Zoek.exe v5.0.0.0 Updated 08-April-2015 Tool run by Coban on wo 08-04-2015 at 13:57:09,76. Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\Coban\Downloads\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 8-4-2015 13:59:15 Zoek.exe System Restore Point Created Successfully. ==== Empty Folders Check ====================== C:\PROGRA~2\Trend Micro deleted successfully C:\Users\Coban\AppData\Roaming\Windows Live Writer deleted successfully ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Installed Programs ====================== Update for Microsoft Office 2007 (KB2508958) ęTorrent Aangifte inkomstenbelasting 2011 Aangifte inkomstenbelasting 2012 Aangifte inkomstenbelasting 2014 ABBYY FineReader 9.0 Sprint Adobe Acrobat XI Pro Adobe AIR Adobe Download Assistant Adobe Flash Player 16 NPAPI Adobe Flash Player 17 ActiveX Adobe Reader XI (11.0.10) - Nederlands Adobe Refresh Manager Adobe Shockwave Player 12.1 Agatha Christie - Peril at End House Apple Application Support (32-bit) Apple Application Support (64-bit) Apple Mobile Device Support Apple Software Update ATI Catalyst Install Manager AuthenTec TrueAPI AviSynth 2.5 Basishandleiding EPSON SX440 Series Bejeweled 2 Deluxe Bejeweled 3 Blackhawk Striker 2 Blasterball 3 Bonjour Bounce Symphony Broadcom 802.11 Wireless LAN Adapter Build-a-lot 2 Cake Mania Catalyst Control Center - Branding Catalyst Control Center Catalyst Control Center Graphics Previews Common Catalyst Control Center InstallProxy Catalyst Control Center Localization All Catalyst Control Center Profiles Mobile ccc-utility64 CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CCleaner Chuzzle Deluxe CyberLink YouCam D3DX10 DAEMON Tools Lite Diner Dash 2 Restaurant Rescue DivX Setup Dora's World Adventure Download Navigator EMDB 1.35 Energy Star Digital Logo Epson Connect Printer Setup Epson Easy Photo Print 2 Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) Epson Event Manager EPSON Scan EPSON SX440 Series Printer Uninstall EpsonNet Print ESU for Microsoft Windows 7 Evernote v. 4.2.2 Farm Frenzy FATE - The Traitor Soul Final Drive Nitro Football Manager 2012 Free Studio version 6.5.0.301 Free Video to MP3 Converter version 5.0.20.1031 Free YouTube to MP3 Converter version 3.12.41.623 Gebruikershandleiding EPSON SX440 Series Google Chrome Google Earth Pro Google Toolbar for Internet Explorer Google Update Helper Hewlett-Packard ACLM.NET v1.2.2.3 HiJackThis HP 3D DriveGuard HP Auto HP Client Services HP Connection Manager HP Customer Experience Enhancements HP Documentation HP DVB-T TV Tuner 8.0.64.43 HP Games HP On Screen Display HP Power Manager HP Product Detection HP Quick Launch HP Setup HP Setup Manager HP SimplePass 2011 HP Software Framework HP Support Assistant iCloud IDT Audio Intel(R) Control Center Intel(R) Display Audio Driver Intel(R) Management Engine Components Intel(R) Rapid Storage Technology iTunes Java 8 Update 40 Java Auto Updater JDownloader Junk Mail filter update KPN Installatie Assistent LockHunter 2.0 beta 2, 32 bit Magic Desktop Mah Jong Medley Mesh Runtime Microsoft .NET Framework 4.5.1 Microsoft .NET Framework 4.5.1 (Nederlands) Microsoft .NET Framework 4.5.1 (NLD) Microsoft Application Error Reporting Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office 2010 Microsoft Office Excel MUI (Dutch) 2007 Microsoft Office File Validation Add-In Microsoft Office Home and Student 2007 Microsoft Office Klik-en-Klaar 2010 Microsoft Office Office 64-bit Components 2007 Microsoft Office OneNote MUI (Dutch) 2007 Microsoft Office PowerPoint MUI (Dutch) 2007 Microsoft Office Proof (Dutch) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (German) 2007 Microsoft Office Proofing (Dutch) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared 64-bit MUI (Dutch) 2007 Microsoft Office Shared MUI (Dutch) 2007 Microsoft Office Starter 2010 - Nederlands Microsoft Office Word MUI (Dutch) 2007 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft SQL Server Compact 3.5 SP1 English Microsoft SQL Server Compact 3.5 SP1 x64 English Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 Microsoft Works 6-9 Converter More Games from HP Games Mozilla Firefox 24.0 (x86 nl) Mozilla Maintenance Service MPC-HC 1.7.0 MSVCRT MSVCRT_amd64 MusicStation Mystery P.I. - Stolen in San Francisco Namco All-Stars PAC-MAN Netwerkhandleiding EPSON SX440 Series Norton Bootable Recovery Tool Wizard Norton Internet Security Penguins Plants vs. Zombies - Game of the Year PM Stitch Creator 3 Trial Poker Superstars III Polar Bowler Polar Golfer PX Profile Update Realtek Ethernet Controller Driver Realtek PCIE Card Reader Recovery Manager Renesas Electronics USB 3.0 Host Controller Driver Seagate Media Software Security Update for Microsoft .NET Framework 4.5.1 (KB2894854v2) Security Update for Microsoft .NET Framework 4.5.1 (KB2898869) Security Update for Microsoft .NET Framework 4.5.1 (KB2901126) Security Update for Microsoft .NET Framework 4.5.1 (KB2931368) Security Update for Microsoft .NET Framework 4.5.1 (KB2972107) Security Update for Microsoft .NET Framework 4.5.1 (KB2972216) Security Update for Microsoft .NET Framework 4.5.1 (KB2978128) Security Update for Microsoft .NET Framework 4.5.1 (KB2979578v2) Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760415) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2817330) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2878233) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2880507) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2880508) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2881069) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2920795) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2984939) 32-Bit Edition Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB2956106) 32-Bit Edition Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB2956107) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2956103) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office OneNote 2007 (KB2596857) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2899580) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2956109) 32-Bit Edition Servicetool Skype Click to Call Skypet 7.0 Slingo Supreme Speccy SubSync swMSM Synaptics TouchPad Driver Torque Tunatic Update for 2007 Microsoft Office System (KB967642) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596787) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2920794) 32-Bit Edition Update Installer for WildTangent Games App Update voor Microsoft Office Excel 2007 Help (KB963678) Update voor Microsoft Office Powerpoint 2007 Help (KB963669) Update voor Microsoft Office Word 2007 Help (KB963665) Validity WBF DDK VC80CRTRedist - 8.0.50727.6195 Veetle TV Virtual Villagers 4 - The Tree of Life VLC media player VLC Streamer 3.28 VobSub v2.23 (Remove Only) WIDCOMM Bluetooth Software WildTangent Games App for HP Windows Live Communications Platform Windows Live Essentials Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Language Selector Windows Live Mail Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen Windows Live Mesh Windows Live Mesh ActiveX Control for Remote Connections Windows Live Messenger Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live Remote Client Windows Live Remote Client Resources Windows Live Remote Service Windows Live Remote Service Resources Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources WinRAR 4.00 (64-bit) Xvid Video Codec Zuma Deluxe ==== Running Processes ====================== C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe C:\Windows\SysWOW64\ezSharedSvcHost.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\NIS.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\NIS.exe C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\conathst.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Coban\Downloads\zoek.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe ==== Deleting Services ====================== ==== FireFox Fix ====================== ProfilePath: C:\Users\Coban\AppData\Roaming\Mozilla\Firefox\Profiles\z93js5lc.default user.js not found ---- FireFox user.js and prefs.js backups ---- prefs_08-04-2015_1411_.backup ==== Deleting Files \ Folders ====================== C:\PROGRA~2\Trend Micro not found C:\Users\Coban\AppData\Roaming\Mozilla\Firefox\Profiles\z93js5lc.default\extensions\{594657B4-413A-41D0-8F85-A6D3F35C9BDF} deleted C:\Users\Coban\AppData\Roaming\Mozilla\Firefox\Profiles\z93js5lc.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} deleted C:\PROGRA~3\0780f478-67ce-4ec3-98db-39a65f4618ce deleted C:\PROGRA~2\Strong Signal deleted C:\PROGRA~2\COMMON~1\DVDVideoSoft\bin deleted C:\PROGRA~2\COMMON~1\0780f478-67ce-4ec3-98db-39a65f4618ce deleted C:\PROGRA~3\APN deleted C:\PROGRA~3\Package Cache deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Bootable Recovery Tool Wizard deleted C:\Windows\wininit.ini deleted C:\Windows\SysNative\config\systemprofile\Searches deleted C:\Users\Coban\AppData\Roaming\Mozilla\Firefox\Profiles\z93js5lc.default\Invalidprefs.js deleted "C:\Users\Coban\AppData\Roaming\Mozilla\Firefox\Profiles\z93js5lc.default\searchplugins\Binkiland.xml" deleted "C:\Users\Coban\AppData\Roaming\Mozilla\Firefox\Profiles\z93js5lc.default\searchplugins\Binkiland.xml" deleted ==== System Specs ====================== Windows: Windows 7 Home Premium Edition (64-bit) Service Pack 1 (Build 7601) Memory (RAM): 8140 MB CPU Info: Intel(R) Core(TM) i7-2670QM CPU @ 2.20GHz CPU Speed: 2250,2 MHz Sound Card: Luidsprekers en hoofdtelefoons | Communicatie-hoofdtelefoons (ID | Display Adapters: Intel(R) HD Graphics