Zoek.exe v5.0.0.0 Updated 31-12-2014 Tool run by Eigenaar on di 06/01/2015 at 8:07:47,84. Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x86 Running in: Normal Mode Internet Access Detected Launched: C:\Users\Eigenaar\Downloads\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 6/01/2015 8:09:39 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\Program Files\Malwarebytes' Anti-Malware deleted successfully C:\Program Files\MSXML 4.0 deleted successfully C:\PROGRA~2\Browser Manager deleted successfully C:\Users\Eigenaar\AppData\Roaming\Malwarebytes deleted successfully C:\Users\Eigenaar\AppData\Local\Conduit deleted successfully C:\Users\Eigenaar\AppData\Local\VirtualStore deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E1670F2-143E-46FE-ABB3-C6C5B9EBFE55} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C115EDE-7BB6-40AC-8279-ABDE3BA5DE9E} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{78357B71-F6EB-4F1A-A35A-9691EB16B9D} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A41C2BDF-C70D-438E-95AB-90DFF7A7759C} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A973D27F-81BF-4E4D-8DCC-A26F9CFEEC8A} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AF6879FC-F075-4EEF-A5F6-81DD96F62226} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9F899F3-F447-4835-BE97-5F339FCDF5AA} deleted successfully HKEY_USERS\S-1-5-21-2609688871-382992579-768947782-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DCEAE8C8-8A8C-4B73-8E61-AC0D7AD1498} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_CLASSES_ROOT\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] ""=- "mobilegeni daemon"=- ==== Deleting Files \ Folders ====================== C:\Program Files\Common Files\DVDVideoSoft not found C:\Program Files\Mobogenie deleted C:\Users\Eigenaar\AppData\LocalLow\Conduit deleted C:\Users\Eigenaar\daemonprocess.txt deleted C:\Users\Eigenaar\.android deleted C:\Program Files\Conduit deleted C:\install_flashplayer11x32ax_gtba_chra_dy_aaa_aih.exe deleted C:\install_reader11_nl_gtbd_chrd_dn_aaa_aih.exe deleted C:\Users\Eigenaar\AppData\Roaming\DownLite deleted C:\PROGRA~2\APN deleted C:\Users\Eigenaar\AppData\Local\Mobogenie deleted C:\Users\Eigenaar\AppData\Local\cache deleted C:\Users\Eigenaar\AppData\Local\Cool_Mirage deleted C:\Windows\system32\tasks\PutLockerDownloader V6.0-codedownloader deleted C:\components deleted C:\Windows\system32\config\systemprofile\Searches deleted C:\Users\Eigenaar\Documents\Mobogenie deleted C:\Users\Eigenaar\Documents\Add-in Express deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\Eigenaar\AppData\Local\Temp ==== ====== Java Cache ===== ====== C:\Windows\system32 ===== 2015-01-05 09:09:30 742BD1F196FEFC94A6379BA039D3CD00 96680 ----a-w- C:\Windows\System32\WindowsAccessBridge.dll ====== C:\Windows\system32\drivers ===== 2014-12-11 11:29:30 7FE680A3DFA421C4A8E4879AE4C5AAB0 74752 ----a-w- C:\Windows\System32\drivers\tdx.sys ====== C:\Windows\Tasks ====== 2015-01-05 08:56:50 20FE14A352F2F12C82F5CA487B8E2BAC 3168 ----a-w- C:\Windows\system32\Tasks\{FB3BF06A-6061-4F81-A89A-3BB220B056DD} 2014-12-26 15:57:44 EA6781100621D1D717973A5CE501993F 3358 ----a-w- C:\Windows\system32\Tasks\HP Photo Creations Communicator 2014-12-26 15:57:44 330E49E27D18048AB8BEB2DCF33831D0 344 ----a-w- C:\Windows\Tasks\HP Photo Creations Communicator.job ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2015-01-05 17:08:03 -------- d-----w- C:\Program Files\trend micro 2015-01-05 09:09:39 -------- d-----w- C:\Program Files\Common Files\Java 2014-12-26 15:57:33 -------- d-----w- C:\Program Files\HP Photo Creations ======= C: ===== ====== C:\Users\Eigenaar\AppData\Roaming ====== 2014-12-26 15:59:04 -------- d-----w- C:\Users\Eigenaar\AppData\Roaming\Visan 2014-12-23 20:53:09 66786471CA690B0E4C1305D8557276CE 161960 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\FontCache3.0.0.0.dat ====== C:\Users\Eigenaar ====== 2015-01-05 17:07:46 8685FAF50C04F9A9C2F56FF64B0B7ACB 1107968 ----a-w- C:\Users\Eigenaar\Downloads\RSIT.exe 2015-01-05 09:09:20 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-01-05 09:02:24 3A582BF6FD39DC6A52AAF316126B40BA 638888 ----a-w- C:\Users\Eigenaar\Downloads\chromeinstall-8u25 (1).exe 2015-01-05 08:54:47 3A582BF6FD39DC6A52AAF316126B40BA 638888 ----a-w- C:\Users\Eigenaar\Downloads\chromeinstall-8u25.exe 2014-12-26 15:57:33 -------- d-----w- C:\ProgramData\Visan 2014-12-26 15:57:33 -------- d-----w- C:\ProgramData\HP Photo Creations 2014-12-26 15:54:36 5405DCBDD1105D7A645C483E9A7DAA97 43244864 ----a-w- C:\Users\Eigenaar\Downloads\hppc-hpcom.12992.exe ====== C: exe-files == 2015-01-05 17:08:03 9A2347903D6EDB84C10F288BC0578C1C 388608 ----a-w- C:\Program Files\trend micro\Eigenaar.exe 2015-01-05 17:07:46 8685FAF50C04F9A9C2F56FF64B0B7ACB 1107968 ----a-w- C:\Users\Eigenaar\Downloads\RSIT.exe 2015-01-05 09:09:22 AA3520FB0133A56BEE1DB34D74DBEF64 0 ----a-we C:\ProgramData\Oracle\Java\javapath\java.exe 2015-01-05 09:09:22 75D477E868CA51EC1B09D730570F322B 0 ----a-we C:\ProgramData\Oracle\Java\javapath\javaw.exe 2015-01-05 09:09:22 691D49FB44EDE9788288CABE4F7E0DAF 0 ----a-we C:\ProgramData\Oracle\Java\javapath\javaws.exe 2015-01-05 09:09:11 DC197DCE6325CBAC905DE0D0E3BA3E8E 15784 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\rmid.exe 2015-01-05 09:09:11 67F763B09F4BC8689E6FA9761E068D74 159656 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\unpack200.exe 2015-01-05 09:09:11 57E1F756FAA787623DFCD2C1B2AACC68 51112 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\ssvagent.exe 2015-01-05 09:09:11 33D2AF53E209DA3E2BA939EB89801DC0 16296 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\rmiregistry.exe 2015-01-05 09:09:11 29E65AC6AFD8A0A9CAA361FF6F7B4886 16296 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\servertool.exe 2015-01-05 09:09:11 28FC00F89631B0F6E1E9CA386FADD566 16296 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\tnameserv.exe 2015-01-05 09:09:10 E3E6B18458FFB07CB24D7A0BA77C9FDF 15784 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\pack200.exe 2015-01-05 09:09:10 7AB1F1B3FB6C3DACA34EA2F988CDF5AC 16296 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\orbd.exe 2015-01-05 09:09:10 75EE99C7F0038C746D82C76221ECA4EF 16296 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\policytool.exe 2015-01-05 09:09:09 B719E0F43166037DF46B5CFBE60A5118 15784 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\jjs.exe 2015-01-05 09:09:09 A458E2535E46151690E53E2A03FAA711 15784 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\keytool.exe 2015-01-05 09:09:09 9BFAEF308D50779F6B255CB7BA7DCA5A 15784 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\kinit.exe 2015-01-05 09:09:09 4367C05B0CF5553E71B34F51003D0615 76200 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\jp2launcher.exe 2015-01-05 09:09:09 4109C4DB4BD48F5BF8115C7523A6B6F8 15784 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\klist.exe 2015-01-05 09:09:09 26C7F32186B1F0364CD06EA69227A79D 15784 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\ktab.exe 2015-01-05 09:09:08 75D477E868CA51EC1B09D730570F322B 176552 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\javaw.exe 2015-01-05 09:09:08 691D49FB44EDE9788288CABE4F7E0DAF 272296 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\javaws.exe 2015-01-05 09:09:07 BB8C890E3E6372F2720709262BD42BF4 30632 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\jabswitch.exe 