Zoek.exe Version 4.0.0.4 Updated 27-September-2013 Tool run by Eigenaar on zo 06-10-2013 at 12:27:42,95. Microsoft® Windows Vista™ Business 6.0.6002 Service Pack 2 x86 Running in: Normal Mode No Internet Access Detected Launched: E:\zoek\zoek.exe [Script inserted] ==== Older Logs ====================== C:\zoek-results2013-10-05-155204.log 581 bytes C:\zoek-results2013-10-05-160443.log 43268 bytes C:\zoek-results2013-10-05-163831.log 483 bytes C:\zoek-results2013-10-06-063905.log 531 bytes ==== Creating Sample_06-10-2013_1245.zip ====================== Copied file C:\Users\Eigenaar\AdbeRdr930_nl_NL.exe to sample\AdbeRdr930_nl_NL.exe Copied file C:\Users\Eigenaar\PowerPointViewer.exe to sample\PowerPointViewer.exe sample\AdbeRdr930_nl_NL.exe renamed to C894DCA0043DCA3AEDC7302E5FA8FFEE sample\PowerPointViewer.exe renamed to A5EE73773DFECA53152371923436DD80 C:\Users\Public\Desktop\sample_06-10-2013_1245.zip created successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Internet Explorer\SearchScopes\{1082BD64-3516-47EB-9477-108D7E8132F4} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Internet Explorer\SearchScopes\{1082BD64-3516-47EB-9477-108D7E8132F4} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Internet Explorer\SearchScopes\{1082BD64-3516-47EB-9477-108D7E8132F4} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Internet Explorer\SearchScopes\{1082BD64-3516-47EB-9477-108D7E8132F4} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Internet Explorer\SearchScopes\{1082BD64-3516-47EB-9477-108D7E8132F4} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully HKEY_CLASSES_ROOT\CLSID\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_CLASSES_ROOT\CLSID\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Internet Explorer\Approved Extensions\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Internet Explorer\Approved Extensions\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Internet Explorer\Approved Extensions\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Internet Explorer\Approved Extensions\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Internet Explorer\Approved Extensions\{b9507101-e464-4b3b-a4cb-291aaedd94f2} deleted successfully ==== Deleting Services ====================== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DatamngrCoordinator deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\DatamngrCoordinator deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SeaPort deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SeaPort deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\SeaPort deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SeaPort deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Update BrowseFox deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Update BrowseFox deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Update BrowseFox deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Update BrowseFox deleted successfully ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 {b9507101-e464-4b3b-a4cb-291aaedd94f2} "AppInit_DLLs"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe] ==== Deleting Files \ Folders ====================== "C:\Users\Jeremy\AppData\Local\funmoods-speeddial.crx" deleted "C:\Users\Jeremy\AppData\Local\funmoods.crx" deleted "C:\Users\Eigenaar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk" deleted "C:\Windows\System32\Tasks\DSite" deleted "C:\Users\Eigenaar\Downloads\iLividSetup-r484-n-bc.exe" deleted "C:\Users\Eigenaar\Downloads\sysrc_trial_9407.exe" deleted "C:\Users\Eigenaar\Downloads\rcpsetup_dcomnew_util_300_dcomnew_util_300.exe" deleted "C:\Users\Eigenaar\Downloads\rcpsetup_marim_marm (1).exe" deleted "C:\Users\Eigenaar\Downloads\rcpsetup_marim_marm.exe" deleted "C:\Users\Eigenaar\Downloads\avg_free_stb_all_2013_3272_cnet.exe" deleted "C:\Users\Eigenaar\Downloads\SoftonicDownloader_voor_odin.exe" deleted "C:\Windows\WININIT.INI" deleted "C:\Windows\tasks\DSite.job" deleted "C:\user.js" deleted "C:\Windows\system32\roboot.exe" deleted "C:\Users\Eigenaar\AdbeRdr930_nl_NL.exe" deleted "C:\Users\Eigenaar\PowerPointViewer.exe" deleted "C:\Program Files\BrowseFox\BrowseFox.Common.dll" deleted "C:\Program Files\BrowseFox\updateBrowseFox.exe" deleted "C:\Program Files\BrowseFox\BrowseFox.Common.dll" deleted "C:\Program Files\BrowseFox\updateBrowseFox.exe" deleted "C:\Program Files\Movies Toolbar\Datamngr\apcrtldr.dll" deleted "C:\Program Files\Movies Toolbar\Datamngr\DatamngrUI.exe" deleted "C:\Program Files\Movies Toolbar\Datamngr\mgrldr.dll" deleted "C:\Program Files\Movies Toolbar\Datamngr\apcrtldr.dll" deleted "C:\Program Files\Movies Toolbar\Datamngr\DatamngrUI.exe" deleted "C:\Program Files\Movies Toolbar\Datamngr\mgrldr.dll" deleted "C:\Users\Eigenaar\AppData\Roaming\AVG" deleted "C:\Users\Eigenaar\AppData\Roaming\DSite" deleted "C:\Program Files\BrowseFox" not deleted "C:\Program Files\Microsoft\Search Enhancement Pack" deleted "C:\Program Files\Movies Toolbar" not deleted "C:\Program Files\Uninstall Information\ib_uninst_514" deleted "C:\Program Files\Uninstall Information\ib_uninst_567" deleted "C:\Program Files\Uninstall Information\ib_uninst_569" deleted "C:\Program Files\Uniblue\SpeedUpMyPC" deleted "C:\Program Files\Movies Toolbar" not deleted "C:\Program Files\BrowseFox" not deleted "C:\Program Files\iMesh Applications" deleted "C:\Program Files\iLivid" deleted "C:\Users\Eigenaar\AppData\Roaming\Uniblue" deleted "C:\Users\Eigenaar\AppData\Roaming\PCCUStubInstaller" deleted "C:\Users\Eigenaar\AppData\Roaming\Uniblue\SpeedUpMyPC" deleted "C:\Users\Eigenaar\AppData\Roaming\DSite" deleted "C:\Users\Eigenaar\AppData\Roaming\Systweak" deleted "C:\Users\Jeremy\AppData\Roaming\Systweak" deleted "C:\ProgramData\Browser Manager" deleted "C:\ProgramData\Ask" deleted "C:\ProgramData\Alawar Stargaze" deleted "C:\ProgramData\Datamngr" deleted "C:\ProgramData\boost_interprocess" deleted "C:\ProgramData\Wincert" deleted "C:\ProgramData\IBUpdaterService" deleted "C:\ProgramData\Tarma Installer" deleted "C:\ProgramData\Trymedia" deleted "C:\Users\Eigenaar\AppData\Local\iLivid" deleted "C:\Users\Eigenaar\AppData\Local\Ilivid Player" deleted "C:\Users\Eigenaar\AppData\Local\ilividmoviestoolbarha" deleted "C:\Users\Eigenaar\AppData\Local\CRE" deleted "C:\Users\Eigenaar\AppData\Local\Updater5060" deleted "C:\Users\Eigenaar\AppData\Local\ilividmoviestoolbarha" deleted "C:\Users\Eigenaar\AppData\Local\Systweak" deleted "C:\Users\Eigenaar\AppData\Local\PackageAware" deleted "C:\Users\Eigenaar\AppData\Local\Conduit" deleted "C:\Users\Jeremy\AppData\Local\Softonic" deleted "C:\Users\Jeremy\AppData\Local\iMesh" deleted "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue" deleted "C:\Users\Eigenaar\AppData\LocalLow\wincorebsband" deleted "C:\Users\Eigenaar\AppData\LocalLow\searchresultstb" deleted "C:\Users\Eigenaar\AppData\LocalLow\ilividmoviestoolbarha" deleted "C:\Users\Eigenaar\AppData\LocalLow\shareazatoolbarguid" deleted "C:\Users\Eigenaar\AppData\LocalLow\BabylonToolbar" deleted "C:\Users\Eigenaar\AppData\LocalLow\Softonic" deleted "C:\Users\Eigenaar\AppData\LocalLow\ilividmoviestoolbarha" deleted "C:\Users\Eigenaar\AppData\LocalLow\PriceGong" deleted "C:\Users\Eigenaar\AppData\LocalLow\bbrs_002.tb" deleted "C:\Users\Eigenaar\AppData\LocalLow\Conduit" deleted "C:\Users\Gast\AppData\LocalLow\SweetIM" deleted "C:\Users\Gast\AppData\LocalLow\appbario8" deleted "C:\Users\Gast\AppData\LocalLow\wincorebsband" deleted "C:\Users\Gast\AppData\LocalLow\mediabarbs" deleted "C:\Users\Gast\AppData\LocalLow\mediabarbs" deleted "C:\Users\Gast\AppData\LocalLow\BabylonToolbar" deleted "C:\Users\Gast\AppData\LocalLow\Softonic" deleted "C:\Users\Gast\AppData\LocalLow\searchquband" deleted "C:\Users\Gast\AppData\LocalLow\searchqutoolbar" deleted "C:\Users\Gast\AppData\LocalLow\bbrs_002.tb" deleted "C:\Users\Gast\AppData\LocalLow\Conduit" deleted "C:\Users\Jeremy\AppData\LocalLow\SweetIM" deleted "C:\Users\Jeremy\AppData\LocalLow\appbario8" deleted "C:\Users\Jeremy\AppData\LocalLow\wincorebsband" deleted "C:\Users\Jeremy\AppData\LocalLow\mediabarbs" deleted "C:\Users\Jeremy\AppData\LocalLow\mediabarbs" deleted "C:\Users\Jeremy\AppData\LocalLow\searchresultstb" deleted "C:\Users\Jeremy\AppData\LocalLow\ilividmoviestoolbarha" deleted "C:\Users\Jeremy\AppData\LocalLow\shareazatoolbarguid" deleted "C:\Users\Jeremy\AppData\LocalLow\AskToolbar" deleted "C:\Users\Jeremy\AppData\LocalLow\BabylonToolbar" deleted "C:\Users\Jeremy\AppData\LocalLow\Softonic" deleted "C:\Users\Jeremy\AppData\LocalLow\DataMngr" deleted "C:\Users\Jeremy\AppData\LocalLow\ilividmoviestoolbarha" deleted "C:\Users\Jeremy\AppData\LocalLow\PriceGong" deleted "C:\Users\Jeremy\AppData\LocalLow\searchquband" deleted "C:\Users\Jeremy\AppData\LocalLow\searchqutoolbar" deleted "C:\Users\Jeremy\AppData\LocalLow\bbrs_002.tb" deleted "C:\Users\Jeremy\AppData\LocalLow\Conduit" deleted "C:\Users\Noah Jaira\AppData\LocalLow\SweetIM" deleted "C:\Users\Noah Jaira\AppData\LocalLow\appbario8" deleted "C:\Users\Noah Jaira\AppData\LocalLow\wincorebsband" deleted "C:\Users\Noah Jaira\AppData\LocalLow\mediabarbs" deleted "C:\Users\Noah Jaira\AppData\LocalLow\mediabarbs" deleted "C:\Users\Noah Jaira\AppData\LocalLow\searchresultstb" deleted "C:\Users\Noah Jaira\AppData\LocalLow\ilividmoviestoolbarha" deleted "C:\Users\Noah Jaira\AppData\LocalLow\shareazatoolbarguid" deleted "C:\Users\Noah Jaira\AppData\LocalLow\BabylonToolbar" deleted "C:\Users\Noah Jaira\AppData\LocalLow\Softonic" deleted "C:\Users\Noah Jaira\AppData\LocalLow\ilividmoviestoolbarha" deleted "C:\Users\Noah Jaira\AppData\LocalLow\searchquband" deleted "C:\Users\Noah Jaira\AppData\LocalLow\searchqutoolbar" deleted "C:\Users\Noah Jaira\AppData\LocalLow\bbrs_002.tb" deleted "C:\Users\Noah Jaira\AppData\LocalLow\Conduit" deleted "C:\Windows\System32\searchplugins" deleted "C:\Windows\System32\Extensions" deleted "C:\Program Files\Movies Toolbar\Datamngr" not deleted "C:\Program Files\Movies Toolbar\Datamngr" not deleted ==== Folders Found In C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 ====================== 2013-09-05 07:30:26 d-----w- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86 2013-09-05 07:30:26 d-----w- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\x86 ==== Files Found In C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 ====================== 2012-08-21 11:01:22 106928 ----a-w- 498BD12B38B549887D9E856EB734354E C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\GEARAspi.dll 2012-08-21 11:01:22 115672 ----a-w- FB45A66ADB7900D80AA65E666A5A3288 C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\DifXInst32.exe 2012-08-21 11:01:22 26840 ----a-w- 185ADA973B5020655CEE342059A86CBB C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\x86\GEARAspiWDM.sys 2012-08-21 11:01:22 2704 ----a-w- 6258ABB375A0C0566EDF16B7C785D994 C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\GEARAspiWDM.inf 2012-08-21 11:01:22 323464 ----a-w- CF73C3A03582408D422D4F7A01190D00 C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\DIFxAPI.dll 2012-08-21 11:01:22 7587 ----a-w- 4AD3F7E7BD34C641ABBDC77472FFD749 C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\gearaspiwdmx86.cat 2012-08-21 11:01:28 1977816 ----a-w- 85E85B5BC75B0D712FEDB5633E1D2AFB C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\GEARDIFx.exe 2013-09-05 07:30:34 3982 ----a-w- 19384D097B02AE97DE3B78DC6896DF17 C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1\x86\DIFxInstallLog.txt ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== 2013-10-03 14:11:24 