Family | Intel(R) HD Graphics Family | RDPDD Chained DD | RDP Encoder Mirror Driver | RDP Reflector Display Driver Monitors: 1x; Algemeen PnP-beeldscherm | Screen Resolution: 1366 X 768 - 32 bit Network: Network Present Network Adapters: Microsoft Virtual WiFi Miniport Adapter | Broadcom 4313GN 802.11b/g/n 1x1 Wi-Fi-adapter | Realtek PCIe GBE Family Controller | Bluetooth-apparaat (Personal Area Network) CD / DVD Drives: 2x (E: | G: | ) E: hp DVDRAM GT31N | G: DTSOFT BDROM Ports: COM5 | COM4 | COM3 LPT Port NOT Present. Mouse: 16 Button Wheel Mouse Present Hard Disks: C: 578,3GB | D: 17,5GB | F: 99,3MB | Q: 0,0MB Hard Disks - Free: C: 206,8GB | D: 1,9GB | F: 79,4MB | Q: 0,0MB Manufacturer *: Hewlett-Packard BIOS Info: AT/AT COMPATIBLE | 01/23/13 | HPQOEM - 1 Time Zone: West-Europa (standaardtijd) Motherboard *: Hewlett-Packard 17FA Country: Nederland Language: NLD ==== System Specs (Software) ====================== Anti-Virus: Norton Internet Security On-access scanning disabled (Outdated) Anti-Spyware: Windows Defender disabled (Outdated) Anti-Spyware: Norton Internet Security disabled (Outdated) Firewall: Norton Internet Security disabled Default Browser: Google Chrome 41.0.2272.118 Internet Explorer Version: 9.0.8112.16421 Mozilla Firefox version: 24.0 (x86 nl) Google Chrome version: 41.0.2272.118 Adobe Reader version: 11.0.10.32 Sun Java version: 1.8.0_40 (32-bit) Sun Java version: 1.8.0_40 (64-bit) Flash Player version: 16.0.0.305 Shockwave Player version: 12.1.1r151 ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\Coban\AppData\Local\Temp ==== ====== Java Cache ===== 2015-04-08 11:53:57 B5484710FD46B5204FB01AE9F3F3E8BE 286754 ----a-w- C:\Users\Coban\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\7e60542d-6225d8a0 2015-04-08 11:53:54 67911F367EC150BDC8F2CB46397F0925 845 ----a-w- C:\Users\Coban\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\11dd5f3d-40289e15 2015-04-08 11:53:55 67911F367EC150BDC8F2CB46397F0925 845 ----a-w- C:\Users\Coban\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\2bbaaf87-1160498f 2015-04-08 11:53:56 0AB4C4F0D484CA52860A53A93D082AE9 438 ----a-w- C:\Users\Coban\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\2bbaaf87-e2e4c8970372d2fb4193a7ef29d16f6c3f08527947fcb9208b3a0e48820369fd-6.0.lap ====== C:\Windows\SysWOW64 ===== 2015-04-08 11:37:46 7A76F83B4DCA86B5DB17D43A5820CF40 98216 ----a-w- C:\Windows\SysWOW64\WindowsAccessBridge-32.dll ====== C:\Windows\SysWOW64\drivers ===== ====== C:\Windows\Sysnative ===== ====== C:\Windows\Sysnative\drivers ===== 2015-04-01 20:53:36 E16E2431516D904CED3946AD3FF8C86B 854 ----a-w- C:\Windows\Sysnative\drivers\SYMEVENT64x86.INF 2015-04-01 20:53:36 97E11C50CE52277B377396EA8838E539 177752 ----a-w- C:\Windows\Sysnative\drivers\SYMEVENT64x86.SYS 2015-04-01 20:53:36 7846ED59291A134CC5DD017C6EC7B433 8222 ----a-w- C:\Windows\Sysnative\drivers\SYMEVENT64x86.CAT 2015-03-11 21:19:13 ED6E75158D28D33A2E2A020AC5B2B59D 663552 ----a-w- C:\Windows\Sysnative\drivers\PEAuth.sys 2015-03-11 21:19:10 87BCD1034CBF33537D4D4C251D39BA26 94656 ----a-w- C:\Windows\Sysnative\drivers\mountmgr.sys 2015-03-11 21:19:03 90C53BD47979FB8814F465A08B885102 61440 ----a-w- C:\Windows\Sysnative\drivers\appid.sys 2015-03-11 21:17:49 8BA90F480705D7153AD0060CCA62222A 155576 ----a-w- C:\Windows\Sysnative\drivers\ksecpkg.sys 2015-03-11 21:17:49 56ED3EE5FED6BF2FC1305CF872042868 95680 ----a-w- C:\Windows\Sysnative\drivers\ksecdd.sys 2015-03-11 21:17:49 27667A788130A7F7A5858DE27572E6D7 459336 ----a-w- C:\Windows\Sysnative\drivers\cng.sys ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2015-03-15 10:51:15 -------- d-----w- C:\Program Files\iTunes 2015-03-15 10:51:15 -------- d-----w- C:\Program Files\iPod ======= C:\PROGRA~2 ===== 2015-04-08 11:38:21 -------- d-----w- C:\PROGRA~2\COMMON~1\Java 2015-03-15 10:51:15 -------- d-----w- C:\PROGRA~2\iTunes 2015-03-09 18:45:15 -------- d-----w- C:\PROGRA~2\JDownloader ======= C: ===== 2015-04-01 20:42:48 BB803658F963F2ACBE248EEA4E8C2250 1315569664 ----a-w- C:\NBRT.iso 2015-04-01 19:55:44 439A75BDB7F5E2156C607EA16FC6F6C8 3608 ------w- C:\bootsqm.dat ====== C:\Users\Coban\AppData\Roaming ====== 2015-03-23 16:38:50 937B3C7A8FB31765AE8C35AE53C5AFEC 5619880 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\FontCache3.0.0.0.dat 2015-03-15 10:48:56 -------- d-----w- C:\Windows\SysNative\config\systemprofile\AppData\Roaming\Apple Computer 2015-03-09 19:25:05 -------- d-----w- C:\Users\Coban\AppData\Local\JDownloader 2.0 ====== C:\Users\Coban ====== 2015-04-08 11:37:31 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-03-28 18:32:27 -------- d-----w- C:\Users\Coban\Tracing 2015-03-15 10:52:15 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-03-15 10:51:15 -------- d-----w- C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2015-03-15 