Zoek.exe v5.0.0.1 Updated 20-December-2015 Tool run by Greet on ma 21/12/2015 at 18:32:01,48. Microsoft Windows 8.1 Pro N 6.3.9600 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\Greet\Desktop\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 21/12/2015 18:34:42 Zoek.exe System Restore Point Created Successfully. ==== Empty Folders Check ====================== C:\PROGRA~2\Sony Mobile deleted successfully C:\PROGRA~2\Wondershare deleted successfully C:\Program Files\log deleted successfully C:\PROGRA~3\ALM deleted successfully C:\PROGRA~3\Reprise deleted successfully C:\Users\Greet\AppData\Local\EmieBrowserModeList deleted successfully C:\Users\Greet\AppData\Local\EmieSiteList deleted successfully C:\Users\Greet\AppData\Local\EmieUserList deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-4172638529-490413501-1354734073-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} deleted successfully HKEY_USERS\S-1-5-21-4172638529-490413501-1354734073-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} deleted successfully HKEY_CLASSES_ROOT\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Registry Fix Code x64 ====================== Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run] ""=- ==== Deleting Files \ Folders ====================== C:\PROGRA~2\Sony Mobile not found C:\PROGRA~2\Wondershare not found C:\Users\Greet\AppData\Local\Wondershare deleted C:\user.js deleted C:\Users\Greet\AppData\Roaming\ContactSheetII.log deleted C:\Users\Greet\AppData\Roaming\Thinstall deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted C:\Users\Greet\AppData\LocalLow\Company deleted C:\Windows\SysNative\config\systemprofile\Searches deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\Greet\AppData\Local\Temp ==== 2015-12-20 08:56:43 50754352847B5E71E11ABF4D30407148 441220 ------w- C:\Users\Greet\AppData\Local\Temp\jna\jna6106961810868075121.dll ====== Java Cache ===== 2015-12-12 13:29:34 C6614F603FB777A0E64B6993B8C39BBB 438 ----a-w- C:\Users\Greet\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\1644d84d-cade22968014b4a08696acaf3eaace939cc9f5010043c54b0c4bb040cb3a45dc-6.0.lap 2015-12-12 13:30:05 F03069EF1C8F5DC0982C397AFBF97147 62271 ----a-w- C:\Users\Greet\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\66fe060d-7a897dce 2015-12-12 13:30:05 D088FF9CB484B37CD62DCA54362D0A0A 434 ----a-w- C:\Users\Greet\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\41bf770f-a8915d95f525f4346331035b7328c0b14b17dd9bf4bb3dbf3f8aee4ebdc33d7d-6.0.lap 2015-12-12 17:29:48 FAA6C85BC2BB08C06BB45A6048378055 64767 ----a-w- C:\Users\Greet\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\7785d013-2a25494a 2015-12-12 13:30:43 48DE5B6E9CB6F7BA991C2723CB888C82 438 ----a-w- C:\Users\Greet\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\66a7eba2-24f3f860a53ddd53c8f76756ff1a61a239aee2e044d30010e19985e66264e948-6.0.lap 2015-12-12 13:29:37 ECDC3BABC61B94F1238C10F8C1732D09 145189 ----a-w- C:\Users\Greet\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\51e813ed-55d43069 2015-12-12 17:29:46 DD8883EA532D0281AB309D19E508C66F 435 ----a-w- C:\Users\Greet\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\68613205-42c322eaf69be64cb0534c14aa6f6fe1c59fa846722e97ab1280cbefc3f970c3-6.0.lap ====== C:\Windows\SysWOW64 ===== 2015-12-09 07:25:50 713919E7E3BD6196D2498C2B8166AEAD 663552 ----a-w- C:\Windows\SysWOW64\jscript.dll 2015-12-09 07:25:50 668D2CA489F605E4C7A743A62632C383 4514816 ----a-w- C:\Windows\SysWOW64\jscript9.dll 2015-12-09 07:25:50 3477EAB965E9DEDCD46F95C55F78489F 710144 ----a-w- C:\Windows\SysWOW64\ieapfltr.dll 2015-12-09 07:25:50 2010B9DF05FF49DA5C56E372D1135C20 880128 ----a-w- C:\Windows\SysWOW64\inetcomm.dll 2015-12-09 07:25:50 0955BBBB50FCC3C2B2EB485FBBFBF4D3 496640 ----a-w- C:\Windows\SysWOW64\vbscript.dll 2015-12-09 07:25:49 B60461B5CED2BFAE1A870C61C66966C4 2011136 ----a-w- C:\Windows\SysWOW64\wininet.dll 2015-12-09 07:25:47 5FA89E1534B675CCA8CEE6B50D0B7B49 2280448 ----a-w- C:\Windows\SysWOW64\iertutil.dll 2015-12-09 07:25:42 B206E8BD4938B6C6B1C84DD13C12C4DF 20366848 ----a-w- C:\Windows\SysWOW64\mshtml.dll 2015-12-09 07:25:40 284442A1BAFD17731398AD22AB6C9099 12856832 ----a-w- C:\Windows\SysWOW64\ieframe.dll 2015-12-09 07:25:39 219494B7F95F86071EC9D4FC0DC4962F 1311744 ----a-w- C:\Windows\SysWOW64\urlmon.dll 2015-12-09 07:25:38 6ED639FAAE29626ED1A98139A3C9C289 687104 ----a-w- C:\Windows\SysWOW64\msfeeds.dll 2015-12-09 07:25:37 F1ED865CA8D6223739233576D7C76C1A 476160 ----a-w- C:\Windows\SysWOW64\ieui.dll 2015-12-09 07:25:35 DD99C9D2CA3F9B3D63B965B4EDDAE612 2050560 ----a-w- C:\Windows\SysWOW64\inetcpl.cpl 2015-12-09 07:25:35 9E096DAFF4A3E967C0010CB9FA272C20 1048576 ----a-w- C:\Windows\SysWOW64\actxprxy.dll 2015-12-09 07:25:35 573B48998A78496D6D40D9C484192C96 325632 ----a-w- C:\Windows\SysWOW64\iedkcs32.dll 2015-12-09 07:25:34 4ED815FE30E048A52A5FC420DD6E49D0 230400 ----a-w- C:\Windows\SysWOW64\webcheck.dll 2015-12-09 07:25:34 13DED010D9DFA204DB2C2F650B3901B8 279040 ----a-w- C:\Windows\SysWOW64\dxtrans.dll 2015-12-09 07:25:33 0E4EB92ED1D036F7C892E9AD3D821BF5 128000 ----a-w- C:\Windows\SysWOW64\iepeers.dll 2015-12-09 07:25:33 081BE765C4025EC2AB8011A6BFE222B5 64000 ----a-w- C:\Windows\SysWOW64\MshtmlDac.dll 2015-12-09 07:24:14 EC29997928C7453BB25D1A3A3A71665F 7168 ----a-w- C:\Windows\SysWOW64\KBDAZST.DLL 2015-12-09 07:24:14 CAE3F5A31092521F08624F9797ED72EA 200704 ----a-w- C:\Windows\SysWOW64\GlobCollationHost.dll 2015-12-09 07:24:14 8F693C83B367F9B04271E9DBC08ADA7D 7168 ----a-w- C:\Windows\SysWOW64\KBDAZEL.DLL 2015-12-09 07:24:14 80A137ED266913C13FE4E30FC2D38838 7168 ----a-w- C:\Windows\SysWOW64\KBDAZE.DLL 2015-12-09 07:24:14 80582AA01F5BD0FA9DA153630208CD93 513456 ----a-w- C:\Windows\SysWOW64\locale.nls 2015-12-09 07:24:14 54BC75A1E5CEA6635EBFCA627F6C3719 868864 ----a-w- C:\Windows\SysWOW64\Windows.Globalization.dll 2015-12-09 07:24:13 87F4773DE0231F08BB572AC09A98EEE2 7168 ----a-w- C:\Windows\SysWOW64\kbdgeoqw.dll 2015-12-09 07:24:09 EA12C211254C4898F9B82DAE20AA372A 1499920 ----a-w- C:\Windows\SysWOW64\ntdll.dll 2015-12-09 07:24:09 6A0901DD70B669927C62A84F6E834A7A 414208 ----a-w- C:\Windows\SysWOW64\catsrvut.dll 2015-12-09 07:24:09 457EB1E8ACA3D6B0B7D366C8264E60F8 14336 ----a-w- C:\Windows\SysWOW64\ntvdm64.dll 2015-12-09 07:24:09 05E13CBD68B08CECB986969611D0A12C 1344000 ----a-w- C:\Windows\SysWOW64\comsvcs.dll 2015-12-09 07:24:06 C883C740EFBE6C298FE7EF3882A3A513 1559552 ----a-w- C:\Windows\SysWOW64\DWrite.dll 