2701448229AEE43D266C00042EA3CB52 2154 ----a-w- C:\Windows\epplauncher.mif 2013-09-29 07:07:50 0F387E9B30925FBA5F82EDAD3596C1D5 540672 ------r- C:\Windows\RtlExUpd.dll ====== C:\Users\Eigenaar\AppData\Local\Temp ==== 2013-09-25 11:43:23 DF889E7ED7A351394EE66D904E703BED 1488384 ----a-w- C:\Windows\system32\config\systemprofile\AppData\Local\Temp\nspEEF2.tmp\Helper.dll 2013-09-24 16:10:06 953A104142958DB65FB37ADF5453E4C8 61960 ----a-w- C:\Windows\system32\config\systemprofile\AppData\Local\Temp\nspEEF2.tmp\Starter.exe ====== Java Cache ===== ====== C:\Windows\system32 ===== 2013-09-29 07:07:58 E5639080A7FFA5F03642F4D4CDB1E9CE 339968 ----a-w- C:\Windows\System32\SRSTSXT.dll 2013-09-29 07:07:58 E067361E60FCAE24790B88135895F3C8 135168 ----a-w- C:\Windows\System32\SRSWOW.dll 2013-09-29 07:07:58 D175A215DF2ECC0D3B3AFBDFFEAE4087 167936 ----a-w- C:\Windows\System32\SRSHP360.dll 2013-09-29 07:07:58 BA21C4B843B4B1DD787A660E17589F4D 185776 ----a-w- C:\Windows\System32\SRSTSHD.dll 2013-09-29 07:07:58 B7EBCA54F31D7FCC90409C2A09AFAB77 46112 ----a-w- C:\Windows\System32\RtkCoInst.dll 2013-09-29 07:07:58 AEB188663AFE040CFFE0C9CF6A0E1BB9 2525216 ----a-w- C:\Windows\System32\RtkAPO.dll 2013-09-29 07:07:58 160D438A8D833F3D8F91CA99C1133FA2 1003040 ----a-w- C:\Windows\System32\RtkPgExt.dll 2013-09-29 07:07:58 0640026E67033DDD7B841F8A84980147 1777664 ----a-w- C:\Windows\System32\WavesLib.dll 2013-09-29 07:07:58 03EFBB40E72B644E466E9DC19E51481B 326176 ----a-w- C:\Windows\System32\RtkApoApi.dll 2013-09-29 07:07:57 98EA21250308083B9F63705587754C54 282112 ----a-w- C:\Windows\System32\RTPCEE32.dll 2013-09-29 07:07:57 4443B2E42060190C4F32A809AB5C98D4 551456 ----a-w- C:\Windows\System32\RTSndMgr.cpl 2013-09-29 07:07:56 A9E5D24FB8AC7AE548BACD085CB0D583 159744 ----a-w- C:\Windows\System32\MaxxAudioAPO20.dll 2013-09-29 07:07:56 79EE57C454E30BE33C11E65EB9348A00 159232 ----a-w- C:\Windows\System32\FMAPO.dll 2013-09-29 07:07:56 7458B8F9AC005CA29BCD6C133B2E4DF4 1933312 ----a-w- C:\Windows\System32\MaxxAudioEQ.dll 2013-09-29 07:07:56 26AE7FE6953D584D349A91A72849A771 126976 ----a-w- C:\Windows\System32\MaxxAudioAPO.dll 2013-09-29 07:07:55 C5BD92FE507CE7456308148589C1E361 60416 ----a-w- C:\Windows\System32\AERTARen.dll 2013-09-29 07:07:55 06E60BE2BA3EC5FE2EE1A3B4A18A514B 142848 ----a-w- C:\Windows\System32\AERTACap.dll 2013-09-29 07:05:38 B073E39AC258E2AF10D7105DA2125CBC 73728 ----a-w- C:\Windows\System32\RtNicProp32.dll ====== C:\Windows\system32\drivers ===== 2013-10-03 14:09:18 3546C0B6F2D808D4E6294A9D6B25151B 221568 ----a-w- C:\Windows\System32\drivers\netio.sys 2013-09-29 07:07:57 2E4F8AD76CB1203D68DB6E8F02E4AF74 2350624 ----a-w- C:\Windows\System32\drivers\RTKVHDA.sys 2013-09-29 07:05:38 034033F5A921764D8C4BA6698800D95B 163328 ----a-w- C:\Windows\System32\drivers\Rtlh86.sys 2013-09-10 20:11:44 C3828E5C49924969799ED8B1E123A267 22840 ----a-w- C:\Windows\System32\drivers\avgidsshimx.sys 2013-09-09 10:41:46 BB6EDB0257860083193CC1581AC7D485 136904 ----a-w- C:\Windows\System32\drivers\ssadbus.sys 2013-09-09 10:41:46 88BBDA3D977429C6DAB0991EC5339A19 15304 ----a-w- C:\Windows\System32\drivers\ssadwhnt.sys 2013-09-09 10:41:46 88BBDA3D977429C6DAB0991EC5339A19 15304 ----a-w- C:\Windows\System32\drivers\ssadwh.sys 2013-09-09 10:41:46 5BCB68F7B62159C07789D3F405750623 17864 ----a-w- C:\Windows\System32\drivers\ssadmdfl.sys 2013-09-09 10:41:46 370168F1FD1CEF45DA470A44439426CA 15560 ----a-w- C:\Windows\System32\drivers\ssadcmnt.sys 2013-09-09 10:41:46 370168F1FD1CEF45DA470A44439426CA 15560 ----a-w- C:\Windows\System32\drivers\ssadcm.sys 2013-09-09 10:41:46 1588A89F9CD9E68DE9FCC9F60FDB5C08 153672 ----a-w- C:\Windows\System32\drivers\ssadmdm.sys 2013-09-09 10:35:46 E6CE6348A4F6E06925548F62527F0F99 136776 ----a-w- C:\Windows\System32\drivers\sscdbus.sys 2013-09-09 10:35:46 BF6F31B9F5A98400DFB42CDB2C6537E1 130248 ----a-w- C:\Windows\System32\drivers\sscdserd.sys 