Zoek.exe v5.0.0.0 Updated 11-August-2014 Tool run by Afram on di 12-08-2014 at 21:08:17,47. Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64 Running in: Normal Mode Internet Access Detected Launched: F:\zoek.exe [Scan all users] [Script inserted] ==== System Restore Info ====================== 12-8-2014 21:13:25 Zoek.exe System Restore Point Created Succesfully. ==== Possible Rootkit Infection ====================== C:\Windows\installer\{0812b19e-879e-1679-e7a4-b49dd37fe106}\L C:\Windows\installer\{0812b19e-879e-1679-e7a4-b49dd37fe106}\U C:\Windows\installer\{0812b19e-879e-1679-e7a4-b49dd37fe106}\@ C:\Windows\installer\{0812b19e-879e-1679-e7a4-b49dd37fe106}\U\00000004.@ C:\Windows\installer\{0812b19e-879e-1679-e7a4-b49dd37fe106}\U\00000008.@ C:\Windows\installer\{0812b19e-879e-1679-e7a4-b49dd37fe106}\U\000000cb.@ C:\Windows\installer\{0812b19e-879e-1679-e7a4-b49dd37fe106}\U\80000000.@ C:\Windows\installer\{0812b19e-879e-1679-e7a4-b49dd37fe106}\U\80000032.@ C:\Windows\installer\{0812b19e-879e-1679-e7a4-b49dd37fe106}\U\80000064.@ ==== Empty Folders Check ====================== C:\PROGRA~2\Search Results Toolbar deleted successfully C:\PROGRA~2\COMMON~1\SWF Studio deleted successfully C:\Program Files\trend micro deleted successfully C:\PROGRA~3\Babylon deleted successfully C:\PROGRA~3\Oracle deleted successfully C:\PROGRA~3\{01BD4FC9-2F86-4706-A62E-774BB7E9D308} deleted successfully C:\PROGRA~3\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42} deleted successfully C:\PROGRA~3\{93E26451-CD9A-43A5-A2FA-C42392EA4001} deleted successfully C:\Users\afram\AppData\Roaming\Media Player Classic deleted successfully C:\Users\afram\AppData\Roaming\YourFileDownloader deleted successfully C:\Users\afram\AppData\Local\Downloaded Installations deleted successfully C:\Users\afram\AppData\Local\OpenCandy deleted successfully C:\Users\afram\AppData\Local\PackageAware deleted successfully C:\Users\afram\AppData\Local\VirtualStore deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0D5F364D-D6A9-43C1-BF0C-99B378972C5B} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1B084C86-9657-42F9-A5E5-AC8DD832CDE9} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{87775fdb-6972-41f9-ae51-8326e38cb206} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{87775fdb-6972-41f9-ae51-8326e38cb206} deleted successfully HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{e9e8eb35-ff77-455d-b677-91e5e4fc06c2} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{e9e8eb35-ff77-455d-b677-91e5e4fc06c2} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{52170494-4d34-4f69-8dac-f726dc0da9ac} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{52170494-4d34-4f69-8dac-f726dc0da9ac} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0388404D-6072-4CEB-B521-8F090FEAEE57} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2431} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FCEF998-E03D-DE82-AAA8-333A275CB7D3} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FCEF998-E03D-DE82-AAA8-333A275CB7D3} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9B803262-7A43-A7DA-2A00-309476EFD150} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9B803262-7A43-A7DA-2A00-309476EFD150} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully HKEY_CLASSES_ROOT\CLSID\{0D5F364D-D6A9-43C1-BF0C-99B378972C5B} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{0D5F364D-D6A9-43C1-BF0C-99B378972C5B} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D5F364D-D6A9-43C1-BF0C-99B378972C5B} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D5F364D-D6A9-43C1-BF0C-99B378972C5B} deleted successfully HKEY_CLASSES_ROOT\CLSID\{1B084C86-9657-42F9-A5E5-AC8DD832CDE9} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{1B084C86-9657-42F9-A5E5-AC8DD832CDE9} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B084C86-9657-42F9-A5E5-AC8DD832CDE9} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B084C86-9657-42F9-A5E5-AC8DD832CDE9} deleted successfully HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{87775fdb-6972-41f9-ae51-8326e38cb206} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87775fdb-6972-41f9-ae51-8326e38cb206} deleted successfully HKEY_CLASSES_ROOT\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{e9e8eb35-ff77-455d-b677-91e5e4fc06c2} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9e8eb35-ff77-455d-b677-91e5e4fc06c2} deleted