - 2019-02-16 15:02 - 000147464 ____C (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2019-03-14 01:36 - 2019-02-16 15:02 - 000071176 ____C (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2019-03-14 01:36 - 2019-02-16 14:57 - 001048472 ____C (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2019-03-14 01:36 - 2019-02-16 14:57 - 000506088 ____C (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe
2019-03-14 01:36 - 2019-02-16 14:56 - 000549520 ____C (Microsoft Corporation) C:\WINDOWS\system32\AppResolver.dll
2019-03-14 01:36 - 2019-02-16 14:56 - 000540984 ____C (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2019-03-14 01:36 - 2019-02-16 14:53 - 001516416 ____C (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2019-03-14 01:36 - 2019-02-16 14:34 - 004718080 ____C (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2019-03-14 01:36 - 2019-02-16 14:34 - 001725952 ____C (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2019-03-14 01:36 - 2019-02-16 14:34 - 000302080 ____C (Microsoft Corporation) C:\WINDOWS\system32\AcLayers.dll
2019-03-14 01:36 - 2019-02-16 14:33 - 001786880 ____C (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2019-03-14 01:36 - 2019-02-16 14:32 - 003646976 ____C (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2019-03-14 01:36 - 2019-02-16 14:32 - 002051072 ____C (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2019-03-14 01:36 - 2019-02-16 14:31 - 001271808 ____C (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll
2019-03-14 01:36 - 2019-02-16 14:31 - 001003520 ____C (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2019-03-14 01:36 - 2019-02-16 14:31 - 000861184 ____C (Microsoft Corporation) C:\WINDOWS\system32\mprddm.dll
2019-03-14 01:36 - 2019-02-16 14:31 - 000615424 ____C (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2019-03-14 01:36 - 2019-02-16 14:30 - 002019840 ____C (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2019-03-14 01:36 - 2019-02-16 14:29 - 000091136 ____C (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2019-03-14 01:36 - 2019-02-16 14:24 - 000444176 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppResolver.dll
2019-03-14 01:36 - 2019-02-16 14:22 - 001322176 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2019-03-14 01:36 - 2019-02-16 14:08 - 000373760 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcLayers.dll
2019-03-14 01:36 - 2019-02-16 14:07 - 001307648 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2019-03-14 01:36 - 2019-02-16 14:07 - 000484352 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2019-03-14 01:36 - 2019-02-16 14:06 - 002890752 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2019-03-14 01:36 - 2019-02-16 14:06 - 001530880 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2019-03-14 01:36 - 2019-02-16 14:06 - 001451520 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2019-03-14 01:36 - 2019-02-16 14:06 - 000774656 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2019-03-14 01:36 - 2019-02-16 14:06 - 000765952 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\mprddm.dll
2019-03-14 01:36 - 2019-02-16 12:24 - 023862272 ____C (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2019-03-14 01:36 - 2019-02-16 12:22 - 019525120 ____C (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2019-03-14 01:36 - 2019-02-16 10:16 - 000511800 ____C (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2019-03-14 01:36 - 2019-02-16 10:15 - 000505656 ____C (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2019-03-14 01:36 - 2019-02-16 10:15 - 000035640 ____C (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2019-03-14 01:36 - 2019-02-16 10:05 - 000087800 ____C (Microsoft Corporation) C:\WINDOWS\system32\taskhostw.exe
2019-03-14 01:36 - 2019-02-16 10:04 - 000193032 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2019-03-14 01:36 - 2019-02-16 10:03 - 007901392 ____C (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2019-03-14 01:36 - 2019-02-16 10:03 - 005625360 ____C (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2019-03-14 01:36 - 2019-02-16 10:03 - 000510288 ____C (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2019-03-14 01:36 - 2019-02-16 10:02 - 005821440 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2019-03-14 01:36 - 2019-02-16 10:02 - 003291632 ____C (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2019-03-14 01:36 - 2019-02-16 10:02 - 001934800 ____C (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2019-03-14 01:36 - 2019-02-16 10:02 - 001792712 ____C (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2019-03-14 01:36 - 2019-02-16 10:02 - 000705848 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2019-03-14 01:36 - 2019-02-16 10:02 - 000432952 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2019-03-14 01:36 - 2019-02-16 10:02 - 000413712 ____C (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2019-03-14 01:36 - 2019-02-16 10:01 - 001285424 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2019-03-14 01:36 - 2019-02-16 10:01 - 001209696 ____C (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2019-03-14 01:36 - 2019-02-16 10:01 - 001098056 ____C (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2019-03-14 01:36 - 2019-02-16 10:01 - 001028920 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2019-03-14 01:36 - 2019-02-16 10:01 - 001014344 ____C (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2019-03-14 01:36 - 2019-02-16 10:01 - 000735464 ____C (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2019-03-14 01:36 - 2019-02-16 10:01 - 000641984 ____C (Microsoft Corporation) C:\WINDOWS\system32\msvcp_win.dll
2019-03-14 01:36 - 2019-02-16 10:01 - 000594024 ____C (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2019-03-14 01:36 - 2019-02-16 10:01 - 000527160 ____C (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2019-03-14 01:36 - 2019-02-16 10:01 - 000480840 ____C (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2019-03-14 01:36 - 2019-02-16 10:01 - 000335672 ____C (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2019-03-14 01:36 - 2019-02-16 10:01 - 000161664 ____C (Microsoft Corporation) C:\WINDOWS\system32\RTWorkQ.dll
2019-03-14 01:36 - 2019-02-16 09:57 - 000383288 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2019-03-14 01:36 - 2019-02-16 09:53 - 000443632 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2019-03-14 01:36 - 2019-02-16 09:51 - 002479168 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2019-03-14 01:36 - 2019-02-16 09:51 - 001584536 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2019-03-14 01:36 - 2019-02-16 09:51 - 000170952 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTWorkQ.dll
2019-03-14 01:36 - 2019-02-16 09:50 - 001805648 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2019-03-14 01:36 - 2019-02-16 09:50 - 001171336 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2019-03-14 01:36 - 2019-02-16 09:50 - 001130568 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2019-03-14 01:36 - 2019-02-16 09:50 - 001011872 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2019-03-14 01:36 - 2019-02-16 09:50 - 000560384 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2019-03-14 01:36 - 2019-02-16 09:50 - 000504072 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp_win.dll