2013-09-09 10:35:46 96E20FE523F992F96CCA23B2437F5CC7 15304 ----a-w- C:\Windows\System32\drivers\sscdwhnt.sys 2013-09-09 10:35:46 96E20FE523F992F96CCA23B2437F5CC7 15304 ----a-w- C:\Windows\System32\drivers\sscdwh.sys 2013-09-09 10:35:46 8F40A62436A05A8963391DFB1D9F2876 15560 ----a-w- C:\Windows\System32\drivers\sscdcmnt.sys 2013-09-09 10:35:46 8F40A62436A05A8963391DFB1D9F2876 15560 ----a-w- C:\Windows\System32\drivers\sscdcm.sys 2013-09-09 10:35:46 68820F9A67F0D170A6842094EBDCD924 17864 ----a-w- C:\Windows\System32\drivers\sscdmdfl.sys 2013-09-09 10:35:46 0A3B7562002C50F208FCCDEB7380B57B 153672 ----a-w- C:\Windows\System32\drivers\sscdmdm.sys 2013-09-09 10:05:39 6216FD7FD227DE454238A702B218CEC7 20032 ----a-w- C:\Windows\System32\drivers\dgderdrv.sys 2013-09-08 20:12:16 9745AD34365318593909EDDEDAE66B9A 27448 ----a-w- C:\Windows\System32\drivers\avgrkx86.sys ====== C:\Windows\Tasks ====== 2013-10-06 06:32:49 CF05B54E021C0068A06A5AA89DF0180B 3340 ----a-w- C:\Windows\system32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2310077886-2185433429-3398584410-1000 ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2013-10-03 15:21:48 -------- d-----w- C:\Program Files\trend micro 2013-09-28 12:27:06 -------- d-----w- C:\Program Files\MSBuild 2013-09-11 14:01:02 -------- d-----w- C:\Program Files\Idols TALENTBOX 2013-09-09 16:13:19 -------- d-----w- C:\Program Files\Movies Toolbar 2013-09-09 10:06:46 -------- d-----w- C:\Program Files\MyFree Codec 2013-09-09 09:45:56 -------- d-----w- C:\Program Files\BrowseFox ======= C: ===== 2013-09-30 13:25:59 E9C056089F1D87BD90888EBC90CF9DC9 3831 ----a-w- C:\ipconfig.txt ====== C:\Users\Eigenaar\AppData\Roaming ====== 2013-09-28 13:48:45 -------- d-----w- C:\Users\Jeremy\AppData\Roaming\RealNetworks 2013-09-28 13:12:41 -------- d-----w- C:\Users\Jeremy\AppData\Roaming\TuneUp Software 2013-09-28 12:54:20 -------- d-----w- C:\Users\Jeremy\AppData\Roaming\AVG2014 2013-09-28 12:54:07 -------- d-----w- C:\Users\Jeremy\AppData\Local\Avg2014 2013-09-28 11:37:47 -------- d-----w- C:\Users\Eigenaar\AppData\Roaming\AVG2014 2013-09-28 11:34:10 -------- d-----w- C:\Windows\system32\config\systemprofile\AppData\Roaming\AVG2014 2013-09-28 11:27:55 -------- d-----w- C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014 2013-09-28 11:23:42 -------- d-----w- C:\Users\Eigenaar\AppData\Local\Avg2014 2013-09-10 15:49:22 -------- d-----w- C:\Users\Noah Jaira\AppData\Roaming\Real 2013-09-09 13:12:42 CD67FFDE4BB3DD4BCBDC2FBACDA14CF2 474392 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\WPFFontCache_v0400-S-1-5-21-2310077886-2185433429-3398584410-1000-8192.dat 2013-09-09 13:12:40 23628F6BD56C3D089613CEA7BFCB03DA 424564 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\WPFFontCache_v0400-S-1-5-21-2310077886-2185433429-3398584410-1000-12288.dat 2013-09-09 10:12:36 -------- d-----w- C:\Users\Eigenaar\AppData\Local\Samsung ====== C:\Users\Eigenaar ====== 2013-09-28 11:28:39 -------- d-----w- C:\ProgramData\AVG2014 2013-09-26 17:06:11 25CC048EF0A0FFB7F811695E121BC17A 24419 ----a-w- C:\Users\Eigenaar\brief tienerplusgroep 2013-2014.docx 2013-09-25 11:43:23 -------- d-----r- C:\Windows\system32\config\systemprofile\Desktop 2013-09-16 16:56:57 BA58D2487FDE0BF7D78ED196278DAECB 57344 ----a-w- C:\Users\Eigenaar\2013177 WNE uitnodiging informatieavond havo 3.doc 2013-09-13 07:14:46 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2013-09-11 14:01:07 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\idols talentbox 2013-09-09 10:06:47 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyFree Codec 2013-09-09 10:06:16 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung ====== C: exe-files == === C: other files == 2013-10-06 10:46:02 68407D33E3AB68938226D0DFF83F044A 54123837 ----a-w- C:\Users\Public\Desktop\sample_06-10-2013_1245.zip 2013-10-03 14:09:18 