Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by M on di 02/06/2015 at 11:03:10,08.
Microsoft Windows 7 Starter  6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\M\Desktop\zoek.exe [Scan all users] [Script inserted] [Checkboxes used]

==== System Restore Info ======================

2/06/2015 11:06:45 Zoek.exe System Restore Point Created Successfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Running Processes ======================

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
C:\Program Files\Intel\Bluetooth\devmonsrv.exe
C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
C:\Program Files\Acer\AOP Framework\CCDMonitorService.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\ProgramData\DatacardService\HWDeviceService.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Intel\Bluetooth\obexsrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\ProgramData\DatacardService\DCSHelper.exe
C:\Windows\system32\GWX\GWX.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Intel\Bluetooth\mediasrv.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Intel\Bluetooth\BTPlayerCtrl.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\M\Desktop\zoek.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

==== Deleting Services ======================


==== System Specs ======================

Windows: Windows 7 Starter Edition Service Pack 1 (Build 7601)
Memory (RAM): 1015 MB
CPU Info: Intel(R) Atom(TM) CPU N570   @ 1.66GHz
CPU Speed: 544.0 MHz
Sound Card: Speakers (Realtek High Definiti | 
Display Adapters: Intel(R) Graphics Media Accelerator 3150 | RDPDD Chained DD | RDP Encoder Mirror Driver | RDP Reflector Display Driver
Monitors: 1x; Algemeen PnP-beeldscherm | 
Screen Resolution: 1024 X 600 - 32 bit
Network: Network Present
Network Adapters: Microsoft Virtual WiFi Miniport Adapter | Intel(R) Centrino(R) Wireless-N 130 | Realtek PCIe FE Family Controller | Bluetooth Device (Personal Area Network)
CD / DVD Drives: No optical drives found.
Ports: COM Ports NOT Present. LPT Port NOT Present. 
Mouse: 16 Button Wheel Mouse Present
Hard Disks: C:  201.8GB | D:  28.0GB | Q:  0.0MB
Hard Disks - Free: C:  16.2GB | D:  13.0GB | Q:  0.0MB
Manufacturer *: H90MB
BIOS Info: AT/AT COMPATIBLE | 08/16/32 | MEDION - 20110424
Time Zone: Romance (standaardtijd)
Motherboard *: Medion E122X
Country: Belgi‰ 
Language: NLB 

==== System Specs (Software) ======================

Anti-Virus: Microsoft Security Essentials On-access scanning disabled (Outdated)
Anti-Spyware: Microsoft Security Essentials disabled (Outdated)
Anti-Spyware: Windows Defender disabled (Outdated)
Default Browser: Google Chrome	43.0.2357.81
Internet Explorer Version: 11.0.9600.17801 
Google Chrome version: 43.0.2357.81
Adobe Reader version: 10.1.14.11
Sun Java version: 1.8.0_45 (32-bit) 
Flash Player version: 10.2.153.1

==== Files Recently Created / Modified ======================

====== C:\Windows ====
====== C:\Users\M\AppData\Local\Temp ====
====== Java Cache =====
====== C:\Windows\system32 =====
2015-05-20 09:29:02	B01B8C949EDEC1B8A856E3056BDA7C42	1372160	----a-w-	C:\Windows\System32\dwmcore.dll
2015-05-20 09:28:53	F7F135F7702E0FB3EFE89283E2BE2EBB	67584	----a-w-	C:\Windows\System32\dwmapi.dll
====== C:\Windows\system32\drivers =====
2015-05-13 06:46:37	76C0D35167B1369C68388FEDB56A3048	137664	----a-w-	C:\Windows\System32\drivers\ksecpkg.sys
2015-05-13 06:46:37	6DD2A1064DD8AFBED22E71176E2AF59B	67520	----a-w-	C:\Windows\System32\drivers\ksecdd.sys
====== C:\Windows\Tasks ======
2015-05-18 09:01:02	8936BB3D3191711FF842054B03AE8CC8	3150	----a-w-	C:\Windows\system32\Tasks\{21396993-D10E-4124-837C-C3076547AEF5}
2015-05-13 05:40:12	F64A2D5E9C1762DEAFBEB4978044D22B	3874	----a-w-	C:\Windows\system32\Tasks\Adobe Acrobat Update Task
====== C:\Windows\Temp ======
======= C:\Program Files =====
2015-05-22 08:49:43	--------	d-----w-	C:\Program Files\trend micro
======= C: =====
====== C:\Users\M\AppData\Roaming ======
2015-05-24 18:54:46	--------	d-----w-	C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp
2015-05-24 18:54:45	--------	d-----w-	C:\Users\Default\AppData\Local\Temp
2015-05-24 18:54:45	--------	d-----w-	C:\Users\Default User\AppData\Local\Temp
2015-05-24 18:54:42	--------	d-----w-	C:\Users\M\AppData\Local\Temp
====== C:\Users\M ======
2015-05-22 08:48:30	8685FAF50C04F9A9C2F56FF64B0B7ACB	1107968	----a-w-	C:\Users\M\Downloads\RSIT.exe

