Zoek.exe v5.0.0.1 Updated 06-December-2015 Tool run by Joon on di 08-12-2015 at 10:49:34,11. Microsoft® Windows Vista™ Business 6.0.6002 Service Pack 2 x86 Running in: Normal Mode Internet Access Detected Launched: C:\Users\Joon\Downloads\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 8-12-2015 10:52:56 Zoek.exe System Restore Point Created Successfully. ==== Empty Folders Check ====================== C:\Program Files\CyberLink deleted successfully C:\Program Files\eSobi deleted successfully C:\Program Files\MSXML 4.0 deleted successfully C:\Program Files\Reason deleted successfully C:\Program Files\Tesco deleted successfully C:\PROGRA~2\a95f8535-bd08-4370-a6e0-814924c0d5f0 deleted successfully C:\PROGRA~2\HPSSUPPLY deleted successfully C:\PROGRA~2\NtiDvdCopy deleted successfully C:\Users\J. Kornalijnslijper\AppData\Roaming\systweak deleted successfully C:\Users\Joon\AppData\Roaming\DigitalVolcano deleted successfully C:\Users\Joon\AppData\Roaming\DuplicateFilterLog deleted successfully C:\Users\Joon\AppData\Roaming\Windows Live Writer deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\._LiveCode_ deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\PackageAware deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{045FEFC3-959C-4107-9729-CAAED1B9EDF2} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{139A9620-4842-4C67-94EA-1C34BA393490} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{180BDB5C-ED6D-47BD-BDEF-E7F011C9F209} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{1A33B581-8484-4C30-B463-9B7D6EA796E0} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{20FF563F-D050-4E06-9928-CFDBFE7C28BB} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{2153A7B7-03CC-402B-99B7-4E670FD23027} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{254959A3-CEFE-47BC-A1C0-B0EA998298C4} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{25B0A09F-9AE2-4128-AC30-E05A4789FD23} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{29B50FDF-69CD-48F3-AFB0-35F54597EB81} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{2ACAD98A-EE1A-4FB4-9861-6FF6C0E6AD0B} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{2B0C78E9-663F-4FD3-BB49-B578E8D09F41} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{2C2FB763-2BEB-4FF4-AF27-4AC106BC4597} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{2DECC434-C429-4557-ABAC-B71F2D494448} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{2FBF873A-9AE0-4516-8BA1-78C140A49CC4} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{3306C64E-11F6-4A6B-A82B-EBAF13F0E207} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{37EFDFFB-955C-4BD3-ACAD-8A3EF7E6FEC7} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{3E449605-DAA9-4E1F-8E0F-191A004F2A8C} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{423E6727-6E08-44A2-8628-4B27BA3A5E6C} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{44680BAF-7C6D-408E-BF81-2568F9D1A2D6} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{462E1A4C-1816-4FC3-8225-A38F3D17DE35} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{4A521AD6-C0DB-4E44-83B6-88A81CFD08C8} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{52BE87C4-ACCB-48C5-AEA8-672EB7640AD3} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{5696FCE8-47FE-46A3-9974-09493A5AF9BC} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{5A7E3781-E297-41ED-9B4F-545571B61538} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{5F75C0EF-5DA4-4F6E-9C8C-0BDC83D354F7} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{6D801095-7833-498C-B624-617DE15998BF} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{7563A2D8-103A-4838-A1FD-C40FE4990E8E} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{7A00CA5B-DA29-4B04-B0DB-E488E0D81506} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{7E7B43BB-3BD5-4ED6-9AA9-F99370E1B56A} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{870619E2-130B-4855-BA77-C69E492F1A24} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{875F3AA5-EBC3-43B9-BC99-95F628CC28DF} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{90711C5B-6FCB-49B6-9B86-D7A7EF2EA683} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{92FB1239-C3F5-4C3B-9A3C-D4B2D4EE4434} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{937D182F-10C3-4795-BF97-551E8154873D} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{96155007-AC23-4777-80F7-EE0ED1E0C89D} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{98C75ACB-D5FC-49CB-A094-72B0CC278582} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{9AA80FD1-2901-4BA7-A713-C9ADF01EE8C7} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{9BCBE073-132B-4930-9D9B-B475F36E652B} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{9E9C20F3-0A8C-4D7D-9FEB-C1D9238400E4} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{A11B94DA-9982-4C3F-B676-A594FF2BAA14} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{A4BD92F0-DD20-4773-BD13-3C249E4F67C8} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{A7FED51C-6123-447C-826B-C2B71AED30B2} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{B06BE6EC-110D-43FC-8172-6B417B10B9C7} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{B1AA3A2D-306C-47E2-AB68-BC2A8904BF50} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{B2885964-6C1E-4801-8125-926942902C89} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{B44318AB-51FF-425E-B4EA-B17FD88D1304} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{B53EEB52-3694-4FB7-AE8B-40FC7B35AFCD} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{C3361A53-4C15-4093-AD4B-96718AEB28FB} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{C47041E6-4EE7-4045-A7E0-0E8FDD0008E4} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{C64C091D-910E-49A4-9B85-0354690B79AB} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{C74B5118-EC7B-4273-B8AA-8D77CF977149} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