2019-03-14 01:36 - 2019-02-16 09:37 - 009084928 ____C (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2019-03-14 01:36 - 2019-02-16 09:36 - 007057408 ____C (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2019-03-14 01:36 - 2019-02-16 09:36 - 000144384 ____C (Microsoft Corporation) C:\WINDOWS\system32\fcon.dll
2019-03-14 01:36 - 2019-02-16 09:35 - 008188928 ____C (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2019-03-14 01:36 - 2019-02-16 09:35 - 006661632 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2019-03-14 01:36 - 2019-02-16 09:34 - 005883904 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2019-03-14 01:36 - 2019-02-16 09:34 - 000095232 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2019-03-14 01:36 - 2019-02-16 09:33 - 006646784 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2019-03-14 01:36 - 2019-02-16 09:33 - 004708864 ____C (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2019-03-14 01:36 - 2019-02-16 09:33 - 000054272 ____C (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll
2019-03-14 01:36 - 2019-02-16 09:32 - 002969088 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2019-03-14 01:36 - 2019-02-16 09:31 - 002825728 ____C (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
2019-03-14 01:36 - 2019-02-16 09:31 - 000126976 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\srpapi.dll
2019-03-14 01:36 - 2019-02-16 09:30 - 002449408 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
2019-03-14 01:36 - 2019-02-16 09:30 - 001986560 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
2019-03-14 01:36 - 2019-02-16 09:30 - 001124352 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
2019-03-14 01:36 - 2019-02-16 09:30 - 000530432 ____C (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2019-03-14 01:36 - 2019-02-16 09:30 - 000145920 ____C (Microsoft Corporation) C:\WINDOWS\system32\srpapi.dll
2019-03-14 01:36 - 2019-02-16 09:29 - 001768448 ____C (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2019-03-14 01:36 - 2019-02-16 09:29 - 000304128 ____C (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2019-03-14 01:36 - 2019-02-16 09:28 - 003381248 ____C (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
2019-03-14 01:36 - 2019-02-16 09:28 - 002585600 ____C (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2019-03-14 01:36 - 2019-02-16 09:28 - 001668096 ____C (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
2019-03-14 01:36 - 2019-02-16 09:28 - 000713216 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2019-03-14 01:36 - 2019-02-16 09:28 - 000705024 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2019-03-14 01:36 - 2019-02-16 09:28 - 000528384 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll
2019-03-14 01:36 - 2019-02-16 09:27 - 001364992 ____C (Microsoft Corporation) C:\WINDOWS\system32\lpasvc.dll
2019-03-14 01:36 - 2019-02-16 09:27 - 000729088 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2019-03-14 01:36 - 2019-02-16 09:27 - 000686592 ____C (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2019-03-14 01:36 - 2019-02-16 09:26 - 001459712 ____C (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2019-03-14 01:36 - 2019-02-16 09:26 - 001225216 ____C (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2019-03-14 01:36 - 2019-02-16 09:26 - 000943616 ____C (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2019-03-14 01:36 - 2019-02-16 09:26 - 000935424 ____C (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2019-03-14 01:36 - 2019-02-16 09:25 - 000884224 ____C (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2019-03-14 01:36 - 2019-02-16 09:25 - 000652800 ____C (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
2019-03-14 01:35 - 2019-03-06 17:20 - 000064000 ____C (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2019-03-14 01:35 - 2019-03-06 10:32 - 000209408 ____C (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2019-03-14 01:35 - 2019-03-06 10:31 - 000726528 ____C (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2019-03-14 01:35 - 2019-03-06 10:31 - 000154112 ____C (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2019-03-14 01:35 - 2019-03-06 10:26 - 000868864 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2019-03-14 01:35 - 2019-03-06 09:08 - 000001310 ____C C:\WINDOWS\system32\tcbres.wim
2019-03-14 01:35 - 2019-03-06 07:51 - 000032768 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2019-03-14 01:35 - 2019-03-06 07:49 - 000251904 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2019-03-14 01:35 - 2019-02-16 14:36 - 000127488 ____C (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2019-03-14 01:35 - 2019-02-16 14:30 - 000877568 ____C (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2019-03-14 01:35 - 2019-02-16 14:29 - 000174080 ____C (Microsoft Corporation) C:\WINDOWS\system32\ResetEngOnline.dll
2019-03-14 01:35 - 2019-02-16 14:04 - 000080384 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2019-03-14 01:35 - 2019-02-16 09:34 - 000002560 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2019-03-14 01:35 - 2019-02-16 09:33 - 000119808 ____C (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2019-03-14 01:35 - 2019-02-16 09:33 - 000043520 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll
2019-03-14 01:35 - 2019-02-16 09:33 - 000002560 ____C (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2019-03-14 01:35 - 2019-02-16 09:32 - 000173568 ____C (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll
2019-03-14 01:35 - 2019-02-16 09:31 - 000392704 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2019-03-14 01:35 - 2019-02-16 09:31 - 000141312 ____C (Microsoft Corporation) C:\WINDOWS\system32\AppointmentActivation.dll
2019-03-14 01:35 - 2019-02-16 09:30 - 000357888 ____C (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll
2019-03-14 01:35 - 2019-02-16 09:30 - 000254464 ____C (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppLockerCSP.dll
2019-03-14 01:35 - 2019-02-16 09:26 - 000401920 ____C (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2019-03-05 14:02 - 2019-03-05 14:02 - 000045922 ____C C:\ProgramData\vpn.1551787300.12072.bin
2019-03-05 14:02 - 2019-03-05 14:02 - 000000000 ___DC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender VPN
2019-03-05 14:02 - 2019-03-05 14:02 - 000000000 ____C C:\ProgramData\vpn.uninstall.1551787306.bdinstall.bin
2019-03-05 14:01 - 2019-03-05 14:02 - 000033724 ____C C:\ProgramData\vpn.1551787300.10696.bin
2019-03-04 17:16 - 2019-03-31 21:43 - 001071908 ____C C:\WINDOWS\ZAM_Guard.krnl.trace
2019-03-04 17:16 - 2019-03-31 21:42 - 001079310 ____C C:\WINDOWS\ZAM.krnl.trace
2019-03-03 17:42 - 2019-03-03 17:42 - 005074288 ____C C:\Users\Administrator\Downloads\eac-1.3.exe
2019-03-02 20:36 - 2019-03-03 15:45 - 000000000 ___DC C:\Users\Administrator\AppData\Roaming\avidemux
2019-03-02 20:36 - 2019-03-02 20:36 - 000000000 ___DC C:\Users\Administrator\AppData\Local\avidemux