10:45:15 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud ====== C: exe-files == 2015-04-08 11:56:54 C38CCFBB0325D9DE76BF616005AD81FE 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$ICQWB3W.exe 2015-04-08 11:37:32 A07427A93E1133A7F0F4691CC54B9294 0 ----a-we C:\ProgramData\Oracle\Java\javapath\javaws.exe 2015-04-08 11:37:32 94017ABBDE345580542D8301793EFF7A 0 ----a-we C:\ProgramData\Oracle\Java\javapath\javaw.exe 2015-04-08 11:37:32 30E9397C2F0C8FF128219D6A25E172BB 0 ----a-we C:\ProgramData\Oracle\Java\javapath\java.exe 2015-04-08 11:37:24 F95C5163F6D8955BEF59A896C7F7112D 159656 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\unpack200.exe 2015-04-08 11:37:23 A29B7A1BAD1A1EB608ACF7684F1F1E37 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\tnameserv.exe 2015-04-08 11:37:23 7833052815087E5BF9346AC78FDCED68 51112 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssvagent.exe 2015-04-08 11:37:22 751E8649890CC42727D80F8D6DE1F1CB 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\servertool.exe 2015-04-08 11:37:22 689916BDF4F58C7F7AD25F8B3ABB783A 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\rmiregistry.exe 2015-04-08 11:37:21 DFB1F31DD4A08FA5892886DC7117064A 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\rmid.exe 2015-04-08 11:37:21 7162180C98D1BE5D1315FC05B3C91E9D 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\pack200.exe 2015-04-08 11:37:21 0A9C7408BADBA5D2C841817C22ACBF07 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\policytool.exe 2015-04-08 11:37:21 08363434BEC1B0AE6420C77820BC12E9 16296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\orbd.exe 2015-04-08 11:37:20 AF28DAA2B4EB3AD87203202264A2491C 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\klist.exe 2015-04-08 11:37:20 946FD6292EAE3FBB93CC3BB01BA8763D 76712 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2launcher.exe 2015-04-08 11:37:20 32700B34EE49959FAF64EC46D96B3630 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\ktab.exe 2015-04-08 11:37:20 1FA2D0F07730F502A857BFC63DA6C193 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\kinit.exe 2015-04-08 11:37:20 042B789E469D238D5FA9DEC4241CE3FD 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\keytool.exe 2015-04-08 11:37:19 A07427A93E1133A7F0F4691CC54B9294 272296 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\javaws.exe 2015-04-08 11:37:19 94017ABBDE345580542D8301793EFF7A 191400 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\javaw.exe 2015-04-08 11:37:19 79B6403F5BD398BB9880F00FAF7C69DA 68520 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\javacpl.exe 2015-04-08 11:37:19 6031BACB59D93E5ECB4ACDE6E12565EA 30632 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\jabswitch.exe 2015-04-08 11:37:19 3DB4CD42B36FD2C98E9B51E3CBC1670E 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\jjs.exe 2015-04-08 11:37:19 30E9397C2F0C8FF128219D6A25E172BB 190888 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\java.exe 2015-04-08 11:37:19 2794D464D89260B0316C16A9FE24C660 15784 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\bin\java-rmi.exe 2015-04-08 11:22:38 49BF715D225A5D3FE9D2FA75967C1466 561064 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RCQWB3W.exe 2015-04-07 16:42:19 3065209DB604550DB875EAE03AEAE81E 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I47LM30.exe 2015-04-07 15:49:25 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R47LM30.exe 2015-04-07 12:31:18 E91402B0E9CB123E9EB0CADDBA240E98 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I34CWE6.exe 2015-04-07 12:31:18 4DEE87AE44B77136580B665A082F049C 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IKRBGSK.exe 2015-04-04 14:01:02 E32AAB3E477398B78E9D8F2418D1989C 658944 ----a-w- C:\Windows\System32\GWX\GWXConfigManager.exe 2015-04-04 14:01:02 A6C3E3120AC125BABE410959083A0108 459264 ----a-w- C:\Windows\System32\GWX\GWX.exe 2015-04-04 14:01:02 86345D30828786E1CC6AF12DF769D136 392704 ----a-w- C:\Windows\SysWOW64\GWX\GWX.exe 2015-04-04 14:01:02 771215B601C7D7E88D015D974AF7BEC7 393216 ----a-w- C:\Windows\System32\GWX\GWXUX.exe 2015-04-04 14:01:02 29038FF696BB007224872DA9645EA324 353048 ----a-w- C:\Windows\System32\GWX\GWXUXWorker.exe 2015-04-02 20:58:37 04A8F29E2CB7A633109E6AF1316F6E97 864336 ----a-w- C:\Program Files (x86)\Google\Update\Install\{109D3F96-1DE7-441C-AF4D-AA02848C3765}\41.0.2272.118_41.0.2272.101_chrome_updater.exe 2015-04-02 20:58:37 04A8F29E2CB7A633109E6AF1316F6E97 864336 ----a-w- C:\Program Files (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\41.0.2272.118\41.0.2272.118_41.0.2272.101_chrome_updater.exe 2015-04-01 20:51:22 DF225966734F129F07FD92C02EA0D15F 1021936 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RKRBGSK.exe 2015-04-01 20:15:30 0B88F9150730A7E11A4EE8170DEF4D65 8742200 