Zoek.exe v5.0.0.0 Updated 29-11-2014 Tool run by hillebil on ma 01-12-2014 at 13:19:49,88. Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\hillebil\Downloads\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 1-12-2014 13:22:19 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\PROGRA~2\MSXML 4.0 deleted successfully C:\PROGRA~2\PC Speed Up deleted successfully C:\PROGRA~2\PC Tools deleted successfully C:\PROGRA~2\Pixum deleted successfully C:\PROGRA~2\PokerStars.EU deleted successfully C:\PROGRA~2\Raptr deleted successfully C:\PROGRA~2\Sony Ericsson deleted successfully C:\PROGRA~2\TornTV.com deleted successfully C:\Program Files\Google deleted successfully C:\Program Files\Symantec deleted successfully C:\PROGRA~3\Babylon deleted successfully C:\PROGRA~3\Sony Ericsson deleted successfully C:\Users\hillebil\AppData\Roaming\TP deleted successfully C:\Users\hillebil\AppData\Local\PackageAware deleted successfully C:\Users\hillebil\AppData\Local\PokerStars.EU deleted successfully C:\Users\hillebil\AppData\Local\TomTom deleted successfully C:\Users\hillebil\AppData\Local\Unity deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-3976547258-427986622-4025846072-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B939CF93-F2CB-443d-956C-DC523D85C9DB} deleted successfully HKEY_USERS\S-1-5-21-3976547258-427986622-4025846072-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B939CF93-F2CB-443d-956C-DC523D85C9DB} deleted successfully HKEY_USERS\S-1-5-21-3976547258-427986622-4025846072-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_USERS\S-1-5-21-3976547258-427986622-4025846072-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_USERS\S-1-5-21-3976547258-427986622-4025846072-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully HKEY_USERS\S-1-5-21-3976547258-427986622-4025846072-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully HKEY_CLASSES_ROOT\CLSID\{B939CF93-F2CB-443d-956C-DC523D85C9DB} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{B939CF93-F2CB-443d-956C-DC523D85C9DB} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B939CF93-F2CB-443d-956C-DC523D85C9DB} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B939CF93-F2CB-443d-956C-DC523D85C9DB} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{07BA1DA9-F501-4796-8728-74D1B91A6CD5} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} deleted successfully ==== Deleting Services ====================== ==== Registry Fix Code x64 ====================== Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B939CF93-F2CB-443d-956C-DC523D85C9DB}] [-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B939CF93-F2CB-443d-956C-DC523D85C9DB}] [-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}] [-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}] [HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run] "DATAMNGR"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=- ==== Deleting Files \ Folders ====================== C:\Program Files (x86)\PokerStars.EU not found C:\Program Files (x86)\Vuze_Remote deleted C:\Program Files (x86)\PokerStars deleted C:\PROGRA~3\100 deleted C:\PROGRA~3\Premium deleted C:\Users\hillebil\AppData\LocalLow\Conduit deleted C:\Users\hillebil\AppData\LocalLow\Vuze_Remote deleted C:\PROGRA~2\DealPly deleted C:\PROGRA~2\Gophoto.it deleted C:\Users\hillebil\AppData\Roaming\Babylon deleted C:\Users\hillebil\AppData\Roaming\DSite deleted C:\PROGRA~3\Partner deleted C:\PROGRA~3\boost_interprocess deleted C:\PROGRA~3\Codecv deleted C:\PROGRA~3\OberonGameConsole deleted C:\PROGRA~3\SoftSafe deleted C:\PROGRA~3\InstallMate deleted C:\PROGRA~3\Tarma Installer deleted C:\Users\hillebil\AppData\Local\CRE deleted C:\Users\hillebil\AppData\Local\TB deleted C:\Users\hillebil\AppData\Local\tbccint deleted C:\Users\hillebil\AppData\Local\NativeMessaging deleted C:\Users\hillebil\AppData\Local\Conduit deleted C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847} deleted C:\Users\hillebil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com deleted C:\windows\SysNative\Tasks\DSite deleted C:\Users\hillebil\AppData\LocalLow\TB deleted C:\Users\hillebil\AppData\LocalLow\wincorebsband deleted C:\Users\hillebil\AppData\LocalLow\mediabarbs deleted C:\Users\hillebil\AppData\LocalLow\DataMngr deleted