==================== Een maand (gewijzigd) ========

(Als een item is opgenomen in de fixlist, wordt de map of het bestand verplaatst.)

2019-03-31 21:40 - 2018-09-19 22:02 - 000000000 ___DC C:\FRST
2019-03-31 21:39 - 2018-06-23 11:09 - 000000000 ___DC C:\ProgramData\regid.1991-06.com.microsoft
2019-03-31 21:37 - 2018-06-23 11:09 - 000000000 ___DC C:\WINDOWS\LiveKernelReports
2019-03-31 21:37 - 2018-06-23 11:08 - 000000000 ___DC C:\WINDOWS\INF
2019-03-31 21:36 - 2018-06-23 23:34 - 000001044 ____C C:\Users\Public\Desktop\CCleaner.lnk
2019-03-31 20:59 - 2018-06-23 10:17 - 000000000 ___DC C:\WINDOWS\system32\SleepStudy
2019-03-31 11:55 - 2018-06-23 10:18 - 000000000 ___DC C:\ProgramData\NVIDIA
2019-03-31 11:05 - 2018-06-24 22:26 - 000000000 ___DC C:\Program Files\Recuva
2019-03-31 09:43 - 2018-06-23 11:09 - 000000000 __HDC C:\Program Files\WindowsApps
2019-03-31 09:43 - 2018-06-23 11:09 - 000000000 ___DC C:\WINDOWS\AppReadiness
2019-03-28 16:45 - 2018-07-20 19:00 - 000003574 ____C C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2019-03-28 16:45 - 2018-07-20 19:00 - 000003450 ____C C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2019-03-27 22:11 - 2018-06-24 22:31 - 000000000 ___DC C:\Program Files (x86)\Mozilla Maintenance Service
2019-03-27 22:11 - 2018-06-24 15:50 - 000001188 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-03-27 22:11 - 2018-06-24 15:50 - 000001176 ____C C:\Users\Public\Desktop\Firefox.lnk
2019-03-27 22:11 - 2018-06-24 15:50 - 000000000 ___DC C:\Program Files (x86)\Mozilla Firefox
2019-03-27 22:07 - 2019-02-23 01:07 - 000000000 ___DC C:\Users\Administrator\AppData\Roaming\WhatsApp
2019-03-27 22:07 - 2019-02-23 01:07 - 000000000 ___DC C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhatsApp
2019-03-27 22:07 - 2019-02-23 01:07 - 000000000 ___DC C:\Users\Administrator\AppData\Local\SquirrelTemp
2019-03-27 22:06 - 2018-06-24 19:21 - 000001310 ____C C:\Users\Public\Desktop\Kaspersky Software Updater.lnk
2019-03-26 22:12 - 2018-06-23 11:13 - 000784122 ____C C:\WINDOWS\system32\perfh013.dat
2019-03-26 22:12 - 2018-06-23 11:13 - 000153476 ____C C:\WINDOWS\system32\perfc013.dat
2019-03-26 22:12 - 2018-06-23 10:25 - 001767124 ____C C:\WINDOWS\system32\PerfStringBackup.INI
2019-03-26 22:06 - 2018-06-23 10:21 - 000000006 ___HC C:\WINDOWS\Tasks\SA.DAT
2019-03-26 22:05 - 2019-01-09 16:14 - 000009363 ____C C:\bdlog.txt
2019-03-26 22:05 - 2018-06-23 11:15 - 000000000 ___DC C:\WINDOWS\Setup
2019-03-26 22:05 - 2018-06-23 11:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2019-03-26 20:44 - 2018-07-02 19:42 - 000001178 ____C C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2019-03-26 20:43 - 2018-07-02 19:42 - 000192216 ____C (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2019-03-26 20:43 - 2018-06-23 11:04 - 000065536 _____ C:\WINDOWS\system32\config\ELAM
2019-03-25 22:54 - 2018-11-26 21:56 - 000000000 ___DC C:\Users\Administrator\AppData\Roaming\vlc
2019-03-25 22:16 - 2019-02-27 21:09 - 000000000 ___DC C:\Users\Administrator\AbiSuite
2019-03-23 10:30 - 2018-07-20 19:00 - 000002281 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-03-23 10:30 - 2018-07-20 19:00 - 000002240 ____C C:\Users\Public\Desktop\Google Chrome.lnk
2019-03-20 21:11 - 2018-06-23 10:17 - 000534504 ____C C:\WINDOWS\system32\FNTCACHE.DAT
2019-03-20 20:49 - 2018-11-16 14:46 - 000000000 ___DC C:\Program Files\rempl
2019-03-20 17:51 - 2017-03-19 17:14 - 000000000 ____D C:\Printers
2019-03-19 10:55 - 2018-10-02 19:28 - 000000000 ___DC C:\Program Files\LibreOffice
2019-03-18 00:58 - 2018-06-24 22:32 - 000003936 ____C C:\WINDOWS\System32\Tasks\CCleaner Update
2019-03-16 20:46 - 2018-06-24 19:36 - 000000000 ___DC C:\Users\Administrator\AppData\Roaming\MediaMonkey
2019-03-14 16:56 - 2018-06-23 10:20 - 000000000 ___DC C:\Users\Administrator
2019-03-14 08:58 - 2018-06-24 22:26 - 000001880 ____C C:\Users\Public\Desktop\Recuva.lnk
2019-03-14 02:04 - 2018-06-23 11:09 - 000000000 __SDC C:\WINDOWS\system32\UNP
2019-03-14 02:04 - 2018-06-23 11:09 - 000000000 __RDC C:\Program Files\Windows Defender
2019-03-14 02:04 - 2018-06-23 11:09 - 000000000 ___DC C:\WINDOWS\TextInput
2019-03-14 02:04 - 2018-06-23 11:09 - 000000000 ___DC C:\WINDOWS\system32\oobe
2019-03-14 02:04 - 2018-06-23 11:09 - 000000000 ___DC C:\WINDOWS\system32\appraiser
2019-03-14 02:04 - 2018-06-23 11:09 - 000000000 ___DC C:\WINDOWS\ShellExperiences
2019-03-14 02:04 - 2018-06-23 11:09 - 000000000 ___DC C:\WINDOWS\bcastdvr
2019-03-14 02:04 - 2018-06-23 11:09 - 000000000 ___DC C:\Program Files (x86)\Windows Defender
2019-03-14 01:39 - 2018-06-23 11:05 - 000000000 ___DC C:\WINDOWS\CbsTemp
2019-03-14 01:35 - 2018-06-23 17:13 - 000000000 ___DC C:\WINDOWS\system32\MRT
2019-03-14 01:32 - 2018-06-23 17:13 - 127411920 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2019-03-12 18:15 - 2018-06-23 10:22 - 000000000 ___DC C:\Users\Administrator\AppData\Local\Packages
2019-03-12 17:47 - 2018-06-24 19:19 - 000000000 ___DC C:\Program Files\FreeFileSync
2019-03-05 14:02 - 2018-10-01 09:29 - 000002191 ____C C:\Users\Public\Desktop\Bitdefender VPN.lnk
2019-03-05 14:02 - 2018-07-02 19:22 - 000000000 ___DC C:\Program Files\Bitdefender
2019-03-04 19:16 - 2018-06-23 10:33 - 000000000 ___DC C:\Users\Administrator\AppData\Local\ElevatedDiagnostics
2019-03-04 10:45 - 2018-07-02 19:24 - 000001983 ____C C:\Users\Public\Desktop\Bitdefender.lnk
2019-03-04 10:45 - 2018-03-13 11:20 - 000000000 ___DC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender Security
2019-03-04 10:42 - 2018-07-02 19:23 - 000201000 ____C (BitDefender LLC) C:\WINDOWS\system32\Drivers\gzflt.sys
2019-03-04 10:40 - 2018-12-12 12:38 - 000374632 ____C (BitDefender S.R.L. Bucharest, ROMANIA) C:\WINDOWS\system32\Drivers\gemma.sys
2019-03-04 10:40 - 2018-09-29 17:45 - 000367096 ____C (Bitdefender) C:\WINDOWS\system32\Drivers\bddci.sys
2019-03-04 10:40 - 2018-07-02 19:24 - 001423680 ____C (BitDefender S.R.L. Bucharest, ROMANIA) C:\WINDOWS\system32\Drivers\atc.sys
2019-03-04 10:40 - 2018-07-02 19:22 - 000610640 ____C (Bitdefender) C:\WINDOWS\system32\Drivers\trufos.sys
2019-03-03 18:54 - 2018-06-23 11:11 - 000835480 ____C (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2019-03-03 18:54 - 2018-06-23 11:11 - 000179608 ____C (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2019-03-03 18:08 - 2018-11-11 20:26 - 000000000 ___DC C:\Program Files (x86)\Exact Audio Copy
2019-03-03 16:44 - 2019-02-21 18:36 - 000000000 ___DC C:\WINDOWS\System32\Tasks\NCH Software
2019-03-02 20:23 - 2018-11-11 21:51 - 000000986 ____C C:\WINDOWS\cdplayer.ini
2019-03-02 19:59 - 2018-11-17 17:02 - 000001413 ____C C:\Users\Public\Desktop\CyberLink Media Suite 10.lnk
2019-03-01 18:00 - 2018-06-23 10:29 - 000000000 ___DC C:\ProgramData\Packages
2019-03-01 18:00 - 2018-06-23 10:23 - 000000000 ___DC C:\Users\Administrator\AppData\Local\PlaceholderTileLogoFolder

==================== Bestanden in de root van sommige mappen =======

2018-07-19 19:38 - 2018-07-19 19:38 - 000342282 ____C () C:\Users\Administrator\AppData\Local\ars.cache
2018-07-19 19:38 - 2018-07-19 19:38 - 000791884 ____C () C:\Users\Administrator\AppData\Local\census.cache
2018-07-19 19:28 - 2018-07-19 19:28 - 000000036 ____C () C:\Users\Administrator\AppData\Local\housecall.guid.cache
2018-07-19 19:32 - 2018-07-19 19:32 - 000000010 ____C () C:\Users\Administrator\AppData\Local\sponge.last.runtime.cache

Sommige nul byte grootte bestanden/mappen:
==========================
C:\Windows\SysWOW64\gm320ain.dll

==================== Bamital & volsnap ======================

(Er is geen automatische fix voor bestanden die de verificatie niet doorkomen.)

C:\WINDOWS\system32\winlogon.exe => Bestand is getekend
C:\WINDOWS\system32\wininit.exe => Bestand is getekend
C:\WINDOWS\explorer.exe => Bestand is getekend
C:\WINDOWS\SysWOW64\explorer.exe => Bestand is getekend
C:\WINDOWS\system32\svchost.exe => Bestand is getekend
C:\WINDOWS\SysWOW64\svchost.exe => Bestand is getekend
C:\WINDOWS\system32\services.exe => Bestand is getekend
C:\WINDOWS\system32\User32.dll => Bestand is getekend
C:\WINDOWS\SysWOW64\User32.dll => Bestand is getekend
C:\WINDOWS\system32\userinit.exe => Bestand is getekend
C:\WINDOWS\SysWOW64\userinit.exe => Bestand is getekend
C:\WINDOWS\system32\rpcss.dll => Bestand is getekend
C:\WINDOWS\system32\dnsapi.dll => Bestand is getekend
C:\WINDOWS\SysWOW64\dnsapi.dll => Bestand is getekend
C:\WINDOWS\system32\dllhost.exe => Bestand is getekend
C:\WINDOWS\SysWOW64\dllhost.exe => Bestand is getekend
C:\WINDOWS\system32\Drivers\volsnap.sys => Bestand is getekend

LastRegBack: 2018-06-23 10:17

==================== Einde van FRST.txt ============================

en ....

