Zoek.exe v5.0.0.1 Updated 27-December-2015 Tool run by franneke on ma 28/12/2015 at 23:21:11,22. Microsoft Windows 8.1 6.3.9600 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\franneke\Downloads\zoek.exe [Scan all users] [Script inserted] ==== Older Logs ====================== C:\zoek-results2015-12-28-201914.log 21104 bytes ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "write.exe"=- "hh.exe"=- "winhlp32.exe"=- "regedit.exe"=- "bfsvc.exe"=- "HelpPane.exe"=- [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run] "write.exe"=- "hh.exe"=- "winhlp32.exe"=- "regedit.exe"=- "bfsvc.exe"=- "HelpPane.exe"=- ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\franneke\AppData\Local\Temp ==== ====== Java Cache ===== ====== C:\Windows\SysWOW64 ===== ====== C:\Windows\SysWOW64\drivers ===== ====== C:\Windows\Sysnative ===== ====== C:\Windows\Sysnative\drivers ===== 2015-12-28 13:06:50 78488AF2AB2111D67B3C4044707A519B 192216 ----a-w- C:\Windows\Sysnative\drivers\MBAMSwissArmy.sys 2015-12-28 13:06:35 CFBC6C6D8A492697CABD1D353EE64933 25816 ----a-w- C:\Windows\Sysnative\drivers\mbam.sys 2015-12-28 13:06:35 42B3F5C9FBC9B3F0E0BA6B5D7FC8E849 109272 ----a-w- C:\Windows\Sysnative\drivers\mbamchameleon.sys 2015-12-28 13:06:35 08DECFCB9BA97786165A69AB1015BC30 64216 ----a-w- C:\Windows\Sysnative\drivers\mwac.sys ====== C:\Windows\Tasks ====== 2015-12-23 11:48:52 FADFD2C0D8AE35BC1AD856CF3CF576AF 4054 ----a-w- C:\Windows\Sysnative\Tasks\Opera scheduled Autoupdate 1450871319 ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2015-12-25 11:18:42 -------- d-----w- C:\Program Files\trend micro ======= C:\PROGRA~2 ===== ======= C: ===== 2015-12-28 15:57:41 8018E8544E269ECAC9E8C6AA70759621 19556 ----a-w- C:\mbam scanlog1.txt ====== C:\Users\franneke\AppData\Roaming ====== 2015-12-28 20:09:25 -------- d-----w- C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp 2015-12-28 20:09:25 -------- d-----w- C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp 2015-12-28 20:09:25 -------- d-----w- C:\Users\UpdatusUser\AppData\Local\Temp 2015-12-28 20:09:25 -------- d-----w- C:\Users\franneke\AppData\Local\Temp 2015-12-28 20:09:25 -------- d-----w- C:\Users\Default\AppData\Local\Temp 2015-12-28 20:09:25 -------- d-----w- C:\Users\Default User\AppData\Local\Temp ====== C:\Users\franneke ====== 2015-12-28 13:04:16 49E3825ACB348F848D9B841E4D48FD3B 22908888 ----a-w- C:\Users\franneke\Downloads\mbam-setup-2.2.0.1024.exe 2015-12-25 13:05:42 76F7569DB01B4D65431B0E6BBBDD261D 1743360 ----a-w- C:\Users\franneke\Downloads\adwcleaner_5.026.exe 2015-12-25 11:18:21 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\Users\franneke\Downloads\RSITx64.exe ====== C: exe-files == 2015-12-28 13:04:16 49E3825ACB348F848D9B841E4D48FD3B 22908888 ----a-w- C:\Users\franneke\Downloads\mbam-setup-2.2.0.1024.exe 2015-12-25 13:05:42 76F7569DB01B4D65431B0E6BBBDD261D 1743360 ----a-w- C:\Users\franneke\Downloads\adwcleaner_5.026.exe 2015-12-25 11:18:42 9A2347903D6EDB84C10F288BC0578C1C 388608 ----a-w- C:\Program Files\trend micro\franneke.exe 2015-12-25 11:18:21 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\Users\franneke\Downloads\RSITx64.exe 2015-12-25 10:22:53 DD3A361397510929971971961205B406 600080 ----a-w- C:\ProgramData\NVIDIA\Updatus\Packages\00008472\CoProc update.20288251.exe 2015-12-23 11:48:40 F90C47D126AFEF34B23B2BB10850240D 504952 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\opera_crashreporter.exe 2015-12-23 11:48:40 E89574946D96BA9F6DFCCB119879EEAB 630392 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\opera.exe 2015-12-23 11:48:40 753809DCCF8AC8C72EBDCE2A921EC550 73336 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\wow_helper.exe 2015-12-23 11:48:40 5B9AE3FCBDE36C3FEF53B679DFBDAB4F 697464 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\launcher.exe 2015-12-23 11:48:40 333499EDCC3C04F6B86E739EB8F5BAC9 3798648 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\opera_autoupdate.exe 2015-12-23 11:48:39 2FAA725B5C6121F70698CABB7D948EC8 1319544 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\installer.exe === C: other files == 2015-12-28 13:06:50 78488AF2AB2111D67B3C4044707A519B 192216 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys 2015-12-28 13:06:35 CFBC6C6D8A492697CABD1D353EE64933 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys 2015-12-28 13:06:35 42B3F5C9FBC9B3F0E0BA6B5D7FC8E849 109272 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys 2015-12-28 13:06:35 08DECFCB9BA97786165A69AB1015BC30 64216 ----a-w- C:\Windows\System32\drivers\mwac.sys 2015-12-23 11:48:40 F6B685306C89EE40A4B687A1F0758DCA 218650 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\resources\standard_themes\default_theme.zip 2015-12-23 11:48:40 B9E7A356DBFD03D6EC62607A3F7A267B 53056 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\resources\standard_themes\reine.zip 2015-12-23 11:48:40 9BB699BFD48DC443711F1BE8077B5677 289 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\resources\standard_themes\grey.zip 