{D2C4891D-B1CC-408A-882F-5693B0D1DCEA} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{D50A7EA6-220B-4A79-83A2-928E80EF81D4} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{D52313B1-08D7-429D-ADFB-1418EC50EA30} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{D83E0495-6480-4B15-9C66-1B03A8FC07A6} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{DC42F3DA-8105-4C15-82E9-64CB8127AECD} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{E479EED3-33E0-46C9-9A83-42626AEDCAC1} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{E4BE3BBB-C10B-484D-9C4F-2ACF0451F172} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{E89E064F-17B9-44EA-B218-A7F8464DEA4E} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{EB06053E-45AF-45D4-AB6A-F3EBF9A959FF} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{F4F0AEA8-83AD-4EEC-8744-46A48F378B69} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{F9C79B85-098C-429D-AE5F-F93CB5BC7FFD} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{FC9F18C6-BF40-47F3-9F1A-E70E50C0A015} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{FE1821A0-0EF5-4698-8211-33F317AF25F0} deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\{FE186523-8F8C-490C-8EEC-796BCC241101} deleted successfully C:\Users\Joon\AppData\Local\Samsung deleted successfully C:\Users\Joon\AppData\Local\VDownloader deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-266344984-2920979057-1876800491-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7b523e7c-f096-4e36-a0cb-7efeb5c675c1} deleted successfully HKEY_USERS\S-1-5-21-266344984-2920979057-1876800491-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7b523e7c-f096-4e36-a0cb-7efeb5c675c1} deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully HKEY_CLASSES_ROOT\CLSID\{7b523e7c-f096-4e36-a0cb-7efeb5c675c1} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7b523e7c-f096-4e36-a0cb-7efeb5c675c1} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_USERS\S-1-5-21-266344984-2920979057-1876800491-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{AA8F4D51-BBD2-421C-A0DE-0A2B6369F0FD} deleted successfully ==== Installed Programs ====================== Update for Microsoft Office 2007 (KB2508958) 3100_3200_3300_Help 3100_3200_3300trb 32 Bit HP CIO Components Installer 3200 Acer eDataSecurity Management Acer eLock Management Acer Empowering Technology Acer ePerformance Management Acer eSettings Management Acer LANScope Agent Acer ScreenSaver Acer System Information Activation Assistant for the 2007 Microsoft Office suites Adobe Flash Player 19 ActiveX Adobe Reader X (10.1.16) - Nederlands AIO_CDB_ProductContext AIO_CDB_Software AIO_Scan Apple Application Support Apple Software Update ATI Catalyst Install Manager AVG PC TuneUp 2015 (nl-NL) Bonjour-afdrukservices Bonjour BufferChm Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center HydraVision Full Catalyst Control Center InstallProxy Catalyst Control Center Localization All Catalyst Control Center Localization Chinese Standard Catalyst Control Center Localization Chinese Traditional Catalyst Control Center Localization Dutch Catalyst Control Center Localization Finnish Catalyst Control Center Localization French Catalyst Control Center Localization German Catalyst Control Center Localization Greek Catalyst Control Center Localization Hungarian Catalyst Control Center Localization Italian Catalyst Control Center Localization Japanese Catalyst Control Center Localization Korean Catalyst Control Center Localization Norwegian Catalyst Control Center Localization Polish Catalyst Control Center Localization Portuguese Catalyst Control Center Localization Russian Catalyst Control Center Localization Spanish Catalyst Control Center Localization Swedish Catalyst Control Center Localization Thai Catalyst Control Center Localization Turkish ccc-core-static ccc-utility CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CCleaner Copy D3DX10 Destinations DeviceManagementQFolder DivX Setup DocProc DocProcQFolder eProtection eSupportQFolder Facebook Video Calling 2.0.0.447 Fax FormatFactory 2.90 Google Chrome Google Chrome Frame Google Earth Google Toolbar for Internet Explorer Google Update Helper Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) HP Display Assistant HP FWUpdateEDO2 HP Imaging Device Functions 8.0 HP OCR Software 8.0 HP Photo Creations HP Photosmart 6520 series Basissoftware van het apparaat HP Photosmart 6520 series Help HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B HP Product Assistant HP Solution Center 8.0 HP Update HPDiagnosticAlert HPProductAssistant HPSSupply ITECIR Driver Java 8 Update 65 Java 8 Update 66 Java Auto Updater Junk Mail filter update LightScribe 1.4.142.1 Mesh Runtime Microsoft .NET Framework 3.5 Language Pack SP1 - nld Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4.5.1 (Nederlands) Microsoft .NET Framework 4.5.1 (NLD) Microsoft .NET Framework 4.5.2 Microsoft Antimalware Service NL-NL Language Pack Microsoft Application Error Reporting Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (Dutch) 2007 Microsoft Office Communicator 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (Dutch) 2007 Microsoft Office File Validation Add-In Microsoft Office Groove MUI (Dutch) 2007 Microsoft Office InfoPath MUI (Dutch) 2007 Microsoft Office OneNote MUI (Dutch) 2007 Microsoft Office Outlook Connector Microsoft Office Outlook MUI (Dutch) 2007 Microsoft Office PowerPoint MUI (Dutch) 2007 Microsoft Office Proof (Dutch) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (German) 2007 Microsoft Office Proofing (Dutch) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (Dutch) 2007 Microsoft Office Shared MUI (Dutch) 2007 Microsoft Office Web Apps Browser Plugin Microsoft Office Word MUI (Dutch) 2007 Microsoft Security Client Microsoft Security Client NL-NL Language Pack Microsoft Security