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R34CWE6.exe === C: other files == 2015-04-08 11:37:24 9DCBFF045A2A43212A4763C3461A50B9 14130 ----a-w- C:\Program Files (x86)\Java\jre1.8.0_40\lib\deploy\ffjcext.zip 2015-04-07 17:42:31 AEE71863D26AFFF67994854B9D1CD7F4 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I3CW6ZZ.zip 2015-04-07 17:42:04 4D7E5D868B86F10D76F307CA8A629403 28192 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R3CW6ZZ.zip 2015-04-07 17:26:23 500333E5ED26F9E122B6A8DD8BCFF0CC 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I8UL97H.zip 2015-04-07 17:26:03 6389EDF7E8AABBFC17B53FE5A441CC8B 25270 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R8UL97H.zip 2015-04-07 17:24:48 2CC314A9686B734B6E7D7EEE0A2A2FB5 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IDKD4TS.zip 2015-04-07 17:24:33 329D848191A2D919000A02FD99EF4EC4 37772 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RDKD4TS.zip 2015-04-07 17:23:21 C2A4379B6576B06D0A06555DB8FC3DB0 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IBR2XOV.zip 2015-04-07 17:22:59 B1052B6F2F79C3FAA268FE34580834C6 20993 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RBR2XOV.zip 2015-04-07 17:21:52 B9DC7F40AE10949D2DE9EEB6F975D251 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I8SPI8J.zip 2015-04-07 17:21:33 18868A5D55824C9542A8306CB9578D96 22333 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R8SPI8J.zip 2015-04-07 17:20:33 ABD386966131C49BEEC898CC9BE26B3C 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I7HLZ2C.zip 2015-04-07 17:20:08 C20963002152EE96B43DAAA031080528 21038 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R7HLZ2C.zip 2015-04-07 17:18:25 57690D7A21E5501FB6A207A9820EE12C 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IPXCJAK.zip 2015-04-07 17:18:06 505F43AA6A87548D5551BFBF56D988BA 19432 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RPXCJAK.zip 2015-04-07 17:16:34 EF718C76D351B8FF99AE90474F92E23C 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IQELMXH.zip 2015-04-07 17:16:18 1496A163C484A120050B0423F0729D95 19516 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RQELMXH.zip 2015-04-07 17:14:50 B04C423D84CFA2FC24951927889AC115 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IMTM5VL.zip 2015-04-07 17:14:28 8A6409D29F1A237120559C3FB724F40B 14568 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RMTM5VL.zip 2015-04-07 17:13:30 1477D2EC45DB2A686E693DA5F77E658B 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$INVU8HW.zip 2015-04-07 17:13:09 D5230FFBC7F9EF09D312A181169CEF3C 15704 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RNVU8HW.zip 2015-04-07 17:11:21 0E37FB61B5A68A1AAD55E0570B34A29D 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I3SR9GX.zip 2015-04-07 17:11:07 B8E63C75EBE6F725BD0E65E0342CBA21 21627 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R3SR9GX.zip 2015-04-07 17:09:57 47FC88551DE38305377242F2548D5261 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IN05GLV.zip 2015-04-07 17:09:35 42425C0575BE2F70E186B1B0A839FBDC 19200 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RN05GLV.zip 2015-04-07 17:06:34 419941DF0D32445111DE7D6639014F20 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I6Y5W5C.zip 2015-04-07 17:06:17 8420F0F6594CDF83DA7065D21641423E 20015 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R6Y5W5C.zip 2015-04-07 17:05:18 962BC5781668CA38B4F0794ED8EF38A3 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I6UJDZL.zip 2015-04-07 17:05:02 61AB62DBE4D858ADC33B6833CAD311C3 20892 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R6UJDZL.zip 2015-04-07 17:04:09 BC39EBF4E0DFF5A8306D180D36732D20 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IPZM7TB.zip 2015-04-07 17:03:52 8DA3CE8F1E04053A2F1445433D7E7C01 20803 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RPZM7TB.zip 2015-04-07 17:02:37 22E7757225879C18FD3D3544FBFD51E8 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IKTT37F.zip 2015-04-07 17:02:17 7A7D6B3C65A4144545A2A5F9448BF119 19113 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RKTT37F.zip 2015-04-07 17:01:13 7F1461C35E22C24CB40116C022E19CD5 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IMMGQVD.zip 2015-04-07 17:00:36 3CC263BC917EB5E9A2C171A85791768D 19576 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RMMGQVD.zip 2015-04-07 16:59:18 BBBE2C11E70FB189FEFA46D41D206FD2 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I3558KD.zip 2015-04-07 16:58:42 EE54D9DC6232E07FF8B795642F1A7215 18737 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R3558KD.zip 2015-04-07 16:57:04 D77B0E83553CE3793DAE1D9AA3B5C895 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$ILG313B.zip 2015-04-07 16:56:39 600797E475BD5E8264F046B01563BB14 18377 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RLG313B.zip 