Extra scanresultaten van Farbar Recovery Scan Tool (x64) Versie: 17.03.2019
Gestart door Administrator (31-03-2019 21:44:13)
Gestart vanaf C:\Users\Administrator\Downloads
Windows 10 Home Versie 1803 17134.648 (X64) (2018-06-23 08:22:00)
Boot Modus: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2136469052-3984601998-3441907689-500 - Administrator - Enabled) => C:\Users\Administrator
DefaultAccount (S-1-5-21-2136469052-3984601998-3441907689-503 - Limited - Disabled)
Gast (S-1-5-21-2136469052-3984601998-3441907689-501 - Limited - Disabled)
GDB (S-1-5-21-2136469052-3984601998-3441907689-1000 - Administrator - Enabled) => C:\Users\GDB
WDAGUtilityAccount (S-1-5-21-2136469052-3984601998-3441907689-504 - Limited - Disabled)

==================== Security Center ========================

(Als een item is opgenomen in de fixlist, zal het worden verwijderd.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Bitdefender Antivirus (Enabled - Up to date) {0E17DB7D-A20F-62CE-B95B-17DB0CDFE318}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Bitdefender Antispyware (Enabled - Up to date) {B5763A99-8435-6D40-83EB-2CA97758A9A5}
FW: Bitdefender Firewall (Enabled) {362C5A58-E860-6396-9204-BEEEF20CA463}

==================== Geïnstalleerde programma's ======================

(Alleen de adware-programma's met 'verborgen' vlag kunnen worden toegevoegd aan de fixlist om ze zichtbaar te maken. De adware-programma's moeten handmatig gedeïnstalleerd worden.)

7-Zip 19.00 (x64) (HKLM\...\7-Zip) (Version: 19.00 - Igor Pavlov)
AbiWord 2.8.6 (HKLM-x32\...\AbiWord2) (Version: 2.8.6 - AbiSource Developers)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 32.0.0.89 - Adobe Systems Incorporated)
AM-DeadLink 4.6 (HKLM-x32\...\aignesamdeadlink_is1) (Version: 4.6 - www.aignes.com)
Ant Movie Catalog (HKLM-x32\...\Ant Movie Catalog_is1) (Version: 4.2.1 - Ant Software)
Belgium e-ID middleware 4.3.2 (build 3551) (HKLM\...\{DB942AEA-93D6-4FE4-8862-180D35A73551}) (Version: 4.3.3551 - Belgian Government)
Belgium e-ID viewer 4.3.6 (build 3571) (HKLM-x32\...\{F3DC7F06-92FF-4C98-87F5-72C0B7863571}) (Version: 4.3.3571 - Belgian Government)
Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 21.0.25.59 - Bitdefender)
Bitdefender Internet Security (HKLM\...\Bitdefender) (Version: 22.0.21.297 - Bitdefender)
Bitdefender VPN (HKLM\...\Bitdefender VPN) (Version: 23.0.8.655 - Bitdefender)
CCleaner (HKLM\...\CCleaner) (Version: 5.55 - Piriform)
CodeStuff Starter (HKLM-x32\...\CodeStuff Starter) (Version: 5.6.2.9 - CodeStuff)
CrystalDiskInfo 8.0.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 8.0.0 - Crystal Dew World)
CSR Harmony Wireless Software Stack (HKLM\...\{17DEA095-8EE1-49A2-AC5A-9663DB098FA9}) (Version: 2.1.63.0 - CSR Plc.)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
eaZyLink (HKLM-x32\...\{841B3841-39EF-4190-804C-5E2F0A19314B}) (Version: 1.4.4 - ZETES)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
FUJIFILM MyFinePix Studio 4.2b (HKLM-x32\...\MyFinePix Studio_is1) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 73.0.3683.86 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.7 - Google LLC) Hidden
HP Deskjet 2540 series Basissoftware van het apparaat (HKLM\...\{A7F14256-6DC6-458A-A92D-B5EEF79429AB}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Deskjet 2540 series Help (HKLM-x32\...\{50467ECF-F6A9-40EC-A649-67EB6FAD9894}) (Version: 30.0.0 - Hewlett Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
IrfanView 4.52 (64-bit) (HKLM\...\IrfanView64) (Version: 4.52 - Irfan Skiljan)
Kaspersky Software Updater (HKLM-x32\...\{DEEDA858-A9B4-4212-8873-2F2CE2706E68}) (Version: 2.0.0.623 - Kaspersky Lab) Hidden
Kaspersky Software Updater (HKLM-x32\...\InstallWIX_{DEEDA858-A9B4-4212-8873-2F2CE2706E68}) (Version: 2.0.0.623 - Kaspersky Lab)
LibreOffice 6.2.1.2 (HKLM\...\{28B8E75D-44A5-4057-8369-5951A15BAF08}) (Version: 6.2.1.2 - The Document Foundation)
Malwarebytes Anti-Malware versie 1.80.2.1012 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.80.2.1012 - Malwarebytes Corporation)
MediaMonkey 4.1 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.1 - Ventis Media Inc.)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 66.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 66.0.2 (x86 en-US)) (Version: 66.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 66.0.2 - Mozilla)
Pegasus Mail HTML Renderer 2.4.10.3 (HKLM-x32\...\{A9F5E1E1-1281-4862-90B4-6CF8E6AF83CE}_is1) (Version: - Micha's Midnight Manufacture)
Pegasus Mail v4.73 (HKLM-x32\...\{6998396E-6D20-48FE-9200-4C9DFAFCED54}_is1) (Version: 4.73 - David Harris)
Printer EPSON XP-422 423 425 Series verwijderen (HKLM\...\EPSON XP-422 423 425 Series) (Version: - SEIKO EPSON Corporation)
Productverbeteringsonderzoek voor HP Deskjet 2540 series (HKLM\...\{08FB88A2-3FB6-4E82-AD55-393EBAD0E967}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
Quintessential Media Player (HKLM-x32\...\Quintessential Media Player) (Version: Version 5.0 - Quinnware)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Speccy (HKLM\...\Speccy) (Version: 1.32 - Piriform)
UltraSearch V2.3 (64 bit) (HKLM\...\UltraSearch_is1) (Version: 2.3 - JAM Software)
Unchecky v1.2 (HKLM-x32\...\Unchecky) (Version: 1.2 - Reason Software Company Inc.)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{FBA3961B-D1DF-493C-BC1F-E67D3B832895}) (Version: 2.56.0.0 - Microsoft Corporation)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player (HKLM\...\VLC media player) (Version: 3.0.6 - VideoLAN)
WhatsApp (HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\WhatsApp) (Version: 0.3.2386 - WhatsApp)
Wondershare Helper Compact 2.5.3 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.3 - Wondershare)

==================== Aangepaste CLSID (gefilterd): ==========================

(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)

ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2019-02-21] (Igor Pavlov) [Bestand niet getekend]
ContextMenuHandlers1: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll [2015-07-07] (CyberLink Corp. -> Cyberlink)
ContextMenuHandlers2: [CLVDShellExt] -> {3E2A0A32-6E14-4BAD-AA87-BBB6A75EBFF2} => C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll [2015-07-07] (CyberLink Corp. -> Cyberlink)
ContextMenuHandlers2: [QMPlayer] -> {71A068F3-2DC9-438D-8944-6B4FF540D2F5} => C:\Program Files (x86)\Quintessential Media Player\QMPShell64.dll [2009-02-07] (Quinnware) [Bestand niet getekend]
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll [2015-07-30] (Malwarebytes Corporation -> Malwarebytes Corporation)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2019-02-21] (Igor Pavlov) [Bestand niet getekend]
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Geen bestand
ContextMenuHandlers4: [QMPlayer] -> {71A068F3-2DC9-438D-8944-6B4FF540D2F5} => C:\Program Files (x86)\Quintessential Media Player\QMPShell64.dll [2009-02-07] (Quinnware) [Bestand niet getekend]
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd -> Piriform Ltd)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-10-30] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2019-02-21] (Igor Pavlov) [Bestand niet getekend]
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll [2015-07-30] (Malwarebytes Corporation -> Malwarebytes Corporation)
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Geen bestand
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd -> Piriform Ltd)

==================== Geplande Taken (gefilterd) =============

(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)