2015-01-05 09:09:07 AA3520FB0133A56BEE1DB34D74DBEF64 176552 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\java.exe 2015-01-05 09:09:07 74713E9C1B01B152DDD3A1A3519A3647 15784 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\java-rmi.exe 2015-01-05 09:09:07 70E67429D2C011FD0419AF899A8D0D70 68520 ----a-w- C:\Program Files\Java\jre1.8.0_25\bin\javacpl.exe 2015-01-05 09:02:24 3A582BF6FD39DC6A52AAF316126B40BA 638888 ----a-w- C:\Users\Eigenaar\Downloads\chromeinstall-8u25 (1).exe 2015-01-05 08:54:47 3A582BF6FD39DC6A52AAF316126B40BA 638888 ----a-w- C:\Users\Eigenaar\Downloads\chromeinstall-8u25.exe === C: other files == 2015-01-05 09:09:12 CE44A9D4918DCDC7CCCF5503BF4D7A3D 14130 ----a-w- C:\Program Files\Java\jre1.8.0_25\lib\deploy\ffjcext.zip ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\Windows\system32\igfxtray.exe" "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" "Persistence"="C:\Windows\system32\igfxpers.exe" "MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey" "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" ==== Startup Folders ====================== 2013-01-06 09:49:50 2069 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [10/12/2014 19:17] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [19/11/2013 18:56] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [19/11/2013 18:56] C:\Windows\tasks\HP Photo Creations Communicator.job --a------ C:\ProgramData\HP Photo Creations\Communicator.exe [26/12/2014 16:58] ==== Other Scheduled Tasks ====================== "C:\Windows\system32\tasks\Adobe Flash Player Updater" [C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\system32\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\Windows\system32\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\HP Photo Creations Communicator" [C:\ProgramData\HP Photo Creations\Communicator.exe] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "smartwebprinting@hp.com"="C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3" [06/01/2013 10:51] [HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions] "smartwebprinting@hp.com"="C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3" [06/01/2013 10:51] ==== Chromium Look ====================== Google Docs - Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Google Wallet - Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Gmail - Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia Ask Toolbar - Eigenaar\AppData\Local\Torch\User Data\Default\Extensions\aaaalejpmnocmhmlbmlkjemekckoagne Torch Helper - Eigenaar\AppData\Local\Torch\User Data\Default\Extensions\lecpjhggilhbceadobnggaagnpfpafhg ==== Chromium Startpages ====================== C:\Users\Eigenaar\AppData\Local\Torch\User Data\Default\Preferences "homepage": "http://home.torchbrowser.com/?systemid=406&appid=287&ua=Torch", ==== Chromium Fix ====================== C:\Users\Eigenaar\AppData\Local\Torch\User Data\Default\Extensions\aaaalejpmnocmhmlbmlkjemekckoagne deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] not found New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes {012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\TVWiz deleted successfully ==== Empty IE Cache ====================== C:\Users\Eigenaar\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\Eigenaar\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\Eigenaar\AppData\Local\Torch\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=2127 folders=264 150779397 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\Eigenaar\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\Eigenaar\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== EOF on di 06/01/2015 at 8:32:43,04 ======================