2015-04-07 16:54:56 F955B39B97D855AE355BF25EAFEE0AB3 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$I8GZR2R.zip 2015-04-07 16:54:36 60E1C9725D53B6886C1612B0180B2583 27810 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$R8GZR2R.zip 2015-04-07 16:47:49 64BB5F4CEACD5969B0D0716A17C9245C 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IXLE4X7.zip 2015-04-07 16:47:46 F1138F51AEF916BA2B8A83F477D39168 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$ICMLUNU.zip 2015-04-07 16:47:46 C31D2D935AC98E781F027A9BE0ED0F80 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$INLEFGR.zip 2015-04-07 16:47:46 9128B5C5E0542CE191948228BF5DA5C9 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IQXSZX7.zip 2015-04-07 16:47:46 8556F591F78B39F28C24B1CD63EF6454 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IZ66GHP.zip 2015-04-07 16:47:46 36AD6CAFF4B663ED93DCD44A670A2DD5 544 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$IJV1K3R.zip 2015-04-07 16:47:03 44AE1FEC669FF4511DFADAA334D3F16F 23178 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RNLEFGR.zip 2015-04-07 16:46:23 3CF56BEA86D579AB3559BF788532FD07 21537 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RQXSZX7.zip 2015-04-07 16:45:38 329233C9FBC803EBCE6A86505011F456 20425 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RXLE4X7.zip 2015-04-07 16:43:51 A5D7AF22EAA6D1BD42F9F526FABFEBEC 22794 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RCMLUNU.zip 2015-04-07 16:43:07 C86339436BF1B00ED18B5137F3676115 20470 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RJV1K3R.zip 2015-04-07 16:42:06 88B17F409D94BD4AD16E32943DAFC4C7 19954 ----a-w- C:\$RECYCLE.BIN\S-1-5-21-1327584340-4008737961-4063509114-1001\$RZ66GHP.zip 2015-04-01 21:05:12 E163E10191958FF6A2B0B48353F9E9FD 876248 ----a-r- C:\Windows\System32\drivers\NISx64\1507000.00B\srtsp64.sys 2015-04-01 21:05:12 9F31630D7FC2DD9D5DA1CE359AAD1F46 1148120 ----a-r- C:\Windows\System32\drivers\NISx64\1507000.00B\symefa64.sys 2015-04-01 21:05:12 68E7B6708B9EEE021301C483825D05EA 37592 ----a-r- C:\Windows\System32\drivers\NISx64\1507000.00B\srtspx64.sys 2015-04-01 21:05:12 5C9EE2303CA7F267665D75237862B39C 493656 ----a-r- C:\Windows\System32\drivers\NISx64\1507000.00B\symds64.sys 2015-04-01 21:05:12 5570A74FF9B1EFBC5154DD1E2F05C517 593112 ----a-r- C:\Windows\System32\drivers\NISx64\1507000.00B\symnets.sys 2015-04-01 21:05:12 2C95265BE19F338E1C1090E4E91055BB 266968 ----a-r- C:\Windows\System32\drivers\NISx64\1507000.00B\ironx64.sys 2015-04-01 21:05:12 20F758E6339A16F97DD83389D582E09A 23568 ----a-r- C:\Windows\System32\drivers\NISx64\1507000.00B\symelam.sys 2015-04-01 21:05:12 0510396A957E9FD7205BA62D3CAE4528 162392 ----a-r- C:\Windows\System32\drivers\NISx64\1507000.00B\ccsetx64.sys 2015-04-01 20:53:36 97E11C50CE52277B377396EA8838E539 177752 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-21-1327584340-4008737961-4063509114-1001\Software\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "730EC8BC70AF1CF4762F584DB61104CA38861B1D._service_run"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --type=service" "uTorrent"="C:\Users\Coban\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED" "iCloudServices"="C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" "StartCCC"="C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun" "NUSB3MON"="C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" "Easybits Recovery"="C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe" "HP Quick Launch"="C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" "HPOSD"="C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" "SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "730EC8BC70AF1CF4762F584DB61104CA38861B1D._service_run"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --type=service" "uTorrent"="C:\Users\Coban\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED" "iCloudServices"="C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\Windows\system32\igfxtray.exe" "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" "Persistence"="C:\Windows\system32\igfxpers.exe" "AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe " "SysTrayApp"="C:\Program Files\IDT\WDM\sttray64.exe" ==== Startup Registry Disabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Acrobat Assistant 8.0] "key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Acrobat Assistant 8.0" "hkey"="HKLM" "command"="\"C:\\Program Files (x86)\\Adobe\\Acrobat 11.0\\Acrobat\\Acrotray.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Speed Launcher] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce" "item"="Adobe Speed Launcher" "hkey"="HKCU" "command"="1422095642" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AdobeAAMUpdater-1.0] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AdobeAAMUpdater-1.0" "hkey"="HKLM" "command"="\"C:\\Program Files (x86)\\Common Files\\Adobe\\OOBE\\PDApp\\UWA\\UpdaterStartupUtility.