Task: {5026A089-4861-48D0-B6B3-6EB68821F99F} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
Task: {602B9A72-ACDF-41B6-90DF-70F1C6DE47F3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Google Inc -> Google Inc.)
Task: {7295006E-3C63-4ED3-B3E9-9A34D5AFDB6E} - System32\Tasks\Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures
Task: {905D3CB5-5899-4365-8120-7A1FDF06A3CC} - System32\Tasks\Bitdefender AgentTask_AD394AE64E874073B10A89FEEC305A3C => C:\Program Files\Bitdefender\Bitdefender Security\bdagent.exe (Bitdefender SRL -> Bitdefender)
Task: {A0140991-0A18-4CF4-B516-DEA49ED6650C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (Google Inc -> Google Inc.)
Task: {D9A7D520-5FBA-4EA2-8267-4818BEFA674E} - System32\Tasks\HPCustParticipation HP Deskjet 2540 series => C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPCustPartic.exe (Hewlett Packard -> Hewlett-Packard Co.)
Task: {EE1E40F8-2466-4DEC-BB79-5045021F84D6} - System32\Tasks\EPSON XP-422 423 425 Series Update {AB0F27C2-40AF-4EA3-B242-FF25D99F4253} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNDE.EXE (SEIKO EPSON CORPORATION -> SEIKO EPSON CORPORATION)
Task: {FC220CF3-DC61-4CA3-B9F6-684B5CFC2319} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe (Piriform Software Ltd -> Piriform Software Ltd)
Task: {FE27A122-4658-4496-8947-8B55838B44EC} - System32\Tasks\Bitdefender Agent WatchDog_65D6944A0EF74FDAB96E31112AD39864 => C:\Program Files\Bitdefender Agent\WatchDog.exe (Bitdefender SRL -> Bitdefender)

(Als een item is opgenomen in de fixlist, wordt de taak (job) bestand verplaatst. Het bestand dat wordt uitgevoerd door de taak zal niet worden verplaatst.)

Task: C:\WINDOWS\Tasks\EPSON XP-422 423 425 Series Update {AB0F27C2-40AF-4EA3-B242-FF25D99F4253}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNDE.EXE:/EXE:{AB0F27C2-40AF-4EA3-B242-FF25D99F4253} /F:UpdateWORKGROUP\GDB-PC$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi

==================== Snelkoppelingen & WMI ========================

(De items kunnen worden opgenomen in de fixlist.txt om hersteld of verwijderd te worden.)


Shortcut: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Quintessential Media Player\Quinnware Website.lnk -> hxxp://www.quinnware.com

==================== Geladen Modules (gefilterd) ==============

2017-05-04 17:49 - 2017-05-04 17:49 - 000518656 ____C () [Bestand niet getekend] C:\ProgramData\eaZyLink\eaZySvr.exe
2018-06-24 22:31 - 2019-02-21 18:00 - 000078336 ____C (Igor Pavlov) [Bestand niet getekend] C:\Program Files\7-Zip\7-zip.dll

==================== Alternate Data Streams (gefilterd) =========

(Als een item is opgenomen in de fixlist, wordt alleen de ADS verwijderd.)

AlternateDataStreams: C:\WINDOWS\SysWOW64\gm320ain.dll:ExtraData [15]

==================== Veilige Modus (gefilterd) ===================

(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. De waarde van "AlternateShell" wordt hersteld.)


==================== Bestandskoppeling (gefilterd) ===============

(Als een item is opgenomen in de fixlist, zal het registeritem worden teruggezet naar de standaardwaarden of verwijderd.)


==================== Internet Explorer vertrouwde/beperkte toegang ===============

(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

Er zijn 7938 Meer websites.

IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\123simsen.com -> www.123simsen.com

Er zijn 7938 Meer websites.


==================== Hosts inhoud: ==========================

(Indien nodig kan Hosts:-opdracht worden opgenomen in de fixlist om Hosts te resetten.)

2018-06-23 11:09 - 2019-03-20 21:11 - 000455111 ___RC C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123haustiereundmehr.com
127.0.0.1 123moviedownload.com

Er zijn 15644 meer regels.


==================== Andere gebieden ============================

(Momenteel is er geen automatische fix voor dit onderdeel.)

HKU\S-1-5-21-2136469052-3984601998-3441907689-500\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is ingeschakeld.

==================== MSCONFIG/TASK MANAGER Uitgeschakelde items ==

Als een item is opgenomen in de fixlist, zal het worden verwijderd.

HKLM\...\StartupApproved\Run: => "vksts"
HKLM\...\StartupApproved\Run: => "TrayApplication"
HKLM\...\StartupApproved\Run: => "HarmonyUserStartup"
HKLM\...\StartupApproved\Run: => "CsrHCRPServer"
HKLM\...\StartupApproved\Run: => "CsrAudioguiCtrl"
HKLM\...\StartupApproved\Run: => "CSRHarmonySkypePlugin"
HKLM\...\StartupApproved\Run32: => "CLMLServer_For_P2G8"
HKLM\...\StartupApproved\Run32: => "CLVirtualDrive"
HKLM\...\StartupApproved\Run32: => "YouCam Service"
HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
HKU\S-1-5-21-2136469052-3984601998-3441907689-500\...\StartupApproved\Run: => "OneDrive"

==================== Firewall regels (gefilterd) ===============

(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)

FirewallRules: [{B6709A90-1808-4FE3-B30B-CF6B2019E1A3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{4108EDB7-5901-4654-B1E5-10481BFC546D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{47AE8406-D02D-412F-89CC-75E07F24AC94}] => (Allow) C:\Program Files\HP\HP Deskjet 2540 series\Bin\DeviceSetup.exe (Hewlett Packard -> Hewlett-Packard Co.)
FirewallRules: [{1F21B97E-69A3-41FA-94F7-A421E5A0A34D}] => (Allow) LPort=5357
FirewallRules: [{DE78B4CE-60BA-4391-885A-3A3BFD72B7AE}] => (Allow) C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPNetworkCommunicatorCom.exe (Hewlett Packard -> Hewlett-Packard Co.)
FirewallRules: [{D89F5A71-0111-4B1D-9325-E1B7E7F9B12B}] => (Allow) C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe (Ventis Media, Inc. -> Ventis Media Inc.)
FirewallRules: [{35D76D8A-45B3-41F0-8F9E-96B952331D9C}] => (Allow) C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe (Ventis Media, Inc. -> Ventis Media Inc.)
FirewallRules: [{74C7BB9B-3945-411C-A0F8-B75F66927EAF}] => (Allow) C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe (Ventis Media, Inc. -> Ventis Media Inc.)
FirewallRules: [{F2AD5B27-8A8C-4405-A1B3-DBA7D1A41D95}] => (Allow) C:\Program Files (x86)\Apowersoft\ApowerREC\ApowerREC.exe (Apowersoft Ltd -> Apowersoft)
FirewallRules: [{C4C1D935-BE06-444F-84E1-5F795352D2DE}] => (Allow) C:\Program Files (x86)\Apowersoft\ApowerREC\ApowerREC.exe (Apowersoft Ltd -> Apowersoft)
FirewallRules: [{A0D456F0-76A1-4893-891F-241CA139DFD0}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{D9CE9549-589B-4020-91BD-0FA4B3ACA1F1}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{653710EC-4416-41C7-BCE7-022318EE57E8}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google Inc.)
FirewallRules: [{FAD1BE58-4934-45FD-B33D-E1C7BDD7A535}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.103.259.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{55416EDE-8A1A-4275-ABB3-AC2E48CA1F9D}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.103.259.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{CBCC671C-C264-4D62-9610-793F13061AD2}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.103.259.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{2C65E1D5-651F-4153-9538-0047CCA9F86B}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.103.259.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{89E79B5B-9C62-4D4B-B94C-0DF3F0EABFBE}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.103.259.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{129DE678-5A87-4302-90A5-9AADD98DD67A}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.103.259.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{261CAE10-3ECE-440D-A594-3D6690C7DC57}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.103.259.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{9736F23E-84A9-4653-871F-F4113E7B4524}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.103.259.0_x86__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)

==================== Herstelpunten =========================

18-03-2019 21:47:39 Removed LibreOffice 6.2.0.3
22-03-2019 21:01:59 Installed eaZyLink
26-03-2019 22:07:08 JRT Pre-Junkware Removal

==================== Defecte Apparaatbeheer Apparaten =============

Name: Microsoft-muis (PS/2)
Description: Microsoft-muis (PS/2)
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Standaard PS/2-toetsenbord
Description: Standaard PS/2-toetsenbord
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (standaardtoetsenbord)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Eventlog fouten: =========================

Applicatiefouten:
==================
Error: (03/31/2019 07:00:00 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: De back-up is niet voltooid vanwege een fout bij schrijven naar de back-uplocatie F:\. De fout is: De back-uplocatie is niet gevonden of is niet geldig. Controleer de back-upinstellingen en de back-uplocatie. (0x81000006).

