Zoek.exe v5.0.0.0 Updated 19-07-2014 Tool run by Gebruiker on di 22/07/2014 at 9:56:52,54. Microsoft Windows 8.1 Pro 6.3.9600 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\Gebruiker\Downloads\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 22/07/2014 9:58:08 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\Program Files\log deleted successfully C:\PROGRA~3\Oracle deleted successfully C:\Users\Gebruiker\AppData\Local\eSSYjvLB deleted successfully C:\Users\Gebruiker\AppData\Local\Linkey deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-2548447246-1423535028-305805995-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_USERS\S-1-5-21-2548447246-1423535028-305805995-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_USERS\S-1-5-21-2548447246-1423535028-305805995-1001\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_CLASSES_ROOT\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Registry Fix Code x64 ====================== Windows Registry Editor Version 5.00 [--HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}] [--HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}] [-HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run] ""=- [-HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce] "removeSettingsManagerdatamngr"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe] ==== Deleting Files \ Folders ====================== C:\Program Files (x86)\Settings Manager not found C:\Program Files (x86)\Common Files\DVDVideoSoft deleted C:\ProgramData\IObit deleted C:\Program Files (x86)\IObit deleted C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 deleted C:\Users\Gebruiker\AppData\Local\mZmeRajG deleted C:\PROGRA~2\File Type Assistant deleted C:\Users\Gebruiker\AppData\Roaming\Systweak deleted C:\PROGRA~3\Systweak deleted C:\PROGRA~3\APN deleted C:\Users\Gebruiker\AppData\Local\FileTypeAssistant deleted C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\FileTypeAssistant deleted C:\WINDOWS\SysNative\roboot64.exe deleted C:\WINDOWS\SysNative\sasnative64.exe deleted C:\Users\Gebruiker\Searches deleted C:\windows\SysNative\Tasks\Advanced System Protector_startup deleted C:\windows\SysNative\tasks\RegClean Pro deleted C:\Users\Gebruiker\Documents\Updater deleted "C:\WINDOWS\Installer\62a7d.msi" deleted "C:\PROGRA~2\ASP\AdvancedSystemProtector.exe" deleted "C:\PROGRA~2\ASP\aspsys.dll" deleted "C:\PROGRA~2\ASP\Interop.IWshRuntimeLibrary.dll" deleted "C:\PROGRA~2\ASP\Microsoft.Win32.TaskScheduler.DLL" deleted "C:\PROGRA~2\ASP\scandll.dll" deleted "C:\PROGRA~2\ASP\System.Data.SQLite.dll" deleted "C:\PROGRA~2\ASP\unrar.dll" deleted "C:\PROGRA~2\ASP\Xceed.Compression.dll" deleted "C:\PROGRA~2\ASP\Xceed.FileSystem.dll" deleted "C:\PROGRA~2\ASP\Xceed.Zip.dll" deleted "C:\PROGRA~2\ASP" not deleted ==== Files Recently Created / Modified ====================== ====== C:\WINDOWS ==== ====== C:\Users\GEBRUI~1\AppData\Local\Temp ==== 2014-07-21 17:23:41 005A0D97A6CD71EC22FE71944EF96CC1 6262016 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\is1957915176\6D6CD0B1_stp.EXE 2014-07-21 17:11:47 8AA94A64117D7AFDA8C22176F138DD76 918952 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe 2014-07-17 09:20:42 EF2E5FE2FACC168B62450D2BE0DA4640 4312600 ------w- C:\Users\Gebruiker\AppData\Local\Temp\is1957915176\1B5020B0_stp\rcpsetup_adppi14_adppi14.exe 2014-07-09 17:12:30 8DC8286FAB0193AF701D8A5FB85ED6D6 17202688 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\BeidMW.msi 2014-07-09 17:12:30 639C0F8172702E3E88723681579B2642 18949120 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\BeidMW64.msi 2014-07-08 15:32:12 CBAF35316E3E316AE3F6C733769CE50C 111440 ------w- C:\Users\Gebruiker\AppData\Local\Temp\is1957915176\719B3F1C_stp\aff_setup.exe ====== Java Cache ===== 2014-07-09 17:15:56 C1BBA7F1278F193AB584FFF460DB5E2A 17878 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\eef218c-7b85b007 2014-07-09 17:15:53 415FC9732A3F4D89A0E01251CD66E136 646 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\49a00451-2d48a599 2014-07-09 17:15:53 FC78701F1224939988C24EE01F9849E3 100 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\49a00451-aa56bb018d5de3a531ee91cc4857f0f479656e5370ebf87789e721aaaf530ebc-6.0.lap 2014-07-09 17:15:52 415FC9732A3F4D89A0E01251CD66E136 646 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\3cb32f52-60a36aa9 2014-07-09 17:21:35 1AB86506A1E769DEFE8473C9A3D1A2C2 33702 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\5e12f555-5cb2a57d 2014-07-09 17:21:35 4E1FB425E36D24FE13BF9EF6331657C5 460 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\5bd0c21a-50b8b441 2014-07-09 17:21:34 C37CF13225EC6A998C12AC57DC4DAE9C 451 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\6d059aa0-49cc3d0fd2ab0bdc75f756a756670115f0f3a0f1e5d13301d808bfc8e49268ca-6.0.lap 2014-07-09 17:21:35 7BDC686736FC064EE9085D9A443F8511 16373 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\4867e6a4-2d8b5eb7 2014-07-09 17:21:35 C38028FD720443A0873E4372A60D5D92 469 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\e4f6ea4-3808d421 2014-07-09 17:15:53 34FA8033B50A3F99D3AB8209C72C0ABA 6860 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\1ca2666b-680bf527 2014-07-21 12:38:45 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\6c34baa0-5246c679 ====== C:\WINDOWS\SysWOW64 ===== 2014-07-21 17:12:33 7F26D694BC7E78958BE38D1D9AAFC2B9 272808 ----a-w- C:\WINDOWS\SysWOW64\javaws.exe 2014-07-21 17:12:31 67BE34FBF29E783691C713517102E67E 175528 ----a-w- C:\WINDOWS\SysWOW64\javaw.exe 2014-07-21 17:12:31 419094DF76A32252ECD70730382029ED 98216 ----a-w- C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2014-07-21 17:12:30 FFAECE8AEC1D9CCDCEC1C55C2CA450BA 175528 ----a-w- C:\WINDOWS\SysWOW64\java.exe ====== C:\WINDOWS\SysWOW64\drivers ===== ====== C:\WINDOWS\Sysnative ===== ====== C:\WINDOWS\Sysnative\drivers ===== 2014-07-22 08:00:49 95B3CEAF06A2DF96FE28CD0755D319C4 79064 ----a-w- C:\WINDOWS\Sysnative\drivers\bxkjkk.sys 2014-07-21 16:56:25 8A50D5304E6AE48664CF5838EC32F647 122584 ----a-w- C:\WINDOWS\Sysnative\drivers\MBAMSwissArmy.sys 2014-07-21 16:56:12 F92B0E478C0FAA6D6661E6E977247E60 25816 ----a-w- C:\WINDOWS\Sysnative\drivers\mbam.sys 2014-07-21 16:56:12 9D9ED48F841EA37AA5310D54B9E5D3C7 91352 ----a-w- C:\WINDOWS\Sysnative\drivers\mbamchameleon.sys 2014-07-21 16:56:12 0664F6335F108F38FE08C3CA747311EE 64216 ----a-w- C:\WINDOWS\Sysnative\drivers\mwac.sys 2014-07-09 16:58:48 D41D8CD98F00B204E9800998ECF8427E 0 ---ha-w- C:\WINDOWS\Sysnative\drivers\Msft_User_WUDFUsbccidDriver_01_11_00.Wdf 2014-06-30 10:43:18 382904E87741638CF051E2B0C62335C4 270104 ----a-w- C:\WINDOWS\Sysnative\drivers\avgwfpa.sys 2014-06-30 10:43:02 CDE60914D4ED81291F0CCFDB2CA311B9 152344 ----a-w- C:\WINDOWS\Sysnative\drivers\avgdiska.sys ====== C:\WINDOWS\Tasks ====== 2014-07-21 17:24:18 4C5E9FFC0894760DA4CAD83CB765D25A 3580 ----a-w- C:\WINDOWS\Sysnative\Tasks\ProgramRefresh-ATFST 2014-07-21 17:24:17 0B767A8F0D03FCF27F5B6146CD39797E 3926 ----a-w- C:\WINDOWS\Sysnative\Tasks\ProgramUpdateCheck 2014-07-21 17:24:02 E54E09F2F8D11D1182DA8DDB5E5F37B8 3344 ----a-w- C:\WINDOWS\Sysnative\Tasks\ASP 2014-06-24 17:42:34 0BF09E6F10D89508737C5C8899BF23B8 3990 ----a-w- C:\WINDOWS\Sysnative\Tasks\User_Feed_Synchronization-{719A16F9-08A5-4A67-AA3A-EB7AF80E3BED} ====== C:\WINDOWS\Temp ====== ======= C:\Program Files ===== 2014-07-21 16:42:20 -------- d-----w- C:\Program Files\trend micro 2014-07-21 15:58:52 -------- d-----w- C:\Program Files\iTunes 2014-07-09 17:12:39 -------- d-----w- C:\Program Files\DIFX ======= C:\PROGRA~2 ===== 2014-07-21 18:05:35 -------- d-----w- C:\PROGRA~2\ShadowExplorer 2014-07-21 17:24:10 -------- d-----w- C:\PROGRA~2\BitZipper 2014-07-21 17:24:07 -------- d-----w- C:\PROGRA~2\ASP 2014-07-21 17:23:55 -------- d-----w- C:\PROGRA~2\RCP 2014-07-21 17:12:34 -------- d-----w- C:\PROGRA~2\COMMON~1\Java 2014-07-21 15:58:52 -------- d-----w- C:\PROGRA~2\iTunes 2014-07-21 14:48:33 -------- d-----w- C:\PROGRA~2\AVG 2014-07-09 17:15:28 -------- d-----w- C:\PROGRA~2\Java 2014-07-09 17:12:32 -------- d-----w- C:\PROGRA~2\Belgium Identity Card ======= C: ===== 2014-07-21 15:46:50 5EE61AF78EF3CF7DE7812C8EDCE0A9D8 48 ----a-w- C:\RB.rdat 2014-07-21 15:46:50 58EECD332B68BB36DF1E8B1384A5CCFE 48 ----a-w- C:\License_Time.rdat 2014-07-21 14:48:21 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Recovery.txt ====== C:\Users\Gebruiker\AppData\Roaming ====== 2014-07-21 18:05:42 -------- d-----w- C:\Users\Gebruiker\AppData\Roaming\www.shadowexplorer.com 2014-07-21 17:24:12 -------- d-----w- C:\Users\Gebruiker\AppData\Local\BitZipper 2014-07-21 14:49:13 -------- d-----w- C:\Users\Gebruiker\AppData\Roaming\AVG2014 2014-07-21 14:49:04 -------- d-----w- C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Roaming\AVG2014 2014-07-21 14:48:52 -------- d-----w- C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Avg2014 2014-07-21 14:48:52 -------- d-----w- C:\Users\Gebruiker\AppData\Roaming\TuneUp Software 2014-07-21 14:48:33 -------- d-----w- C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Avg2014 2014-07-21 14:46:46 -------- d-----w- C:\Users\Gebruiker\AppData\Local\Avg2014 2014-07-21 14:35:56 -------- d-----w- C:\Users\joeri\AppData\Local\Adobe 2014-07-21 14:35:53 -------- d-----w- C:\Users\joeri\AppData\Roaming\Apple Computer 2014-07-21 14:35:38 -------- d-----w- C:\Users\joeri\AppData\Roaming\Adobe 2014-07-21 14:35:37 -------- d-s---w- C:\Users\joeri\AppData\Locallow\Microsoft 2014-07-21 14:35:37 -------- d-----w- C:\Users\joeri\AppData\Local\Packages 2014-07-21 14:35:37 -------- d-----w- C:\Users\joeri\AppData\Local\Google 2014-07-21 14:35:36 -------- d-----w- C:\Users\joeri\AppData\Roaming\Microsoft 2014-07-21 14:35:36 -------- d-----w- C:\Users\joeri\AppData\Local\Temp 2014-07-21 14:35:36 -------- d-----w- C:\Users\joeri\AppData\Local\Microsoft Help 2014-07-21 14:35:36 -------- d-----w- C:\Users\joeri\AppData\Local\Microsoft 2014-07-21 13:23:47 -------- d-----w- C:\Users\Gebruiker\AppData\Local\hzacUoHm 2014-07-09 17:14:55 -------- d-----w- C:\Users\Gebruiker\AppData\Locallow\Sun 2014-06-24 17:42:33 -------- d-sh--w- C:\Users\Gebruiker\AppData\Local\EmieUserList 2014-06-24 17:42:33 -------- d-sh--w- C:\Users\Gebruiker\AppData\Local\EmieSiteList ====== C:\Users\Gebruiker ====== 2014-07-21 18:05:36 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShadowExplorer 2014-07-21 18:05:20 5AB2EB3CA32416D1C0ADF696579E6924 969845 ----a-w- C:\Users\Gebruiker\Downloads\ShadowExplorer-0.9-setup.exe 2014-07-21 17:24:11 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitZipper 2014-07-21 17:23:52 005A0D97A6CD71EC22FE71944EF96CC1 6262016 ----a-w- C:\Users\Gebruiker\Downloads\BitZipperSetup [1].exe 2014-07-21 17:23:32 79F04ACA3070A867297A32D4924DE830 794008 ----a-w- C:\Users\Gebruiker\Downloads\BitZipperSetup.exe 2014-07-21 17:12:31 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-21 16:41:46 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\Users\Gebruiker\Downloads\RSITx64.exe 2014-07-21 15:59:06 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2014-07-21 