C:\Users\hillebil\AppData\LocalLow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com deleted C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\AVG Secure Search deleted C:\windows\SysNative\tasks\QtraxPlayer deleted C:\Windows\tasks\DSite.job deleted C:\Windows\SysNative\config\systemprofile\Searches deleted "C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe" deleted "C:\PROGRA~2\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe" deleted "C:\Program Files (x86)\BearShare Applications" not deleted "C:\PROGRA~2\BearShare Applications" not deleted "C:\Program Files (x86)\BearShare Applications\MediaBar" not deleted "C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr" not deleted "C:\PROGRA~2\BearShare Applications\MediaBar" not deleted "C:\PROGRA~2\BearShare Applications\MediaBar\Datamngr" not deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== 2014-11-28 20:08:26 F5558C67A3ADB662D43D40A1CBDE4160 525792 ----a-w- C:\Windows\DIFxAPI.dll 2014-11-28 20:08:26 C7D17A96E08028FCAD7605F974547180 232272 ----a-w- C:\Windows\TmNSCIns.dll ====== C:\Users\hillebil\AppData\Local\Temp ==== 2014-11-28 20:15:19 430F0CA1C6E7FFCB5FB671D3C38450A2 7224 ----a-w- C:\Users\hillebil\AppData\Local\Temp\BullseyeCoverage-2-x86.dll 2014-11-28 20:03:14 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite37041.dll 2014-11-28 20:00:52 93A8F05221AC117089456674572134E4 348160 ----a-w- C:\Users\hillebil\AppData\Local\Temp\_unps.exe 2014-11-28 19:24:45 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite11193.dll 2014-11-28 19:15:46 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite55272.dll 2014-11-28 14:47:36 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite31017.dll 2014-11-27 18:27:49 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite38840.dll 2014-11-27 15:56:22 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite66920.dll 2014-11-27 15:50:55 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite96476.dll 2014-11-27 11:27:31 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite47229.dll 2014-11-27 11:18:37 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite99243.dll 2014-11-26 18:27:52 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite69486.dll 2014-11-26 18:27:40 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\hillebil\AppData\Local\Temp\System.Data.SQLite.dll 2014-11-26 17:35:16 C0FE25F036DBAD335A0227D4E7FA7511 28099 ----a-w- C:\Users\hillebil\AppData\Local\Temp\i4jdel1.exe 2014-11-26 17:32:38 DE395ADB369470A953A11B8C300697E2 35680 ----a-w- C:\Users\hillebil\AppData\Local\Temp\i4jdel0.exe ====== Java Cache ===== ====== C:\Windows\SysWOW64 ===== 2014-11-19 11:42:17 98B3C919C6B9C5F810FF2CAFA339822B 186880 ----a-w- C:\Windows\SysWOW64\pku2u.dll 2014-11-19 11:42:16 ADFB31FA72AFE0298A60BF4AC1045A42 550912 ----a-w- C:\Windows\SysWOW64\kerberos.dll ====== C:\Windows\SysWOW64\drivers ===== ====== C:\Windows\Sysnative ===== 2014-11-19 11:42:17 8A8CB073A4B9F9D97CFA8CA9C1C851CE 728064 ----a-w- C:\Windows\Sysnative\kerberos.dll 2014-11-19 11:42:17 1306E6A1BF4D506CD687DF9F947270F2 241152 ----a-w- C:\Windows\Sysnative\pku2u.dll ====== C:\Windows\Sysnative\drivers ===== 2014-11-12 18:39:20 41774FF331F609EF442B7398EE6202B1 155064 ----a-w- C:\Windows\Sysnative\drivers\ksecpkg.sys ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2014-11-29 13:34:26 -------- d-----w- C:\Program Files\trend micro 2014-11-29 11:34:14 -------- d-----w- C:\Program Files\Josip Medved ======= C:\PROGRA~2 ===== 2014-12-01 12:16:03 -------- d-----w- C:\PROGRA~2\COMMON~1\Java ======= C: ===== 2014-11-29 14:14:27 1DAB678B036F9CA39C9B55FF3A0B1916 3976 ----a-w- C:\{D9875994-1628-41B2-B8C5-257C5C89CDA3} 2014-11-28 22:39:37 068DF02AA23655E891B4682AB3323056 3816 ----a-w- C:\{9AACB2F9-25EF-407C-B2DB-AC59BF098905} 2014-11-28 21:40:53 17AFD34D94B25F08DC90E20424667D34 3976 ----a-w- C:\{9182C665-14AA-40F2-8837-BEEC8B5D8879} 2014-11-28 20:17:01 7ACB3A4935FCB012ADB811C73D96D4B2 3976 ----a-w- C:\{D4BA43E9-59FA-4A6D-86C1-EA79D652C654} ====== C:\Users\hillebil\AppData\Roaming ====== 2014-11-26 09:59:43 -------- d-sh--w- C:\Users\hillebil\AppData\Local\EmieBrowserModeList 2014-11-26 09:59:37 -------- d-sh--w- C:\Users\hillebil\AppData\Locallow\EmieBrowserModeList 2014-11-26 09:57:43 -------- d-----w- C:\Users\hillebil\AppData\Roaming\fotofabriekSoftware ====== C:\Users\hillebil ====== 2014-12-01 12:15:30 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-12-01 12:14:59 -------- d-----w- C:\ProgramData\Oracle 2014-12-01 12:09:58 92F975B07E65EF3AE67D89A016FDAACC 638888 ----a-w- C:\Users\hillebil\Downloads\JavaSetup8u25 (1).com 2014-12-01 12:09:46 92F975B07E65EF3AE67D89A016FDAACC 638888 ----a-w- C:\Users\hillebil\Downloads\JavaSetup8u25.com 2014-11-29 16:40:09 -------- d-----r- C:\Windows\SysNative\config\systemprofile\Documents 2014-11-26 09:57:54 -------- d-----w- C:\ProgramData\CodedColor Common 2014-11-26 09:54:44 9E333CC9504A09DE04FAEE07FC871658 59110520 ----a-w- C:\Users\hillebil\Downloads\publisher_setup.exe ====== C: exe-files == 2014-12-01 12:15:33 75D477E868CA51EC1B09D730570F322B 0 ----a-we C:\ProgramData\Oracle\Java\javapath\javaw.exe 2014-12-01 12:15:33 691D49FB44EDE9788288CABE4F7E0DAF 0 ----a-we C:\ProgramData\Oracle\Java\javapath\javaws.exe 2014-12-01 12:15:32 AA3520FB0133A56BEE1DB34D74DBEF64 0 ----a-we C:\ProgramData\Oracle\Java\javapath\java.exe 2014-12-01 12:15:09 E3E6B18458FFB07CB24D7A0BA77C9FDF 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\pack200.exe 2014-12-01 12:15:09 DC197DCE6325CBAC905DE0D0E3BA3E8E 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\rmid.exe 2014-12-01 12:15:09 BB8C890E3E6372F2720709262BD42BF4 30632 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\jabswitch.exe 2014-12-01 12:15:09 B719E0F43166037DF46B5CFBE60A5118 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\jjs.exe 2014-12-01 12:15:09 AA3520FB0133A56BEE1DB34D74DBEF64 176552 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\java.exe 2014-12-01 12:15:09 A458E2535E46151690E53E2A03FAA711 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\keytool.exe 2014-12-01 12:15:09 9BFAEF308D50779F6B255CB7BA7DCA5A 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\kinit.exe 2014-12-01 12:15:09 7AB1F1B3FB6C3DACA34EA2F988CDF5AC 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\orbd.exe 2014-12-01 12:15:09 75EE99C7F0038C746D82C76221ECA4EF 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\policytool.exe 2014-12-01 12:15:09 75D477E868CA51EC1B09D730570F322B 176552 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\javaw.exe 2014-12-01 12:15:09 74713E9C1B01B152DDD3A1A3519A3647 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\java-rmi.exe 2014-12-01 12:15:09 70E67429D2C011FD0419AF899A8D0D70 68520 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\javacpl.exe 2014-12-01 12:15:09 691D49FB44EDE9788288CABE4F7E0DAF 272296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\javaws.exe 2014-12-01 12:15:09 67F763B09F4BC8689E6FA9761E068D74 159656 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\unpack200.exe 2014-12-01 12:15:09 57E1F756FAA787623DFCD2C1B2AACC68 51112 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssvagent.exe 2014-12-01 12:15:09 4367C05B0CF5553E71B34F51003D0615 76200 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2launcher.exe 2014-12-01 12:15:09 4109C4DB4BD48F5BF8115C7523A6B6F8 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\klist.exe 2014-12-01 12:15:09 33D2AF53E209DA3E2BA939EB89801DC0 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\rmiregistry.exe 2014-12-01 12:15:09 29E65AC6AFD8A0A9CAA361FF6F7B4886 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\servertool.exe 2014-12-01 12:15:09 28FC00F89631B0F6E1E9CA386FADD566 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\tnameserv.exe 2014-12-01 12:15:09 26C7F32186B1F0364CD06EA69227A79D 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\bin\ktab.exe 2014-11-28 20:00:52 93A8F05221AC117089456674572134E4 348160 ----a-w- C:\Users\hillebil\AppData\Local\Temp\_unps.exe 2014-11-26 18:23:39 0E81DAAB0027837C05573277A681BD21 10282528 ------w- C:\Users\hillebil\AppData\Roaming\Azureus\tmp\AZU5944366834128298515.tmp\Vuze_5.4.0.0e_win32.exe 2014-11-26 17:35:16 C0FE25F036DBAD335A0227D4E7FA7511 28099 ----a-w- C:\Users\hillebil\AppData\Local\Temp\i4jdel1.exe 2014-11-26 17:32:38 DE395ADB369470A953A11B8C300697E2 35680 ----a-w- C:\Users\hillebil\AppData\Local\Temp\i4jdel0.exe 2014-11-26 09:54:44 9E333CC9504A09DE04FAEE07FC871658 59110520 ----a-w- C:\Users\hillebil\Downloads\publisher_setup.exe === C: other files == 2014-12-01 12:15:09 CE44A9D4918DCDC7CCCF5503BF4D7A3D 14130 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_25\lib\deploy\ffjcext.zip 2014-12-01 12:12:26 92F975B07E65EF3AE67D89A016FDAACC 638888 ----a-w- C:\Users\hillebil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N09D3ESH\JavaSetup8u25.com 2014-12-01 12:09:58 92F975B07E65EF3AE67D89A016FDAACC 638888 ----a-w- C:\Users\hillebil\Downloads\JavaSetup8u25 (1).com 2014-12-01 12:09:46 92F975B07E65EF3AE67D89A016FDAACC 638888 ----a-w- C:\Users\hillebil\Downloads\JavaSetup8u25.com 2014-11-29 18:20:14 EE07D99FD8F69807A3A1023AC24B7E7E 66149 ----a-w- C:\Users\hillebil\Downloads\shexview.zip 2014-11-26 17:00:46 659B53AEF329EDCCC76DB2E9AD92419D 9311665 ----a-w- C:\Users\hillebil\AppData\Local\Temp\Vuze_5.4.0.0e_win32.zip ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-21-3976547258-427986622-4025846072-1001\Software\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background" "ccleaner"="C:\Program Files\CCleaner\CCleaner64.exe /AUTO" "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "Unified Remote v2"="C:\Program Files (x86)\Unified Remote\RemoteServer.exe" "OfficeSyncProcess"="C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Nuance PDF Reader-reminder"="C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe -r C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini" "ASUSPRP"="C:\Program Files (x86)\ASUS\APRP\APRP.EXE" "ASUSWebStorage"="C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe /S" "SonicMasterTray"="C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" "ATKOSD2"="C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" "ATKMEDIA"="C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" "HControlUser"="C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" "Wireless Console 3"="C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe" "UpdateP2GoShortCut"="C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe C:\Program Files (x86)\CyberLink\Power2Go UpdateWithCreateOnce SOFTWARE\CyberLink\Power2Go\6.0" "BCSSync"="C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe /DelayServices" "SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background" "ccleaner"="C:\Program Files\CCleaner\CCleaner64.exe /AUTO" "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" "Unified Remote v2"="C:\Program Files (x86)\Unified Remote\RemoteServer.exe" "OfficeSyncProcess"="C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="c:\\windows\\syswow64\\nvinit.dll" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\Windows\system32\igfxtray.exe" "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" "Persistence"="C:\Windows\system32\igfxpers.exe" "RtHDVBg"="C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3 " "AmIcoSinglun64"="C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" "IntelTBRunOnce"="wscript.exe //b //nologo C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" "ETDCtrl"="%ProgramFiles%\Elantech\ETDCtrl.exe " ==== Startup Registry Disabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ASUS Screen Saver Protector] "command"="C:\\Windows\\AsScrPro.exe" "hkey"="HKLM" "item"="ASUS Screen Saver Protector" "key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CLMLServer] "command"="\"C:\\Program Files (x86)\\CyberLink\\Power2Go\\CLMLSvc.exe\"" "hkey"="HKLM" "item"="CLMLServer" "key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RtHDVCpl] "command"="C:\\Program Files\\Realtek\\Audio\\HDA\\RAVCpl64.exe -s" "hkey"="HKLM" "item"="RtHDVCpl" "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ==== Startup Folders ====================== 2011-12-22 14:08:39 1065 ----a-w- C:\Users\hillebil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel(R) Turbo Boost Technology Monitor 2.0.lnk ==== Other Scheduled Tasks ====================== "C:\Windows\SysNative\tasks\ACMON" [C:\Program Files (x86)\ASUS\Splendid\ACMON.exe] "C:\Windows\SysNative\tasks\AIRecoveryRemind" [C:\Program Files (x86)\ASUS\AI Recovery\AIRecoveryRemind.exe] "C:\Windows\SysNative\tasks\ASUS Live Update" [C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe] "C:\Windows\SysNative\tasks\ASUS P4G" [C:\Program Files\P4G\BatteryLife.exe] "C:\Windows\SysNative\tasks\ASUS SmartLogon Console