successfully HKEY_CLASSES_ROOT\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{52170494-4d34-4f69-8dac-f726dc0da9ac} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52170494-4d34-4f69-8dac-f726dc0da9ac} deleted successfully HKEY_CLASSES_ROOT\CLSID\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{87775fdb-6972-41f9-ae51-8326e38cb206} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{87775fdb-6972-41f9-ae51-8326e38cb206} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{52170494-4d34-4f69-8dac-f726dc0da9ac} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\m3ffxtbr@mywebsearch.com deleted successfully HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{e45a0de0-b4de-11de-8a39-0800200c9a66} deleted successfully ==== Deleting Services ====================== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginService deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IePluginService deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\IePluginService deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\IePluginService deleted successfully ==== FireFox Fix ====================== ProfilePath: C:\Users\afram\AppData\Roaming\Mozilla\Firefox\Profiles\0 prefs.js not found user.js not found ---- FireFox user.js and prefs.js backups ---- ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command] @="C:\\Program Files\\Internet Explorer\\iexplore.exe" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "bProtector Start Page"=- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "bProtectorDefaultScope"=- ==== Deleting Files \ Folders ====================== C:\PROGRA~3\{01BD4FC9-2F86-4706-A62E-774BB7E9D308} not found C:\PROGRA~3\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42} not found C:\PROGRA~3\{93E26451-CD9A-43A5-A2FA-C42392EA4001} not found C:\Program Files (x86)\Free Games deleted C:\Program Files (x86)\Speed Test deleted C:\Program Files (x86)\SupTab deleted C:\Program Files (x86)\uTorrentBar_NL deleted C:\ProgramData\IePluginService deleted C:\Program Files (x86)\bettermarkit-soft deleted C:\Program Files (x86)\PC Performer deleted C:\PROGRA~3\StarApp deleted C:\PROGRA~3\WoW Worldwide Software LTD deleted C:\PROGRA~2\ContinueToSave deleted C:\PROGRA~2\DAEMON Tools Toolbar deleted C:\PROGRA~2\SearchProtect deleted C:\PROGRA~2\iLivid deleted C:\PROGRA~2\WebSearch deleted C:\PROGRA~2\MyFree Codec deleted C:\PROGRA~2\VaudiX deleted C:\PROGRA~2\Vid-Saver deleted C:\PROGRA~2\Gophoto.it deleted C:\PROGRA~2\Ask.com deleted C:\PROGRA~2\Funmoods deleted C:\PROGRA~2\Conduit deleted C:\LIL1AFF.tmp deleted C:\LIL1B00.tmp deleted C:\LIL1B1F.tmp deleted C:\LIL1B2E.tmp deleted C:\LIL1B7C.tmp deleted C:\user.js deleted C:\install.exe deleted C:\SearchProtect deleted C:\Users\afram\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Search.lnk deleted C:\Users\afram\AppData\Roaming\Babylon deleted C:\Users\afram\AppData\Roaming\NCdownloader deleted C:\Users\afram\AppData\Roaming\PerformerSoft deleted C:\Users\afram\AppData\Roaming\OpenCandy deleted C:\Windows\sysWoW64\config\systemprofile\AppData\Roaming\SearchProtect deleted C:\PROGRA~3\BrowserProtect deleted C:\PROGRA~3\AVG Security Toolbar deleted C:\PROGRA~3\boost_interprocess deleted C:\PROGRA~3\DSearchLink deleted C:\PROGRA~3\Wincert deleted C:\PROGRA~3\SeArch-NeewTaab deleted C:\PROGRA~3\ccoonntinuetossave deleted C:\PROGRA~3\Uniblue\DriverScanner deleted C:\PROGRA~3\WPM deleted C:\PROGRA~3\Vaudix deleted C:\PROGRA~3\Uniblue deleted C:\PROGRA~3\InstallMate deleted C:\PROGRA~3\Tarma Installer deleted C:\Users\afram\AppData\Local\Ilivid Player deleted C:\Users\afram\AppData\Local\CRE deleted C:\Users\afram\AppData\Local\SearchProtect deleted C:\Users\afram\AppData\Local\Vid-Saver deleted C:\Users\afram\AppData\Local\Conduit deleted C:\Users\TEMP\AppData\Local\SearchProtect deleted C:\Users\TEMP\AppData\Local\AVG SafeGuard toolbar deleted C:\Windows\sysWoW64\config\systemprofile\AppData\Local\SearchProtect deleted C:\Windows\sysWoW64\config\systemprofile\AppData\Local\AVG SafeGuard toolbar deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyFree Codec deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SeArch-NeewTaab deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ccoonntinuetossave deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vaudix deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Performer deleted