2015-12-09 07:24:06 72DF14DA8F1CC15F7BE4176DE0404D9E 1376256 ----a-w- C:\Windows\SysWOW64\user32.dll 2015-12-09 07:24:06 22C35A1912B6352FDFB8EC5E37DC7A10 1124384 ----a-w- C:\Windows\SysWOW64\msctf.dll 2015-12-09 07:24:06 12F891ACA590368A341D0870AE17D46A 1490944 ----a-w- C:\Windows\SysWOW64\GdiPlus.dll 2015-12-09 07:23:49 55E39A093E4B88F359D2E2D3C410BA78 2462720 ----a-w- C:\Windows\SysWOW64\authui.dll 2015-12-09 07:23:48 D9067A6C370B6AFC04CC582C4F9F8E72 726528 ----a-w- C:\Windows\SysWOW64\wuapi.dll 2015-12-09 07:23:48 463873126358017A07CE8976451759EF 53248 ----a-w- C:\Windows\SysWOW64\PCPKsp.dll 2015-12-09 07:23:47 90E17A681CCBED78BCBC8F7A4455E298 29696 ----a-w- C:\Windows\SysWOW64\wuapp.exe 2015-12-09 07:23:47 4190932D111FF196E9CFBBD5F4232045 81920 ----a-w- C:\Windows\SysWOW64\wudriver.dll 2015-12-09 07:23:47 0FB556A745740EA7309AC9C9609678FA 124928 ----a-w- C:\Windows\SysWOW64\wuwebv.dll ====== C:\Windows\SysWOW64\drivers ===== ====== C:\Windows\Sysnative ===== 2015-12-09 07:25:50 32C4438BACFF7AAC86AE54FAE74AA483 571392 ----a-w- C:\Windows\Sysnative\vbscript.dll 2015-12-09 07:25:49 C24E9C3490373F476166A0D466B0BB8C 1032704 ----a-w- C:\Windows\Sysnative\inetcomm.dll 2015-12-09 07:25:49 64F4B886C95379DEA6EF3DDF3CE2D853 800768 ----a-w- C:\Windows\Sysnative\ieapfltr.dll 2015-12-09 07:25:49 4264B4BD10C5A21CF4A15998CB71551F 817664 ----a-w- C:\Windows\Sysnative\jscript.dll 2015-12-09 07:25:49 3F0827114CE89176253684B588D4B02E 5923840 ----a-w- C:\Windows\Sysnative\jscript9.dll 2015-12-09 07:25:48 E2C385B0D816AD37616BD4C4204D0633 2487808 ----a-w- C:\Windows\Sysnative\wininet.dll 2015-12-09 07:25:48 A8B4563632BAF46BB005A0127727E82D 25837568 ----a-w- C:\Windows\Sysnative\mshtml.dll 2015-12-09 07:25:47 5040CEF0DC919A81AF2C10CC67F3F36C 2887168 ----a-w- C:\Windows\Sysnative\iertutil.dll 2015-12-09 07:25:41 23D900117F368A884C4C36A57E201F97 798208 ----a-w- C:\Windows\Sysnative\msfeeds.dll 2015-12-09 07:25:40 A2F0AB5736B60AC22D63113489D37FF1 14456832 ----a-w- C:\Windows\Sysnative\ieframe.dll 2015-12-09 07:25:38 D0EB186DFF60A296B144A0FC2490AC31 1546752 ----a-w- C:\Windows\Sysnative\urlmon.dll 2015-12-09 07:25:37 963F01E33EFADF54DDCCDDF31DFC2D37 615936 ----a-w- C:\Windows\Sysnative\ieui.dll 2015-12-09 07:25:37 33E703517D83F367B0B0B3EF2C807C77 718336 ----a-w- C:\Windows\Sysnative\ie4uinit.exe 2015-12-09 07:25:35 B72E7828994EC80B5595111D5CD092F5 372224 ----a-w- C:\Windows\Sysnative\iedkcs32.dll 2015-12-09 07:25:35 6D86F7F6C9FE6059B610DB1D6EF77659 2123264 ----a-w- C:\Windows\Sysnative\inetcpl.cpl 2015-12-09 07:25:35 2A0AB8E59C47DC589C2DF3CEB1AA22EF 92160 ----a-w- C:\Windows\Sysnative\mshtmled.dll 2015-12-09 07:25:34 ECD38A229EECE874598B854B2A306347 145408 ----a-w- C:\Windows\Sysnative\iepeers.dll 2015-12-09 07:25:34 C50956683D1FE88EC184F5047EC82864 2880000 ----a-w- C:\Windows\Sysnative\actxprxy.dll 2015-12-09 07:25:34 503155AF5513116632202504D71FA29D 315392 ----a-w- C:\Windows\Sysnative\dxtrans.dll 2015-12-09 07:25:34 377C0436711DE3AFB9527FB88F831F44 262144 ----a-w- C:\Windows\Sysnative\webcheck.dll 2015-12-09 07:24:14 B96A7E78FF3DFBB01515103C1D1A709D 7168 ----a-w- C:\Windows\Sysnative\KBDAZEL.DLL 2015-12-09 07:24:14 B848BD522613BEFC050115376776142C 7168 ----a-w- C:\Windows\Sysnative\KBDAZE.DLL 