Zoek.exe v5.0.0.0 Updated 22-08-2014 Tool run by on vr 22-08-2014 at 21:07:36,70. Microsoft Windows 8 6.2.9200 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\L5EWH4EZ\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 22-8-2014 21:09:43 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\PROGRA~2\Citrix deleted successfully C:\Program Files\Common Files\Symantec Shared deleted successfully C:\Users\\AppData\Local\VirtualStore deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-2625877825-4005762824-1239777394-1001\Software\Microsoft\Internet Explorer\SearchScopes\{2309BE7B-611B-4862-A9D5-1D26ACB6757D} deleted successfully HKEY_USERS\S-1-5-21-2625877825-4005762824-1239777394-1001\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} deleted successfully HKEY_USERS\S-1-5-21-2625877825-4005762824-1239777394-1001\Software\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Running Processes ====================== C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe C:\Users\\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\L5EWH4EZ\zoek.exe C:\WINDOWS\SysWOW64\cmd.exe C:\WINDOWS\SysWOW64\cmd.exe C:\WINDOWS\SysWOW64\cmd.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE ==== Deleting Services ====================== ==== Deleting Files \ Folders ====================== C:\PROGRA~2\Connected Music powered by Universal Music Group deleted C:\Users\\Searches deleted C:\WINDOWS\SysNative\config\systemprofile\Searches deleted ==== System Specs ====================== Windows: Windows Version 6.2 (Build 9200) Memory (RAM): 3989 MB CPU Info: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz CPU Speed: 2514,4 MHz Sound Card: Luidsprekers / HP (IDT High Def | Display Adapters: Intel(R) HD Graphics 4000 | Intel(R) HD Graphics 4000 | Intel(R) HD Graphics 4000 Monitors: 1x; Algemeen PnP-beeldscherm | Screen Resolution: 1366 X 768 - 32 bit Network: Network Present Network Adapters: Microsoft Wi-Fi Direct Virtual Adapter | Ralink RT3290 802.11bgn Wi-Fi Adapter | Realtek PCIe FE Family Controller CD / DVD Drives: 1x (E: | ) E: hp DVD-RAM UJ8D1 Ports: COM Ports NOT Present. LPT Port NOT Present. Mouse: 5 Button Wheel Mouse Present Hard Disks: C: 449,0GB | D: 15,7GB Hard Disks - Free: C: 358,6GB | D: 2,0GB Manufacturer *: Insyde BIOS Info: AT/AT COMPATIBLE | | HPQOEM - 1 Time Zone: West-Europa (standaardtijd) Motherboard *: Hewlett-Packard 183F Country: Nederland Language: NLD ==== System Specs (Software) ====================== Anti-Virus: Windows Defender On-access scanning disabled (Outdated) Anti-Spyware: Windows Defender disabled (Outdated) Internet Explorer Version: 10.0.9200.17054 Adobe Reader version: 11.0.8.4 Shockwave Player version: 11.6.5r635 ==== Files Recently Created / Modified ====================== ====== C:\WINDOWS ==== ====== C:\Users\AppData\Local\Temp ==== ====== Java Cache ===== ====== C:\WINDOWS\SysWOW64 ===== 2014-08-13 07:53:44 38045850ACB96313A1983A8803302906 35480 ----a-w- C:\WINDOWS\SysWOW64\TsWpfWrp.exe 2014-08-13 07:35:24 59519C658518AA899B76AEEFA7719112 14371328 ----a-w- C:\WINDOWS\SysWOW64\mshtml.dll 2014-08-13 07:35:18 DDB6F474132BDF69835C2EA520C27727 13757440 ----a-w- C:\WINDOWS\SysWOW64\ieframe.dll 2014-08-13 07:35:18 7672B85494FCB5349DC6CACA32E87F9C 2054656 ----a-w- C:\WINDOWS\SysWOW64\iertutil.dll 2014-08-13 07:35:17 791868870510413B81F7FFD62912B883 2861568 ----a-w- C:\WINDOWS\SysWOW64\jscript9.dll 2014-08-13 07:35:17 2046CAAF97A0FB7D7F7A799A320C9266 1180672 ----a-w- C:\WINDOWS\SysWOW64\urlmon.dll 2014-08-13 07:35:16 7951C75E6B680204BD624A0C3CE2C573 1766400 ----a-w- C:\WINDOWS\SysWOW64\wininet.dll 2014-08-13 07:35:14 F9A7AF5CEB19DC16C093D7D3C95997A8 1440768 ----a-w- C:\WINDOWS\SysWOW64\inetcpl.cpl 2014-08-13 07:35:14 3DE90B458BC31E029A7009F51F4B0F6A 690688 ----a-w- C:\WINDOWS\SysWOW64\jscript.dll 2014-08-13 07:35:14 1DD42CA0D3338A1A97DFFBC2DA05333D 226816 ----a-w- C:\WINDOWS\SysWOW64\dxtrans.dll 2014-08-13 07:35:14 02389BD2FA7CBAB52BFB5BDA68782043 357888 ----a-w- C:\WINDOWS\SysWOW64\dxtmsft.dll 2014-08-13 07:35:13 BE7707F5514A414DB7B2639A7A00A410 226816 ----a-w- C:\WINDOWS\SysWOW64\iedkcs32.dll 2014-08-13 07:35:13 5C37961676E91B41E42360CB355707FA 493056 ----a-w- C:\WINDOWS\SysWOW64\msfeeds.dll 2014-08-13 07:35:13 44EB410A565D7DD5910C2AC9D7AD6A58 80384 ----a-w- C:\WINDOWS\SysWOW64\mshtmled.dll 2014-08-13 07:35:13 0424E6D3747B6269963D4671040663A2 109056 ----a-w- C:\WINDOWS\SysWOW64\iesysprep.dll 2014-08-13 07:35:12 C582896705A6EA678D874FDFE49E5AD8 44032 ----a-w- C:\WINDOWS\SysWOW64\UXInit.dll 2014-08-13 07:35:12 BDF3562108CF3EB71D50B3E47BB53717 39936 ----a-w- C:\WINDOWS\SysWOW64\jsproxy.dll 2014-08-13 07:35:12 9679A6F7708D6C894B1817EFEB62351F 33280 ----a-w- C:\WINDOWS\SysWOW64\iernonce.dll 2014-08-13 07:35:12 30D7BFA0009C4D2ACFFEEBB2F5663CAB 163840 ----a-w- C:\WINDOWS\SysWOW64\msrating.dll 2014-08-13 07:35:11 DC7056A6F354D67916BE4AEA79D9C24C 534528 ----a-w- C:\WINDOWS\SysWOW64\uxtheme.dll 2014-08-13 07:35:11 B02AF4F75B3280E10468A7E1698DDCD1 2706432 ----a-w- C:\WINDOWS\SysWOW64\mshtml.tlb 2014-08-13 07:35:11 6FE26E630593A71C2AF4F7222A6F7239 61440 ----a-w- C:\WINDOWS\SysWOW64\iesetup.dll 2014-08-13 07:35:10 7C57257903BBE73B2DBBC6E7104EB867 694272 ----a-w- C:\WINDOWS\SysWOW64\rpcrt4.dll 2014-08-13 07:35:08 9C464C1D692BADC68A56F103B228B9D9 1023488 ----a-w- C:\WINDOWS\SysWOW64\gdi32.dll 2014-08-13 07:35:00 A1E0D8F0F686C402B1F398227A4FDD05 8857600 ----a-w- C:\WINDOWS\SysWOW64\twinui.dll 2014-08-13 07:34:58 CD4AD60802EE2C6E6506018D42FE5236 2416128 ----a-w- C:\WINDOWS\SysWOW64\msi.dll 2014-08-13 07:34:55 CF11DC5D87D5FBF3EB2CDE3FC5580873 2037760 ----a-w- C:\WINDOWS\SysWOW64\authui.dll 2014-08-13 07:34:54 FC55D667EDC08B5D4157536A3F6C2641 295424 ----a-w- C:\WINDOWS\SysWOW64\msihnd.dll 2014-08-13 07:34:54 05B751A750FF7CD2164A1671AC65D23C 754176 ----a-w- C:\WINDOWS\SysWOW64\actxprxy.dll ====== C:\WINDOWS\SysWOW64\drivers ===== ====== C:\WINDOWS\Sysnative ===== 2014-08-13 09:01:51 CA887E878FB8CE16C4ACB2F0408D0F0B 712192 ----a-w- C:\WINDOWS\Sysnative\aepdu.dll 2014-08-13 09:01:50 39680DBF9A2A8AFEFE3F745461716133 556544 ----a-w- C:\WINDOWS\Sysnative\aeinv.dll 2014-08-13 07:53:44 6DBE73C09215E281F4283641144110A5 35480 ----a-w- C:\WINDOWS\Sysnative\TsWpfWrp.exe 2014-08-13 07:35:42 CC5B978B9A7EBFF2BB154A816554F51C 199680 ----a-w- C:\WINDOWS\Sysnative\cdd.dll 2014-08-13 07:35:28 