Sensor" [C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe] "C:\Windows\SysNative\tasks\AsusVibeSchedule" ["C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe"] "C:\Windows\SysNative\tasks\ATKOSD2" [C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe] "C:\Windows\SysNative\tasks\Norton WSC Integration" ["C:\Program Files (x86)\Norton AntiVirus\Engine\20.4.0.40\WSCStub.exe"] "C:\Windows\SysNative\tasks\SidebarExecute" [C:\Program Files\Windows Sidebar\sidebar.exe] "C:\Windows\SysNative\tasks\Norton AntiVirus\Norton Error Analyzer" [C:\Program Files (x86)\Norton AntiVirus\Engine\20.4.0.40\SymErr.exe] "C:\Windows\SysNative\tasks\Norton AntiVirus\Norton Error Processor" [C:\Program Files (x86)\Norton AntiVirus\Engine\20.4.0.40\SymErr.exe] "C:\Windows\SysNative\tasks\Norton Identity Safe\Norton Error Analyzer" [C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe] "C:\Windows\SysNative\tasks\Norton Identity Safe\Norton Error Processor" [C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe] "C:\Windows\SysNative\tasks\Norton Management\Norton Error Analyzer" [C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\SymErr.exe] "C:\Windows\SysNative\tasks\Norton Management\Norton Error Processor" [C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\SymErr.exe] "C:\Windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions] "{BBDA0591-3099-440a-AA10-41764D9DB4DB}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\IPSFF" [12-10-2013 09:33] ==== Chromium Look ====================== Norton Identity Safe - hillebil\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif Vuze Remote - hillebil\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpijjmpahflnipadmlpgbjmagmjchkk Torlock.com Verified Torrent Search - hillebil\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjoddcgdinehllagbcombdafjhcobpdd ==== Chromium Fix ====================== C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_toolbar.avg.com_0.localstorage-journal deleted successfully C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_huizen.trovit.nl_0.localstorage-journal deleted successfully C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www1.delta-search.com_0.localstorage-journal deleted successfully C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpijjmpahflnipadmlpgbjmagmjchkk deleted successfully C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ojpijjmpahflnipadmlpgbjmagmjchkk_0.localstorage deleted successfully C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ojpijjmpahflnipadmlpgbjmagmjchkk_0.localstorage-journal deleted successfully C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ojpijjmpahflnipadmlpgbjmagmjchkk_0 deleted successfully C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojpijjmpahflnipadmlpgbjmagmjchkk deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}] not found New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes {012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Unknown Url="Not_Found" ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-3976547258-427986622-4025846072-1001\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{432D59F4-3636-F453-84CC-D41B9227D0C1} deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4887B48D-E8AB-452D-3685-265E2EED3D59} deleted successfully HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5F2F2929-3805-4752-A5B9-702784CC0BDF} deleted successfully ==== Empty IE Cache ====================== C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\hillebil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\hillebil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N09D3ESH will be deleted at reboot ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\hillebil\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=899 folders=236 80798025 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\hillebil\AppData\Local\Temp will be emptied at reboot C:\Users\UpdatusUser\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\hillebil\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Program Files (x86)\BearShare Applications" not found "C:\PROGRA~2\BearShare Applications" not found "C:\Users\hillebil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N09D3ESH" deleted ==== EOF on ma 01-12-2014 at 14:03:14,24 ======================