Zoek.exe v5.0.0.0 Updated 14-April-2014 Tool run by User on za 19/04/2014 at 8:34:18,77. Microsoft Windows 7 Professional 6.1.7600 x86 Running in: Normal Mode Internet Access Detected Launched: C:\Users\User\Desktop\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 19/04/2014 8:41:37 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\Program Files\AVS4YOU deleted successfully C:\Program Files\MSXML 4.0 deleted successfully C:\Program Files\VideoLAN deleted successfully C:\PROGRA~2\Babylon deleted successfully C:\PROGRA~2\Browser Manager deleted successfully C:\PROGRA~2\BrowserProtect deleted successfully C:\PROGRA~2\CanonIJScan deleted successfully C:\PROGRA~2\Oracle deleted successfully C:\Users\User\AppData\Roaming\TP deleted successfully C:\Users\User\AppData\Roaming\Windows Live Writer deleted successfully C:\Users\User\AppData\Local\Bundled software uninstaller deleted successfully C:\Users\User\AppData\Local\PackageAware deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-146841159-3728994346-863424598-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully HKEY_USERS\S-1-5-21-146841159-3728994346-863424598-1000\Software\Microsoft\Internet Explorer\SearchScopes\{1EC76675-2FFC-4B19-9504-04503A0CB463} deleted successfully HKEY_USERS\S-1-5-21-146841159-3728994346-863424598-1000\Software\Microsoft\Internet Explorer\SearchScopes\{ADDACA69-DAA5-4C95-A1C3-3B216CA02344} deleted successfully HKEY_USERS\S-1-5-21-146841159-3728994346-863424598-1000\Software\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully HKEY_CLASSES_ROOT\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\urlsearchhooks\{e84cc2c1-b722-48fc-a39c-edb8b525c777} deleted successfully ==== Deleting Services ====================== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vToolbarUpdater18.0.5 deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\vToolbarUpdater18.0.5 deleted successfully ==== FireFox Fix ====================== ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\jlsr90bq.default-1364328719161 user.js not found ---- Lines ask.com removed from prefs.js ---- user_pref("browser.search.order.1", "Ask.com"); ---- FireFox user.js and prefs.js backups ---- prefs_20141904_0853_.backup ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e84cc2c1-b722-48fc-a39c-edb8b525c777}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "ApnTBMon"=- "MapsGalaxy EPM Support"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rjatydimofu.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe] ==== Deleting Files \ Folders ====================== C:\Program Files\Productivity_2.2 not found C:\Program Files\AskPartnerNetwork not found C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\jlsr90bq.default-1364328719161\extensions\39ffxtbr@MapsGalaxy_39.com not found "C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job" not found "C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\jlsr90bq.default-1364328719161\searchplugins\conduit-search.xml" not found C:\Program Files\ConduitEngine deleted C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 deleted C:\Program Files\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml deleted C:\Program Files\Conduit deleted C:\Program Files\Uncompressor deleted C:\Users\User\AppData\Roaming\Uniblue deleted C:\Users\User\AppData\Roaming\Babylon deleted C:\PROGRA~2\Ask deleted C:\PROGRA~2\AskPartnerNetwork deleted C:\PROGRA~2\APN deleted C:\PROGRA~2\MSComCtl256.dll deleted C:\PROGRA~2\MSidCtl240.dll deleted C:\PROGRA~2\AVG Security Toolbar deleted C:\PROGRA~2\Partner deleted C:\PROGRA~2\boost_interprocess deleted C:\PROGRA~2\AVG Secure Search deleted C:\PROGRA~2\Tarma Installer deleted C:\Users\User\AppData\Local\AVG Secure Search deleted C:\Users\User\AppData\Local\Babylon deleted C:\Users\User\AppData\Local\Conduit deleted C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uncompressor deleted C:\Users\User\Downloads\avg_free_stb_all_2014_4116_cnet.exe deleted C:\Users\User\Downloads\FreeYouTubeToMP3Converter.exe deleted C:\Users\User\AppData\LocalLow\AVG Security Toolbar deleted C:\Users\User\AppData\LocalLow\AVG Secure Search deleted C:\Users\User\AppData\LocalLow\searchresultstb deleted C:\Users\User\AppData\LocalLow\IAC deleted