90B1DA995893F25DE3438B152D29B089 19279872 ----a-w- C:\WINDOWS\Sysnative\mshtml.dll 2014-08-13 07:35:21 D1CC29A03CC49A819031527FEF5C20E0 15399936 ----a-w- C:\WINDOWS\Sysnative\ieframe.dll 2014-08-13 07:35:19 2DC29B4B1380BEE4412FF4BD2CFBEB7C 2655232 ----a-w- C:\WINDOWS\Sysnative\iertutil.dll 2014-08-13 07:35:19 0F57CF6FBA7331C01EF7732902EB544C 3959296 ----a-w- C:\WINDOWS\Sysnative\jscript9.dll 2014-08-13 07:35:17 F49B3E58C3812042D946551FA487A9FF 1407488 ----a-w- C:\WINDOWS\Sysnative\urlmon.dll 2014-08-13 07:35:16 A56400B83371EAD36B9E62FAF0546595 2240000 ----a-w- C:\WINDOWS\Sysnative\wininet.dll 2014-08-13 07:35:16 4FC4D8947E40600FB0B8A3171E3F5F4B 451584 ----a-w- C:\WINDOWS\Sysnative\dxtmsft.dll 2014-08-13 07:35:15 F0E9B12CB933FB1594907D05C963F3D2 281600 ----a-w- C:\WINDOWS\Sysnative\dxtrans.dll 2014-08-13 07:35:15 6A025A6C2D17C325B76FCFC5A9B7DE91 855552 ----a-w- C:\WINDOWS\Sysnative\jscript.dll 2014-08-13 07:35:15 2F12547498513DDAE30713753C05B728 1508864 ----a-w- C:\WINDOWS\Sysnative\inetcpl.cpl 2014-08-13 07:35:15 19FD12A3AF7E0262282AF4F028504F0E 603136 ----a-w- C:\WINDOWS\Sysnative\msfeeds.dll 2014-08-13 07:35:14 A15BACAC115B922F246750770D2378E3 915968 ----a-w- C:\WINDOWS\Sysnative\uxtheme.dll 2014-08-13 07:35:14 0E62277BD6441508410372DCC43A2DB5 97280 ----a-w- C:\WINDOWS\Sysnative\mshtmled.dll 2014-08-13 07:35:13 AC351C1ECAD2701E06F96ABFAB02B773 136704 ----a-w- C:\WINDOWS\Sysnative\iesysprep.dll 2014-08-13 07:35:12 E9E4DB15809472C8F8E211F9F080FCC1 53760 ----a-w- C:\WINDOWS\Sysnative\jsproxy.dll 2014-08-13 07:35:12 ADF4159B1C39869B46AE1E8F0E6D7F65 197120 ----a-w- C:\WINDOWS\Sysnative\msrating.dll 2014-08-13 07:35:12 93F27C7FD64D0E3CDB7454ACF28F160B 255488 ----a-w- C:\WINDOWS\Sysnative\iedkcs32.dll 2014-08-13 07:35:12 8F90D2E05A51C76EA423902B5C4DD6FF 53760 ----a-w- C:\WINDOWS\Sysnative\UXInit.dll 2014-08-13 07:35:12 334C98698434D534E82FE6C7AF8E2531 67072 ----a-w- C:\WINDOWS\Sysnative\iesetup.dll 2014-08-13 07:35:12 3013C41E885F370F75F297A0415611C1 51712 ----a-w- C:\WINDOWS\Sysnative\ie4uinit.exe 2014-08-13 07:35:12 21FE64FECC172DD1D159936B6C983750 39936 ----a-w- C:\WINDOWS\Sysnative\iernonce.dll 2014-08-13 07:35:11 283DD1D3C3E9D0B3D258BC6610540E80 2706432 ----a-w- C:\WINDOWS\Sysnative\mshtml.tlb 2014-08-13 07:35:10 F39B36FC340ED4F322E0FB41FC7307BA 1312768 ----a-w- C:\WINDOWS\Sysnative\rpcrt4.dll 2014-08-13 07:35:09 67DD4FFD6AE0F380E473BAFE002728BC 4035072 ----a-w- C:\WINDOWS\Sysnative\win32k.sys 2014-08-13 07:35:08 A5F88AEFDE2AB3C7B3215B30122754E8 1300992 ----a-w- C:\WINDOWS\Sysnative\gdi32.dll 2014-08-13 07:35:01 4079B9196F0353E57EFBB5E16B5727C0 10116608 ----a-w- C:\WINDOWS\Sysnative\twinui.dll 2014-08-13 07:34:59 DE5D9300DAE9279D6554E5875A079093 2146304 ----a-w- C:\WINDOWS\Sysnative\actxprxy.dll 2014-08-13 07:34:59 60B4FDF22A85713621E6528E68CD8FC9 2885632 ----a-w- C:\WINDOWS\Sysnative\msi.dll 2014-08-13 07:34:58 1BE70D6051837B74BCD06DCE040F102E 2306560 ----a-w- C:\WINDOWS\Sysnative\authui.dll 2014-08-13 07:34:54 B8CDF3317BD77FCF8C798EEB9DEFC5C9 393216 ----a-w- C:\WINDOWS\Sysnative\msihnd.dll 2014-08-13 07:34:54 65DF4D0333CFC7AE430F5D210F77F4CE 112984 ----a-w- C:\WINDOWS\Sysnative\consent.exe ====== C:\WINDOWS\Sysnative\drivers ===== 2014-08-13 09:07:07 58CC013EFA9893057160EDA018D8ADCE 71168 ----a-w- C:\WINDOWS\Sysnative\drivers\hdaudbus.sys 2014-08-13 07:35:42 2BB5627EB587FA995086C3D8C21B6D3F 1453400 ----a-w- C:\WINDOWS\Sysnative\drivers\dxgkrnl.sys 2014-08-13 07:34:51 E7E9DBFDD3F25ED0C05B99AE9FA18BDE 94552 ----a-w- C:\WINDOWS\Sysnative\drivers\mountmgr.sys 2014-08-13 07:34:51 05FACF485F44D1B70E35551D7BB668ED 328024 ----a-w- C:\WINDOWS\Sysnative\drivers\Classpnp.sys ====== C:\WINDOWS\Tasks ====== ====== C:\WINDOWS\Temp ====== ======= C:\Program Files ===== 2014-08-22 12:23:22 -------- d-----w- C:\Program Files\trend micro ======= C:\PROGRA~2 ===== ======= C: ===== ====== C:\Users\AppData\Roaming ====== ====== C:\Users\ ====== ====== C: exe-files == 2014-08-22 12:23:23 9A2347903D6EDB84C10F288BC0578C1C 388608 ----a-w- C:\Program Files\trend micro.exe === C: other files == ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-21-2625877825-4005762824-1239777394-1001\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress8"="C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Quick Launch"="C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" "Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "BtTray"="C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress8"="C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exe" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\Windows\system32\igfxtray.exe" "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" "Persistence"="C:\Windows\system32\igfxpers.exe" "BCSSync"="C:\Program Files\Microsoft Office\Office14\BCSSync.exe /DelayServices" "SysTrayApp"="C:\Program Files\IDT\WDM\sttray64.exe" "SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe " [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "NCPluginUpdater"="C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe Update" ==== Task Scheduler Jobs ====================== C:\WINDOWS\tasks\HPCeeScheduleForkashh.job --a-------- C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [13-09-2010 22:15] ==== Other Scheduled Tasks ====================== "C:\WINDOWS\SysNative\tasks\CLMLSvc_P2G8" [C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe] "C:\WINDOWS\SysNative\tasks\CLVDLauncher" [C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe] "C:\WINDOWS\SysNative\tasks\CreateChoiceProcessTask" [C:\Windows\BrowserChoice\browserchoice.exe] "C:\WINDOWS\SysNative\tasks\HPCeeScheduleForkashh" [C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe] "C:\WINDOWS\SysNative\tasks\MirageAgent" [C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe] "C:\WINDOWS\SysNative\tasks\Norton WSC Integration" ["C:\Program Files (x86)\Norton Internet Security\Engine\21.3.0.12\WSCStub.exe"] "C:\WINDOWS\SysNative\tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon" [C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe] "C:\WINDOWS\SysNative\tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe] "C:\WINDOWS\SysNative\tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe] "C:\WINDOWS\SysNative\tasks\Hewlett-Packard\HP Support Assistant\Update