3546C0B6F2D808D4E6294A9D6B25151B 221568 ----a-w- C:\Windows\System32\drivers\netio.sys ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1001\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "Spybot-S&D Cleaning"="C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe /autoclean" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "Akamai NetSession Interface"="C:\Users\Jeremy\AppData\Local\Akamai\netsession_win.exe" "Spybot-S&D Cleaning"="C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe /autoclean" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "Softonic for Windows"="C:\Users\Jeremy\AppData\Local\Softonic\Softonic.exe -minimize" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Windows\system32\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "Spybot-S&D Cleaning"="C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe /autoclean" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C) -http://www.underdog.be/games/bio-racer-xl/bio-racer1.dcr" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce] "avg_spchecker"="C:\Program Files\AVG\AVG8\Notification\SPChecker.exe /start" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) -http://blip.se/games/tv4.se/lattjo/kojan/bilbana.dcr" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C) -http://static.funnygames.nl/games/8/2768/2768.dcr" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\runonce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C) -http://www.underdog.be/games/bio-racer-xl/bio-racer1.dcr" [HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6.5; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) -http://static.tibaco.nl/games/4/454/454.html" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" "APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" "ControlCenter4"="C:\Program Files\ControlCenter4\BrCcBoot.exe /autorun" "BrStsMon00"="C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN" "AVG_UI"="C:\Program Files\AVG\AVG2014\avgui.exe /TRAYONLY" "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe -atboottime" "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "TkBellExe"="C:\Program Files\Real\RealPlayer\Update\realsched.exe -osboot" "KiesTrayAgent"="C:\Program Files\Samsung\Kies\KiesTrayAgent.exe" "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe" "Skytel"="C:\Program Files\Realtek\Audio\HDA\Skytel.exe" "IgfxTray"="C:\Windows\system32\igfxtray.exe" "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" "Persistence"="C:\Windows\system32\igfxpers.exe" "MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" "AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "KPeerNexonEU"="C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe" "COMMUNICATOR"="C:\Program Files\Microsoft Office Communicator\Communicator.exe /silentRetrials /background" "KiesPreload"="C:\Program Files\Samsung\Kies\Kies.exe /preload" "KiesAirMessage"="C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup" @="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; BTRS122412; GTB7.3; SIMBAR={D382C689-670C-432D-80A6-C751941814B3}; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C) -http://www.underdog.be/games/bio-racer-xl/bio-racer1.dcr" ==== Startup Registry Disabled ====================== [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run-] "MobileDocuments"="C:\\Program Files\\Common Files\\Apple\\Internet Services\\ubd.exe" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-] "NPSStartup"="" "aaservice"="\"C:\\Program Files/Timeslot/servicets.exe\"" "Adobe ARM"="\"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "SunJavaUpdateSched"="\"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\"" ==== Startup Folders ====================== 2013-01-10 16:07:47 954 ----a-w- C:\Users\Eigenaar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk 2013-08-15 17:45:46 2117 ----a-w- C:\Users\Eigenaar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediacontrole Picture Motion Browser.lnk ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job --a------ [Undetermined Task] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [13-10-2010 13:46] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [13-10-2010 13:46] C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job --a------ C:\Program Files\Spybot - Search Destroy 2\SDImmunize.exe [] C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job --a------ C:\Program Files\Spybot - Search Destroy 2\SDScan.exe [] ==== Chrome Look ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions aaaaabcbmongicmdegkmmfgdickgnnob - C:\Users\Eigenaar\AppData\Local\ilividmoviestoolbarha\GC\toolbar.crx[] clbfjfbnelcflpgpklppgplejolacbej - C:\Program Files\BrowserCompanion\blabbers-ch.crx[] eghepdicbhhbhegihkllkmgjggcjpkma - C:\Users\Eigenaar\AppData\Local\CRE\eghepdicbhhbhegihkllkmgjggcjpkma.crx[] idhngdhcfkoamngbedgpaokgjbnpdiji - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[14-08-2013 15:24] kiplfnciaokpcennlkldkdaeaaomamof - C:\Users\Eigenaar\AppData\Local\Torch\Plugins\TorchPlugin.crx[03-01-2013 15:24] lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx[] niapdbllcanepiiimjjndipklodoedlc - C:\Users\Eigenaar\AppData\Local\Temp\YontooLayers.crx[] ppdjnkblmcjfnlogjjhpigpdgpcgdpll - C:\Program Files\BrowseFox\ppdjnkblmcjfnlogjjhpigpdgpcgdpll.crx[] HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions eghepdicbhhbhegihkllkmgjggcjpkma - C:\Users\Eigenaar\AppData\Local\CRE\eghepdicbhhbhegihkllkmgjggcjpkma.crx[] Movies Toolbar - Eigenaar - Default\Extensions\aaaaabcbmongicmdegkmmfgdickgnnob RealDownloader - Eigenaar - Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji Torch Share - Eigenaar - Default\Extensions\kiplfnciaokpcennlkldkdaeaaomamof Chrome In-App Payments service - Eigenaar - Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda BrowseFox - Eigenaar - Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll Ginyas Browser Companions - Gast - Default\Extensions\bpgoohpbdddibhlhdkenenmmlfofjfkh Skype Extension - Gast - Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl Funmoods - Jeremy - Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh RealDownloader - Jeremy - Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji Chrome In-App Payments service - Jeremy - Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda BrowseFox - Jeremy - Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll RealDownloader - Noah Jaira - Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji BrowseFox - Noah Jaira - Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll ==== Chrome Fix ====================== C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_apps.conduit.com_0.localstorage deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_apps.conduit.com_0.localstorage-journal deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_cms.distributionengine.conduit-services.com_0.localstorage deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_cms.distributionengine.conduit-services.com_0.localstorage-journal deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.conduit.com_0.localstorage deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.conduit.com_0.localstorage-journal deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pconverter.ourtoolbar.com_0.localstorage deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pconverter.ourtoolbar.com_0.localstorage-journal deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_directx.nl.softonic.com_0.localstorage deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_directx.nl.softonic.com_0.localstorage-journal deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_trackmania-nations-forever.nl.softonic.com_0.localstorage deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_trackmania-nations-forever.nl.softonic.com_0.localstorage-journal deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_trackmania-nations.en.softonic.com_0.localstorage deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_trackmania-nations.en.softonic.com_0.localstorage-journal deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabcbmongicmdegkmmfgdickgnnob deleted successfully C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl deleted successfully C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lifbcibllhkdhoafpjfnlhfpfgnpldfl_0.localstorage deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_lifbcibllhkdhoafpjfnlhfpfgnpldfl_0.localstorage deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll deleted successfully C:\Users\Noah Jaira\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll deleted successfully C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ppdjnkblmcjfnlogjjhpigpdgpcgdpll_0.localstorage deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage deleted successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage-journal deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{1082BD64-3516-47EB-9477-108D7E8132F4}" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1082BD64-3516-47EB-9477-108D7E8132F4}] not found New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}" ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully HKEY_CLASSES_ROOT\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1002\Software\Microsoft\Internet Explorer\Approved Extensions\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-1003\Software\Microsoft\Internet Explorer\Approved Extensions\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-500\Software\Microsoft\Internet Explorer\Approved Extensions\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully HKEY_USERS\S-1-5-21-2310077886-2185433429-3398584410-501\Software\Microsoft\Internet Explorer\Approved Extensions\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115} deleted successfully ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\aaaaabcbmongicmdegkmmfgdickgnnob deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\clbfjfbnelcflpgpklppgplejolacbej deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\eghepdicbhhbhegihkllkmgjggcjpkma deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll deleted successfully HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\eghepdicbhhbhegihkllkmgjggcjpkma deleted successfully ==== Empty IE Cache ====================== C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Eigenaar\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Users\Eigenaar\AppData\Local\temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Jeremy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Jeremy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Users\Jeremy\AppData\Local\temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Noah Jaira\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Noah Jaira\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Eigenaar\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpgoohpbdddibhlhdkenenmmlfofjfkh\1.0.5_0\cache emptied successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\Jeremy\AppData\Local\Google\Chrome\User Data\Default\Application Cache\Cache emptied successfully C:\Users\Noah Jaira\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== No Flash Cache Found ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\Eigenaar\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Users\Eigenaar\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted "C:\Program Files\BrowseFox" not found "C:\Program Files\Movies Toolbar" not found "C:\Program Files\Movies Toolbar" not found "C:\Program Files\BrowseFox" not found ==== EOF on zo 06-10-2013 at 13:09:12,96 ======================