====== C: exe-files ==
2015-05-28 20:40:50	B1798BC27E40983B12FEFD0D85C05B3F	873800	----a-w-	C:\Users\M\AppData\Local\Google\Chrome\User Data\SwReporter\3.21.0\software_reporter_tool.exe
=== C: other files ==

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-4174719909-4000535656-3623657698-1000\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
"Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"
"Persistence"="C:\Windows\system32\igfxpers.exe"
"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s"
"FLxHCIm"="C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"
"BTMTrayAgent"="rundll32.exe C:\Program Files\Intel\Bluetooth\btmshell.dll,TrayApp"
"CLMLServer"="C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
"MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey"
"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"fspuip"="%ProgramFiles%\FSP\fspuip.exe "

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
"Skype"="C:\Program Files\Skype\Phone\Skype.exe /minimized /regrun"

==== Task Scheduler Jobs ======================

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [21/10/2014 18:40]
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [21/10/2014 18:40]

==== Other Scheduled Tasks ======================

"C:\Windows\system32\tasks\Adobe Acrobat Update Task" [C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe]
"C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe]
"C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe]
"C:\Windows\system32\tasks\{1F9770BB-38FA-4289-BAA7-DC10D8D39A97}" ["c:\program files\google\chrome\application\chrome.exe"]
"C:\Windows\system32\tasks\{41DFAD9C-E866-4682-9614-37D71E1129F5}" ["c:\program files\google\chrome\application\chrome.exe"]
"C:\Windows\system32\tasks\{CDA490B4-6755-4B85-B18A-3C1B81BBBA47}" ["c:\program files\google\chrome\application\chrome.exe"]
"C:\Windows\system32\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"belgiumeid@eid.belgium.be"="C:\Program Files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be" [12/07/2014 17:12]

==== Firefox Extensions ======================

ProfilePath: C:\Users\M\AppData\Roaming\TomTom\HOME\Profiles\328qcwm9.default
- Map status indicator - C:\Program Files\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com
- TomTom HOME default theme - C:\Program Files\TomTom HOME 2\xul\extensions\baseTheme@tomtom.com
- Emulator - %ProfilePath%\extensions\Navcore.9.510.1234792@tomtom.com

AppDir: C:\Program Files\Mozilla Firefox
- Belgium eID - %AppDir%\extensions\belgiumeid@eid.belgium.be

==== Firefox Plugins ======================


==== Chromium Look ======================

Google Chrome Version: 43.0.2357.81

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
kfecnpmgnlnbmipaogfhoacoioifjgko - No path found[]
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[01/05/2015 11:17]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
kfecnpmgnlnbmipaogfhoacoioifjgko - No path found[]

selector is not a valid CSS selector - M\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb
Bookmark Manager - M\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik
Skype Click to Call - M\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Google Wallet - M\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

