Zoek.exe v5.0.0.0 Updated 07-March-2014 Tool run by diana on vr 04-04-2014 at 17:58:41,83. Microsoft Windows Vista Home Premium 6.0.6002 Service Pack 2 x86 Running in: Normal Mode Internet Access Detected Launched: C:\Users\diana\Downloads\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 4-4-2014 18:01:14 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\Program Files\BearShare Applications deleted successfully C:\Program Files\Encore deleted successfully C:\Program Files\eSobi deleted successfully C:\Program Files\MSXML 4.0 deleted successfully C:\Program Files\Samsung deleted successfully C:\Program Files\Symantec deleted successfully C:\PROGRA~2\Babylon deleted successfully C:\PROGRA~2\CanonIJScan deleted successfully C:\PROGRA~2\Oracle deleted successfully C:\PROGRA~2\PCSettings deleted successfully C:\PROGRA~2\Systweak deleted successfully C:\PROGRA~2\WinZip deleted successfully C:\PROGRA~2\WinZipSE deleted successfully C:\Users\diana\AppData\Roaming\Canon deleted successfully C:\Users\diana\AppData\Roaming\eSobi deleted successfully C:\Users\diana\AppData\Roaming\Samsung deleted successfully C:\Users\diana\AppData\Roaming\Systweak deleted successfully C:\Users\diana\AppData\Local\APN deleted successfully C:\Users\diana\AppData\Local\PackageAware deleted successfully C:\Users\diana\AppData\Local\{11BB0B65-F087-4599-A311-8AAA6985C4E0} deleted successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\CrashDumps deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} deleted successfully HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\SearchScopes\{99B65548-5A35-4893-A876-F512DF6CFBF5} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\SearchScopes\{ED77A279-15AB-47E7-A63C-4B3682BF8123} deleted successfully HKEY_CLASSES_ROOT\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully ==== Deleting Services ====================== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\APNMCP deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\APNMCP deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CltMngSvc deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\CltMngSvc deleted successfully ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] ""=- "ApnTBMon"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=- ==== Deleting Files \ Folders ====================== C:\PROGRA~2\?1?18520-1533-40C5-AD09-953C574F14BC1?1 not found C:\PROGRA~2\?8?88520-1533-40C5-AD09-953C574F14BC8?8 not found C:\PROGRA~2\??8520-1533-40C5-AD09-953C574F14BCā? not found C:\PROGRA~2\??8520-1533-40C5-AD09-953C574F14BCĐ? not found C:\PROGRA~2\??8520-1533-40C5-AD09-953C574F14BCĴ? not found C:\PROGRA~2\????8520-1533-40C5-AD09-953C574F14BC??? not found C:\PROGRA~2\????8520-1533-40C5-AD09-953C574F14BC??? not found C:\PROGRA~2\????8520-1533-40C5-AD09-953C574F14BC??? not found C:\PROGRA~2\????8520-1533-40C5-AD09-953C574F14BC??? not found C:\PROGRA~2\????8520-1533-40C5-AD09-953C574F14BC??? not found C:\PROGRA~2\????8520-1533-40C5-AD09-953C574F14BC??? not found C:\PROGRA~2\????8520-1533-40C5-AD09-953C574F14BC??? not found C:\PROGRA~2\????8520-1533-40C5-AD09-953C574F14BC??? not found C:\PROGRA~2\???????8520-1533-40C5-AD09-953C574F14BC??? not found C:\Program Files\SearchProtect deleted C:\Windows\Tasks\PassShow update.job deleted C:\Windows\system32\Tasks\PassShow update deleted C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml deleted C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml deleted C:\Program Files\Mozilla Firefox\searchplugins\SearchResults.xml deleted C:\Program Files\SearchCore for Browsers deleted C:\Program Files\BitLord 1.2 deleted C:\Program Files\PC Speed Up deleted C:\Program Files\Giant Savings deleted C:\Program Files\Windows iLivid Toolbar deleted C:\Program Files\Yahoo! deleted C:\Program Files\Reimage deleted C:\Users\diana\AppData\Roaming\Uniblue deleted C:\Users\diana\AppData\Roaming\BitLord deleted C:\Users\diana\AppData\Roaming\YoudaGames deleted C:\PROGRA~2\Ask deleted C:\PROGRA~2\AskPartnerNetwork deleted C:\PROGRA~2\APN deleted C:\PROGRA~2\boost_interprocess deleted C:\PROGRA~2\Trymedia deleted C:\Users\diana\AppData\Local\Ilivid Player deleted C:\Users\diana\AppData\Local\CRE deleted C:\Users\diana\AppData\Local\SearchProtect deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced System Protector deleted C:\Windows\System32\Tasks\Browser Manager deleted C:\Users\diana\AppData\LocalLow\searchqutoolbar deleted C:\Users\diana\AppData\LocalLow\BabylonToolbar deleted C:\Users\diana\AppData\LocalLow\DataMngr deleted C:\Windows\system32\config\systemprofile\AppData\LocalLow\AVG Secure Search deleted C:\Windows\reimage.ini deleted C:\Windows\VDM135B.tmp deleted C:\Windows\VDM14A2.tmp deleted C:\Windows\VDM15A.tmp deleted C:\Windows\VDM1AE3.tmp deleted C:\Windows\VDM1B91.tmp deleted C:\Windows\VDM1F11.tmp deleted C:\Windows\VDM26A4.tmp deleted C:\Windows\VDM2A1C.tmp deleted C:\Windows\VDM3056.tmp deleted C:\Windows\VDM35D8.tmp deleted C:\Windows\VDM3697.tmp deleted C:\Windows\VDM37EC.tmp deleted C:\Windows\VDM40ED.tmp deleted C:\Windows\VDM4258.tmp deleted C:\Windows\VDM43A1.tmp deleted C:\Windows\VDM445D.tmp deleted C:\Windows\VDM4F72.tmp deleted C:\Windows\VDM50DC.tmp deleted C:\Windows\VDM55B0.tmp deleted C:\Windows\VDM5921.tmp deleted C:\Windows\VDM611.tmp deleted C:\Windows\VDM6227.tmp deleted C:\Windows\VDM64EB.tmp deleted C:\Windows\VDM6D28.tmp deleted C:\Windows\VDM7372.tmp deleted C:\Windows\VDM7634.tmp deleted C:\Windows\VDM78EC.tmp deleted C:\Windows\VDM79A.tmp deleted C:\Windows\VDM79BD.tmp deleted C:\Windows\VDM7E7F.tmp deleted C:\Windows\VDM7F35.tmp deleted C:\Windows\VDM82AB.tmp deleted C:\Windows\VDM8629.tmp deleted C:\Windows\VDM8834.tmp deleted C:\Windows\VDM8C.tmp deleted C:\Windows\VDM8E7F.tmp deleted C:\Windows\VDM9341.tmp deleted C:\Windows\VDM9408.tmp deleted C:\Windows\VDM9409.tmp deleted C:\Windows\VDM976E.tmp deleted C:\Windows\VDM98E.tmp deleted C:\Windows\VDM997D.tmp deleted C:\Windows\VDM9A33.tmp deleted C:\Windows\VDM9CF7.tmp deleted C:\Windows\VDM9D07.tmp deleted C:\Windows\VDM9DAF.tmp deleted C:\Windows\VDM9EF6.tmp deleted C:\Windows\VDMA27F.tmp deleted C:\Windows\VDMA342.tmp deleted C:\Windows\VDMA4A.tmp deleted C:\Windows\VDMA805.tmp deleted C:\Windows\VDMA8BC.tmp deleted C:\Windows\VDMAE43.tmp deleted C:\Windows\VDMB104.tmp deleted C:\Windows\VDMB1B9.tmp deleted C:\Windows\VDMB3C9.tmp deleted C:\Windows\VDMB7F7.tmp deleted C:\Windows\VDMBAC9.tmp deleted C:\Windows\VDMBCBB.tmp deleted C:\Windows\VDMC24F.tmp deleted C:\Windows\VDMC305.tmp deleted C:\Windows\VDMC3BB.tmp deleted C:\Windows\VDMC5CD.tmp deleted C:\Windows\VDMC67A.tmp deleted C:\Windows\VDMCB4F.tmp deleted C:\Windows\VDMCE03.tmp deleted C:\Windows\VDMCF7B.tmp deleted C:\Windows\VDMD240.tmp deleted C:\Windows\VDMD4FF.tmp deleted C:\Windows\VDMD703.tmp deleted C:\Windows\VDMDA91.tmp deleted C:\Windows\VDMDB42.tmp deleted C:\Windows\VDME010.tmp deleted C:\Windows\VDME0C6.tmp deleted C:\Windows\VDME64F.tmp deleted C:\Windows\VDME9D3.tmp deleted C:\Windows\VDMEBD4.tmp deleted C:\Windows\VDMEF45.tmp deleted C:\Windows\VDMF1F.tmp deleted C:\Windows\VDMF798.tmp deleted C:\Windows\VDMFA4D.tmp deleted C:\Windows\VDMFB18.tmp deleted C:\Windows\VDMFD1C.tmp deleted C:\Windows\VDMFD2.tmp deleted C:\Windows\VDMFDCA.tmp deleted C:\Windows\system32\Tasks\Advanced System Protector_startup deleted C:\Windows\system32\Tasks\Reimage Reminder deleted C:\Windows\system32\sasnative32.exe deleted C:\Windows\System32\SearchProtect deleted C:\Windows\System32\searchplugins deleted C:\Windows\System32\Extensions deleted C:\Users\diana\AppData\Roaming\Mozilla\Firefox\Profiles\lar4c6qd.default\bProtector_extensions.rdf deleted C:\Users\diana\AppData\Roaming\Mozilla\Firefox\Profiles\lar4c6qd.default\bProtector_extensions.sqlite deleted C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE} deleted C:\Program Files\Mozilla Firefox\extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433} deleted C:\Users\diana\ReimageRepair.exe deleted C:\Users\diana\wrar390nl.exe deleted "C:\Windows\tasks\Install.job" deleted "C:\Program Files\PassShow\PassShow155.exe" deleted "C:\Program Files\PassShow\PassShow_wd.exe" deleted "C:\Program Files\PassShow\PassShow155.exe" deleted "C:\Program Files\PassShow\PassShow_wd.exe" deleted "C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" deleted "C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" deleted "C:\Program Files\AskPartnerNetwork" deleted "C:\Program Files\PassShow" not deleted "C:\Program Files\PassShow" not deleted "C:\Program