C:\Users\afram\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com deleted C:\windows\SysNative\Tasks\BackgroundContainer Startup Task deleted C:\windows\SysNative\Tasks\PC Performer deleted C:\windows\SysNative\Tasks\PC Performer_DEFAULT deleted C:\windows\SysNative\Tasks\PC Performer_UPDATES deleted C:\Users\afram\Searches deleted C:\Users\afram\Downloads\SoftonicDownloader_voor_video-to-video-converter.exe deleted C:\Users\afram\AppData\LocalLow\AVG Security Toolbar deleted C:\Users\afram\AppData\LocalLow\boost_interprocess deleted C:\Users\afram\AppData\LocalLow\MyWebSearch deleted C:\Users\afram\AppData\LocalLow\BabylonToolbar deleted C:\Users\afram\AppData\LocalLow\Delta deleted C:\Users\afram\AppData\LocalLow\DataMngr deleted C:\Users\afram\AppData\LocalLow\uTorrentBar_NL deleted C:\Users\afram\AppData\LocalLow\PriceGong deleted C:\Users\afram\AppData\LocalLow\Conduit deleted C:\Users\afram\AppData\LocalLow\FunWebProducts deleted C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\AVG SafeGuard toolbar deleted C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\AVG Secure Search deleted C:\Windows\tasks\PC Performer_DEFAULT.job deleted C:\Windows\tasks\PC Performer_UPDATES.job deleted C:\windows\SysNative\tasks\AVG_SYS_TASK_0614t deleted C:\windows\SysNative\tasks\AVG_SYS_TASK_0614t_DELETE deleted C:\windows\SysNative\tasks\YourFile DownloaderUpdate deleted C:\windows\SysNative\tasks\VaudiXUpdaterTask{C81EC507-1FA8-49C3-8729-A8755A720AB8} deleted C:\Windows\tasks\VaudiXUpdaterTask{C81EC507-1FA8-49C3-8729-A8755A720AB8}.job deleted C:\END deleted C:\Windows\SysNative\config\systemprofile\Searches deleted C:\Windows\Syswow64\SearchProtect deleted C:\Users\Public\Desktop\PC Performer.lnk deleted C:\Users\afram\AppData\Roaming\Mozilla\Extensions\freegames197@BestOffers deleted C:\Users\afram\AppData\Roaming\Mozilla\Extensions\speedtest199@BestOffers deleted "C:\Windows\tasks\bettermarkit Update.job" deleted "C:\Windows\tasks\bettermarkit_wd.job" deleted "C:\Users\afram\AppData\Roaming\Mozilla\Firefox\Profiles\0\extensions\torntv@torntv.com.xpi" deleted "C:\ProgramData\Premium\VaudiX\VaudiX.exe" deleted "C:\PROGRA~2\YourFileDownloader Updater\htmlayout.dll" deleted "C:\PROGRA~2\YourFileDownloader Updater\YourFileUpdater.exe" deleted "C:\PROGRA~3\Avg_Update_0614t\AVG-Secure-Search-Update_0614t.exe" deleted "C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe" deleted "C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll" deleted "C:\PROGRA~3\Premium\VaudiX\VaudiX.exe" deleted "C:\ProgramData\Premium\VaudiX" not deleted "C:\Program Files (x86)\Windows Searchqu Toolbar" not deleted "C:\PROGRA~2\YourFileDownloader Updater" deleted "C:\PROGRA~3\Avg_Update_0614t" not deleted "C:\PROGRA~3\Premium" not deleted "C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr" not deleted "C:\Program Files (x86)\Windows Searchqu Toolbar\Datamngr\x64" not deleted "C:\PROGRA~3\Premium\VaudiX" not deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\afram\AppData\Local\Temp ==== ====== Java Cache ===== 2014-08-04 15:37:45 8F3F82320DA7C293396C93E32216CEA0 3318 ----a-w- C:\Users\afram\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\27\46d0731b-2422657e ====== C:\Windows\SysWOW64 ===== 2014-08-03 09:41:41 867148EBF47E7E7E7B21C07B4A981929 581600 ----a-w- C:\Windows\SysWOW64\wuapi.dll 2014-08-03 09:41:41 372218B80DEF827063049EBEE76B7501 92672 ----a-w- C:\Windows\SysWOW64\wudriver.dll 2014-08-03 09:41:41 255F0417EC31C71585824269522EC8E9 36320 ----a-w- C:\Windows\SysWOW64\wups.dll 2014-08-03 09:41:38 5AA2CAD923E9E647276A61387E83DDD0 179656 ----a-w- C:\Windows\SysWOW64\wuwebv.dll 2014-08-03 09:41:37 F419D738BD2AE58D9DF2F9FEB5F43842 33792 ----a-w- C:\Windows\SysWOW64\wuapp.exe ====== C:\Windows\SysWOW64\drivers ===== ====== C:\Windows\Sysnative ===== 2014-08-03 09:41:47 EAD9E413A6CEB9FD8E2AD9DC0716C061 58336 ----a-w- C:\Windows\Sysnative\wuauclt.exe 2014-08-03 09:41:47 E76F105AD039B9E4DA9ECE839298C4A2 44512 ----a-w- C:\Windows\Sysnative\wups2.dll 2014-08-03 09:41:46 6335F8B4B89F002A3801473C1A799237 2620928 ----a-w- C:\Windows\Sysnative\wucltux.dll 2014-08-03 09:41:46 61FF576450CCC80564B850BC3FB6713A 2477536 ----a-w- C:\Windows\Sysnative\wuaueng.dll 2014-08-03 09:41:41 7EC6617005F76714C7E16605E7A8AB06 38880 ----a-w- C:\Windows\Sysnative\wups.dll 2014-08-03 09:41:41 1180B5ADFB507258DA10F51B46681A33 97792 ----a-w- C:\Windows\Sysnative\wudriver.dll 2014-08-03 09:41:41 0DB2758CF1BAFE22E0970FDA0785B74C 700384 ----a-w- C:\Windows\Sysnative\wuapi.dll 2014-08-03 09:41:37 45D4BDEA136E72E75CF008D3C38D949A 198600 ----a-w- C:\Windows\Sysnative\wuwebv.dll 2014-08-03 09:41:37 29FE783F75362AD6D2D9C0555BA83BD2 36864 ----a-w- C:\Windows\Sysnative\wuapp.exe ====== C:\Windows\Sysnative\drivers ===== ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== ======= C:\PROGRA~2 ===== 2014-07-16 20:20:20 -------- d-----w- C:\PROGRA~2\Haali ======= C: ===== ====== C:\Users\afram\AppData\Roaming ====== 2014-07-16 20:30:43 -------- d-----w- C:\Users\afram\AppData\Roaming\Belastingdienst 2014-07-16 20:20:20 -------- d-----w- C:\Users\afram\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter 2014-07-16 20:20:09 -------- d-----w- C:\Users\afram\AppData\Local\speedtest199 2014-07-16 20:20:06 -------- d-----w- C:\Users\afram\AppData\Local\freegames197 2014-07-16 20:20:02 -------- d-----w- C:\Users\afram\AppData\Roaming\UnknownFile ====== C:\Users\afram ====== 2014-07-16 20:20:22 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ffdshow 2014-07-16 20:20:20 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter ====== C: exe-files == 2014-08-11 19:08:42 E4C1EFC479F2EEFD6DFEC7D73C9E4167 7128184 ----a-w- C:\Program Files (x86)\AVG\AVG2014\Notification\Launcher.exe 2014-08-10 00:22:51 FA16230E0329F1054C4723C555EB86B6 302096 ----a-w- C:\Program Files (x86)\AVG\AVG2014\avgndisa.exe 2014-08-10 00:13:39 236D5BD908CC856B8260F587B5E203AB 1267032 ----a-w- C:\Users\afram\Application Data\BitTorrent\updates\7.9.2_32128.exe 2014-08-10 00:13:39 236D5BD908CC856B8260F587B5E203AB 1267032 ----a-w- C:\Users\afram\AppData\Roaming\BitTorrent\updates\7.9.2_32128.exe === C: other files == ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-21-1109859481-692737900-2021271557-1000\Software\Microsoft\Windows\CurrentVersion\Run] "OfficeSyncProcess"="C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE" "KiesPDLR"="C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" "KiesPreload"="C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload" @="C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" "GoogleChromeAutoLaunch_E6D30BB7367ED5F8F79184F7DA40E9A5"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --no-startup-window" "AVG-Secure-Search-Update_0614t"="C:\Users\afram\AppData\Roaming\Avg_Update_0614t\AVG-Secure-Search-Update_0614t.exe /PROMPT /mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17 /CMPID=0614t" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PMBVolumeWatcher"="C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe" "APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" "AVG_UI"="C:\Program Files (x86)\AVG\AVG2014\avgui.exe /TRAYONLY" "DATAMNGR"="C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE" "ConnectionCenter"="C:\Program Files (x86)\Citrix\ICA Client\concentr.exe /startup" "DivXMediaServer"="C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" "KiesTrayAgent"="C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe" "TkBellExe"="C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe -osboot" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "B Register C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll"="C:\Windows\system32\rundll32.exe C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll,DllRegisterServer" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "OfficeSyncProcess"="C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE" "KiesPDLR"="C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" "KiesPreload"="C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload" @="C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" "GoogleChromeAutoLaunch_E6D30BB7367ED5F8F79184F7DA40E9A5"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --no-startup-window" "AVG-Secure-Search-Update_0614t"="C:\Users\afram\AppData\Roaming\Avg_Update_0614t\AVG-Secure-Search-Update_0614t.exe /PROMPT /mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17 /CMPID=0614t" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nwiz"="nwiz.exe /installquiet" "NvCplDaemon"="RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup" "NVHotkey"="rundll32.exe C:\Windows\system32\nvHotkey.dll,Start" "BCSSync"="C:\Program Files\Microsoft Office\Office14\BCSSync.exe /DelayServices" "Apoint"="C:\Program Files\DellTPad\Apoint.exe" ==== Startup