Zoek.exe v5.0.0.0 Updated 31-12-2014 Tool run by PATRICK on di 06/01/2015 at 9:45:01,83. Microsoft Windows 8.1 6.3.9600 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\PATRICK\Downloads\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 6/01/2015 9:46:15 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\PROGRA~3\CanonEPP deleted successfully C:\PROGRA~3\CanonIJEPPEX2 deleted successfully C:\Users\PATRICK\AppData\Local\MediaShow deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08c7c29a-564e-4be1-8b3f-1ef9d4ce45e5} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{133600F6-E9C1-4A7A-BB33-51E53C5AB685} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{181B8A26-E9AB-4751-849D-BE9DDBF9593A} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1AAD2BC3-9857-4AE9-B9C2-B6C449686CA7} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1bb21050-f8ad-4162-811c-c17d8e9f4ec0} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4037B1AE-F35F-43E5-AEE9-BA53DD9B7F27} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5BC7ED7A-8F87-4126-A581-C9D57433C535} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{73f4703d-05c2-4e2c-929f-cd1db1dae9a5} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7EA2BBEF-6961-41DC-A38A-6596B2B4574C} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{814F1C48-E6DB-432A-8CA5-9AD41D6FA825} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{84fe7e4f-eb50-42fe-b127-ac480eb887c6} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8F106CBC-B185-4C52-9512-20EAA03018F6} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{94da54d2-e05b-4b1d-aea7-5537150d909b} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95eeddad-75bc-4826-afa9-92bb36646741} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A88A4A80-919F-460A-8027-1096F49FC03F} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC077623-33AA-4E3E-BD3D-96AA36D85AE1} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d031418f-6ccb-4a2f-92d3-7604913b8836} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E166635E-46E-4549-AA1A-F2ACB6C7B32} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E99EAE0F-3D88-447C-BB5-DCC363F2529D} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eaca7357-2c47-4b31-af13-111fd1dfe7b9} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F4F9EB17-8682-4091-8F17-8C5F39D79383} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FAC98F56-C8A2-45C4-ADD1-38B423C4B289} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FBAAB78D-8359-43B5-9DE0-A3A810B8D869} deleted successfully HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FEB3BD14-455C-4944-86CF-ACA72892C3} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08c7c29a-564e-4be1-8b3f-1ef9d4ce45e5} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1bb21050-f8ad-4162-811c-c17d8e9f4ec0} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{73f4703d-05c2-4e2c-929f-cd1db1dae9a5} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{84fe7e4f-eb50-42fe-b127-ac480eb887c6} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{94da54d2-e05b-4b1d-aea7-5537150d909b} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95eeddad-75bc-4826-afa9-92bb36646741} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d031418f-6ccb-4a2f-92d3-7604913b8836} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eaca7357-2c47-4b31-af13-111fd1dfe7b9} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== FireFox Fix ====================== ProfilePath: C:\Users\PATRICK\AppData\Roaming\Mozilla\Firefox\Profiles\n5db0g9x.default-1405878230274 user.js not found ---- Lines a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059 removed from prefs.js ---- user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.0b21f775-d32a-4eac-84c6-c00ac1ae2ec5@gmail.coma0b21f775d32a4eac84c6c00ac1ae user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.0b21f775-d32a-4eac-84c6-c00ac1ae2ec5@gmail.coma0b21f775d32a4eac84c6c00ac1ae user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.0b21f775-d32a-4eac-84c6-c00ac1ae2ec5@gmail.comasyncdb_dbWasSet", true); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.0b21f775-d32a-4eac-84c6-c00ac1ae2ec5@gmail.comasyncdb_dbWasSet_FF25_FIX", t user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.0b21f775-d32a-4eac-84c6-c00ac1ae2ec5@gmail.comasyncinternaldb_dbWasSet", tr user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.0b21f775-d32a-4eac-84c6-c00ac1ae2ec5@gmail.comasyncinternaldb_dbWasSet_FF25 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.InstallationThankYouPage", false); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.InstallationTime", 1418983444); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.active", true); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.addressbar", "NA"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.addressbarenhanced", ""); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.asyncdb.was_copied", "true"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.asyncinternaldb.was_copied", "true"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.backgroundver", 1); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.certdomaininstaller", ""); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.changeprevious", false); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100 (Ro user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.cookie.InstallationTime.value", "%221418983444%22"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100 (Rom user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.cookie.InstallerParams.value", "%7B%22source_id%22%3A%22000803%22%2C%22sub_ user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.description", "."); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.domain", ""); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.enablesearch", false); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.homepage", ""); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.iframe", false); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT+ user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3A%22AD6CCF user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.InstallerParams.value", "%7B%22source_id%22%3A%22000803%22%2C%22 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.InstallerParamsCache.expiration", "Fri Feb 01 2030 00:00:00 GMT+ user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.InstallerParamsCache.value", "%7B%22source_id%22%3A%22000803%22% user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.InstallerUserIdentifiersCache.expiration", "Fri Feb 01 2030 00:0 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.InstallerUserIdentifiersCache.value", "%7B%22installer_bic%22%3A user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_appVer.value", "8"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_lastVersion.value", "1"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100 ( user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_meta.value", "%7B%7D"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_nextCheck.expiration", "Fri Dec 19 2014 17:20:22 GMT+0 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_nextCheck.value", "true"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_queue.value", "%7B%7D"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_remote_resources.expiration", "Fri Feb 01 2030 00:00:0 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.Resources_remote_resources.value", "%7B%22remoteId%22%3A0%7D"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.__defualt_browser__.expiration", "Fri Feb 01 2030 00:00:00 GMT+0 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.__defualt_browser__.value", "%22ff%22"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.installer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100 (Roman user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.installer.value", "%7B%22InstallerIdentifiers%22%3A%7B%22install user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.monetization_plugin_bundledUrls.expiration", "Fri Feb 01 2030 00 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.monetization_plugin_bundledWithHash.expiration", "Fri Feb 01 203 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.monetization_plugin_bundledWithHash.value", "null"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.monetization_plugin_notBundledArr_.expiration", "Fri Feb 01 2030 user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.monetization_plugin_notBundledArr_.value", "%5B%5D"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.monetization_plugin_regBundledWithSoftware.expiration", "Fri Feb user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.internaldb.monetization_plugin_regBundledWithSoftware.value", "%7B%7D"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.lastDailyReport", "1418984421347"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.lastUpdate", "1418984421309"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.manifesturl", ""); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.name", "Sense"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.newtab", ""); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.opensearch", ""); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.pluginsurl", "http://js.newstaticinputserv.com/plugin/apps/69059/plugins/na user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.pluginsversion", 4); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.publisher", "Object Browser"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.searchstatus", 0); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.setnewtab", false); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.thankyou", ""); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.updateinterval", 360); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.69059.ver", 8); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.apps", "69059"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.bic", "14a620ff17921857a0db090d7700a426"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.cid", 69059); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.firstrun", false); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.hadappinstalled", true); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.installationdate", 1418984420); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.modetype", "production"); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.reportInstall", true); user_pref("extensions.a0b21f775d32a4eac84c6c00ac1ae2ec5gmailcom69059.statsDailyCounter", 1); ---- Lines ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129 removed from prefs.js ---- user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.active", true); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.addressbar", "NA"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.addressbarenhanced", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.asyncdb.was_copied", "true"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.asyncinternaldb.was_copied", "true"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.backgroundver", 1); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.certdomaininstaller", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.changeprevious", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.InstallationTime.value", "%221418983444%22"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:00: user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.InstallerParams.value", "%7B%22source_id%22%3A%22001 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.uc.expiration", "Fri Jan 02 2015 11:20:22 GMT+0100 ( user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.uc.value", "%22%5C%22BE%5C%22%22"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.description", "Ge-Force"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.domain", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.enablesearch", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.homepage", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.iframe", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.InstallationThankYouPage", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.InstallationTime", 1418983444); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.__defualt_browser__.expiration", "Fri Feb 01 203 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.__defualt_browser__.value", "%22ff%22"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.installer.expiration", "Fri Feb 01 2030 00:00:00 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.installer.value", "%7B%22InstallerIdentifiers%22 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 20 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerIdentifiers.value", "%7B%22installer_bi user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerParams.expiration", "Fri Feb 01 2030 00 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerParams.value", "%7B%22source_id%22%3A%2 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerParamsCache.expiration", "Fri Feb 01 20 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerParamsCache.value", "%7B%22source_id%22 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerUserIdentifiersCache.expiration", "Fri user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerUserIdentifiersCache.value", "%7B%22ins user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_bundledUrls.expiration", "Fr user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_bundledWithHash.expiration", user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_bundledWithHash.value", "nul user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_last_executable_request.expi user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_last_executable_request.valu user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_notBundledArr_.expiration", user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_notBundledArr_.value", "%5B% user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_regBundledWithSoftware.expir user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_regBundledWithSoftware.value user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 0 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_appVer.value", "8"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_lastVersion.value", "1"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00: user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_meta.value", "%7B%7D"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_nextCheck.expiration", "Fri Dec 19 201 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_nextCheck.value", "true"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_queue.value", "%7B%7D"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948852.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948853.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948854.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948855.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948856.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948857.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948857.value", "%22//Javascri user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948858.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948859.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948860.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948861.expiration", "Thu Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.lastDailyReport", "1419006308578"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.lastUpdate", "1419006308522"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.manifesturl", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.name", "Ge-Force"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.newtab", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.opensearch", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.pluginsurl", "http://js.newstaticinputserv.com/plugin/apps/ user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.pluginsversion", 4); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.publisher", "iWebar"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.searchstatus", 0); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.setnewtab", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.thankyou", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.updateinterval", 360); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.ver", 8); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.apps", "69129"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.bic", "14a620ff17921857a0db090d7700a426"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.cid", 69129); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.firstrun", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.hadappinstalled", true); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.installationdate", 1418984420); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.modetype", "production"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.reportInstall", true); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.statsDailyCounter", 