15:46:50 -------- d-----w- C:\ProgramData\FileCure 2014-07-21 14:48:52 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2014-07-21 14:48:41 -------- d-----w- C:\ProgramData\AVG2014 2014-07-21 14:46:46 -------- d--h--w- C:\ProgramData\Common Files 2014-07-21 14:35:39 -------- d-----w- C:\Users\joeri\Searches 2014-07-21 14:35:36 -------- d-----w- C:\Users\joeri\Favorites 2014-07-21 14:35:36 -------- d-----w- C:\Users\joeri\Documents 2014-07-21 14:35:36 -------- d-----w- C:\Users\joeri\AppData 2014-07-09 17:15:39 -------- d-----w- C:\ProgramData\Sun 2014-07-09 17:12:39 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Belgium - eID ====== C: exe-files == 2014-07-21 18:08:26 378DD10936AAFF40EB34D94DC29F2366 22472 ----a-w- C:\$Recycle.Bin\S-1-5-21-2548447246-1423535028-305805995-1001\$R60UVEM\OmniCryptoFinder.vshost.exe 2014-07-21 18:08:23 378DD10936AAFF40EB34D94DC29F2366 22472 ----a-w- C:\$Recycle.Bin\S-1-5-21-2548447246-1423535028-305805995-1001\$RN0DH9H\OmniCryptoFinder.vshost.exe 2014-07-21 18:08:07 378DD10936AAFF40EB34D94DC29F2366 22472 ----a-w- C:\$Recycle.Bin\S-1-5-21-2548447246-1423535028-305805995-1001\$R9JR2YJ\OmniCryptoFinder.vshost.exe 2014-07-21 18:05:36 D9A4EA4D6F3C3B619AB008B146168543 884224 ----a-w- C:\Program Files (x86)\ShadowExplorer\ShadowExplorer.exe 2014-07-21 18:05:35 6564D2786B46C39FB25B2F5FA213BE32 962601 ----a-w- C:\Program Files (x86)\ShadowExplorer\unins000.exe 2014-07-21 18:05:35 02DED435FCAA1C02959051AF636E154A 9216 ----a-w- C:\Program Files (x86)\ShadowExplorer\sesvc.exe 2014-07-21 18:05:20 5AB2EB3CA32416D1C0ADF696579E6924 969845 ----a-w- C:\Users\Gebruiker\Downloads\ShadowExplorer-0.9-setup.exe 2014-07-21 17:24:11 F08ED17265ADD9C7424B6EAE88738E4E 14200 ----a-w- C:\Program Files (x86)\BitZipper\BZSHLEXTLOADER.EXE 2014-07-21 17:24:11 554A45894C0D67E3E403F35F93F6E584 632696 ----a-w- C:\Program Files (x86)\BitZipper\BZSETUPFILEASSOCIATIONS.EXE 2014-07-21 17:24:10 CDE0F20FA43B6CCBE7A10386F012AE58 713008 ----a-w- C:\Program Files (x86)\BitZipper\unins000.exe 2014-07-21 17:24:10 03972A29316A0C5E9C09E4503AF76199 10971952 ----a-w- C:\Program Files (x86)\BitZipper\BITZIPPER.EXE 2014-07-21 17:23:55 E555EDE09092C54790BAAC531DD9FFB9 7958328 ----a-w- C:\Program Files (x86)\RCP\RegCleanPro.exe 2014-07-21 17:23:55 9A13E56FA4A07E91E60A3A8E4D7A923F 593088 ----a-w- C:\Program Files (x86)\RCP\systweakasp.exe 2014-07-21 17:23:55 538D51C21DC915F0B065ADBAC8C52B7A 1199928 ----a-w- C:\Program Files (x86)\RCP\unins000.exe 2014-07-21 17:23:55 51494E1690A608D63FC4FD838D519A83 547128 ----a-w- C:\Program Files (x86)\RCP\RCPUninstall.exe 2014-07-21 17:23:55 3904882F17BFEFF3DF716419C98A3319 114488 ----a-w- C:\Program Files (x86)\RCP\CleanSchedule.exe 2014-07-21 17:23:52 005A0D97A6CD71EC22FE71944EF96CC1 6262016 ----a-w- C:\Users\Gebruiker\Downloads\BitZipperSetup [1].exe 2014-07-21 17:23:41 005A0D97A6CD71EC22FE71944EF96CC1 6262016 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\is1957915176\6D6CD0B1_stp.EXE 2014-07-21 17:23:32 79F04ACA3070A867297A32D4924DE830 794008 ----a-w- C:\Users\Gebruiker\Downloads\BitZipperSetup.exe 2014-07-21 17:12:33 7F26D694BC7E78958BE38D1D9AAFC2B9 272808 ----a-w- C:\Windows\SysWOW64\javaws.exe 2014-07-21 17:12:31 67BE34FBF29E783691C713517102E67E 175528 ----a-w- C:\Windows\SysWOW64\javaw.exe 2014-07-21 17:12:30 FFAECE8AEC1D9CCDCEC1C55C2CA450BA 175528 ----a-w- C:\Windows\SysWOW64\java.exe 2014-07-21 17:11:55 3842C46F2FBC7522EF625F1833530804 145408 ----a-w- C:\Users\Gebruiker\AppData\LocalLow\Sun\Java\jre1.7.0_65\lzma.exe 2014-07-21 17:11:47 8AA94A64117D7AFDA8C22176F138DD76 918952 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe 2014-07-21 16:42:21 