Error: (03/31/2019 11:55:22 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Naam van toepassing met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Naam van module met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Uitzonderingscode: 0xc0000005
Foutmarge: 0x0000000000006f58
Id van proces met fout: 0x1aa0
Starttijd van toepassing met fout: 0x01d4e7956fb28a6b
Pad naar toepassing met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Pad naar module met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Rapport-id: 8573a121-c644-4470-8e29-4a3644a87768
Volledige pakketnaam met fout:
Relatieve toepassings-id van pakket met fout:

Error: (03/31/2019 12:46:15 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Naam van toepassing met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Naam van module met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Uitzonderingscode: 0xc0000005
Foutmarge: 0x0000000000006f58
Id van proces met fout: 0x2334
Starttijd van toepassing met fout: 0x01d4e72434bbb943
Pad naar toepassing met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Pad naar module met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Rapport-id: 73551b05-3bdd-47ba-a323-13042cb8b4bf
Volledige pakketnaam met fout:
Relatieve toepassings-id van pakket met fout:

Error: (03/29/2019 11:31:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Naam van toepassing met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Naam van module met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Uitzonderingscode: 0xc0000005
Foutmarge: 0x0000000000006f58
Id van proces met fout: 0x424
Starttijd van toepassing met fout: 0x01d4e66c983799f5
Pad naar toepassing met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Pad naar module met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Rapport-id: d2143a38-b61d-4376-aecd-db9a838db763
Volledige pakketnaam met fout:
Relatieve toepassings-id van pakket met fout:

Error: (03/29/2019 08:19:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Naam van toepassing met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Naam van module met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Uitzonderingscode: 0xc0000005
Foutmarge: 0x0000000000006f58
Id van proces met fout: 0x13d4
Starttijd van toepassing met fout: 0x01d4e647346ade58
Pad naar toepassing met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Pad naar module met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Rapport-id: 42754c50-d610-43e3-b8f4-30d791287d33
Volledige pakketnaam met fout:
Relatieve toepassings-id van pakket met fout:

Error: (03/29/2019 11:00:10 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Naam van toepassing met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Naam van module met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Uitzonderingscode: 0xc0000005
Foutmarge: 0x0000000000006f58
Id van proces met fout: 0x1b4c
Starttijd van toepassing met fout: 0x01d4e60d4ab98630
Pad naar toepassing met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Pad naar module met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Rapport-id: 9c86155c-1343-420e-9eda-0eae9ab9532a
Volledige pakketnaam met fout:
Relatieve toepassings-id van pakket met fout:

Error: (03/29/2019 01:01:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Naam van toepassing met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Naam van module met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Uitzonderingscode: 0xc0000005
Foutmarge: 0x0000000000006f58
Id van proces met fout: 0x910
Starttijd van toepassing met fout: 0x01d4e5b18f474c58
Pad naar toepassing met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Pad naar module met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Rapport-id: c6523073-f102-41a1-a437-1433296762ab
Volledige pakketnaam met fout:
Relatieve toepassings-id van pakket met fout:

Error: (03/28/2019 08:06:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Naam van toepassing met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Naam van module met fout: CsrBtOBEXService.exe, versie: 2.1.63.0, tijdstempel: 0x4f68683b
Uitzonderingscode: 0xc0000005
Foutmarge: 0x0000000000006f58
Id van proces met fout: 0xb84
Starttijd van toepassing met fout: 0x01d4e574aa903102
Pad naar toepassing met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Pad naar module met fout: C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
Rapport-id: 0cb44fc5-9083-4e00-a794-36b68d00edfb
Volledige pakketnaam met fout:
Relatieve toepassings-id van pakket met fout:


Systeemfouten:
=============
Error: (03/31/2019 09:38:46 PM) (Source: DCOM) (EventID: 10016) (User: GDB-PC)
Description: In de machtigingsinstellingen toepassingsspecifiek wordt de machtiging Activeren niet verleend aan Lokaal voor de COM-servertoepassing met CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
en APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
aan de gebruiker GDB-PC\Administrator SID (S-1-5-21-2136469052-3984601998-3441907689-500) met het adres LocalHost (via LRPC) die wordt uitgevoerd in de toepassingscontainer Niet beschikbaar SID (Niet beschikbaar). Deze beveiligingsmachtiging kan worden gewijzigd met het beheerprogramma van Component Services.

Error: (03/31/2019 07:16:02 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: In de machtigingsinstellingen toepassingsspecifiek wordt de machtiging Activeren niet verleend aan Lokaal voor de COM-servertoepassing met CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
en APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
aan de gebruiker NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) met het adres LocalHost (via LRPC) die wordt uitgevoerd in de toepassingscontainer Niet beschikbaar SID (Niet beschikbaar). Deze beveiligingsmachtiging kan worden gewijzigd met het beheerprogramma van Component Services.

Error: (03/31/2019 07:15:33 PM) (Source: DCOM) (EventID: 10016) (User: GDB-PC)
Description: In de machtigingsinstellingen toepassingsspecifiek wordt de machtiging Activeren niet verleend aan Lokaal voor de COM-servertoepassing met CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
en APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
aan de gebruiker GDB-PC\Administrator SID (S-1-5-21-2136469052-3984601998-3441907689-500) met het adres LocalHost (via LRPC) die wordt uitgevoerd in de toepassingscontainer Niet beschikbaar SID (Niet beschikbaar). Deze beveiligingsmachtiging kan worden gewijzigd met het beheerprogramma van Component Services.

Error: (03/31/2019 06:40:33 PM) (Source: DCOM) (EventID: 10016) (User: GDB-PC)
Description: In de machtigingsinstellingen toepassingsspecifiek wordt de machtiging Activeren niet verleend aan Lokaal voor de COM-servertoepassing met CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
en APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
aan de gebruiker GDB-PC\Administrator SID (S-1-5-21-2136469052-3984601998-3441907689-500) met het adres LocalHost (via LRPC) die wordt uitgevoerd in de toepassingscontainer Niet beschikbaar SID (Niet beschikbaar). Deze beveiligingsmachtiging kan worden gewijzigd met het beheerprogramma van Component Services.

Error: (03/31/2019 05:24:09 PM) (Source: DCOM) (EventID: 10016) (User: GDB-PC)
Description: In de machtigingsinstellingen toepassingsspecifiek wordt de machtiging Activeren niet verleend aan Lokaal voor de COM-servertoepassing met CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
en APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
aan de gebruiker GDB-PC\Administrator SID (S-1-5-21-2136469052-3984601998-3441907689-500) met het adres LocalHost (via LRPC) die wordt uitgevoerd in de toepassingscontainer SpotifyAB.SpotifyMusic_1.103.259.0_x86__zpdnekdrzrea0 SID (Niet beschikbaar). Deze beveiligingsmachtiging kan worden gewijzigd met het beheerprogramma van Component Services.

Error: (03/31/2019 05:23:41 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: In de machtigingsinstellingen toepassingsspecifiek wordt de machtiging Activeren niet verleend aan Lokaal voor de COM-servertoepassing met CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
en APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
aan de gebruiker NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) met het adres LocalHost (via LRPC) die wordt uitgevoerd in de toepassingscontainer Niet beschikbaar SID (Niet beschikbaar). Deze beveiligingsmachtiging kan worden gewijzigd met het beheerprogramma van Component Services.

Error: (03/31/2019 11:55:24 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: De CSR OBEX Service-service is onverwacht beëindigd. Dit is nu 11 keer gebeurd.

Error: (03/31/2019 11:55:20 AM) (Source: DCOM) (EventID: 10010) (User: GDB-PC)
Description: De server {F9717507-6651-4EDB-BFF7-AE615179BCCF} heeft zich niet binnen de vereiste termijn bij DCOM geregistreerd.