2); ---- FireFox user.js and prefs.js backups ---- prefs_20150601_0956_.backup ==== Deleting Files \ Folders ====================== "C:\Users\PATRICK\AppData\Roaming\DIDBW.exe" not found "C:\Users\PATRICK\AppData\Roaming\FCG.exe" not found C:\windows\AutoKMS deleted C:\Users\PATRICK\AppData\Local\AVG Web TuneUp deleted C:\Program Files\AVG Web TuneUp deleted C:\PROGRA~3\AVG Web TuneUp deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services deleted C:\Users\PATRICK\AppData\LocalLow\AVG Web TuneUp deleted C:\windows\sysWoW64\config\systemprofile\AppData\LocalLow\AVG Web TuneUp deleted C:\windows\wininit.ini deleted C:\windows\SysNative\tasks\Microsoft\Windows\Maintenance\SMupdate2 deleted C:\windows\SysNative\tasks\Microsoft\Windows\Multimedia\SMupdate3 deleted C:\windows\SysNative\config\systemprofile\Searches deleted C:\Users\PATRICK\AppData\Roaming\Mozilla\Firefox\Profiles\n5db0g9x.default-1405878230274\extensions\e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.com deleted "C:\windows\tasks\AutoKMS.job" deleted "C:\windows\tasks\DIDBW.job" deleted "C:\windows\tasks\FCG.job" deleted "C:\Users\PATRICK\AppData\Roaming\DIDBW" deleted "C:\windows\tasks\DIDBW.job" deleted "C:\windows\SysNative\tasks\DIDBW" deleted "C:\Users\PATRICK\AppData\Roaming\FCG" deleted "C:\windows\tasks\FCG.job" deleted "C:\windows\SysNative\tasks\FCG" deleted "C:\PROGRA~2\AVG Web TuneUp\TBAPI.dll" deleted "C:\PROGRA~2\AVG Web TuneUp" not deleted ==== Files Recently Created / Modified ====================== ====== C:\windows ==== ====== C:\Users\PATRICK\AppData\Local\Temp ==== ====== Java Cache ===== ====== C:\windows\SysWOW64 ===== ====== C:\windows\SysWOW64\drivers ===== ====== C:\windows\Sysnative ===== ====== C:\windows\Sysnative\drivers ===== 2014-12-31 15:26:24 26C43960C99EE861A5D0EDC4DCF3B1C3 129752 ----a-w- C:\windows\Sysnative\drivers\2A3558D8.sys 2014-12-23 14:55:55 26C43960C99EE861A5D0EDC4DCF3B1C3 129752 ----a-w- C:\windows\Sysnative\drivers\18A35073.sys 2014-12-20 15:33:51 26C43960C99EE861A5D0EDC4DCF3B1C3 129752 ----a-w- C:\windows\Sysnative\drivers\17380316.sys 2014-12-14 09:01:28 26C43960C99EE861A5D0EDC4DCF3B1C3 129752 ----a-w- C:\windows\Sysnative\drivers\48C501F8.sys 2014-12-11 08:53:10 B02118A776C368F7EE1A8CC81378D265 153920 -c--a-w- C:\windows\Sysnative\drivers\dumpsd.sys 2014-12-11 08:53:10 A770340FC02B999EF0DE6C2A6BC8437C 39744 -c--a-w- C:\windows\Sysnative\drivers\intelpep.sys 2014-12-11 08:53:10 7B7C482CF48E6EE33664340D1A78E6FE 238912 -c--a-w- C:\windows\Sysnative\drivers\sdbus.sys 2014-12-11 08:53:10 24A8DFC07E4BAF29AEA26E383D4CC886 86336 ----a-w- C:\windows\Sysnative\drivers\pdc.sys ====== C:\windows\Tasks ====== 2014-12-26 08:42:15 B63AD96D5AB77552EFDB7D2277C3B0CB 3886 ----a-w- C:\windows\Sysnative\Tasks\Adobe Acrobat Update Task 2014-12-23 08:27:48 D8EFED3348BA7F143CDDBA26AC9101D0 3816 ----a-w- C:\windows\Sysnative\Tasks\GoogleUpdateTaskMachineCore 2014-12-23 08:27:48 3797BDFDCFB79C77AD7630A7E90C3087 1080 ----a-w- C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-23 08:27:48 2B8ABF0A71FB03B35434C4ED24F25A14 4052 ----a-w- C:\windows\Sysnative\Tasks\GoogleUpdateTaskMachineUA 2014-12-23 08:27:47 D7BA0E11DCC583A75D0FF8724A5712A1 1076 ----a-w- C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-17 10:00:45 9BBBEC5C7370FF72F853197CFB8E5AB9 3124 ----a-w- C:\windows\Sysnative\Tasks\{9B257A73-4215-4004-B806-440419645B05} ====== C:\windows\Temp ====== ======= C:\Program Files ===== ======= C:\PROGRA~2 ===== ======= C: ===== ====== C:\Users\PATRICK\AppData\Roaming ====== 2014-12-23 08:27:16 -------- d-----w- C:\Users\PATRICK\AppData\Local\Deployment 2014-12-23 08:27:16 -------- d-----w- C:\Users\PATRICK\AppData\Local\Apps ====== C:\Users\PATRICK ====== 2015-01-05 15:31:45 110DE4097548F8B85349A8229297C5A3 5316792 ----a-w- C:\Users\PATRICK\Downloads\ccsetup501pro.exe 2015-01-04 15:42:31 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\Users\PATRICK\Downloads\RSITx64.exe 2014-12-25 10:24:17 9208E5A0A844FCCB39B5252C07B4E860 2173952 ----a-w- C:\Users\PATRICK\Downloads\adwcleaner_4.106.exe 2014-12-23 08:27:59 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-12-22 08:23:16 -------- d-----w- C:\windows\serviceprofiles\Localservice\winhttp 2014-12-19 16:38:35 -------- d-----w- C:\ProgramData\HitmanPro 2014-12-18 15:48:40 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RAR Password Recovery ====== C: exe-files == 2015-01-05 15:31:45 110DE4097548F8B85349A8229297C5A3 5316792 ----a-w- C:\Users\PATRICK\Downloads\ccsetup501pro.exe 2015-01-04 15:42:31 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\Users\PATRICK\Downloads\RSITx64.exe === C: other files == 2014-12-31 15:26:24 26C43960C99EE861A5D0EDC4DCF3B1C3 129752 ----a-w- C:\Windows\System32\drivers\2A3558D8.sys ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-21-3281137686-3600045230-3634462768-1001\Software\Microsoft\Windows\CurrentVersion\Run] "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner64.exe /MONITOR" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe MSRun" "BCSSync"="C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe /DelayServices" "AVG_UI"="C:\Program Files (x86)\AVG\AVG2015\avgui.exe /TRAYONLY" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner64.exe /MONITOR" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SimplePass"="C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe /hideui" "OPBHOBroker"="C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe" "OPBHOBrokerDesktop"="C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe" "BeatsOSDApp"="C:\Program Files\IDT\WDM\beats64.exe" "SysTrayApp"="C:\Program Files\IDT\WDM\sttray64.exe" ==== Task Scheduler Jobs ====================== C:\windows\tasks\Adobe Flash Player Updater.job --a-------- C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [10/12/2014 10:19] C:\windows\tasks\GoogleUpdateTaskMachineCore.