Zoek.exe v5.0.0.0 Updated 24-12-2014 Tool run by Gebruiker on vr 26-12-2014 at 0:46:13.45. Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64 Running in: Normal Mode Internet Access Detected Launched: D:\Users\Gebruiker\Downloads\zoek (2).exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 26-12-2014 0:48:17 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\Users\Gebruiker\AppData\Local\CutePDF Writer deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1CB99435-A192-496E-BC8C-2526E5ADF2C6} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1CB99435-A192-496E-BC8C-2526E5ADF2C6} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{30000515-C0AF-40FE-9B30-60A636BAC8EC} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{30000515-C0AF-40FE-9B30-60A636BAC8EC} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{341EC7C5-DFF4-4DCC-827E-86F29DD6E2FB} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{341EC7C5-DFF4-4DCC-827E-86F29DD6E2FB} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{34297968-6250-4F02-A82A-3B55AF2A12D} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{34297968-6250-4F02-A82A-3B55AF2A12D} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3A78CBBC-3755-421F-83BB-1F70AE3C1B7B} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3A78CBBC-3755-421F-83BB-1F70AE3C1B7B} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4720F0FE-4314-4DD3-AEB2-F93A4B1467A0} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4720F0FE-4314-4DD3-AEB2-F93A4B1467A0} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72BAA9F1-9657-4914-AEDB-5666481A67AA} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{72BAA9F1-9657-4914-AEDB-5666481A67AA} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80BB7EF7-DFAA-4AA7-B046-506DE282244} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80BB7EF7-DFAA-4AA7-B046-506DE282244} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C78A822-B814-4532-8B8B-96E0D8815615} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C78A822-B814-4532-8B8B-96E0D8815615} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5F29391-2D57-4197-8F82-13D4E25E196A} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5F29391-2D57-4197-8F82-13D4E25E196A} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BBE8BB7A-B571-4060-AE71-4F18807EF9} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BBE8BB7A-B571-4060-AE71-4F18807EF9} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BDFB8647-7871-4E01-A9D7-96FA6CBAD636} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BDFB8647-7871-4E01-A9D7-96FA6CBAD636} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CD116343-EBF6-497D-889D-61F53C80943C} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CD116343-EBF6-497D-889D-61F53C80943C} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D038B4A4-5CB0-4796-B2A4-E6B9F75F70E0} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D038B4A4-5CB0-4796-B2A4-E6B9F75F70E0} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1FFBB1C-B9D-4536-9D78-3715761FC69} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1FFBB1C-B9D-4536-9D78-3715761FC69} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DA0DA653-AF5A-4C4C-B1D3-A8BA855F3617} deleted successfully HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DA0DA653-AF5A-4C4C-B1D3-A8BA855F3617} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Running Processes ====================== C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe C:\Program Files (x86)\Skype\Phone\Skype.exe C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe C:\Program Files (x86)\Trust mouse utility\1.0\mouse32a.exe C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Program Files (x86)\Google\Update\GoogleUpdate.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe D:\Users\Gebruiker\Downloads\zoek (2).exe C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==== Deleting Services ====================== ==== Deleting Files \ Folders ====================== C:\Users\Gebruiker\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 deleted C:\Users\Gebruiker\AppData\Roaming\appdataFr2.bin deleted C:\Users\Gebruiker\AppData\Local\adawarebp deleted C:\Windows\SysNative\config\systemprofile\Searches deleted "C:\PROGRA~3\Ad-Aware Browsing Protection\adawarebp.dll" deleted "C:\PROGRA~3\Ad-Aware Browsing Protection\adawarebp.exe" deleted "C:\PROGRA~3\Ad-Aware Browsing Protection" not deleted ==== System Specs ====================== Operating System: Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 64-bits Manufacturer: MICRO-STAR INTERNATIONAL CO.,LTD - Model: MS-7519 Install Date: 7-3-2014 10:50:52 Last Boot: 26-12-2014 0:00:01 Processor: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz Number of Processors: 2 Work Station Bootmode: Normal boot Total RAM: 4095 MB (free 2628 MB - 64) Computername: GEBRUIKER-PC Domain: WORKGROUP User: Gebruiker (Non-Administrator account) Local Disk: C:\ - NTFS - 224 GB (free 138 GB) Local Disk: D:\ - NTFS - 241 GB (free 203 GB) CD \ DVD Drive: E:\ CD \ DVD Drive: F:\ Removable Disk: G:\ - - GB (free GB) Removable Disk: H:\ - - GB (free GB) Removable Disk: I:\ - - GB (free GB) Removable Disk: J:\ - - GB (free GB) Bootdevice: \Device\HarddiskVolume1 Windows update: Country: Nederland Language: NLD ==== System Specs (Software) ====================== Anti-Virus: Emsisoft Anti-Malware On-access scanning disabled (Outdated) Anti-Spyware: Windows Defender disabled (Outdated) Anti-Spyware: Emsisoft Anti-Malware disabled (Outdated) Default Browser: Google Chrome 36.0.1985.143 Internet Explorer Version: 10.0.9200.17183 Google Chrome version: 36.0.1985.143 Adobe Reader version: 11.0.10.32 ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\GEBRUI~1\AppData\Local\Temp ==== ====== Java Cache ===== ====== C:\Windows\SysWOW64 ===== ====== C:\Windows\SysWOW64\drivers ===== ====== C:\Windows\Sysnative ===== ====== C:\Windows\Sysnative\drivers ===== 2014-12-10 08:39:00 70988118145F5F10EF24720B97F35F65 119296 ----a-w- C:\Windows\Sysnative\drivers\tdx.sys ====== C:\Windows\Tasks ====== 2014-12-25 23:01:35 B63AD96D5AB77552EFDB7D2277C3B0CB 3886 ----a-w- C:\Windows\Sysnative\Tasks\Adobe Acrobat Update Task ====== C:\Windows\Temp ====== ======= C:\Program Files ===== ======= C:\PROGRA~2 ===== ======= C: ===== ====== C:\Users\Gebruiker\AppData\Roaming ====== 2014-12-24 11:07:15 -------- d-----w- C:\Windows\sysWoW64\config\systemprofile\AppData\Roaming\Dropbox ====== C:\Users\Gebruiker ====== 2014-12-23 13:11:07 -------- d-----w- C:\ProgramData\Lavasoft ====== C: exe-files == 2014-12-25 