Windows Defender:
===================================
Date: 2018-07-01 00:02:50.851
Description:
Scan van Windows Defender Antivirus is gestopt voordat deze was voltooid.
Scan-id: {A2FC8EE8-8C53-4677-93EE-10BA7D186B75}
Type scan: Antimalware
Scanparameters: Volledige scan
Gebruiker: GDB-PC\Administrator

Date: 2018-06-27 20:07:10.194
Description:
Scan van Windows Defender Antivirus is gestopt voordat deze was voltooid.
Scan-id: {B15D10C6-87F0-43AD-B189-B3EAC723517C}
Type scan: Antimalware
Scanparameters: Snelle scan
Gebruiker: NT AUTHORITY\SYSTEM

CodeIntegrity:
===================================

Date: 2019-03-26 21:06:20.483
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Quintessential Media Player\cdrpdacc.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-03-26 21:06:11.002
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\dbghelp.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2019-03-26 19:55:26.371
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-03-26 19:55:26.364
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-03-26 19:55:26.359
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-03-26 19:43:26.834
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Quintessential Media Player\cdrpdacc.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2019-03-26 19:43:15.327
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\bdservicehost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Bitdefender\Bitdefender Security\dbghelp.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2019-03-23 20:48:16.818
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Quintessential Media Player\cdrpdacc.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Geheugen info ===========================

Processor: Intel(R) Core(TM) i3-2100 CPU @ 3.10GHz
Percentage geheugen in gebruik: 41%
Totaal fysiek RAM-geheugen: 8150.05 MB
Beschikbaar fysiek RAM-geheugen: 4752.43 MB
Totaal Virtueel geheugen: 8662.05 MB
Beschikbaar Virtueel geheugen: 4990.82 MB

==================== Schijven ================================

Drive c: () (Fixed) (Total:222.88 GB) (Free:139.97 GB) NTFS
Drive d: (Lokale schijf) (Fixed) (Total:465.76 GB) (Free:341.7 GB) NTFS
Drive f: (SILVER AM) (Removable) (Total:1.87 GB) (Free:1.87 GB) FAT32

\\?\Volume{087d2844-11d8-4e75-8682-39f14d29abc7}\ () (Fixed) (Total:0.46 GB) (Free:0.09 GB) NTFS
\\?\Volume{f3ae05db-ef29-43bd-8b41-c1f88998bd01}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

==================== MBR & Partitietabel ==================

========================================================
Disk: 0 (Size: 223.6 GB) (Disk ID: 720E3869)

Partition: GPT.

========================================================
Disk: 1 (Size: 465.8 GB) (Disk ID: 64C8DA24)

Partition: GPT.

========================================================
Disk: 3 (Size: 1.9 GB) (Disk ID: 01B56062)
Partition 1: (Active) - (Size=1.9 GB) - (Type=0C)

==================== Einde van Addition.txt ============================
Warning: most messages of this kind, could be sent by an oldtimer Acer Aspire 7530 laptop or even an older Lenovo T500 laptop, both proudly and pretty fast using Linux Mint 21.1 "Vera" Cinnamon 64 bits operating system.
Give it a try too !
abbs 01 apr 2019, 11:45 Leidschendam 1.589 berichten
Hallo,

Stap 1.
Afbeelding Reset Internet Explorer.


Stap 2.

De tool FRST.exe staat in de dik gedrukte map: C:\Users\Administrator\'Downloads <== Sleep de FRST.exe vanuit deze map naar je bureaublad.

Lees eerst de handleiding en voer daarna de fix uit Handleiding Fix

Note: Dit script is speciaal bedoeld voor deze computer, gebruik dit dan ook niet op andere computers met een gelijkaardig probleem.

Klik Windows knop plus R tegelijk in. Afbeelding
"Uitvoeren" opent vul daar Notepad in en klik daarna op "OK", Kladblok opent.
Kopieer onderstaande code en plak dat in "Kladblok"

Code: Selecteer alles

start
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
FF NetworkProxy: Mozilla\Firefox\Profiles\2ughqukf.default -> type", 0
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2018-09-20] (Zemana Ltd. -> Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2018-07-07] (Zemana Ltd. -> Zemana Ltd.)
S1 epp; \??\F:\EMSISOFTEMERGENCYKIT\BIN64\epp.sys [X]
S1 SASDIFSV; \??\F:\Superantispyware\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\F:\Superantispyware\SASKUTIL64.SYS [X]
2019-03-04 17:16 - 2019-03-31 21:43 - 001071908 ____C C:\WINDOWS\ZAM_Guard.krnl.trace
2019-03-04 17:16 - 2019-03-31 21:42 - 001079310 ____C C:\WINDOWS\ZAM.krnl.trace
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Geen bestand
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Geen bestand
AlternateDataStreams: C:\WINDOWS\SysWOW64\gm320ain.dll:ExtraData [15]
Hosts:
RemoveProxy:
EmptyTemp:
Reboot:
end
Ga naar Bestand - Opslaan als.
Kies als locatie bureaublad.
Bij "Bestandsnaam" zet je:fixlist.txt
Bij "Opslaan als type" selecteer je: Alle bestanden.

Als het goed is staat er nu een text bestand op je bureaublad?

Start de Farbar Recovery Scan Tool.
Als het programma is geopend klik Yes (Ja) bij de disclaimer. (indien nodig)
Druk op de Fix knop.
Er zal u een logbestand aangemaakt worden (fixlog.txt) op dezelfde plaats vanwaar de 'tool' is gestart.
Kopieer en plak de inhoud van de logbestanden in je het volgende bericht.(als de inhoud te groot is voor één bericht plaats het in meerdere berichten)
Groeten abbs
Afbeelding
Member of UNITE (Unified Network of Instructors and Trained Eliminators)
Toby Startte dit onderwerp 07 apr 2019, 07:18 Het Soete Land Van Waes 966 berichten
Heerlijk om een oplossing aangereikt te krijgen, maar door omstandigheden kon ik die toepassing nog niet uitvoeren.
Excuses daarvoor, voor het lange wachten dus, maar eerstdaags ga ik aan de slag en ik laat zeker en vast iets weten. :oops:

Het is mijn absolute gewoonte om forumleden die een helpende hand aanreiken, zeker op de hoogte te houden, zoveel is zeker. 8)
Warning: most messages of this kind, could be sent by an oldtimer Acer Aspire 7530 laptop or even an older Lenovo T500 laptop, both proudly and pretty fast using Linux Mint 21.1 "Vera" Cinnamon 64 bits operating system.
Give it a try too !
abbs 07 apr 2019, 09:15 Leidschendam 1.589 berichten
Hallo,

Dat is goed ik wacht het af :)
Groeten abbs
Afbeelding
Member of UNITE (Unified Network of Instructors and Trained Eliminators)
Toby Startte dit onderwerp 08 apr 2019, 11:48 Het Soete Land Van Waes 966 berichten
... blijkbaar doe ik initieel al iets verkeerd, want bij het openen van het exe bestand, FRST, op het bureaublad, krijg ik onderstaande melding. :oops:
Afbeelding
Warning: most messages of this kind, could be sent by an oldtimer Acer Aspire 7530 laptop or even an older Lenovo T500 laptop, both proudly and pretty fast using Linux Mint 21.1 "Vera" Cinnamon 64 bits operating system.
Give it a try too !
abbs 08 apr 2019, 11:53 Leidschendam 1.589 berichten
Hallo,

Verwijder die FRST en herstart je pc, download dan FRST opnieuw en sla die dan meteen op het bureaublad.
Hier de uitleg: viewtopic.php?f=43&t=197564

Voer het dan uit zoals ik heb uitgelegd.
Groeten abbs
Afbeelding
Member of UNITE (Unified Network of Instructors and Trained Eliminators)
Toby Startte dit onderwerp 08 apr 2019, 17:11 Het Soete Land Van Waes 966 berichten
Ik denk nu reeds gedeeltelijk geslaagd te zijn in de te verrichten procedure, nl. overmaken twee logbestanden addition.txt en FRST.txt via Wetransfer.com, met referte : https://we.tl/t-SAZihu38KT.