Files\AskPartnerNetwork" deleted "C:\Program Files\AskPartnerNetwork\Toolbar" deleted "C:\Program Files\AskPartnerNetwork\Toolbar\Updater" deleted "C:\Program Files\AskPartnerNetwork\Toolbar" deleted "C:\Program Files\AskPartnerNetwork\Toolbar\Updater" deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\diana\AppData\Local\Temp ==== 2014-03-30 12:06:16 4B5F2C6306FBC3F6658CB47D3060A77B 6339168 ----a-w- C:\Users\diana\AppData\Local\Temp\SPSetup.exe ====== Java Cache ===== ====== C:\Windows\system32 ===== 2014-03-26 19:50:18 95E15A2DE75AB48728AB8E1911C3EDB1 264616 ----a-w- C:\Windows\System32\javaws.exe 2014-03-26 19:50:01 FD80D0AE205EC54D1A204DDBD6B766DA 94632 ----a-w- C:\Windows\System32\WindowsAccessBridge.dll 2014-03-26 19:50:01 CB3638541DCAC86EE17FA8258202E20E 175016 ----a-w- C:\Windows\System32\javaw.exe 2014-03-26 19:50:01 9395BBE294045909A025C9F3DC3D9025 174504 ----a-w- C:\Windows\System32\java.exe ====== C:\Windows\system32\drivers ===== 2014-03-09 16:37:38 A240E42A7402E927A71B6E8AA4629B13 6756632 ----a-w- C:\Windows\System32\drivers\lvuvc.sys 2014-03-09 16:37:38 835C775A6871D2A2EA6FC343B6B4C9A2 266828 ----a-w- C:\Windows\System32\drivers\LVAFT.cfg 2014-03-09 16:36:32 37072EC9299E825F4335CC554B6FAC6A 266008 ----a-w- C:\Windows\System32\drivers\lvrs.sys 2014-03-09 16:36:31 9FB982DE1C8DD769F8ED681DD878B12F 114712 ----a-w- C:\Windows\System32\drivers\lvpopflt.sys ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2014-04-04 12:27:24 -------- d-----w- C:\Program Files\trend micro ======= C: ===== ====== C:\Users\diana\AppData\Roaming ====== ====== C:\Users\diana ====== 2014-04-04 12:26:19 69CA82A7482A00D8EE063D2B97FC4338 781383 ----a-w- C:\Users\diana\Downloads\RSIT.exe ====== C: exe-files == 2014-04-04 12:27:25 9A2347903D6EDB84C10F288BC0578C1C 388608 ----a-w- C:\Program Files\trend micro\diana.exe 2014-04-04 12:26:19 69CA82A7482A00D8EE063D2B97FC4338 781383 ----a-w- C:\Users\diana\Downloads\RSIT.exe 2014-03-30 12:06:16 4B5F2C6306FBC3F6658CB47D3060A77B 6339168 ----a-w- C:\Users\diana\AppData\Local\Temp\SPSetup.exe 2014-03-30 11:05:16 096E0D55823FDEB3916584071E9B7ACA 156063 ----a-w- C:\Windows\Temp\nswF29D.exe 2014-03-30 11:05:16 096E0D55823FDEB3916584071E9B7ACA 156063 ----a-w- C:\Windows\Temp\nsq73BC.exe === C: other files == ==== Startup Registry Enabled ====================== [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /detectMem" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /detectMem" [HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background" "ehTray.exe"="C:\Windows\ehome\ehTray.exe" "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "Logitech Vid"="C:\Program Files\Logitech\Logitech Vid\vid.exe -bootmode" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run] "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" "PCMMediaSharing"="C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" "Acer Empowering Technology Monitor"="C:\Acer\Empowering Technology\SysMonitor.exe" "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" "Skytel"="Skytel.exe" "WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" "ArcSoft Connection Service"="C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" "IgfxTray"="C:\Windows\system32\igfxtray.exe" "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" "Persistence"="C:\Windows\system32\igfxpers.exe" "CommonToolkitTray"="C:\Program Files\Fighters\Tray\FightersTray.exe" "APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" "EEventManager"="C:\Program Files\Epson Software\Event Manager\EEventManager.exe" "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe -atboottime" "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "LogitechQuickCamRibbon"="C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe /hide" "Windows Defender"="%ProgramFiles%\Windows Defender\MSASCui.exe -hide" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background" "ehTray.exe"="C:\Windows\ehome\ehTray.exe" "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "Logitech Vid"="C:\Program Files\Logitech\Logitech Vid\vid.exe -bootmode" ==== Startup Folders ====================== 2007-08-29 05:19:22 1493 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk 2009-08-01 13:51:30 1824 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\EZ VHS Converter