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AppleIEDAV] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AppleIEDAV" "hkey"="HKCU" "command"="C:\\Program Files (x86)\\Common Files\\Apple\\Internet Services\\AppleIEDAV.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApplePhotoStreams] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ApplePhotoStreams" "hkey"="HKCU" "command"="C:\\Program Files (x86)\\Common Files\\Apple\\Internet Services\\ApplePhotoStreams.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\APSDaemon] "key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="APSDaemon" "hkey"="HKLM" "command"="\"C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DAEMON Tools Lite] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DAEMON Tools Lite" "hkey"="HKCU" "command"="\"C:\\Program Files (x86)\\DAEMON Tools Lite\\DTLite.exe\" -autorun" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Hobbyist Software VLC Streamer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Hobbyist Software VLC Streamer" "hkey"="HKCU" "command"="\"C:\\Program Files (x86)\\Hobbyist Software\\VLC Streamer\\VLC Streamer Configuration.exe\" /startup" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HPConnectionManager] "key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="HPConnectionManager" "hkey"="HKLM" "command"="C:\\Program Files (x86)\\Hewlett-Packard\\HP Connection Manager\\HPCMDelayStart.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iCloudServices] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iCloudServices" "hkey"="HKCU" "command"="C:\\Program Files (x86)\\Common Files\\Apple\\Internet Services\\iCloudServices.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Servicetool] "key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Servicetool" "hkey"="HKLM" "command"="C:\\Program Files (x86)\\KPN\\Servicetool\\KPNServicetool_Launcher.exe /auto" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Sidebar] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Sidebar" "hkey"="HKCU" "command"="C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Skype] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Skype" "hkey"="HKCU" "command"="\"C:\\Program Files (x86)\\Skype\\Phone\\Skype.exe\" /minimized /regrun" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\swg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="swg" "hkey"="HKCU" "command"="\"C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\"" ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [07-04-2015 14:32] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [26-10-2014 00:38] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:6C:\ProgramC:FilesC:x86\Google\Update\GoogleUpdate.exe [] C:\Windows\tasks\HPCeeScheduleForCoban.job --a------ [Undetermined Task] ==== Other Scheduled Tasks ====================== "C:\Windows\SysNative\tasks\Adobe Acrobat Update Task" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\SysNative\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\Windows\SysNative\tasks\HPCeeScheduleForCoban" [C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe] "C:\Windows\SysNative\tasks\MirageAgent" [C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe] "C:\Windows\SysNative\tasks\Norton WSC Integration" ["C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\WSCStub.exe"] "C:\Windows\SysNative\tasks\ServicePlan" ["C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe"] "C:\Windows\SysNative\tasks\User_Feed_Synchronization-{4D9CA7BB-4295-445D-BDC3-4F47CF3FC0CB}" [C:\Windows\system32\msfeedssync.exe] "C:\Windows\SysNative\tasks\{BE65A1D9-4520-4C57-92BF-8E12A53F0871}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/5.1.0.104.161/nl/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled] "C:\Windows\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe] "C:\Windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe] "C:\Windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe] "C:\Windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\Update Check" [C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe] "C:\Windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe] "C:\Windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe] "C:\Windows\SysNative\tasks\Norton Internet Security\Norton Error Analyzer" [C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\SymErr.exe] "C:\Windows\SysNative\tasks\Norton Internet Security\Norton Error Processor" [C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\SymErr.exe] "C:\Windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions] "{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.6.0.32\coFFPlgn" [08-04-2015 13:49] ==== Firefox