Ik wacht verder af.
Warning: most messages of this kind, could be sent by an oldtimer Acer Aspire 7530 laptop or even an older Lenovo T500 laptop, both proudly and pretty fast using Linux Mint 21.1 "Vera" Cinnamon 64 bits operating system.
Give it a try too !
abbs 08 apr 2019, 17:33 Leidschendam 1.589 berichten
Hallo,

Stap 1.
Afbeelding Reset Internet Explorer.


Stap 2.

De tool FRST.exe staat in de dik gedrukte map: C:\Users\Administrator\'Downloads <== Sleep de FRST.exe vanuit deze map naar je bureaublad.

Lees eerst de handleiding en voer daarna de fix uit Handleiding Fix

Note: Dit script is speciaal bedoeld voor deze computer, gebruik dit dan ook niet op andere computers met een gelijkaardig probleem.

Klik Windows knop plus R tegelijk in. Afbeelding
"Uitvoeren" opent vul daar Notepad in en klik daarna op "OK", Kladblok opent.
Kopieer onderstaande code en plak dat in "Kladblok"

Code: Selecteer alles

start
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
FF NetworkProxy: Mozilla\Firefox\Profiles\2ughqukf.default -> type", 0
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2018-09-20] (Zemana Ltd. -> Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2018-07-07] (Zemana Ltd. -> Zemana Ltd.)
S1 epp; \??\F:\EMSISOFTEMERGENCYKIT\BIN64\epp.sys [X]
S1 SASDIFSV; \??\F:\Superantispyware\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\F:\Superantispyware\SASKUTIL64.SYS [X]
2019-03-04 17:16 - 2019-03-31 21:43 - 001071908 ____C C:\WINDOWS\ZAM_Guard.krnl.trace
2019-03-04 17:16 - 2019-03-31 21:42 - 001079310 ____C C:\WINDOWS\ZAM.krnl.trace
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Geen bestand
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Geen bestand
AlternateDataStreams: C:\WINDOWS\SysWOW64\gm320ain.dll:ExtraData [15]
Hosts:
RemoveProxy:
EmptyTemp:
Reboot:
end
Ga naar Bestand - Opslaan als.
Kies als locatie bureaublad.
Bij "Bestandsnaam" zet je:fixlist.txt
Bij "Opslaan als type" selecteer je: Alle bestanden.

Als het goed is staat er nu een text bestand op je bureaublad?

Start de Farbar Recovery Scan Tool.
Als het programma is geopend klik Yes (Ja) bij de disclaimer. (indien nodig)
Druk op de Fix knop.
Er zal u een logbestand aangemaakt worden (fixlog.txt) op dezelfde plaats vanwaar de 'tool' is gestart.
Kopieer en plak de inhoud van de logbestanden in je het volgende bericht.(als de inhoud te groot is voor één bericht plaats het in meerdere berichten)
Groeten abbs
Afbeelding
Member of UNITE (Unified Network of Instructors and Trained Eliminators)
Toby Startte dit onderwerp 08 apr 2019, 23:47 Het Soete Land Van Waes 966 berichten
Ik hoop dat ik de oplossing nu niet weer verknald hebt en voeg hierbij het gevraagde log bestand.

Fix resultaat van Farbar Recovery Scan Tool (x64) Versie: 17.03.2019
Gestart door Administrator (08-04-2019 23:19:13) Run:1
Gestart vanaf C:\Users\Administrator\Contacts\Desktop
Geladen Profielen: Administrator (Beschikbare Profielen: GDB & Administrator)
Boot Modus: Normal
==============================================

fixlist inhoud:
*****************
start
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
FF NetworkProxy: Mozilla\Firefox\Profiles\2ughqukf.default -> type", 0
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2018-09-20] (Zemana Ltd. -> Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2018-07-07] (Zemana Ltd. -> Zemana Ltd.)
S1 epp; \??\F:\EMSISOFTEMERGENCYKIT\BIN64\epp.sys [X]
S1 SASDIFSV; \??\F:\Superantispyware\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\F:\Superantispyware\SASKUTIL64.SYS [X]
2019-03-04 17:16 - 2019-03-31 21:43 - 001071908 ____C C:\WINDOWS\ZAM_Guard.krnl.trace
2019-03-04 17:16 - 2019-03-31 21:42 - 001079310 ____C C:\WINDOWS\ZAM.krnl.trace
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Geen bestand
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => -> Geen bestand
AlternateDataStreams: C:\WINDOWS\SysWOW64\gm320ain.dll:ExtraData [15]
Hosts:
RemoveProxy:
EmptyTemp:
Reboot:
end
*****************

Herstelpunt is succesvol gemaakt.
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\" => is succesvol verwijderd
Firefox Proxy-instellingen zijn hersteld.
ZAM => Kon service niet stoppen.
HKLM\System\CurrentControlSet\Services\ZAM => is succesvol verwijderd
ZAM => service is succesvol verwijderd
ZAM_Guard => Kon service niet stoppen.
HKLM\System\CurrentControlSet\Services\ZAM_Guard => is succesvol verwijderd
ZAM_Guard => service is succesvol verwijderd
HKLM\System\CurrentControlSet\Services\epp => is succesvol verwijderd
epp => service is succesvol verwijderd
HKLM\System\CurrentControlSet\Services\SASDIFSV => is succesvol verwijderd
SASDIFSV => service is succesvol verwijderd
HKLM\System\CurrentControlSet\Services\SASKUTIL => is succesvol verwijderd
SASKUTIL => service is succesvol verwijderd
C:\WINDOWS\ZAM_Guard.krnl.trace => is succesvol verplaatst
C:\WINDOWS\ZAM.krnl.trace => is succesvol verplaatst
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\PowerISO => is succesvol verwijderd
HKLM\Software\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => niet gevonden
HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\PowerISO => is succesvol verwijderd
HKLM\Software\Classes\CLSID\{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => niet gevonden
C:\WINDOWS\SysWOW64\gm320ain.dll => ":ExtraData" ADS is succesvol verwijderd
C:\Windows\System32\Drivers\etc\hosts => is succesvol verplaatst
Hosts met succes hersteld.

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => is succesvol verwijderd
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => is succesvol verwijderd
"HKU\S-1-5-21-2136469052-3984601998-3441907689-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => is succesvol verwijderd
"HKU\S-1-5-21-2136469052-3984601998-3441907689-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => is succesvol verwijderd


========= Einde van RemoveProxy: =========


=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 412605615 B
Java, Flash, Steam htmlcache => 1110 B
Windows/system/drivers => 160359 B
Edge => 94208 B
Chrome => 442478707 B
Firefox => 13493927 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 2708 B
LocalService => 0 B
NetworkService => 0 B
NetworkService => 0 B
GDB => 0 B
Administrator => 5186322 B

RecycleBin => 98440193 B
EmptyTemp: => 934.9 MB tijdelijke gegevens verwijderd.

================================


Het systeem moest herstart worden.

==== Einde van Fixlog 23:20:34 ====
Warning: most messages of this kind, could be sent by an oldtimer Acer Aspire 7530 laptop or even an older Lenovo T500 laptop, both proudly and pretty fast using Linux Mint 21.1 "Vera" Cinnamon 64 bits operating system.
Give it a try too !
abbs 09 apr 2019, 09:29 Leidschendam 1.589 berichten
Hallo,

Heel goed, voer ter controle nog eens een scan uit met Malwarebytes.
Vertel de uitslag en of je nog problemen ondervind.
Groeten abbs
Afbeelding
Member of UNITE (Unified Network of Instructors and Trained Eliminators)
Toby Startte dit onderwerp 09 apr 2019, 20:49 Het Soete Land Van Waes 966 berichten
Heel erg bedankt voor de welwillende medewerking en hulp.
De MBAM scan draait nu en na afloop laat ik iets weten.

Toch nog enkele bedenkingen :
1) mag de software van Farbar blijven staan op de computer ?
2) de visu is er niks abnormaals te bemerken in de computer, maar dat was daar voorheen ook zo, totdat de fraude bekend werd via het uittreksel kredietkaart ...
Warning: most messages of this kind, could be sent by an oldtimer Acer Aspire 7530 laptop or even an older Lenovo T500 laptop, both proudly and pretty fast using Linux Mint 21.1 "Vera" Cinnamon 64 bits operating system.
Give it a try too !