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [23/12/2014 09:27] C:\windows\tasks\GoogleUpdateTaskMachineUA.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [23/12/2014 09:27] ==== Other Scheduled Tasks ====================== "C:\windows\SysNative\tasks\Adobe Acrobat Update Task" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\windows\SysNative\tasks\Adobe Flash Player Updater" [C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\windows\SysNative\tasks\CLMLSvc_P2G8" [c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe] "C:\windows\SysNative\tasks\CLVDLauncher" [c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe] "C:\windows\SysNative\tasks\CreateChoiceProcessTask" [C:\Windows\BrowserChoice\browserchoice.exe] "C:\windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\windows\SysNative\tasks\User_Feed_Synchronization-{E6FB1735-DA8A-431B-9428-C11287962EB6}" [C:\windows\system32\msfeedssync.exe] "C:\windows\SysNative\tasks\Cybertron\Privacy Eraser\SkipUAC" [C:\Program Files\Cybertron\Privacy Eraser\PrivacyEraser.exe] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\Update Check" [C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe] "C:\windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] ==== Firefox Start and Search pages ====================== ProfilePath: C:\Users\PATRICK\AppData\Roaming\Mozilla\Firefox\Profiles\n5db0g9x.default-1405878230274 user_pref("browser.startup.homepage", "https://www.google.be/?gws_rd=ssl"); ==== Firefox Extensions ====================== ProfilePath: C:\Users\PATRICK\AppData\Roaming\Mozilla\Firefox\Profiles\n5db0g9x.default-1405878230274 - Undetermined - e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.com ==== Firefox Plugins ====================== Profilepath: C:\Users\PATRICK\AppData\Roaming\Mozilla\Firefox\Profiles\n5db0g9x.default-1405878230274 9860727E477F17B88E39AF8B69B0407A - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll - Shockwave Flash 9C06DBC403F91D518ED117E460F03F85 - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL - CANON iMAGE GATEWAY Album Plugin Utility for IJ ==== Chromium Look ====================== Google Chrome Version: 39.0.2171.95 (Up to date, latest Stable version: 39.0.2171.95) Comodo DragDrop Service - PATRICK\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aneodkojaglhnkkdbbdnmmmgimlcaogo Comodo Web Inspector - PATRICK\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bdngekjahnmlkinegnhdmmbcfnmbclnn Comodo Share Page Service - PATRICK\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\mcmdgbiocnkpnaccjkailibfgepaccgf Google Wallet - PATRICK\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Google Slides - PATRICK\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek Google Docs - PATRICK\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - PATRICK\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - PATRICK\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - PATRICK\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Google Sheets - PATRICK\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap Google Wallet - PATRICK\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Gmail - PATRICK\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="https://www.google.be/?gws_rd=ssl" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Search_URL"="http://www.google.com" "Default_Page_URL"="http://www.google.com" "Start Page"="http://www.google.com" "Search Page"="http://www.google.com" [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main] "Default_Search_URL"="http://www.google.com" "Default_Page_URL"="http://www.google.com" "Start Page"="http://www.google.com" "Search Page"="http://www.google.com" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="https://www.google.be/?gws_rd=ssl" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896" "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896" "Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157" "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main] "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896" "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896" "Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157" "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" {012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" {D944BB61-2E34-4DBF-A683-47E505C587DC} eBay Url="http://rover.ebay.com/rover/1/1553-29906-12136-18/4" ==== Empty IE Cache ====================== C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\PATRICK\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\PATRICK\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully ==== Empty FireFox Cache ====================== No FireFox Cache found ==== Empty Chrome Cache ====================== C:\Users\PATRICK\AppData\Local\Comodo\Dragon\User Data\Default\Cache emptied successfully C:\Users\PATRICK\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== No Flash Cache Found ==== Empty All Java Cache ====================== No Java Cache Found ==== C:\zoek_backup content ====================== C:\zoek_backup (files=437 folders=108 130289191 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\PATRICK\AppData\Local\Temp will be emptied at reboot C:\windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\windows\Temp successfully emptied C:\Users\PATRICK\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\PROGRA~2\AVG Web TuneUp" not found ==== EOF on di 06/01/2015 at 10:01:54,09 ======================