9A2347903D6EDB84C10F288BC0578C1C 388608 ----a-w- C:\Program Files\trend micro\Gebruiker.exe 2014-07-21 16:41:46 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\Users\Gebruiker\Downloads\RSITx64.exe 2014-07-21 16:21:17 7422A67F7A3C4044CC489350AA8832C4 2702328 ----a-w- C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\INetCache\IE\N40HTAPF\FreeTVDownloader4[1].exe 2014-07-21 15:59:21 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\INetCache\IE\YY10QAEF\VOPackage[1].exe 2014-07-21 15:59:21 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\INetCache\IE\EOUF3WFB\VOPackage[1].exe 2014-07-21 15:59:21 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\INetCache\IE\9M1MWVM6\VOPackage[1].exe 2014-07-21 15:56:57 AA3621250F5654CCAFF1CCDA6558BB80 77136 ----a-w- C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\INetCache\IE\EOUF3WFB\SetupAdmin[2].exe 2014-07-21 15:56:57 AA3621250F5654CCAFF1CCDA6558BB80 77136 ----a-w- C:\ProgramData\Apple Computer\Installer Cache\iTunes 11.3.0.54\SetupAdmin.exe 2014-07-17 09:20:42 EF2E5FE2FACC168B62450D2BE0DA4640 4312600 ------w- C:\Users\Gebruiker\AppData\Local\Temp\is1957915176\1B5020B0_stp\rcpsetup_adppi14_adppi14.exe === C: other files == 2014-07-22 08:00:49 95B3CEAF06A2DF96FE28CD0755D319C4 79064 ----a-w- C:\Windows\System32\drivers\bxkjkk.sys 2014-07-21 18:07:50 5776BC08F17A34283E9CD7A1FEA19E07 248714 ----a-w- C:\Users\Gebruiker\Downloads\OCF_20131025.zip 2014-07-21 17:29:58 4883D7E43155FC3A1034F924217FCC2F 544 ----a-w- C:\$Recycle.Bin\S-1-5-21-2548447246-1423535028-305805995-1001\$IUDC1U5.zip 2014-07-21 16:56:25 8A50D5304E6AE48664CF5838EC32F647 122584 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys 2014-07-21 16:56:12 F92B0E478C0FAA6D6661E6E977247E60 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys 2014-07-21 16:56:12 9D9ED48F841EA37AA5310D54B9E5D3C7 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys 2014-07-21 16:56:12 0664F6335F108F38FE08C3CA747311EE 64216 ----a-w- C:\Windows\System32\drivers\mwac.sys 2014-07-21 14:07:25 6DDD017687C72229218C25173BBA9A24 417580 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\scoped_dir_3872_24838\DVDVideoSoftBrowserExtension.crx 2014-07-21 13:24:06 6DDD017687C72229218C25173BBA9A24 417580 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\scoped_dir_6164_29633\DVDVideoSoftBrowserExtension.crx 2014-07-21 13:24:01 6DDD017687C72229218C25173BBA9A24 417580 ----a-w- C:\Users\Gebruiker\AppData\Local\Temp\scoped_dir_4684_4684\DVDVideoSoftBrowserExtension.crx 2014-07-21 13:23:47 EF57E19360A0157B1EE8D0FE7672DC08 101540 ----a-w- C:\Users\Gebruiker\AppData\Local\hzacUoHm\spexaJNB.zip 2014-07-21 13:23:47 EF57E19360A0157B1EE8D0FE7672DC08 101540 ----a-w- C:\$Recycle.Bin\S-1-5-21-2548447246-1423535028-305805995-1001\$RUDC1U5.zip ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-21-2548447246-1423535028-305805995-1001\Software\Microsoft\Windows\CurrentVersion\Run] "ApplePhotoStreams"="C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" "Facebook Update"="C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver" "HP Deskjet 3070 B611 series (NET)"="C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe -deviceID CN17D363PB05MQ:NW -scfn HP Deskjet 3070 B611 series (NET) -AutoStart 1" "HP Officejet 6700 (NET)"="C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe -deviceID CN39FC5G9J05RQ:NW -scfn HP Officejet 6700 (NET) -AutoStart 1" [HKEY_USERS\S-1-5-21-2548447246-1423535028-305805995-1002\Software\Microsoft\Windows\CurrentVersion\RunOnce] "WAB Migrate"="%ProgramFiles%\Windows Mail\wab.exe /Upgrade" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ApplePhotoStreams"="C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" "Facebook