Extensions ====================== ProfilePath: C:\Users\Coban\AppData\Roaming\Mozilla\Firefox\Profiles\z93js5lc.default - DivX Plus Web Player HTML5 lt;videogt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 - Convert.Files - %ProfilePath%\extensions\addconvertbutton@convertfiles.com.xpi - Strong Signal - %ProfilePath%\extensions\{02df6ed9-d89d-425c-afc3-3a79ad6ce5ef}.xpi - Media Converter - %ProfilePath%\extensions\{6e764c17-863a-450f-bdd0-6772bd5aaa18}.xpi - DVDVideoSoft YouTube MP3 and Video Download - %ProfilePath%\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi - Sothink Web Video Downloader for Firefox - %ProfilePath%\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}.xpi AppDir: C:\Program Files (x86)\Mozilla Firefox - TrueSuite Website Logon - %AppDir%\extensions\websitelogon@truesuite.com - Default - %AppDir%\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} - Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} - Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi ==== Firefox Plugins ====================== Profilepath: C:\Users\Coban\AppData\Roaming\Mozilla\Firefox\Profiles\z93js5lc.default C62322C77D1AAB77B1CF1130FCC3673A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll - Shockwave Flash E37EAD09D28AE19D8A39B6A95F47513A - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1211151.dll - Shockwave for Director / Shockwave for Director ==== Deleted Firefox Extensions ====================== C:\Users\Coban\AppData\Roaming\Mozilla\Firefox\Profiles\z93js5lc.default\extensions\{02df6ed9-d89d-425c-afc3-3a79ad6ce5ef}.xpi deleted ==== Chromium Look ====================== Google Chrome Version: 41.0.2272.118 (Latest Stable version: 41.0.2272.118) HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions dfaldikcoaplhepekpbngkepfcoiihef - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx[22-08-2011 05:50] efaidnbmnnnibpcajpcglclefindmkaj - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx[03-12-2014 08:31] iikflkcanblccfahdhdonehdalibjnif - No path found[] lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[14-07-2014 19:22] mkfokfffehpeedafpekjeddnmnjhmcmk - C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\Exts\Chrome.crx[05-03-2015 10:45] nneajnkjbffgblleaoojgaacokifdkhm - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx[12-12-2011 15:13] Google Drive - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Website Logon - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\dfaldikcoaplhepekpbngkepfcoiihef Adobe Acrobat - Create PDF - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj Full Screen Weather - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkkaebihfmbofclegkcfkkemepfehibg BitTorrent Surf (Beta) - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibpbofogepkkeoockhkfcgngjkimndlp Norton Identity Safe - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif Norton Security Toolbar - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk Norton Safe Search as default for Chrome - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmgcfemagnogdodbambjhdcmfcpicngl Google Wallet - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda DivX Plus Web Player HTML5 \u003Cvideo\u003E - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm Gmail - Coban\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia ==== Chromium Startpages ====================== C:\Users\Coban\AppData\Local\Google\Chrome\User Data\Default\Preferences "homepage": "https://www.google.nl/", "startup_urls": [ "http://google.nl/" ] ==== Chromium Fix ====================== C:\Users\Coban\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage deleted successfully C:\Users\Coban\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully C:\Users\Coban\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_nortonsafe.search.ask.com_0.localstorage deleted successfully C:\Users\Coban\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_nortonsafe.search.ask.com_0.localstorage-journal deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=nl&pid=nis&pvid=21.6.0.32" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=nl&pid=nis&pvid=21.6.0.32" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" {012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}&rlz=1I7GGHP_nlNL457" {C7520077-EF9A-4B72-AA51-A2C62C8016BE} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGHP_nlNL457" ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-1327584340-4008737961-4063509114-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_USERS\S-1-5-21-1327584340-4008737961-4063509114-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_CLASSES_ROOT\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== HijackThis Entries ====================== O2 - BHO: Increase performance and video formats for your HTML5