C:\Users\User\AppData\LocalLow\DataMngr deleted C:\Users\User\AppData\LocalLow\MapsGalaxy_39 deleted C:\Users\User\AppData\LocalLow\Productivity_2.2 deleted C:\Users\User\AppData\LocalLow\Conduit deleted C:\Users\User\AppData\LocalLow\ConduitEngine deleted C:\Windows\system32\config\systemprofile\AppData\LocalLow\AVG Secure Search deleted C:\Windows\system32\config\systemprofile\AppData\LocalLow\Application Updater deleted C:\Windows\wininit.ini deleted C:\user.js deleted C:\END deleted "C:\Users\User\AppData\Local\{D5536CC0-BBCB-4FEF-999A-1D871B911DAA}" deleted "C:\Program Files\AVG Secure Search\TBAPI.dll" deleted "C:\Program Files\AVG Secure Search\vprot.exe" deleted "C:\Program Files\AVG Secure Search\TBAPI.dll" deleted "C:\Program Files\AVG Secure Search\vprot.exe" deleted "C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\18.0.5\SiteSafety.dll" deleted "C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\log4cplusU.dll" deleted "C:\Program Files\AVG Secure Search" not deleted "C:\Program Files\AVG Secure Search" not deleted "C:\Program Files\Common Files\AVG Secure Search" not deleted "C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller" deleted "C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater" deleted "C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\18.0.5" deleted "C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5" deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== 2014-04-18 08:20:50 F042EE4C8D66248D9B86DCF52ABAE416 256000 ----a-w- C:\Windows\PEV.exe 2014-04-18 08:20:50 9E05A9C264C8A908A8E79450FCBFF047 80412 ----a-w- C:\Windows\grep.exe 2014-04-18 08:20:50 5E832F4FAF5F481F2EAF3B3A48F603B8 68096 ----a-w- C:\Windows\zip.exe 2014-04-18 08:20:50 0297C72529807322B152F517FDB0A9FC 406528 ----a-w- C:\Windows\SWSC.exe 2014-04-18 08:20:50 0277C027A26428DB64EF4F64F52BB4FD 208896 ----a-w- C:\Windows\MBR.exe ====== C:\Users\User\AppData\Local\Temp ==== 2014-04-18 19:13:09 949AF3E92B8ADF423A222F4A27A41A30 115137 ----a-w- C:\Users\User\AppData\Local\temp\26b4a1dd-e07b-48af-be4e-9642b273284b\CliSecureRT.dll ====== Java Cache ===== ====== C:\Windows\system32 ===== ====== C:\Windows\system32\drivers ===== 2014-04-19 06:31:18 661B911FA04E73FB073FF9B1C9BD2E05 107736 ----a-w- C:\Windows\System32\drivers\48230029.sys 2014-04-17 17:40:46 661B911FA04E73FB073FF9B1C9BD2E05 107736 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys 2014-04-17 17:40:25 2BB23932978D623D3D395AEAB1825BF1 73432 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys 2014-04-17 17:40:25 18898A87CBA96DEA2074C19E140938A8 51416 ----a-w- C:\Windows\System32\drivers\mwac.sys 2014-04-17 17:40:25 0C6EA0109CFEDF441F06D031E9A8D1A9 23256 ----a-w- C:\Windows\System32\drivers\mbam.sys 2014-04-01 19:07:04 7D77484DE1D2FA16D578D9CB2482B06E 199448 ----a-w- C:\Windows\System32\drivers\avgidsdriverx.sys 2014-03-31 14:11:58 CFA067ADD4D1A8D081FF816E817CAF39 211224 ----a-w- C:\Windows\System32\drivers\avgtdix.sys 2014-03-31 14:11:50 5E26854C4FF7368A79C48F01D4388E28 108312 ----a-w- C:\Windows\System32\drivers\avgmfx86.sys 2014-03-27 20:15:18 D0F06211AE2BDD5F2F82279550EED31B 193304 ----a-w- C:\Windows\System32\drivers\avgldx86.sys 2014-03-27 20:14:40 4F5490453284A641F159FF7AE6E0D736 123160 ----a-w- C:\Windows\System32\drivers\avgdiskx.sys 2014-03-27 20:04:22 FF4297EC210BC9A6BCFEF929694EA88D 150296 ----a-w- C:\Windows\System32\drivers\avgidshx.sys 2014-03-27 20:03:22 DAC682B3F40824E1E1011A899ED2AF36 28440 ----a-w- C:\Windows\System32\drivers\avgrkx86.sys 2014-03-27 20:03:20 F3643535D7598B950BC774D8E3D4626D 22296 ----a-w- C:\Windows\System32\drivers\avgidsshimx.sys ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2014-04-13 09:53:31 -------- d-----w- C:\Program Files\iTunes 2014-04-13 09:53:31 -------- d-----w- C:\Program Files\iPod 2014-04-06 12:25:18 -------- d-----w- C:\Program Files\trend micro 2014-04-06 11:12:25 -------- d-----w- C:\Program Files\Mozilla Maintenance Service ======= C: ===== ====== C:\Users\User\AppData\Roaming ====== 2014-04-18 16:06:51 -------- d-----w- C:\Users\Public\AppData\Local\temp 2014-04-18 16:06:51 -------- d-----w- C:\Users\Default\AppData\Local\temp 2014-04-18 16:06:51 -------- d-----w- C:\Users\Default User\AppData\Local\temp 2014-04-18 15:56:47 -------- d-----w- C:\Users\User\AppData\Local\temp 2014-04-17 20:28:35 0C4B1ACB72943D8D024DABD9CDC37F85 7605 ----a-w- C:\Users\User\AppData\Local\Resmon.ResmonCfg 2014-04-17 17:36:30 -------- d-----w- C:\Users\User\AppData\Local\Programs ====== C:\Users\User ====== 2014-04-18 08:45:45 -------- d-----w- C:\Users\Public\AppData 2014-04-17 17:35:29 32A7154F9934CF3AA5D945D02D069D1F 17523384 ----a-w- C:\Users\User\Desktop\mbam-setup-2.0.0.1000.exe 2014-04-13 09:54:48 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-04-06 12:24:08 69CA82A7482A00D8EE063D2B97FC4338 781383 ----a-w- C:\Users\User\Desktop\RSIT.exe 2014-04-06 11:10:56 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-04-06 11:08:31 DEA5D3599892CA79149B2683325B226F 884680 ----a-w- C:\Users\User\Downloads\ChromeSetup.exe 2014-04-06 10:32:03 6923AE4BC668E604081BE3D3723B4B31 24654088 ----a-w- C:\Users\User\Downloads\Firefox_Setup_27.0.1.exe 2014-03-31 15:01:34 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG ====== C: exe-files == 2014-04-18 08:20:50 F042EE4C8D66248D9B86DCF52ABAE416 256000 ----a-w- C:\Windows\PEV.exe 2014-04-18 08:20:50 9E05A9C264C8A908A8E79450FCBFF047 80412 ----a-w- C:\Windows\grep.exe 2014-04-18 08:20:50 5E832F4FAF5F481F2EAF3B3A48F603B8 68096 ----a-w- C:\Windows\zip.exe 2014-04-18 08:20:50 0297C72529807322B152F517FDB0A9FC 406528 ----a-w- C:\Windows\SWSC.exe 2014-04-18 08:20:50 0277C027A26428DB64EF4F64F52BB4FD 208896 ----a-w- C:\Windows\MBR.exe 2014-04-17 17:35:29 32A7154F9934CF3AA5D945D02D069D1F 17523384 ----a-w- C:\Users\User\Desktop\mbam-setup-2.0.0.1000.exe 2014-04-14 07:50:14 8F9D0265F4CB7674F54D82EA25AE3992 15888 ----a-w- C:\Program Files\AVG\AVG2014\avgrdtestx.exe 2014-04-14 07:50:14 87C96EE0BFF3AC495CBDC951FA5CE8A0 62992 ----a-w- C:\Program Files\AVG\AVG2014\avguirux.exe 2014-04-14 07:50:14 1F323C17E6E41653C09A1B8C14ECF794 6089216 ----a-w- C:\Program Files\AVG\AVG2014\avgmfapx.exe 2014-04-13 10:03:41 4BE56260ED6F5E37AA88A858F7C8B7FC 70638408 ----a-w- C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\W33W4VEI\iCloudSetup[1].exe === C: other files == 2014-04-19 06:31:18 661B911FA04E73FB073FF9B1C9BD2E05 107736 ----a-w- C:\Windows\System32\drivers\48230029.sys 2014-04-18 15:58:13 32737B72403E19B658576D2AF85BFB4D 145098 ----a-w- C:\ProgramData\AVG2014\IDS\outbox\tmp_9521d2b7-f911-47d2-83d2-b1a22fde8fdc.zip 2014-04-18 09:41:19 0ACCE208561789DAB2BEC928018D8057 11849 ----a-w- C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\XF48KRPX\www.pajotsevalkjes.webs.com[1].com 2014-04-17 17:40:46 661B911FA04E73FB073FF9B1C9BD2E05 107736 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys 2014-04-17 17:40:25 2BB23932978D623D3D395AEAB1825BF1 73432 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys 2014-04-17 17:40:25 18898A87CBA96DEA2074C19E140938A8 51416 ----a-w- C:\Windows\System32\drivers\mwac.sys 2014-04-17 17:40:25 0C6EA0109CFEDF441F06D031E9A8D1A9 23256 ----a-w- C:\Windows\System32\drivers\mbam.sys ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-21-146841159-3728994346-863424598-1000\Software\Microsoft\Windows\CurrentVersion\Run] "SmileboxTray"="C:\Users\User\AppData\Roaming\Smilebox\SmileboxTray.exe" "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun" "ISUSPM"="C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler" "KiesHelper"="C:\Program Files\Samsung\Kies\KiesHelper.exe /s" "KiesPDLR"="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" "OfficeSyncProcess"="C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" "cAudioFilterAgent"="C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" "AmIcoSinglun"="C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe" "ODDPwr"="C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe" "NortonOnlineBackupReminder"="C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe UNATTENDED" "BackupManagerTray"="C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe -h -k" "IgfxTray"="C:\Windows\system32\igfxtray.exe" "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" "Persistence"="C:\Windows\system32\igfxpers.exe" "LManager"="C:\Program Files\Launch Manager\LManager.exe" "Acer ePower Management"="C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe" "BCSSync"="C:\Program Files\Microsoft Office\Office14\BCSSync.exe /DelayServices" "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "FLMOFFICE4DMOUSE"="C:\Program Files\Labtec\Desktop\V5.1\moffice.exe" "vProt"="C:\Program Files\AVG Secure Search\vprot.exe" "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot" "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" "PPort11reminder"="C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe -r C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini" "BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN" "ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun" "AtherosBtStack"="C:\Program Files\Bluetooth Suite\BtvStack.exe" "AthBtTray"="C:\Program Files\Bluetooth Suite\AthBtTray.exe" "PDFHook"="C:\Program Files\Nuance\PDF Professional 6\pdfpro6hook.exe" "PDF6 Registry Controller"="C:\Program Files\Nuance\PDF Professional 6\RegistryController.exe" "Nuance PDF Professional 6-reminder"="C:\Program Files\Nuance\PDF Professional 6\Ereg\Ereg.exe -r C:\ProgramData\Nuance\PDF Professional 6\Ereg\Ereg.ini" "APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe -atboottime" "AVG_UI"="C:\Program Files\AVG\AVG2014\avgui.exe /TRAYONLY" "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe " [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "SmileboxTray"="C:\Users\User\AppData\Roaming\Smilebox\SmileboxTray.exe" "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\DTLite.exe -autorun" "ISUSPM"="C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler" "KiesHelper"="C:\Program Files\Samsung\Kies\KiesHelper.exe /s" "KiesPDLR"="C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" "OfficeSyncProcess"="C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE" ==== Startup Folders ====================== 2011-04-01 20:45:56 1270 ----a-w- C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Schermopname en Snel starten.lnk 2010-06-23 08:30:10 1724 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk 2010-10-11 06:20:10 834 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [12/03/2014 20:06] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [23/12/2010 20:39] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [23/12/2010 20:39] ==== Other Scheduled Tasks ====================== "C:\Windows\system32\tasks\Adobe Flash Player Updater" [C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\system32\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\Windows\system32\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\SidebarExecute" [C:\Program Files\Windows Sidebar\sidebar.exe] "C:\Windows\system32\tasks\{CAB783B9-500F-4070-BB25-7452EC94DA81}" ["C:\Program Files\Internet Explorer\iexplore.exe" http://ui.skype.com/ui/0/4.1.0.179.367/nl/abandoninstall?source=lightinstaller&page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;notincluded] "C:\Windows\system32\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files\Apple Software Update\SoftwareUpdate.exe] "C:\Windows\system32\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "avg@toolbar"="C:\ProgramData\AVG Secure Search\FireFoxExt\18.0.5.292" [] ==== Firefox Extensions ====================== ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\jlsr90bq.default-1364328719161 - PDF Converter 6.0 - %ProfilePath%\extensions\nuance@pdf6 - Belgium eID - %ProfilePath%\extensions\belgiumeid@eid.belgium.be.xpi - Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi AppDir: C:\Program Files\Mozilla Firefox - Belgium eID - %AppDir%\extensions\belgiumeid@eid.belgium.be - Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} ==== Firefox Plugins ====================== Profilepath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\jlsr90bq.default-1364328719161 E83B541C71965CFA1DEFF846CD6E9ECD - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll - Google Update 95812430959AE88CDD0301AB3A71913B - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll - Shockwave Flash 49CFBB2130C682FFDF2CEBEE9A2D556E - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll - iTunes Application Detector 01D93217A9EE48DD37072B671378CC9C - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll - Silverlight Plug-In A9191AE22A8F1287B5E2DF33E3A57253 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll - Java(TM) Platform SE 7 U51 9B10927CFD0F7AD39E40C0E34005B1AD - C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll - Java Deployment Toolkit 7.0.510.13 3220B1254AEF7A191187EC03F51B3D61 - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll - Adobe Acrobat B2576571746839180833E048AC2CCA5C - C:\Program Files\Adobe\Reader 10.0\Reader\browser\nppdf32.dll - Adobe Acrobat 86FD0445C7A92516FC0BA201C79B8E9E - C:\Program Files\QuickTime\Plugins\npqtplugin5.dll - QuickTime Plug-in 7.7.4 9FDABAD05A9623988750CCC10223BDB0 - C:\Program Files\QuickTime\Plugins\npqtplugin4.dll - QuickTime Plug-in 7.7.4 5E1D0432C765884434A7CCD4DBDC80AA - C:\Program Files\QuickTime\Plugins\npqtplugin3.dll - QuickTime Plug-in 7.7.4 3B293C235A80E7A5369E6AA28FEA50B1 - C:\Program Files\QuickTime\Plugins\npqtplugin2.dll - QuickTime Plug-in 7.7.4 A80BCBED52F7DD5FDBF346A985A4E4D5 - C:\Program Files\QuickTime\Plugins\npqtplugin.dll - QuickTime Plug-in 7.7.4 C548328E9DE5EB73350EF292D7140662 - C:\Program Files\Google\Picasa3\npPicasa3.dll - Picasa 99B4B884FE9A878B4822F7F326C90CE1 - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll - Shockwave Flash C517E5EA7CEE783F3681F62D2A362E5B - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live? Photo Gallery E01E08A5C8BB2196E9C7E23F8370D5FD - C:\Program Files\Nuance\PDF Professional 6\bin\nppdf.dll - Zeon Plus E01E08A5C8BB2196E9C7E23F8370D5FD - C:\Program Files\Nuance\PDF Professional 6\Bin\nppdf.dll - Zeon Plus 28986F0A2342A033345EF9E70D395E4F - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrlui.dll - Microsoft® Silverlight ==== Chrome Look ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions aaaajpkhjdkhhnkmgfjodbkfpbmibkkk - C:\ProgramData\AskPartnerNetwork\Toolbar\ORJ-V7\CRX\ToolbarCR.crx[] ndibdjnfmopecpmkdieinmbadjfpblof - C:\ProgramData\\ChromeExt\\avg.crx[] Ask Toolbar - User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaajpkhjdkhhnkmgfjodbkfpbmibkkk YouTube - User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Helper extension - User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nchpfiddbhbdnagofhkjlaiaejmkdcla Google Wallet - User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Gmail - User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia ==== Chrome Fix ====================== C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nchpfiddbhbdnagofhkjlaiaejmkdcla deleted successfully C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaajpkhjdkhhnkmgfjodbkfpbmibkkk deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com/" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://homepage.acer.com/rdr.aspx?b=ACAW&l=0813&m=travelmate_8572t&r=27051210z016l0453z215x48j1q32r" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com/" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" {67A2568C-7A0A-4EED-AECC-B5405DE63B64} Google Url="http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_nlBE411BE411" {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}" ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\aaaajpkhjdkhhnkmgfjodbkfpbmibkkk deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine deleted successfully ==== Empty IE Cache ====================== C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot ==== Empty FireFox Cache ====================== C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\h9kaen4h.default\Cache emptied successfully C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\jlsr90bq.default-1364328719161\Cache emptied successfully ==== Empty Chrome Cache ====================== C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=1223 folders=451 235127199 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\temp emptied successfully C:\Users\Default User\AppData\Local\temp emptied successfully C:\Users\Public\AppData\Local\temp emptied successfully C:\Users\User\AppData\Local\temp will be emptied at reboot C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\User\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found "C:\Program Files\AVG Secure Search" not found "C:\Program Files\AVG Secure Search" not found "C:\Program Files\Common Files\AVG Secure Search" deleted "C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaajpkhjdkhhnkmgfjodbkfpbmibkkk" not found ==== EOF on za 19/04/2014 at 9:14:41,62 ======================