Check" [C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe] "C:\WINDOWS\SysNative\tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_backup" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe] "C:\WINDOWS\SysNative\tasks\Norton Internet Security\Norton Error Analyzer" [C:\Program Files (x86)\Norton Internet Security\Engine\21.3.0.12\SymErr.exe] "C:\WINDOWS\SysNative\tasks\Norton Internet Security\Norton Error Processor" [C:\Program Files (x86)\Norton Internet Security\Engine\21.3.0.12\SymErr.exe] "C:\WINDOWS\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.nl/" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.nl/" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" {012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS" {D944BB61-2E34-4DBF-A683-47E505C587DC} eBay Url="http://rover.ebay.com/rover/1/1346-154357-12126-2/4?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}" ==== HijackThis Entries ====================== F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll O4 - HKLM\..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [BtTray] "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe" O4 - HKCU\..\Run: [Power2GoExpress8] "C:\Program Files (x86)\CyberLink\Power2Go8\Power2GoExpress8.exe" O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105 O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000 O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra button: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: &Gekoppelde notities van OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\SysWow64\skype4com.dll O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing) O23 - Service: BlueSoleilCS - IVT Corporation - C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BsHelpCS - IVT Corporation - C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing) O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe O23 - Service: @oem22.inf,%hpservice_desc%;HP Service (hpsrv) - Unknown owner - C:\WINDOWS\system32\Hpservice.exe (file missing) O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing) O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10101 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing) O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) ==== Empty IE Cache ====================== C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\L5EWH4EZ will be deleted at reboot ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== No Chrome User Data found ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== No Java Cache Found ==== C:\zoek_backup content ====================== C:\zoek_backup (files=52 folders=43 2683345 bytes) ==== Empty Temp Folders ====================== C:\Users\Administrator\AppData\Local\Temp emptied successfully C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\AppData\Local\Temp will be emptied at reboot C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\WINDOWS\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\WINDOWS\Temp successfully emptied C:\Users\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Users\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\L5EWH4EZ" not found ==== EOF on vr 22-08-2014 at 21:27:20,16 ======================