Essentials Microsoft Silverlight Microsoft Software Update for Web Folders (Dutch) 12 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft SQL Server Native Client Microsoft SQL Server Setup-ondersteuningsbestanden (Engels) Microsoft SQL Server VSS Writer Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft_VC100_CRT_SP1_x86 MSVC80_x86_v2 MSVC90_x86 MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MyFreeCodec NetDeviceManager Nokia Connectivity Cable Driver Nokia Suite Norman Security Suite NTI Backup NOW 4.7 NTI CD & DVD-Maker NTI Shadow OGA Notifier 2.0.0048.0 PC Connectivity Solution Picasa 3 QuickTime 7 Rapport Realtek High Definition Audio Driver Samsung New PC Studio SAMSUNG USB Driver for Mobile Phones SDK Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697) Security Update for Microsoft .NET Framework 4.5.2 (KB3074230) Security Update for Microsoft .NET Framework 4.5.2 (KB3074550) Security Update for Microsoft .NET Framework 4.5.2 (KB3097996) Security Update for Microsoft .NET Framework 4.5.2 (KB3098781) Security Update for Microsoft Office 2007 suites (KB2596650) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687409) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2817330) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2825645) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2837610) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2880507) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2880508) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2881069) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2920795) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB3085546) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB3085620) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB3101555) 32-Bit Edition Security Update for Microsoft Office Access 2007 (KB2596614) 32-Bit Edition Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3085551) 32-Bit Edition Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3101558) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB3101554) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687406) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office OneNote 2007 (KB2889915) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB3085548) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2880506) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB3085552) 32-Bit Edition Segoe UI Skins Skype Click to Call SkypeT 7.0 SolutionCenter Standaard Lexicon NmG OW1 Status TeamViewer 6 Toolbox TrayApp Trusteer Eindpuntbeveiliging UnloadSupport Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596787) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2965286) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition Update for Microsoft Office Outlook 2007 Junk Email Filter (KB3101557) 32-Bit Edition Update voor Microsoft Office Excel 2007 Help (KB963678) Update voor Microsoft Office Powerpoint 2007 Help (KB963669) Update voor Microsoft Office Word 2007 Help (KB963665) VC80CRTRedist - 8.0.50727.6195 VDownloader 3.9.990 Vuze Vuze Remote Toolbar WebReg Windows-stuurprogrammapakket - ITE Tech.Inc. (itecir) HIDClass (06/20/2007 5.0.0004.2) Windows Live Communications Platform Windows Live Essentials Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Mail Windows Live Mesh Windows Live Messenger Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live Remote Client Windows Live Remote Client Resources Windows Live Remote Service Windows Live Remote Service Resources Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources ==== Running Processes ====================== C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe C:\Program Files\Norman\Npm\Bin\nfservice.exe C:\Program Files\Norman\nse\bin\nseupdatesvc.exe C:\Program Files\Norman\nvc\bin\nvcsvc.exe C:\Program Files\Norman\Npm\Bin\nvoy.exe C:\Program Files\Norman\Ngs\Bin\Nnf.exe C:\Program Files\Norman\npf\bin\npfsvc32.exe C:\Program Files\Norman\Ngs\Bin\Nprosec.exe C:\Program Files\Norman\Npm\Bin\nwscmon2.exe C:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\Ati2evxx.exe C:\Program Files\Norman\Npm\Bin\Zanda.exe C:\Windows\System32\spoolsv.exe C:\Acer\Empowering Technology\ePerformance\MemCheck.exe C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe C:\Windows\system32\atashost.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe C:\Program Files\Acer\eProtection\Service\eProtectionServ.exe C:\Windows\system32\FsUsbExService.Exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe C:\Program Files\Microsoft Security Client\NisSrv.exe C:\Program Files\Norman\Npm\Bin\scheduler.exe C:\Program Files\Norman\Npm\Bin\Njeeves2.exe C:\Program Files\Norman\nig\bin\nigsvc32.exe C:\Windows\system32\taskeng.exe C:\Acer\LANScope Agent\awServ.exe C:\Acer\LANScope Agent\LockKM.exe C:\Windows\system32\UI0Detect.exe C:\Program Files\Google\Update\1.3.29.1\GoogleCrashHandler.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Windows\RtHDVCpl.exe C:\Acer\Empowering Technology\eLock\autolockprocess\AutoLockProcess.exe C:\Program Files\Norman\Npm\Bin\Zlh.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe C:\Program Files\Norman\nig\bin\niguser.exe C:\Program Files\Portrait Displays\HP Display Assistant\DTHtml.exe C:\Program Files\Norman\Npm\Bin\zlhh.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Program Files\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\HP\HP Photosmart 6520 series\Bin\HPNetworkCommunicator.exe C:\Users\Joon\Downloads\zoek.exe C:\Windows\system32\conime.exe C:\Program Files\Norman\npf\bin\npfuser.