2015-12-09 07:24:14 B80DCE56ABFF1F616609A6747B4F4997 1200128 ----a-w- C:\Windows\Sysnative\Windows.Globalization.dll 2015-12-09 07:24:14 80582AA01F5BD0FA9DA153630208CD93 513456 ----a-w- C:\Windows\Sysnative\locale.nls 2015-12-09 07:24:14 50B837542006546DEBE89A9AB8B2A17B 7168 ----a-w- C:\Windows\Sysnative\KBDAZST.DLL 2015-12-09 07:24:13 B04F291677C9B91405E84FBCD0437411 7168 ----a-w- C:\Windows\Sysnative\kbdgeoqw.dll 2015-12-09 07:24:13 48C3652B04833C1D517A4BF751519F65 323072 ----a-w- C:\Windows\Sysnative\GlobCollationHost.dll 2015-12-09 07:24:10 54A9B188D1E558C9EF987ACAA5E7B997 186880 ----a-w- C:\Windows\Sysnative\dpapisrv.dll 2015-12-09 07:24:10 4BB376166563BCF9FE3AF100E159EB04 7455064 ----a-w- C:\Windows\Sysnative\ntoskrnl.exe 2015-12-09 07:24:09 FAA44737F9CE36A16AE0B9657F265609 1355848 ----a-w- C:\Windows\Sysnative\winresume.exe 2015-12-09 07:24:09 D89241C56421970BD644CEA453F9F1A8 1487008 ----a-w- C:\Windows\Sysnative\winresume.efi 2015-12-09 07:24:09 944CCF13CB8C8A2ED3CFD1464807EE77 16896 ----a-w- C:\Windows\Sysnative\ntvdm64.dll 2015-12-09 07:24:09 7F4589C9A7B8BEE7F12B48244922F6DA 1735000 ----a-w- C:\Windows\Sysnative\ntdll.dll 2015-12-09 07:24:09 5CCBB90E1CE7A71718576A777AA47838 1706496 ----a-w- C:\Windows\Sysnative\comsvcs.dll 2015-12-09 07:24:09 592AC223520391D7D7E6F0D6A7723672 1659568 ----a-w- C:\Windows\Sysnative\winload.efi 2015-12-09 07:24:09 33F44F60A2ADADA0395114DCBD509623 1519592 ----a-w- C:\Windows\Sysnative\winload.exe 2015-12-09 07:24:09 258FCB4843397FE4008CC0B7041F16F7 522240 ----a-w- C:\Windows\Sysnative\catsrvut.dll 2015-12-09 07:24:06 F06533D9251558E69088F53AD420D796 1753600 ----a-w- C:\Windows\Sysnative\GdiPlus.dll 2015-12-09 07:24:06 44BCB14107479CF6874C06FEF5D77336 4176384 ----a-w- C:\Windows\Sysnative\win32k.sys 2015-12-09 07:24:06 33094E2182C451BCFCFD60F734B1C4EF 1540728 ----a-w- C:\Windows\Sysnative\user32.dll 2015-12-09 07:24:06 3250C161812B3A98ADABBAB19E8CB98B 1994752 ----a-w- C:\Windows\Sysnative\DWrite.dll 2015-12-09 07:24:06 2F225BC85B84C04EA01BAB8D8DACFA83 1383936 ----a-w- C:\Windows\Sysnative\FntCache.dll 2015-12-09 07:24:06 12CEF192F55EC60A9BCA37F4B2E7729B 1385280 ----a-w- C:\Windows\Sysnative\msctf.dll 2015-12-09 07:23:49 C903FFA0307A1BBD31F7B5316191F4E0 2775552 ----a-w- C:\Windows\Sysnative\authui.dll 2015-12-09 07:23:48 E0FEF9522094BE3AAEAE307118F556AD 897024 ----a-w- C:\Windows\Sysnative\wuapi.dll 2015-12-09 07:23:48 B1613F8E78ACA385EC652437482AC4DC 60928 ----a-w- C:\Windows\Sysnative\PCPKsp.dll 2015-12-09 07:23:48 688DAAE720E39DA86822785195646663 3706880 ----a-w- C:\Windows\Sysnative\wuaueng.dll 2015-12-09 07:23:47 9F0C4323E23ACDA82C46377DAC589411 52224 ----a-w- C:\Windows\Sysnative\wups2.dll 2015-12-09 07:23:47 91CA64009EF06F9C732E76B90C915FA4 140288 ----a-w- C:\Windows\Sysnative\wuwebv.dll 2015-12-09 07:23:47 82EF611A17E71211661210825CD50B43 2243584 ----a-w- C:\Windows\Sysnative\wucltux.dll 2015-12-09 07:23:47 6A5F107E73586860440F46651EC8DA31 409088 ----a-w- C:\Windows\Sysnative\WUSettingsProvider.dll 2015-12-09 07:23:47 47142466B2D7FF48A4F64E8CAA1A17DD 35840 ----a-w- C:\Windows\Sysnative\wuapp.exe 2015-12-09 07:23:47 30B7D98DC425DDB424C8DDFDB55979BA 136904 ----a-w- C:\Windows\Sysnative\wuauclt.exe 2015-12-09 07:23:47 