Monitor.lnk 2012-12-03 19:20:06 1915 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [14-03-2014 13:20] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [28-07-2009 22:54] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [28-07-2009 22:54] C:\Windows\tasks\PassShow_wd.job --a------ C:\Program Files\PassShow\PassShow_wd.exe [] ==== Other Scheduled Tasks ====================== "C:\Windows\system32\tasks\Adobe Flash Player Updater" [C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\system32\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\Norton WSC Integration" ["C:\Program Files\Norton Internet Security\Engine\21.2.0.38\WSCStub.exe"] "C:\Windows\system32\tasks\PassShow_wd" [C:\Program Files\PassShow\PassShow_wd.exe] "C:\Windows\system32\tasks\User_Feed_Synchronization-{273772C8-31BB-4266-8049-A1B96E79F0FC}" [C:\Windows\system32\msfeedssync.exe] "C:\Windows\system32\tasks\{032588DB-084A-4C47-9539-13949960DCF3}" ["c:\program files\google\chrome\application\chrome.exe"] "C:\Windows\system32\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files\Apple Software Update\SoftwareUpdate.exe] "C:\Windows\system32\tasks\Norton Internet Security\Norton Error Analyzer" [C:\Program Files\Norton Internet Security\Engine\21.2.0.38\SymErr.exe] "C:\Windows\system32\tasks\Norton Internet Security\Norton Error Processor" [C:\Program Files\Norton Internet Security\Engine\21.2.0.38\SymErr.exe] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "{BBDA0591-3099-440a-AA10-41764D9DB4DB}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF" [04-01-2014 13:38] [HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions] "{07236a7a-ea6f-49fe-a3c5-8f3d188c0b4f}"="C:\Program Files\PassShow\155.xpi" [] ==== Firefox Extensions ====================== ==== Firefox Plugins ====================== ==== Chrome Look ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions aaaajpkhjdkhhnkmgfjodbkfpbmibkkk - C:\ProgramData\AskPartnerNetwork\Toolbar\ORJ-V7\CRX\ToolbarCR.crx[] meinjhkhgaalhfbinmclpmjikccbplkf - C:\Users\diana\AppData\Local\CRE\meinjhkhgaalhfbinmclpmjikccbplkf.crx[] mkfokfffehpeedafpekjeddnmnjhmcmk - C:\Program Files\Norton Internet Security\Engine\21.2.0.38\Exts\Chrome.crx[11-03-2014 22:44] ndkhncnongaclekkbelchmeafffimifj - C:\Users\diana\AppData\Local\Giant Savings\Chrome\Giant Savings.crx[] pgafcinpmmpklohkojmllohdhomoefph - C:\ProgramData\Browser Manager\2.6.1125.80\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.crx[] HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions meinjhkhgaalhfbinmclpmjikccbplkf - C:\Users\diana\AppData\Local\CRE\meinjhkhgaalhfbinmclpmjikccbplkf.crx[] AdBlock - diana\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom Piet Mondrian Theme - diana\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdcbkinbgfgdddnchgcccaoghdflkjmi Norton Identity Protection - diana\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk Google Wallet - diana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Google Drive - diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Babylon Toolbar - diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\dhkplhfnhceodhffomolpfigojocbpcb FileConverter 1.4 - diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\meinjhkhgaalhfbinmclpmjikccbplkf Giant Savings - diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ndkhncnongaclekkbelchmeafffimifj Settings Protector - diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pgafcinpmmpklohkojmllohdhomoefph Gmail - diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia ==== Chrome Fix ====================== C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_apps.conduit.com_0.localstorage deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_apps.conduit.com_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_facebook.conduitapps.com_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_images.search.conduit.com_0.localstorage deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_images.search.conduit.com_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\http_groupon.conduitapps.com_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\http_pricegong.conduitapps.com_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\http_storage.conduit.com_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_service6.pricegong.com_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_service7.pricegong.com_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.babylon.com_0.localstorage deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.babylon.com_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\dhkplhfnhceodhffomolpfigojocbpcb deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\meinjhkhgaalhfbinmclpmjikccbplkf deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\chrome-extension_meinjhkhgaalhfbinmclpmjikccbplkf_0.localstorage deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\chrome-extension_meinjhkhgaalhfbinmclpmjikccbplkf_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ndkhncnongaclekkbelchmeafffimifj deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\chrome-extension_ndkhncnongaclekkbelchmeafffimifj_0.localstorage deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\chrome-extension_ndkhncnongaclekkbelchmeafffimifj_0.localstorage-journal deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\databases\chrome-extension_ndkhncnongaclekkbelchmeafffimifj_0 deleted successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pgafcinpmmpklohkojmllohdhomoefph deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP2525D2E9-BD6A-4DF4-8134-6B4A6BEA3E8A&SSPV=" "SearchMigratedDefaultURL"="http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Page_URL"="http://nl.intl.acer.yahoo.com" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}] not found New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "SearchMigratedDefaultURL"="http://go.microsoft.com/fwlink/?LinkId=54896" "Start Page"="http://www.google.com" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?FORM=IEFM1&q={searchTerms}&src={referrer:source?}" {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}" {7C5CE077-16F7-4A77-AD20-A1F965D15D7A} dutch.ircfast2.com Url="dutch.ircfast2.com" {A64E2716-4380-4AE5-AE78-8CA558491776} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== HKEY_USERS\S-1-5-21-1257370170-937872720-2204360584-1000\Software\Mozilla\Firefox\Extensions\{07236a7a-ea6f-49fe-a3c5-8f3d188c0b4f} deleted successfully ==== Reset IE Proxy ====================== Value(s) before fix: "ProxyServer"="http=127.0.0.1:13828" "ProxyEnable"=dword:00000001 Value(s) after fix: "ProxyEnable"=dword:00000000 ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\aaaajpkhjdkhhnkmgfjodbkfpbmibkkk deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\meinjhkhgaalhfbinmclpmjikccbplkf deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\ndkhncnongaclekkbelchmeafffimifj deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph deleted successfully HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\meinjhkhgaalhfbinmclpmjikccbplkf deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\912138fe-a986-4780-ad7a-24960030e414 deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchCore for Browsers deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu 406 MediaBar deleted successfully ==== Empty IE Cache ====================== C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\diana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Users\diana\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\diana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UJUL234C will be deleted at reboot C:\Users\diana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot ==== Empty FireFox Cache ====================== No FireFox Cache found ==== Empty Chrome Cache ====================== C:\Users\diana\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\diana\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=1483 folders=333 87241034 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\diana\AppData\Local\Temp will be emptied at reboot C:\Windows\system32\config\systemprofile\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\diana\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Users\diana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found "C:\Program Files\PassShow" not found "C:\Program Files\PassShow" not found "C:\Users\diana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UJUL234C" not found ==== EOF on vr 04-04-2014 at 18:56:27,93 ======================