Update"="C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver" "HP Deskjet 3070 B611 series (NET)"="C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\ScanToPCActivationApp.exe -deviceID CN17D363PB05MQ:NW -scfn HP Deskjet 3070 B611 series (NET) -AutoStart 1" "HP Officejet 6700 (NET)"="C:\Program Files\HP\HP Officejet 6700\Bin\ScanToPCActivationApp.exe -deviceID CN39FC5G9J05RQ:NW -scfn HP Officejet 6700 (NET) -AutoStart 1" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" "Persistence"="C:\WINDOWS\system32\igfxpers.exe" ==== Startup Folders ====================== 2014-01-16 13:04:06 1381 ----a-w- C:\Users\Gebruiker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk 2013-07-10 18:53:31 1956 ----a-w- C:\Users\Gebruiker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Inktwaarschuwingen controleren - HP Deskjet 3070 B611 series (netwerk).lnk 2013-12-09 17:07:10 1928 ----a-w- C:\Users\Gebruiker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Inktwaarschuwingen controleren - HP Officejet 6700 (netwerk).lnk ==== Task Scheduler Jobs ====================== C:\WINDOWS\tasks\Adobe Flash Player Updater.job --a-------- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [09/07/2014 09:37] C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2548447246-1423535028-305805995-1001Core.job --a-------- C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe [04/06/2013 17:12] C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-2548447246-1423535028-305805995-1001UA.job --a-------- C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe [04/06/2013 17:12] C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [26/02/2014 12:54] C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [26/02/2014 12:54] ==== Other Scheduled Tasks ====================== "C:\WINDOWS\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\WINDOWS\SysNative\tasks\Apple Diagnostics" [C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe] "C:\WINDOWS\SysNative\tasks\ASP" ["C:\Program Files (x86)\RegClean Pro\SystweakASP.exe"] "C:\WINDOWS\SysNative\tasks\CreateChoiceProcessTask" [C:\Windows\BrowserChoice\browserchoice.exe] "C:\WINDOWS\SysNative\tasks\FacebookUpdateTaskUserS-1-5-21-2548447246-1423535028-305805995-1001Core" [C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe] "C:\WINDOWS\SysNative\tasks\FacebookUpdateTaskUserS-1-5-21-2548447246-1423535028-305805995-1001UA" [C:\Users\Gebruiker\AppData\Local\Facebook\Update\FacebookUpdate.exe] "C:\WINDOWS\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\WINDOWS\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\WINDOWS\SysNative\tasks\HP AR Program Upload - 11d11d77f52b4390a5947b653228c0c35498149e938143d9aa3f088f61bc4a00" [C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe] "C:\WINDOWS\SysNative\tasks\HP AR Program Upload - 4700333770ac42a9872276304174e2297fb84876e9bd493483bfa2d05175acac" [C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe] "C:\WINDOWS\SysNative\tasks\HP AR Program Upload - 8ce26455b74b4552ad96348cd999ef4e20693c34697b458bad7d7fce71da8e39" [C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe] "C:\WINDOWS\SysNative\tasks\HP AR Program Upload - ad218a2d0aa14a33a1ec569ac1e1d27755989f77805c4647a130caee80c5cbd2" [C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe] "C:\WINDOWS\SysNative\tasks\HP AR Program Upload - bfd9ce6392e74fd0932dfafebbe13908733700172dea4880a99c348162a55f12" [C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe] "C:\WINDOWS\SysNative\tasks\HPCustParticipation HP Deskjet 3070 B611 series" ["C:\Program Files\HP\HP Deskjet 3070 B611 series\Bin\HPCustPartic.exe"] "C:\WINDOWS\SysNative\tasks\HPCustParticipation