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k hpdevmgmt C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k HPService C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k SDRSVC ==== Deleting Services ====================== ==== FireFox Fix ====================== ProfilePath: C:\Users\J2EDE~1.KOR\AppData\Roaming\Mozilla\Firefox\Profiles\kc7nlszz.default ---- Lines BabylonToolbar removed from prefs.js ---- user_pref("extensions.BabylonToolbar_i.aflt", "babsst"); user_pref("extensions.BabylonToolbar_i.babExt", ""); user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112844&tt=010712_6"); user_pref("extensions.BabylonToolbar_i.hardId", "c477764c00000000000000242b231437"); user_pref("extensions.BabylonToolbar_i.id", "c477764c00000000000000242b231437"); user_pref("extensions.BabylonToolbar_i.instlDay", "15523"); user_pref("extensions.BabylonToolbar_i.instlRef", "sst"); user_pref("extensions.BabylonToolbar_i.newTab", true); user_pref("extensions.BabylonToolbar_i.newTabUrl", "http://search.babylon.com/?affID=112844&tt=010712_6&babsrc=NT_ss&mntrId=c477764c00000000000000242b user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar"); user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon"); user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); user_pref("extensions.BabylonToolbar_i.tlbrId", "base"); user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17"); user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1715:17:48"); user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17"); ---- Lines BabylonToolbar removed from user.js ---- user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112844&tt=010712_6"); user_pref("extensions.BabylonToolbar_i.babExt", ""); user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); user_pref("extensions.BabylonToolbar_i.id", "c477764c00000000000000242b231437"); user_pref("extensions.BabylonToolbar_i.hardId", "c477764c00000000000000242b231437"); user_pref("extensions.BabylonToolbar_i.instlDay", "15523"); user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17"); user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17"); user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1715:17:48"); user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon"); user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar"); user_pref("extensions.BabylonToolbar_i.aflt", "babsst"); user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); user_pref("extensions.BabylonToolbar_i.tlbrId", "base"); user_pref("extensions.BabylonToolbar_i.instlRef", "sst"); ---- FireFox user.js and prefs.js backups ---- user_08-12-2015_1140_.backup prefs_08-12-2015_1140_.backup ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] Objects\{7b523e7c-f096-4e36-a0cb-7efeb5c675c1}] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mbot_nl_34] ==== Deleting Files \ Folders ====================== C:\Program Files\CyberLink not found C:\Program Files\eSobi not found C:\Program Files\Reason not found C:\Program Files\Tesco not found C:\ProgramData\a95f8535-bd08-4370-a6e0-814924c0d5f0 not found C:\PROGRA~2\a95f8535-bd08-4370-a6e0-814924c0d5f0 not found C:\Program Files\Unlocker deleted C:\Program Files\Duplicate Filter deleted C:\Program Files\Vuze_Remote deleted C:\Users\Joon\appdata\locallow\Vuze_Remote deleted C:\Users\Joon\Documents\Optimizer Pro deleted C:\Users\J. Kornalijnslijper\AppData\LocalLow\Conduit deleted C:\Users\J. Kornalijnslijper\AppData\LocalLow\ConduitEngine deleted C:\Users\J. Kornalijnslijper\AppData\LocalLow\Vuze_Remote deleted C:\Users\Joon\AppData\LocalLow\Conduit deleted C:\Users\Joon\.android deleted C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml deleted C:\Program Files\Bonjour Print Services deleted C:\Program Files\VDownloader deleted C:\user.js deleted C:\Users\J. Kornalijnslijper\AppData\Roaming\VDownloader deleted C:\Users\J. Kornalijnslijper\AppData\Roaming\Yahoo! deleted C:\Users\J. Kornalijnslijper\AppData\Roaming\Babylon deleted C:\Users\J. Kornalijnslijper\AppData\Roaming\OpenCandy deleted C:\Users\Joon\AppData\Roaming\RHEng deleted C:\Users\Joon\AppData\Roaming\VDownloader deleted C:\PROGRA~2\APN deleted C:\PROGRA~2\{174892B1-CBE7-44F5-86FF-AB555EFD73A3} deleted C:\PROGRA~2\{429CAD59-35B1-4DBC-BB6D-1DB246563521} deleted C:\Users\J. Kornalijnslijper\AppData\Local\Conduit deleted C:\Users\Joon\AppData\Local\HWVendorDetection.log deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PremierOpinion deleted C:\Users\Joon\AppData\LocalLow\IAC deleted C:\Users\Joon\AppData\LocalLow\PriceGong deleted C:\Windows\system32\tasks\ASP deleted C:\Windows\System32\drivers\SPPD.sys deleted C:\Windows\system32\roboot.exe deleted C:\Windows\System32\SETDA99.tmp deleted C:\Windows\system32\pmls.dll deleted C:\Users\J2EDE~1.KOR\AppData\Roaming\Mozilla\Firefox\Profiles\kc7nlszz.default\searchplugins\askcom.xml deleted C:\Users\J2EDE~1.KOR\AppData\Roaming\Mozilla\Firefox\Profiles\kc7nlszz.default\CT2504091 deleted C:\Users\Joon\paint_shop_pro_x.exe deleted C:\Users\J2EDE~1.KOR\AppData\Roaming\Mozilla\Firefox\Profiles\kc7nlszz.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted C:\Users\J2EDE~1.KOR\AppData\Roaming\Mozilla\Firefox\Profiles\kc7nlszz.default\conduitCommon deleted ==== System Specs ====================== Windows: Windows Vista Business Edition Service Pack 2 (Build 6002) Memory (RAM): 1791 MB CPU Info: AMD Athlon(tm) Dual Core Processor 4850e CPU Speed: 2538,2 MHz Sound Card: Realtek Digital Output (Realtek | Display Adapters: ATI Radeon X1250 | ATI Radeon X1250 | RDPDD Chained DD | RDP Encoder Mirror Driver Monitors: 1x; HP Compaq LA2205 Wide LCD Monitor | Screen Resolution: 1280 X 768 - 32 bit Network: Network Present Network Adapters: Atheros AR5007EG Wireless Network Adapter | Realtek RTL8168/8111 Family PCI-E Gigabit Ethernet NIC (NDIS 6.0) CD / DVD Drives: 1x (E: | ) E: MATSHITADVD-RAM UJ-875S Ports: COM Ports NOT Present. LPT Port NOT Present. Mouse: 5 Button Wheel Mouse Present Hard Disks: C: 143,8GB | D: 143,6GB | F: 111,8GB Hard Disks - Free: C: 19,7GB | D: 5,0GB | F: 9,9GB Manufacturer *: Phoenix Technologies, LTD BIOS Info: AT/AT COMPATIBLE | 08/09/08 | ACRSYS - 42302e31 Time Zone: West-Europa (standaardtijd) Motherboard *: Acer FRS690L Country: Nederland Language: NLD ==== System Specs (Software) ====================== AV: Microsoft Security Essentials *Enabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A} AV: Norman Security Suite Anti-Virus *Disabled/Updated* {EE1E9DC5-F163-7545-FFEE-B15767C7A7EB} SP: Microsoft Security Essentials *Enabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norman Security Suite Anti-Spyware *Disabled/Updated* {557F7C21-D759-7ACB-C55E-8A251C40ED56} FW: Norman Security Suite Firewall *Enabled* {D6251CE0-BB0C-741D-D4B1-18629914E090} Default Browser: Google Chrome 47.0.2526.73 Internet Explorer Version: 9.0.8112.16421 Google Chrome version: 47.0.2526.73 Adobe Reader version: 10.1.16.13 Sun Java version: 1.8.0_66 (32-bit) ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\Joon\AppData\Local\Temp ==== 2015-11-29 14:57:10 BCB0728F4B117855765CE8FE883B5E9B 1536 ----a-w- C:\Users\Joon\AppData\Local\Temp\NOSEventMessages.dll ====== Java Cache ===== ====== C:\Windows\system32 ===== ====== C:\Windows\system32\drivers ===== 2015-11-12 23:38:47 EC565DFA3D9C45D8083B72DEC5B33710 72192 ----a-w- C:\Windows\System32\drivers\tdx.sys 2015-11-12 23:38:46 4A0978779958D8FE8F5849F452BCC812 273408 ----a-w- C:\Windows\System32\drivers\afd.sys 2015-11-12 23:27:52 DEC4B200C459FA929B0A764E79904B79 526272 ----a-w- C:\Windows\System32\drivers\ndis.sys 2015-11-12 23:22:45 C89E473697B67F0E3AE9211ADBD43278 440768 ----a-w- C:\Windows\System32\drivers\ksecdd.sys ====== C:\Windows\Tasks ====== 2015-11-16 17:01:09 635EAE27E39B8714D84ABDB88F26AC88 3008 ----a-w- C:\Windows\system32\Tasks\{484E205F-D789-4E72-A444-7713FD99B651} ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2015-11-29 13:48:46 -------- d-----w- C:\Program Files\trend micro 2015-11-20 15:35:28 -------- d-----w- C:\Program Files\Common Files\Java ======= C: ===== ====== C:\Users\Joon\AppData\Roaming ====== ====== C:\Users\Joon ====== 2015-11-29 13:43:55 -------- d-----w- C:\ProgramData\Reason 2015-11-29 13:35:49 8685FAF50C04F9A9C2F56FF64B0B7ACB 1107968 ----a-w- C:\Users\Joon\Downloads\RSIT.exe ====== C: exe-files == 2015-12-06 11:22:42 EC0FAADC62E1C1DADA953DE433BEFB01 88392 ----atw- C:\Program Files\Google\Update\1.3.29.1\GoogleUpdateOnDemand.exe 2015-12-06 11:22:42 BA7396EF42213C0F84343C186610B851 88392 ----atw- C:\Program Files\Google\Update\1.3.29.1\GoogleUpdateWebPlugin.exe 2015-12-06 11:22:42 AD8495335C1A605A4E0E32334DF52303 88392 ----atw- C:\Program Files\Google\Update\1.3.29.1\GoogleUpdateBroker.exe 2015-12-06 11:22:40 1D652959033B873B77B8D5A12011FD85 927824 ----a-w- C:\Program Files\Google\Update\1.3.29.1\GoogleUpdateSetup.exe 2015-12-06 11:22:28 73F542663FD48B49A798A56DAA18C136 307016 ----atw- C:\Program Files\Google\Update\1.3.29.1\GoogleCrashHandler64.exe 2015-12-06 11:22:28 5424FDF3776F5458EAFAABFB87AA9285 130888 ----atw- C:\Program Files\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe 2015-12-06 11:22:27 7DC16FAEA44C8D96A1C113305A4059A2 245576 ----atw- C:\Program Files\Google\Update\1.3.29.1\GoogleCrashHandler.exe 2015-12-06 11:22:25 88FBBB1C601A6BC42054E57C2897FA45 144200 ----atw- C:\Program Files\Google\Update\1.3.29.1\GoogleUpdate.exe 2015-12-06 11:22:14 1D652959033B873B77B8D5A12011FD85 927824 ----a-w- C:\Program Files\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.29.1\GoogleUpdateSetup.exe 2015-12-03 06:22:03 1C7B42662625CB22E1CAA241A1D845CC 6912080 ----a-w- C:\Program Files\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\47.0.2526.73\47.0.2526.73_46.0.2490.86_chrome_updater.exe === C: other files == ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /detectMem" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /detectMem" [HKEY_USERS\S-1-5-21-266344984-2920979057-1876800491-1004\Software\Microsoft\Windows\CurrentVersion\Run] "HP Photosmart 6520 series (NET)"="C:\Program Files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe -deviceID CN28S1511F05TZ:NW -scfn HP Photosmart 6520 series (NET) -AutoStart 1" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "NokiaSuite.exe"="C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe -tray" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSC"="C:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey" "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun" "RtHDVCpl"="RtHDVCpl.exe" "AutoLockProcess"="C:\Acer\Empowering Technology\eLock\autolockprocess\autolockprocess.exe" "Norman ZANDA"="C:\Program Files\Norman\Npm\Bin\ZLH.EXE /LOAD /SPLASH" "DT HWP"="C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HWP" "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "HP Photosmart 6520 series (NET)"="C:\Program Files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe -deviceID CN28S1511F05TZ:NW -scfn HP Photosmart 6520 series (NET) -AutoStart 1" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" "NokiaSuite.exe"="C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe -tray" ==== Startup Registry Disabled ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="KiesPDLR" "hkey"="HKCU" "command"="C:\\Program Files\\Samsung\\Kies\\External\\FirmwareUpdate\\KiesPDLR.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Acer Empowering Technology Monitor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Acer Empowering Technology Monitor" "hkey"="HKLM" "command"="C:\\Acer\\Empowering Technology\\SysMonitor.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AdminWorks Tray] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AdminWorks Tray" "hkey"="HKLM" "command"="\"C:\\Acer\\LANScope Agent\\awtray.