23:01:27 516C021FEBEDE2962C9252DF85606C76 382168 ----a-w- C:\ProgramData\Adobe\ARM\S\24660\AdobeARMHelper.exe 2014-12-19 07:48:18 FC5B75CA6A1DA31EDD4F8D53F5540B98 81088 ----a-w- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 2014-12-19 07:48:18 3E04F1E482357B1FC8B088197C3D9FF8 1022152 ----a-w- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2014-12-19 07:48:18 31657ADA786863B73FAC28E5BD0753AD 382168 ----a-w- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe === C: other files == ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1000\Software\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun" [HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun" "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-21-1243184377-1695436347-1374857548-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "FLMTRUSTMOUSE"="C:\Program Files (x86)\Trust mouse utility\1.0\mouse32a.exe" "ArcSoft Connection Service"="C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" "Ad-Aware Browsing Protection"="C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" "HP Software Update"="C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe" "emsisoft anti-malware"="c:\program files (x86)\emsisoft anti-malware\a2guard.exe /d=60" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s" "AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" "EvtMgr6"="C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming" ==== Startup Folders ====================== 2014-03-10 12:15:54 1966 ----a-w- C:\Users\Gebruiker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Inktwaarschuwingen controleren - HP Deskjet 3050A J611 series.lnk ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ [Undetermined Task] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ [Undetermined Task] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ [Undetermined Task] C:\Windows\tasks\HP Photo Creations Messager.job --a------ [Undetermined Task] C:\Windows\tasks\WpsNotifyTask_Gebruiker.job --a------ [Undetermined Task] C:\Windows\tasks\WpsUpdateTask_Gebruiker.job --a------ [Undetermined Task] ==== Other Scheduled Tasks ====================== "C:\Windows\SysNative\tasks\Adobe Acrobat Update Task" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\SysNative\tasks\AdobeAAMUpdater-1.0-Gebruiker-PC-Gebruiker" [C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe] "C:\Windows\SysNative\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\Windows\SysNative\tasks\HP Photo Creations Messager" [C:\ProgramData\HP Photo Creations\MessageCheck.exe] "C:\Windows\SysNative\tasks\HPCustParticipation HP Deskjet 3050A J611 series" ["C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe"] "C:\Windows\SysNative\tasks\User_Feed_Synchronization-{A1FB8921-779B-4911-B1A1-D6976E0949A5}" [C:\Windows\system32\msfeedssync.exe] "C:\Windows\SysNative\tasks\WpsNotifyTask_Gebruiker" [C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsnotify.exe] "C:\Windows\SysNative\tasks\WpsUpdateTask_Gebruiker" [C:\Program Files (x86)\Kingsoft\Kingsoft Office\wtoolex\wpsupdate.exe] "C:\Windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions] "belgiumeid@eid.belgium.be"="C:\Program Files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be" [] ==== Chromium Look ====================== Google Chrome Version: 36.0.1985.143 (Possible outdated, latest Stable version: 39.0.2171.95) Google Wallet - Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda ==== Chromium Fix ====================== C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.superfish.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_www.superfish.com_0.localstorage-journal deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_vacatures.trovit.nl_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_vacatures.trovit.nl_0.localstorage-journal deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.audienceinsights.net_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.audienceinsights.net_0.localstorage-journal deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_services.hearstmags.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_answers.nl.softonic.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_answers.nl.softonic.com_0.localstorage-journal deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_microsoft-office-2010.nl.softonic.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_microsoft-office-2010.nl.softonic.com_0.localstorage-journal deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_openoffice-org.nl.softonic.com_0.localstorage deleted successfully C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_openoffice-org.nl.softonic.com_0.localstorage-journal deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] No DefaultScope Set For HKCU New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes {012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully ==== HijackThis Entries ====================== F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll O4 - HKLM\..\Run: [FLMTRUSTMOUSE] C:\Program Files (x86)\Trust mouse utility\1.0\mouse32a.exe O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [emsisoft anti-malware] "c:\program files (x86)\emsisoft anti-malware\a2guard.exe" /d=60 O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-21-1243184377-1695436347-1374857548-1003\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser') O4 - HKUS\S-1-5-21-1243184377-1695436347-1374857548-1003\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser') O4 - Startup: Inktwaarschuwingen controleren - HP Deskjet 3050A J611 series.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Emsisoft Protection Service (a2AntiMalware) - Emsisoft GmbH - C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe O23 - Service: Adobe Active File Monitor V9 (AdobeActiveFileMonitor9.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) ==== Empty IE Cache ====================== C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Gebruiker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\Gebruiker\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== No Java Cache Found ==== C:\zoek_backup content ====================== C:\zoek_backup (files=49 folders=17 20072081 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\Gebruiker\AppData\Local\Temp will be emptied at reboot C:\Users\UpdatusUser\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\GEBRUI~1\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\PROGRA~3\Ad-Aware Browsing Protection" not found ==== EOF on vr 26-12-2014 at 1:13:09.41 ======================