Registry Disabled ====================== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-] "Adobe ARM"="\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\"" "TkBellExe"="\"C:\\Program Files (x86)\\Real\\RealPlayer\\update\\realsched.exe\" -osboot" "DivXUpdate"="\"C:\\Program Files (x86)\\DivX\\DivX Update\\DivXUpdate.exe\" /CHECKNOW" "SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\"" "QuickTime Task"="\"C:\\Program Files (x86)\\QuickTime\\QTTask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files (x86)\\iTunes\\iTunesHelper.exe\"" ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [10-07-2014 18:08] C:\Windows\tasks\AVG_SYS_TASK_0614t.job --a------ C:\ProgramData\Avg_Update_0614t\AVG-Secure-Search-Update_0614t.exe [] C:\Windows\tasks\AVG_SYS_TASK_0614t_DELETE.job --a------ C:CC:\ProgramData\Avg_Update_0614t\AVG-Secure-Search-Update_0614t.exe [] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [13-06-2014 09:45] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [13-06-2014 09:45] ==== Other Scheduled Tasks ====================== "C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\SysNative\tasks\Adobe-online actualiseringsprogramma" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\Windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\Windows\SysNative\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\SysNative\tasks\DivX-online actualiseringsprogramma" [C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe] "C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\Windows\SysNative\tasks\Java Update Scheduler" [C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe] "C:\Windows\SysNative\tasks\Real Player-online actualiseringsprogramma" [C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe] "C:\Windows\SysNative\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1109859481-692737900-2021271557-1000" [C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe] "C:\Windows\SysNative\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1109859481-692737900-2021271557-1000" [C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe] "C:\Windows\SysNative\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1109859481-692737900-2021271557-1000" [C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe] "C:\Windows\SysNative\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1109859481-692737900-2021271557-1000" [C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe] "C:\Windows\SysNative\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1109859481-692737900-2021271557-1000" [C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe] "C:\Windows\SysNative\tasks\RealUpgradeLogonTaskS-1-5-21-1109859481-692737900-2021271557-1000" [C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe] "C:\Windows\SysNative\tasks\RealUpgradeScheduledTaskS-1-5-21-1109859481-692737900-2021271557-1000" [C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe] "C:\Windows\SysNative\tasks\SidebarExecute" [C:\Program Files\Windows Sidebar\sidebar.exe] "C:\Windows\SysNative\tasks\TuneUpUtilities_Task_BkGndMaintenance2013" [C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe] "C:\Windows\SysNative\tasks\User_Feed_Synchronization-{920D8BC1-399E-494D-A2C6-0404305B8F73}" [C:\Windows\system32\msfeedssync.exe] "C:\Windows\SysNative\tasks\{1FFFD5FC-73D2-4C4F-ACDB-58B7C4EE90DB}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{366BDB82-0497-4A77-83D6-B6E18E250335}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{3B56E2BC-3B29-46E5-82A2-90AB971B6D53}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{4934CBD8-28E9-4BB5-9284-69C2A4F3269B}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{543E789A-CBE5-4F18-A741-3C39E94597F3}" [C:\Program Files (x86)\HFSExplorer\hfsexplorer.exe] "C:\Windows\SysNative\tasks\{759E2A13-87CC-45F2-9FB6-B9FFE6137107}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{77373436-4885-4691-A12B-699023439A71}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{8009D311-3AA4-462B-A45F-4CC9F6BA7420}" [C:\Program Files (x86)\HFSExplorer\hfsexplorer.exe] "C:\Windows\SysNative\tasks\{89D98599-1BBA-4025-BF1E-6AF60A7C82B3}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{CE689CA1-B9B1-445C-A267-CBC38BA4B5BD}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{D297E7F8-AD1B-41F7-BCDA-C5459DF26FE4}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{F077E723-2D06-457E-95EB-007342AD6F05}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\{FC3B7CFF-3B89-45DB-ABBD-DC8329D8B67B}" [C:\Users\afram\Documents\sobotta\SOBOTTA.EXE] "C:\Windows\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe] "C:\Windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions] "{23fcfd51-4958-4f00-80a3-ae97e717ed8b}"="C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5" [24-08-2013 00:25] [HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions] "speedtest199@BestOffers"="C:\Users\afram\AppData\Roaming\Mozilla\Extensions\speedtest199@BestOffers" [] ==== Firefox Extensions ====================== ExtDir: C:\Users\afram\AppData\Roaming\Mozilla\Firefox\Profiles\extensions - GoPhotoIt - %ExtDir%\gophoto@gophoto.it.xpi ==== Firefox Plugins ====================== ==== Deleted Firefox Extensions ====================== C:\Users\afram\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\gophoto@gophoto.it.xpi deleted ==== Chrome Look ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions bpegkgagfojjbcpkihigfmkojdmmimdf - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx[01-02-2013 11:31] cjofdnhdkbflacojpfpkchgafjahijbb - C:\Users\afram\AppData\Local\Temp\ccex.crx[] ehgldbbpchgpcfagfpfjgoomddhccfgh - C:\Program Files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Chrome\ChromeYoutubePlugin.crx[01-02-2013 11:31] hhipkohoapdfaggfeglmjgmdoddonilo - C:\ProgramData\Vaudix\hhipkohoapdfaggfeglmjgmdoddonilo.crx[] idhngdhcfkoamngbedgpaokgjbnpdiji - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[29-11-2012 21:35] jbpkiefagocgkmemidfngdkamloieekf - C:\Program Files (x86)\TornTV.com\torn11.crx[] kfkcangbigakljkjeglcofaomihpejif - C:\Users\afram\AppData\Local\CRE\kfkcangbigakljkjeglcofaomihpejif.crx[] nneajnkjbffgblleaoojgaacokifdkhm - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx[26-07-2013 16:31] pfmopbbadnfoelckkcmjjeaaegjpjjbk - C:\Program Files (x86)\Gophoto.it\gophotoit14.crx[] pgmfkblbflahhponhjmkcnpjinenhlnc - C:\Users\afram\AppData\Local\Vid-Saver\Chrome\Vid-Saver.crx[] HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions kfkcangbigakljkjeglcofaomihpejif - C:\Users\afram\AppData\Local\CRE\kfkcangbigakljkjeglcofaomihpejif.crx[] Nice Translator - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\echdnikijbegadnenjfmhfjflclkjcbp Freemake Video Downloader - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Nice Translator - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\echdnikijbegadnenjfmhfjflclkjcbp Freemake Youtube Download Button - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Image Info Hotkey - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eiaegfndkgibamojhkobffhhdjffdfkp Delta Toolbar - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde AdBlock - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom WhiteSmoke US New - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Wheels On Fire - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn Highlight to Search - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lncokdgmmjicggolpdppfgbjeaikekhn AVG Secure Search - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Extended Protection - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo Vid-Saver - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc Freemake Video Downloader - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Nice Translator - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\echdnikijbegadnenjfmhfjflclkjcbp Freemake Youtube Download Button - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Image Info Hotkey - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eiaegfndkgibamojhkobffhhdjffdfkp Delta Toolbar - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde AdBlock - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom WhiteSmoke US New - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Wheels On Fire - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn Highlight to Search - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lncokdgmmjicggolpdppfgbjeaikekhn AVG Secure Search - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Extended Protection - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo Vid-Saver - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc Freemake Video Downloader - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Nice Translator - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\echdnikijbegadnenjfmhfjflclkjcbp Freemake Youtube Download Button - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Image Info Hotkey - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eiaegfndkgibamojhkobffhhdjffdfkp Delta Toolbar - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde AdBlock - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom WhiteSmoke US New - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Wheels On Fire - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn Highlight to Search - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lncokdgmmjicggolpdppfgbjeaikekhn AVG Secure Search - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Extended Protection - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo Vid-Saver - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc Freemake Video Downloader - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Nice Translator - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\echdnikijbegadnenjfmhfjflclkjcbp Freemake Youtube Download Button - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Image Info Hotkey - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eiaegfndkgibamojhkobffhhdjffdfkp Delta Toolbar - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde AdBlock - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom WhiteSmoke US New - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Wheels On Fire - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn Highlight to Search - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lncokdgmmjicggolpdppfgbjeaikekhn AVG Secure Search - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Extended Protection - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo Vid-Saver - afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc Freemake Video Downloader - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Nice Translator - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\echdnikijbegadnenjfmhfjflclkjcbp Freemake Youtube Download Button - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Image Info Hotkey - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eiaegfndkgibamojhkobffhhdjffdfkp Delta Toolbar - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde AdBlock - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom WhiteSmoke US New - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Wheels On Fire - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn Highlight to Search - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lncokdgmmjicggolpdppfgbjeaikekhn AVG Secure Search - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Extended Protection - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo Vid-Saver - afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc Freemake Video Downloader - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Nice Translator - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\echdnikijbegadnenjfmhfjflclkjcbp Freemake Youtube Download Button - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Image Info Hotkey - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eiaegfndkgibamojhkobffhhdjffdfkp Delta Toolbar - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde AdBlock - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom WhiteSmoke US New - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Wheels On Fire - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn Highlight to Search - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\lncokdgmmjicggolpdppfgbjeaikekhn AVG Secure Search - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Extended Protection - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo Vid-Saver - afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc Freemake Video Downloader - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Nice Translator - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\echdnikijbegadnenjfmhfjflclkjcbp Freemake Youtube Download Button - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Image Info Hotkey - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\eiaegfndkgibamojhkobffhhdjffdfkp Delta Toolbar - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde AdBlock - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom WhiteSmoke US New - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Wheels