==== Chromium Startpages ======================

C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Preferences
},"https://[*.]wifiportal.telenet.be:443,*":{"popups":1},"https://[*.]www.homebank.recordbank.be:443,*":{"plugins":1},"https://[*.]www.youtube.com:443,*":{"fullscreen":1},"https://mail.google.com:443,*":{"notifications":1},"https://www.google.be:443,*":{"last_used":{"media-stream-mic":1422302505.680068},"media-stream-mic":1}},"pref_version":1},"exit_type":"Crashed","exited_cleanly":true,"gaia_info_picture_url":"https://lh5.googleusercontent.com/-b4YXVGgDwmI/AAAAAAAAAAI/AAAAAAAAEO8/h2E9Q8uOCFc/s256-c/photo.jpg","gaia_info_update_time":"13077660285102808","icon_version":3,"is_managed":false,"managed_user_id":"","managed_users":{},"migrated_content_settings_exceptions":true,"migrated_default_content_settings":true,"migrated_default_media_stream_content_settings":true,"name":"Eerste gebruiker","per_host_zoom_levels":{}},"protection":{"macs":{}},"reverse_autologin":{"enabled":false},"savefile":{"default_directory":"C:\\Users\\M\\Downloads","type":1},"search":{"suggest_enabled":false},"selectfile":{"last_directory":"C:\\Users\\M\\Desktop"},"session":{"restore_on_startup_migrated":true,"startup_urls_migration_time":"13034340232157120"},"sync":{"acknowledged_types":["Bookmarks","Preferences","Passwords","Autofill Profiles","Autofill","Themes","Typed URLs","Extensions","Search Engines","Sessions","Apps","App settings","Extension settings","Dictionary","Tabs","Encryption keys"],"app_list":true,"app_settings":true,"apps":true,"autofill":true,"autofill_profile":true,"autofill_wallet":true,"bookmarks":true,"dictionary":true,"encryption_bootstrap_token":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA73o39FOXnEqfbDEXMcrtgAAAAAACAAAAAAAQZgAAAAEAACAAAADcHQNdVWx9R6l2nzbCe+VVJ6ZrQEQXvS4CVVZRtwSyBAAAAAAOgAAAAAIAACAAAABi4OwMx2p1BJ5UOk+cTx1Wmx9SGkw73Zh5/FkcuMHqAEAAAABixZfo7H9vUCMn3YGDLbY6aMp1pGDdubO7ZR7If3NpHWTVt7ssDeNlbNgs23H93Jk8GtAYyXNiH+IhMZpb50MoQAAAAJMj4tyZSvrOgJlnAkL85weGHm7bQ/FZAC6TjcWVOKSsxkLNlHrxKrkL2S8fp9lvYJVAJ5MWhSQ/IVqS8Tt31ss=","extension_settings":true,"extensions":true,"favicon_images":true,"favicon_tracking":true,"favicons_syncing_enabled":true,"first_sync_time":"13054486667718272","has_setup_completed":true,"history_delete_directives":true,"keep_everything_synced":true,"keystore_encryption_bootstrap_token":"AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA73o39FOXnEqfbDEXMcrtgAAAAAACAAAAAAAQZgAAAAEAACAAAAD1QLHkAoZmE3jt/+V2LSYxRYiIC1SmYtdg14SAaqYJJAAAAAAOgAAAAAIAACAAAACoHv4NMPX1WUoqXSDAZMIudBOuUUB3jDoIy1p349pFi1AAAAA1te4N1Mih8sCfmHmiNt6xW+5QwbolqWrQP2Gu/Rsc4vaSAgJ54nNJI9GNbwrjPWT7m0xDUD9ir6ZQz8YAE7b9GIXs3Jte1WH8ZGB+enH4B0AAAAB3eNCLHXJ30c5fENm2qZoT/g8fXzlc8dP6Lo+w2BHvx70jVGCkIZu73XMSpaLNDmrc/FR4Cd50jahG5l4HReV0","last_synced_time":"13077709303233560","managed_user_settings":true,"managed_user_shared_settings":true,"managed_user_whitelists":true,"managed_users":true,"passwords":true,"preferences":true,"priority_preferences":true,"search_engines":true,"session_sync_guid":"session_syncbCkDMMokGiUt46SnpeQY9A==","sessions":true,"suppress_start":false,"synced_notifications":true,"tabs":true,"themes":true,"typed_urls":true},"sync_promo":{"show_ntp