HP Officejet 6700" ["C:\Program Files\HP\HP Officejet 6700\Bin\HPCustPartic.exe"] "C:\WINDOWS\SysNative\tasks\ProgramRefresh-ATFST" [C:\Program Files (x86)\File Type Assistant\tsasetup.exe] "C:\WINDOWS\SysNative\tasks\ProgramUpdateCheck" [C:\Program Files (x86)\File Type Assistant\TSAssist.exe] "C:\WINDOWS\SysNative\tasks\User_Feed_Synchronization-{719A16F9-08A5-4A67-AA3A-EB7AF80E3BED}" [C:\WINDOWS\system32\msfeedssync.exe] "C:\WINDOWS\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions] "belgiumeid@eid.belgium.be"="C:\Program Files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be" [] [HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions] "{B64D9B05-48E1-4CEB-BF58-E0643994E900}"="C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff" [] ==== Firefox Extensions ====================== AppDir: C:\Program Files (x86)\Mozilla Firefox - Belgium eID - %AppDir%\extensions\belgiumeid@eid.belgium.be ==== Firefox Plugins ====================== ==== Chrome Look ====================== HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions nikpibnbobmbdbheedjfogjlikpgpnhp - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx[] Google Docs - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Ratchet Clank Future 2 - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejhfomhehcinmhgnlhdpghklkjgppdmn Google Wallet - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Facebook Themes (Facebook Style Gallery) App - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\oklfegjlnijpeedheifelomiocbagekj Gmail - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia ==== Chrome Fix ====================== C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filecure.en.softonic.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_filecure.en.softonic.com_0.localstorage-journal deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_ignition.en.softonic.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_ignition.en.softonic.com_0.localstorage-journal deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_iobit-unlocker.en.softonic.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_iobit-unlocker.en.softonic.com_0.localstorage-journal deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_unlocker.en.softonic.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_unlocker.en.softonic.com_0.localstorage-journal deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" {012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== HKEY_USERS\S-1-5-21-2548447246-1423535028-305805995-1001\Software\Mozilla\Firefox\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} deleted successfully ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F60730A4A66673047777F5728467D401 deleted successfully HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp deleted successfully HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F60730A4A66673047777F5728467D401 deleted successfully ==== Empty IE Cache ====================== C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully C:\Users\joeri\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=601 folders=93 324158453 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\Gebruiker\AppData\Local\Temp will be emptied at reboot C:\Users\joeri\AppData\Local\Temp emptied successfully C:\Users\UpdatusUser\AppData\Local\Temp emptied successfully C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\WINDOWS\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\WINDOWS\Temp successfully emptied C:\Users\GEBRUI~1\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\PROGRA~2\ASP" not found ==== EOF on di 22/07/2014 at 10:18:59,10 ======================