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\APSDaemon] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="APSDaemon" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\D7A29B69611541B340BBCE8881BBD1BDD94F0C4B._service_run] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="D7A29B69611541B340BBCE8881BBD1BDD94F0C4B._service_run" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --type=service" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DivXMediaServer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DivXMediaServer" "hkey"="HKLM" "command"="C:\\Program Files\\DivX\\DivX Media Server\\DivXMediaServer.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DivXUpdate] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DivXUpdate" "hkey"="HKLM" "command"="\"C:\\Program Files\\DivX\\DivX Update\\DivXUpdate.exe\" /CHECKNOW" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\eDataSecurity Loader] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="eDataSecurity Loader" "hkey"="HKLM" "command"="C:\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSloader.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\eRecoveryService] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="eRecoveryService" "hkey"="HKLM" "command"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Facebook Update] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Facebook Update" "hkey"="HKCU" "command"="\"C:\\Users\\J. Kornalijnslijper\\AppData\\Local\\Facebook\\Update\\FacebookUpdate.exe\" /c /nocrashserver" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HP Software Update] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="HP Software Update" "hkey"="HKLM" "command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ISUSPM Startup] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ISUSPM Startup" "hkey"="HKCU" "command"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\ISUSPM.exe\" -startup" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ISUSScheduler] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ISUSScheduler" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\KiesPreload] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="KiesPreload" "hkey"="HKCU" "command"="C:\\Program Files\\Samsung\\Kies\\Kies.exe /preload" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\KiesTrayAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="KiesTrayAgent" "hkey"="HKLM" "command"="C:\\Program Files\\Samsung\\Kies\\KiesTrayAgent.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Network Drive Mapping Utility] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Network Drive Mapping Utility" "hkey"="HKLM" "command"="\"C:\\Program Files\\Linksys\\Network Storage\\Network Drive Mapping Utility.exe\" Z" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NokiaSuite.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NokiaSuite.exe" "hkey"="HKCU" "command"="C:\\Program Files\\Nokia\\Nokia Suite\\NokiaSuite.exe -tray" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="QuickTime Task" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Skytel] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Skytel" "hkey"="HKLM" "command"="Skytel.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\swg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="swg" "hkey"="HKCU" "command"="\"C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\UnlockerAssistant] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="UnlockerAssistant" "hkey"="HKLM" "command"="\"C:\\Program Files\\Unlocker\\UnlockerAssistant.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WarReg_PopUp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="WarReg_PopUp" "hkey"="HKLM" "command"="C:\\Acer\\WR_PopUp\\WarReg_PopUp.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Windows Defender] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Windows Defender" "hkey"="HKLM" "command"="%ProgramFiles%\\Windows Defender\\MSASCui.exe -hide" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk] "item"="Empowering Technology Launcher" "path"="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Empowering Technology Launcher.lnk" "backup"="C:\\Windows\\pss\\Empowering Technology Launcher.lnk.CommonStartup" "backupExtension"=".CommonStartup" "command"="C:\\Acer\\EMPOWE~1\\EAPLAU~1.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Philips Configo.lnk] "item"="Philips Configo" "path"="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Philips Configo.lnk" "backup"="C:\\Windows\\pss\\Philips Configo.lnk.CommonStartup" "backupExtension"=".CommonStartup" "command"="C:\\PROGRA~1\\Philips\\Configo\\217~1.0\\Configo.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^J. Kornalijnslijper^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Schermopname en Snel starten.lnk] "item"="OneNote 2007 Schermopname en Snel starten" "path"="C:\\Users\\J. Kornalijnslijper\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneNote 2007 Schermopname en Snel starten.lnk" "backup"="C:\\Windows\\pss\\OneNote 2007 Schermopname en Snel starten.lnk.Startup" "backupExtension"=".Startup" "command"="C:\\PROGRA~1\\MICROS~1\\Office12\\ONENOTEM.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^J. Kornalijnslijper^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^VDownloader.lnk] "path"="C:\\Users\\J. Kornalijnslijper\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\VDownloader.lnk" "backup"="C:\\Windows\\pss\\VDownloader.lnk.Startup" "backupExtension"=".Startup" "command"="C:\\PROGRA~1\\VDOWNL~1\\VDOWNL~1.EXE /silent" "item"="VDownloader" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Joon^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Schermopname en Snel starten.lnk] "item"="OneNote 2007 Schermopname en Snel starten" "path"="C:\\Users\\Joon\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneNote 2007 Schermopname en Snel starten.lnk" "backup"="C:\\Windows\\pss\\OneNote 2007 Schermopname en Snel starten.lnk.Startup" "backupExtension"=".Startup" "command"="C:\\PROGRA~1\\MICROS~1\\Office12\\ONENOTEM.