_bubble":false},"synced_notification":{"enabled_sending_services":["Google+"],"first_run":false,"initialized_sending_services":["Google+"]},"tabs":{"use_vertical_tabs":false},"translate_accepted_count":{"de":0,"en":0,"es":0,"fr":0,"ko":1,"pt":1,"sv":1},"translate_blocked_languages":[],"translate_denied_count":{"de":31,"en":155,"es":4,"fr":29,"ko":0,"pt":0,"sv":0},"translate_language_blacklist":[],"translate_last_denied_time":1413040354435.098,"translate_site_blacklist":[],"translate_too_often_denied":true,"translate_whitelists":{},"webkit":{"webprefs":{"default_fixed_font_size":17,"default_font_size":20,"fonts":{"standard":{"Zyyy":"Arial"}}}},"zerosuggest":{"cachedresults":""}}
uPUpza18XJlhr6jHbny4VJgSsGAOlfMSUpVi5eZDXv72kbnvqg0ZWwTfmq1FK37uQ1/ToqQIDAQAB","manifest_version":2,"name":"MapsGalaxy","permissions":["tabs","cookies","history","contextMenus","management","http://*/*","https://*/*","http://127.0.0.1/*","http://localhost/*","chrome://favicon/*","downloads"],"update_url":"https://clients2.google.com/service/update2/crx","version":"12.9.6.8621","web_accessible_resources":["toolbarUI.html","components/api/window/widgetWindow.html","components/search/html/searchSuggestions.html","common/widget-api/widgets/rss/rssWidget.html","components/moviereviews/html/movieReviews.html","common/components/embedscript/html/embedScriptTemplate.html","common/components/embedhtml/html/embedHtmlTemplate.html","common/components/menu/html/menuframe.html","common/widget-api/widgets/weather/weatherButton.html","components/supertab/html/supertab.html","common/widget-api/widgets/radio/radio-widget.html","js/widgetContentScriptInjectee.js"]},"path":"pcpehlgijbdajfafffojllcaecaecngb\\12.9.6.8621_0","preferences":{},"regular_only_preferences":{},"state":0,"was_installed_by_default":false,"was_installed_by_oem":false}}},"google":{"services":{"last_username":"Nitram1943@gmail.com","username":"Nitram1943@gmail.com"}},"homepage":"http://www.google.com/ig/redirectdomain?brand=MDNE&bmod=MDNE","homepage_changed":true,"homepage_is_newtabpage":false,"pinned_tabs":[],"protection":{"macs":{"browser":{"show_home_button":"CB4A48413CBCA72A9AF961DE1BE696ABE017A6E8113D922207F4EED6D50C76BE"},"default_search_provider":{"keyword":"5A6E852E4C8F091ED772E725F065BAE423FF338F252D247CB50B92412733A71C","name":"BD31E54EA193FFE5F575FD3CB6A999A2A4BC9336540088900A50AC8BFA5BDF31","search_url":"53D03D0BE388FDDCE351D759E664827FAF7A436E2229F70A73E163A2D75C3B6A"},"default_search_provider_data":{"template_url_data":"0C6CBB84AD039C067D9BE5DF32C171D133318BF30A59D3A25AD121EAAB788C2A"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":"E91E537ED14B6F68BAFBE0BB6B42DA43B2E79A5019D591BD9C4ADDA2A7426DC8","bepbmhgboaologfdajaanbcjmnhjmhfn":"D05988C2AD7EBBBD7AB76B6F68E7DB60A0197655EB0D31B2DA2BCD271AA961F8","cfhdojbkjhnklbpkdaibdccddilifddb":"AD1BEF179309EBAF830C4A1D2BA3D45C29C2978F1EC8D0599F47FFE71F3535B7","eemcgdkfndhakfknompkggombfjjjeno":"FDB5321A450BD21C048D7FD1AD125FD3D85F5720C04631DF30880B18C3082A7A","ennkphjdgehloodpbhlhldgbnhmacadg":"0E8AC422EACF32BB7C815D244DCE2258035E9606593232FC7F0E88CDBCE5A97D","gfdkimpbcpahaombhbimeihdjnejgicl":"67EB8899A74837FEFC46AC81B72F006EE172074938B99F14BB8B13408186C3BF","gmlllbghnfkpflemihljekbapjopfjik":"1189CAC41272F898962454D13ABAB45F1D6CF69884411C148DB19FA636C24785","kfecnpmgnlnbmipaogfhoacoioifjgko":"BE8E07E12EDBFDB20BE0448AE722204D7A3F17C1DDC92F5E5FCBA33798D0E9AF","kmendfapggjehodndflmmgagdbamhnfd":"167ACA0FA72B19F556AAEFB9F59313E01AF45F3D03CDAB66A0F94E6301EE3149","lifbcibllhkdhoafpjfnlhfpfgnpldfl":"0294FDD1E9925A4FDA4054A809EFB203983D1FE499882EF5C8DEA144F030DC29","mfehgcgbbipciphmccgaenjidiccnmng":"C32F49DFA7F2FFA5BB4C6F4A7D4753757787EE5E269D8CB77726EE02C2598FA2","mgndgikekgjfcpckkfioiadnlibdjbkf":"D69E7AB972A774BA31B6BF85D483C8BE121DA12D945D5223749E0644B6E1E059","mhjfbmdgcfjbbpaeojofohoefgiehjai":"CDB6E234268FA96F9BBB8B1040D32F2841F2DFF92005A528177D72835D552FE6","neajdppkdcdipfabeoofebfddakdcjhd":"9D09ACFAB2699FC29DC7CB968389E36DC35430E62F06B2F875D4FF0EE6403D38","nkeimhogjdpnpccoofpliimaahmaaome":"15EC47864696BE737E637C70260A9F6227C1811257DD0621BDD004B5A4D53F87","nmmhkkegccagdldgiimedpiccmgmieda":"0DE718664BC18766530005C41F6F1ECEA13E830172A0E87469E50BAA9202C648","pafkbggdmjlpgkdkcbjmhmfcdpncadgh":"1B2A6FD6A60BAA3D47FF92E2DE1F8D8C58500C03DE0646BA60E1A3C52B039393","pcpehlgijbdajfafffojllcaecaecngb":"4DE7EACA06A2EF89FE58F3AAE1B84261451A45628BA3C3A1C346FA97264C9932"}},"google":{"services":{"last_username":"DEA448690183849561FF2B36ED4E06FF760EC9B3F8A5D56BA4304DA9AFD9E720","username":"64F5ACD170253EB3D2EDEE65924C1E6342604AC5DBAE0EFF28BF13C8DFE94617"}},"homepage":"F7793406C9199375EAD7174AAD6B98E36591D7A54F4647CBB8D48F4F4747E68C","homepage_is_newtabpage":"054A0291B1EE8002883DD47B550078381A8D7C1A1B50955AF27F4392BA811A5F","pinned_tabs":"29BD2FEBD2C6AEFE8CC528E3BD8333274E3B53BF677E8DF0791A7E5124E100DF","prefs":{"preference_reset_time":"3F337060B38DEE82A61FCCF9D59FB943B5C711C63B561255A9A42FC0B35742D5"},"profile":{"reset_prompt_memento":"A77EF89C78490C1F1400691C6C145233E018E8C7A93119476C7E0BE5A95F9F82"},"safebrowsing":{"incidents_sent":"832096927D01FF780AC954735CF0241C9FD0A69AF664D05B3ED59A85306FAF02"},"search_provider_overrides":"A0E08851FE8F512EC3C8C64207CACA1988F45FB9FDBB96FDA1343B2E398CA063","session":{"restore_on_startup":"54D0CED64672F64BCC373301E7460DAE30E5A89BB6FAC3A3E587337E3572ABDA","startup_urls":"324F704D48B6F6DA6BC68D269C233F17F18E9B42C8A76EC193424BDC8D85802C"},"software_reporter":{"prompt_reason":"0AE2248EA18D00C55BF96A72A73F5AD8559913A799AFEA6E67EC7E1505F9A6B0","prompt_seed":"B83DE37E5658496A4FCB63A262D5B8CB7B13F4015726B4D54015B75403CA7C34","prompt_version":"09BCFB9C9003C963BF50BB85B412C7CD3C6496A8D08D40EAFE20FD187FB725DE"},"sync":{"remaining_rollback_tries":"7AD184761703EDA0417120E56E8ECEA4C0BF65AAB7C55C9464C306DAB58850FD"}},"super_mac":"04929E727BECBE08F3C0B4A131C2FCB3E41FD40E300A889625447C7096F0F070"},"session":{"restore_on_startup":5,"startup_urls":["http://www.google.com/ig/redirectdomain?brand=MDNE&bmod=MDNE","http://www.google.com/ig/redirectdomain?brand=MDNC&bmod=MDNC","http://www.mystartsearch.com/?type=hp&ts=1431897513&z=32baa49efcf8eab58cd8710gcz5c9g6b8tcmcwbg6o&from=cvs&uid=HitachiXHTS543225A7A384_E242124200U3TK00U3TKX","http://www.google.com/","?type=hppp&ts=1432124412&from=xtab&uid=D6AA852FD2574aec8F8023DA20F2A62B"]},"software_reporter":{"prompt_reason":0,"prompt_version":"3.20.1"},"sync":{"remaining_rollback_tries":0}}