On Fire - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn Highlight to Search - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\lncokdgmmjicggolpdppfgbjeaikekhn AVG Secure Search - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Extended Protection - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo Vid-Saver - afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc Freemake Video Downloader - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Nice Translator - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\echdnikijbegadnenjfmhfjflclkjcbp Freemake Youtube Download Button - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Image Info Hotkey - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiaegfndkgibamojhkobffhhdjffdfkp Delta Toolbar - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde AdBlock - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom WhiteSmoke US New - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Wheels On Fire - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn Highlight to Search - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\lncokdgmmjicggolpdppfgbjeaikekhn AVG Secure Search - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Extended Protection - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo Vid-Saver - afram\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc Freemake Video Downloader - TEMP\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Freemake Youtube Download Button - TEMP\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Vaudix - TEMP\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhipkohoapdfaggfeglmjgmdoddonilo RealDownloader - TEMP\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji WhiteSmoke US New - TEMP\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Quick Start - TEMP\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma GoPhoto.it - TEMP\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk Vid-Saver - TEMP\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc Docs - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake Freemake Video Downloader - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf Freemake Youtube Download Button - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh Vaudix - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhipkohoapdfaggfeglmjgmdoddonilo RealDownloader - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji WhiteSmoke US New - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfkcangbigakljkjeglcofaomihpejif Torntv V9.0 - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnbobhffedhdhfpcjkjphcfpeeiocdn OMG Music Plus - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\lncokdgmmjicggolpdppfgbjeaikekhn GoPhoto.it - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk Vid-Saver - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc ==== Chromium Startpages ====================== C:\Users\afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ], C:\Users\afram\AppData\Local\Google\Chrome\User Data\Default\Preferences "homepage": "http://onsintranet.elkerliek.nl/", "startup_urls": [ "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp", "http://search.conduit.com/?ctid=CT3244149&SearchSource=48", "http://www.searchnu.com/431", "http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=17.3.1.91&pid=safeguard&sg=&sap=hp", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp", "http://www.google.nl/", "http://feed.snap.do/?publisher=SnapdoOpenCandy&dpid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&co=NL&userid=2f53b93c-daba-42ec-95fc-544743f740c0&searchtype=hp|http://search.conduit.com/?ctid=CT3244149&SearchSource=48|http://www.searchnu.com/431|http://websearch.pu-result.info/?pid=708&r=2013/05/21&hid=1733223101&lg=EN&cc=NL|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-01-29 21:24:33&v=18.0.5.292&pid=safeguard&sg=&sap=hp|http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=17.3.1.204&pid=safeguard&sg=&sap=hp|http://www.google.nl/", "http://mysearch.avg.com?cid={8212A9D4-D933-44C3-A8E6-6545A9B93C10}&mid=86387480667247d694b4cd2cdbaa44b8-bd5a02297fa69c5d22fc7c9ec56352ec14e9ad17&lang=nl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-02-11 21:27:44&v=18.1.5.512&pid=safeguard&sg=&sap=hp", "http://www.delta-homes.com/?type=hp&ts=1402587832&from=wpm0612&uid=SAMSUNGXSSDXPM800X2X5XX256GB_S0GUNEAZ901051901051" ],