0DBC49D2C19FAE040B2DEF2BFD09F5F0 95744 ----a-w- C:\Windows\Sysnative\wudriver.dll 2015-12-09 07:23:46 EC302D06155F8E3C383750993FCB6B27 146432 ----a-w- C:\Windows\Sysnative\wininit.exe 2015-12-09 07:23:46 3F8645885823692D93765817759BE21C 572928 ----a-w- C:\Windows\Sysnative\winlogon.exe ====== C:\Windows\Sysnative\drivers ===== 2015-12-09 07:25:52 A7D51169CA28B0AA9B5DE2B7EFB5C3C9 145408 ----a-w- C:\Windows\Sysnative\drivers\rmcast.sys 2015-12-09 07:23:48 FC974B03C8B87455F44F734C8F31A3C8 37376 -c--a-w- C:\Windows\Sysnative\drivers\usbuhci.sys 2015-12-09 07:23:48 D25F0093A71FFB355160358DD70B0373 443224 -c--a-w- C:\Windows\Sysnative\drivers\usbport.sys 2015-12-09 07:23:48 CD81683F4553677B9BF5163A922153EB 462168 -c--a-w- C:\Windows\Sysnative\drivers\usbhub.sys 2015-12-09 07:23:48 BBFD17B6B954FC9FA02E62D604052069 92504 -c--a-w- C:\Windows\Sysnative\drivers\usbehci.sys 2015-12-09 07:23:48 A0F0484C97D6441ED6A75D7426ECCC9E 30208 -c--a-w- C:\Windows\Sysnative\drivers\usbohci.sys 2015-12-09 07:23:48 9A2B3A98D7982372CA36A823F673EFB8 27992 -c--a-w- C:\Windows\Sysnative\drivers\usbd.sys 2015-12-09 07:23:48 5C90D5379B53590FBB24BBAD4FA682EE 468824 -c--a-w- C:\Windows\Sysnative\drivers\USBHUB3.SYS 2015-12-09 07:23:48 3AF1FA17F1C4ACBDB660D8F98B1A9C13 78848 -c--a-w- C:\Windows\Sysnative\drivers\winusb.sys ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2015-12-21 12:59:15 -------- d-----w- C:\Program Files\trend micro ======= C:\PROGRA~2 ===== ======= C: ===== ====== C:\Users\Greet\AppData\Roaming ====== 2015-12-08 16:41:40 -------- d-----w- C:\Users\Greet\AppData\Locallow\uTorrent ====== C:\Users\Greet ====== ====== C: exe-files == 2015-12-21 17:39:40 C0DCC702A6B2DE3D4643D98E1DDE7E40 544 ----a-w- C:\$Recycle.Bin\S-1-5-21-4172638529-490413501-1354734073-1001\$ISLSGYD.exe 2015-12-21 12:59:16 9A2347903D6EDB84C10F288BC0578C1C 388608 ----a-w- C:\Program Files\trend micro\Greet.exe 2015-12-21 12:57:47 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\$Recycle.Bin\S-1-5-21-4172638529-490413501-1354734073-1001\$RSLSGYD.exe 2015-12-21 12:49:15 1D749FC1137C46737F14EDD47219FDA3 1740288 ----a-w- C:\Users\Greet\AppData\Local\Microsoft\Windows\INetCache\IE\QCG1RLDT\adwcleaner_5.025.exe 2015-12-21 12:47:26 1D749FC1137C46737F14EDD47219FDA3 1740288 ----a-w- C:\Users\Greet\AppData\Local\Microsoft\Windows\INetCache\IE\OFK319XS\adwcleaner_5.025.exe 2015-12-18 07:20:38 6DABFABC761F2DC1F0D159CC591C2A3B 119296 ----a-w- C:\Windows\System32\GWX\GWXUX.exe 2015-12-18 07:20:38 4A90FEC11212C344801655DB1FBF5E4A 518656 ----a-w- C:\Windows\System32\GWX\GWX.exe 2015-12-18 07:20:38 497D6328C4DB4BACD4222ADCE9E9D1D4 742400 ----a-w- C:\Windows\System32\GWX\GWXConfigManager.exe 2015-12-18 07:20:38 323DA0EA734D0335CBD95A10344E0128 442880 ----a-w- C:\Windows\SysWOW64\GWX\GWX.exe 2015-12-18 07:20:38 0EE82D09011C456040EEA0EA7BAB66F2 394544 ----a-w- C:\Windows\System32\GWX\GWXUXWorker.exe 2015-12-18 07:20:38 044403024E2CB2F9372D51D5A282C936 354816 ----a-w- C:\Windows\System32\GWX\GWXDetector.exe === C: other files == 2015-12-16 20:41:13 0224EF3B030D7B51AA0BB983B6FDA482 97806 ----a-w- C:\Users\Greet\AppData\Local\Microsoft\Windows\INetCache\IE\QCG1RLDT\berichten691077.zip ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-21-4172638529-490413501-1354734073-1001\Software\Microsoft\Windows\CurrentVersion\Run] "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner64.exe /MONITOR" [HKEY_USERS\S-1-5-21-4172638529-490413501-1354734073-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "StartCCC"="C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun" "AMD AVT"="Cmd.exe /c start AMD Accelerated Video Transcoding device initialization /min C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe aml" "SwitchBoard"="C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" "AdobeCS6ServiceManager"="C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe -launchedbylogin" "TrueImageMonitor.exe"="C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" "AcronisTibMounterMonitor"="C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe" "EaseUS EPM tray"="C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe" "EaseUS EPM Tray Agent"="C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe" "SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner64.exe /MONITOR" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce] ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Classic Start Menu"="C:\Program Files\Classic Shell\ClassicStartMenu.exe -autorun" "AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" "Acronis Scheduler2 Service"="C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" ==== Startup Folders ====================== 2015-03-14 12:06:48 2119 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk 2015-04-25 10:17:23 1349 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Spyder3Utility.lnk ==== Other Scheduled Tasks ====================== "C:\Windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\Windows\SysNative\tasks\User_Feed_Synchronization-{F49E096B-5AD5-4A5D-953E-F7D46426E817}" [C:\Windows\system32\msfeedssync.exe] "C:\Windows\SysNative\tasks\Lenovo\Lenovo Customer Feedback Program 64 35" ["%ProgramFiles(x86)%\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe"] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions] "belgiumeid@eid.belgium.be"="C:\Program Files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be" [] ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com/" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com/" ==== All HKLM and HKCU SearchScopes ====================== HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms} HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02 ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Empty IE Cache ====================== C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Greet\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\Greet\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\Greet\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\Users\Greet\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== No Chrome User Data found ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=76 folders=12 2001645576 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\Greet\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\Greet\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun.log" not found ==== EOF on ma 21/12/2015 at 18:48:44,07 ======================