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Search Page"="http://www.mystartsearch.com/web/?type=ds&ts=1431897513&z=32baa49efcf8eab58cd8710gcz5c9g6b8tcmcwbg6o&from=cvs&uid=HitachiXHTS543225A7A384_E242124200U3TK00U3TKX&q={searchTerms}"
"Search Bar"="http://www.google.com/ie"
"Default_Search_URL"="http://www.mystartsearch.com/web/?type=ds&ts=1431897513&z=32baa49efcf8eab58cd8710gcz5c9g6b8tcmcwbg6o&from=cvs&uid=HitachiXHTS543225A7A384_E242124200U3TK00U3TKX&q={searchTerms}"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

==== Reset Google Chrome ======================

C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF3e6587.TMP will be reset at reboot
C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe43b5f.TMP will be reset at reboot
C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko deleted successfully

==== HijackThis Entries ======================

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [FLxHCIm] "C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe"
O4 - HKLM\..\Run: [BTMTrayAgent] rundll32.exe "C:\Program Files\Intel\Bluetooth\btmshell.dll",TrayApp
O4 - HKLM\..\Run: [fspuip] %ProgramFiles%\FSP\fspuip.exe
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Mobile Partner] C:\Program Files\MobileWiFi\MobileWiFi
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: eBay.be - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/1553-72747-17534-1/4 (file missing)
O9 - Extra 'Tools' menuitem: eBay.be - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/1553-72747-17534-1/4 (file missing)
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: eBay.be - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/1553-72747-17534-1/4 (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: eBay.be - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/1553-72747-17534-1/4 (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O21 - SSODL: EldosMountNotificator-cbfs5 - {886BE196-291B-4FB4-A103-EAFD68427E12} - C:\Windows\system32\cbfsMntNtf5.dll
O22 - SharedTaskScheduler: Virtual Storage Mount Notification - {886BE196-291B-4FB4-A103-EAFD68427E12} - C:\Windows\system32\cbfsMntNtf5.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Intel® Centrino® Bluetooth 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Bluetooth Device Monitor - Intel Corporation - C:\Program Files\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Intel Corporation - C:\Program Files\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Intel Corporation - C:\Program Files\Intel\Bluetooth\obexsrv.exe
O23 - Service: Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel(R) Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: CCDMonitorService - Acer Incorporated - C:\Program Files\Acer\AOP Framework\CCDMonitorService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HWDeviceService.exe - Unknown owner - C:\ProgramData\DatacardService\HWDeviceService.exe
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

==== Empty IE Cache ======================

C:\Users\M\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\M\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=335 folders=127 19587067 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\M\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\M\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF3e6587.TMP" not found
"C:\Users\M\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe43b5f.TMP" not found
"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on di 02/06/2015 at 11:51:13,81 ======================