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Joon^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^VDownloader.lnk] "item"="VDownloader" "path"="C:\\Users\\Joon\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\VDownloader.lnk" "backup"="C:\\Windows\\pss\\VDownloader.lnk.Startup" "backupExtension"=".Startup" "command"="C:\\PROGRA~1\\VDOWNL~1\\VDOWNL~1.EXE" ==== Startup Folders ====================== 2013-12-11 22:52:31 3656 --sha-w- C:\Users\Joon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote-inhoudsopgave.onetoc2 ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [11-11-2015 06:41] C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-266344984-2920979057-1876800491-1003Core.job --a------ C:\Users\J. Kornalijnslijper\AppData\Local\Facebook\Update\FacebookUpdate.exe [16-07-2012 06:19] C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-266344984-2920979057-1876800491-1003UA.job --a------ C:\Users\J. Kornalijnslijper\AppData\Local\Facebook\Update\FacebookUpdate.exe [16-07-2012 06:19] C:\Windows\tasks\GoogleUpdateTaskMachineCore1cf6cf920790203.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [30-08-2015 22:27] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ [Undetermined Task] ==== Other Scheduled Tasks ====================== "C:\Windows\system32\tasks\Adobe Flash Player Updater" [C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\system32\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\Windows\system32\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\system32\tasks\FacebookUpdateTaskUserS-1-5-21-266344984-2920979057-1876800491-1003Core" [C:\Users\J. Kornalijnslijper\AppData\Local\Facebook\Update\FacebookUpdate.exe] "C:\Windows\system32\tasks\FacebookUpdateTaskUserS-1-5-21-266344984-2920979057-1876800491-1003UA" [C:\Users\J. Kornalijnslijper\AppData\Local\Facebook\Update\FacebookUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore1cf6cf920790203" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\HP AR Program Upload - 1142c6e7a75f4a149829c548b67c3e357e2fbf05591c4f81b8ccf5e396c796b8" [C:\Program Files\HP\HP Photosmart 6520 series\bin\HPRewards.exe] "C:\Windows\system32\tasks\HP AR Program Upload - 77c1577525074376ae60102b0ce6acc1b16c1865718b455388e14e81780ca948" [C:\Program Files\HP\HP Photosmart 6520 series\bin\HPRewards.exe] "C:\Windows\system32\tasks\{484E205F-D789-4E72-A444-7713FD99B651}" ["c:\program files\google\chrome\application\chrome.exe"] "C:\Windows\system32\tasks\{C5218FF3-378B-49AB-A913-F68832FD449B}" ["c:\program files\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.59.104/nl/abandoninstall?page=tsProgressBar] "C:\Windows\system32\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files\Apple Software Update\SoftwareUpdate.exe] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "support@vdownloader.com"="C:\Program Files\VDownloader\Addons\FireFox" [] ==== Firefox Extensions ====================== ProfilePath: C:\Users\J2EDE~1.KOR\AppData\Roaming\Mozilla\Firefox\Profiles\kc7nlszz.default - Undetermined - C:\Users\J. Kornalijnslijper\AppData\Roaming\Mozilla\Firefox\Profiles\kc7nlszz.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} - Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension - Undetermined - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 AppDir: C:\Program Files\Mozilla Firefox - Skype Click to Call - %AppDir%\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} ==== Firefox Plugins ====================== ==== Chromium Look ====================== Google Chrome Version: 46.0.2490.86 HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions eoccbpoodnckjdnackiffhjfkogfhnhh - C:\Program Files\VDownloader\Addons\Chrome.crx[] fheoggkfdfchfphceeifdbepaooicaho - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx[] lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx[02-10-2012 12:14] Skype Click to Call - J. Kornalijnslijper\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl Chrome Web Store Payments - J. Kornalijnslijper\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Skype Click to Call - Joon\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl Chrome Web Store Payments - Joon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Skype Click to Call - J2EDE~1.KOR\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl Chrome Web Store Payments - J2EDE~1.KOR\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda ==== Chromium Fix ====================== C:\Users\J. Kornalijnslijper\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage-journal deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage deleted successfully C:\Users\J. Kornalijnslijper\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage-journal deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.jazzfestivalenkhuizen.nl/" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs] "Tabs"="http://services.freshy.com/general/newhometab.php?hometab=home&partner=10853&guid={A533DBE6-BF8B-421A-AF0A-01C8340371C1}&i=" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.jazzfestivalenkhuizen.nl/" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs] "Tabs"="about:newtab" ==== All HKLM and HKCU SearchScopes ====================== HKLM\SearchScopes "DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" HKLM\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} - No_Url_Value HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC HKLM\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 HKLM\SearchScopes\{75b4241f-171e-44a3-bf44-23613b6e3e03} - http://search.tb.ask.com/search/GGmain.jhtml?p2=^AYY^xdm072^YYA^nl&si=flvrunner&ptb=CD57B86D-704E-47ED-8B0F-2C7462EFB9F6&ind=2013090714&n=77fd539a&psa=&st=sb&searchfor={searchTerms} HKCU\SearchScopes "DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms} HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - No_Url_Value HKCU\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - https://www.google.com/search?q={searchTerms}&rlz=1I7ADRA_nlNL415 HKCU\SearchScopes\{75b4241f-171e-44a3-bf44-23613b6e3e03} - No_Url_Value ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-266344984-2920979057-1876800491-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_USERS\S-1-5-21-266344984-2920979057-1876800491-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_CLASSES_ROOT\CLSID\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_USERS\S-1-5-21-266344984-2920979057-1876800491-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted successfully HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\support@vdownloader.com deleted successfully ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\eoccbpoodnckjdnackiffhjfkogfhnhh deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\fheoggkfdfchfphceeifdbepaooicaho deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vuze_Remote Toolbar deleted successfully HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload deleted successfully HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent deleted successfully HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Drive Mapping Utility deleted successfully HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant deleted successfully ==== HijackThis Entries ====================== O1 - Hosts: ::1 localhost O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll O2 - BHO: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [AutoLockProcess] C:\Acer\Empowering Technology\eLock\autolockprocess\autolockprocess.exe O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH O4 - HKLM\..\Run: [DT HWP] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HWP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [HP Photosmart 6520 series (NET)] "C:\Program Files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN28S1511F05TZ:NW" -scfn "HP Photosmart 6520 series (NET)" -AutoStart 1 O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [NokiaSuite.exe] C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe -tray O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Startup: OneNote-inhoudsopgave.onetoc2 O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O18 - Protocol: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe O23 - Service: WebEx Service Host for Support Center (atashost) - Cisco WebEx LLC - C:\Windows\system32\atashost.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: eProtection Service (eProtection) - Unknown owner - C:\Program Files\Acer\eProtection\Service\eProtectionServ.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Norman Flight Recorder service (nfservice) - Norman Safeground AS - C:\Program Files\Norman\Npm\Bin\nfservice.exe O23 - Service: Norman Intrusion Guard (NIG) - Norman Safeground AS - C:\Program Files\Norman\nig\bin\nigsvc32.exe O23 - Service: Norman Jeeves (NJeeves2) - Unknown owner - C:\Program Files\Norman\Npm\Bin\Njeeves2.exe O23 - Service: Norman Network Filtering service (NNFSVC) - Norman Safeground AS - C:\Program Files\Norman\Ngs\Bin\Nnf.exe O23 - Service: Norman ZANDA - Norman Safeground AS - C:\Program Files\Norman\Npm\Bin\Zanda.exe O23 - Service: Norman Personal Firewall Service (NPFSvc32) - Norman Safeground AS - C:\Program Files\Norman\npf\bin\npfsvc32.exe O23 - Service: Norman Security service (NPROSECSVC) - Norman Safeground AS - C:\Program Files\Norman\Ngs\Bin\Nprosec.exe O23 - Service: Norman Engine Update Service (nseupdatesvc) - Norman Safeground AS - C:\Program Files\Norman\nse\bin\nseupdatesvc.exe O23 - Service: Norman Anti Malware Service (nvcsvc) - Norman Safeground AS - C:\Program Files\Norman\nvc\bin\nvcsvc.exe O23 - Service: Norman Resource Provider (NICCA) (nvoy) - Norman AS - C:\Program Files\Norman\Npm\Bin\nvoy.exe O23 - Service: Norman WSC Monitor Service 2 (NWSCMON2) - Norman Safeground AS - C:\Program Files\Norman\Npm\Bin\nwscmon2.exe O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe O23 - Service: Rapport Management Service (RapportMgmtService) - IBM Corp. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe O23 - Service: Norman Scheduler Service (Scheduler) - Norman Safeground AS - C:\Program Files\Norman\Npm\Bin\scheduler.exe O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe ==== Empty IE Cache ====================== C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\J. Kornalijnslijper\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\J. Kornalijnslijper\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Users\J. Kornalijnslijper\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Joon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Users\Joon\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\J2EDE~1.KOR\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\J2EDE~1.KOR\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Users\J2EDE~1.KOR\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Joon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot ==== Empty FireFox Cache ====================== No FireFox Cache found ==== Empty Chrome Cache ====================== C:\Users\J. Kornalijnslijper\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\Joon\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\J2EDE~1.KOR\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=585 folders=186 141955365 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\J. Kornalijnslijper\AppData\Local\Temp emptied successfully C:\Users\Joon\AppData\Local\Temp will be emptied at reboot C:\Users\J2EDE~1.KOR\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\Joon\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Users\Joon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted "C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted "C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted ==== EOF on di 08-12-2015 at 12:21:34,91 ======================