2015-12-23 11:48:40 8B86C14C2676D3611194F6E932A0C71A 299162 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\resources\standard_themes\landscape_photo.zip 2015-12-23 11:48:40 57BD727A9E6668CEA21EA9A52CA65767 243193 ----a-w- C:\Users\franneke\AppData\Local\Programs\Opera\34.0.2036.41\resources\standard_themes\darkbreeze.zip ==== Startup Registry Enabled ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mcpltui_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey" "PMBVolumeWatcher"="C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe" "Adobe ARM"="c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "DivXMediaServer"="C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" "DivXUpdate"="C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe /CHECKNOW" "MobileConnect"="%programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="c:\\windows\\syswow64\\nvinit.dll" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVBg"="C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SONYAPO" "Bluetooth"="c:\Program Files\WIDCOMM\Bluetooth Software\bttray.exe" "IgfxTray"="C:\Windows\system32\igfxtray.exe" "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" "Persistence"="C:\Windows\system32\igfxpers.exe" "AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" ==== Startup Folders ====================== 2015-01-21 14:03:37 2237 ----a-w- C:\Users\franneke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office 2007 Professional Plus NL Serial.lnk ==== Other Scheduled Tasks ====================== "C:\Windows\SysNative\tasks\Adobe Acrobat Update Task" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\Windows\SysNative\tasks\CLVDLauncher" [c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe] "C:\Windows\SysNative\tasks\CreateChoiceProcessTask" [C:\Windows\BrowserChoice\browserchoice.exe] "C:\Windows\SysNative\tasks\Opera scheduled Autoupdate 1450871319" [C:\Users\franneke\AppData\Local\Programs\Opera\launcher.exe] "C:\Windows\SysNative\tasks\PDVDServ Task" [c:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.EXE] "C:\Windows\SysNative\tasks\Synaptics TouchPad Enhancements" ["C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"] "C:\Windows\SysNative\tasks\USER_ESRV_SVC" ["C:\Windows\System32\Wscript.exe" //B //NoLogo "C:\Program Files\Sony\VAIO Care\ESRV\task.vbs"] "C:\Windows\SysNative\tasks\User_Feed_Synchronization-{CD209867-BF56-4204-87C4-A179DA6667C9}" [C:\Windows\system32\msfeedssync.exe] "C:\Windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\ActiveStatusCollect" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\CheckSystemInfo" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\DeployCRMflag" ["%ProgramFiles%\Sony\VAIO Care\DeployCRMflag.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\DeployVAIOManual" ["%ProgramData%\Sony Corporation\VAIO Care\VAIOUserGuideUpdate.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\GetPOTInfo" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\UpdateContacts" ["%ProgramData%\Sony Corporation\VAIO Care\UpdateContacts.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\UpdateSolution" ["%ProgramFiles%\Sony\VAIO Care\Solution.Updater.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\UploadPOT" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\VAIO Care" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\VCCheckIolo" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\VCMetrics" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\VCOneClick" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\VCRLog" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Care\VCSelfHeal" ["%ProgramFiles%\Sony\VAIO Care\VCSystemTray.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Control Center\Level4Daily" [C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Control Center\Level4Month" [C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterSystem" [C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterUser" [C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Control Center\NetworkSetting\NetworkSetting Logon Start" [C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Control Center\VAIO Capture\VAIO Clip" [C:\Program Files (x86)\Sony\VAIO Control Center\VAIO Clip.exe] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader" [C:\Program Files\Sony\VAIO Improvement\viuploader.exe] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Improvement\v3\VAIOImprovementUploader" [C:\Program Files\Sony\VAIO Improvement\v3\Sony.VAIO.VAIOImprovement.Uploader.exe] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Improvement\v3\VAIOImprovementUploaderUserConected" [C:\Program Files\Sony\VAIO Improvement\v3\Sony.VAIO.VAIOImprovement.Uploader.exe] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Improvement\v3\VAIOImprovementUploaderUserDisconected" [C:\Program Files\Sony\VAIO Improvement\v3\Sony.VAIO.VAIOImprovement.Uploader.exe] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Update\VAIO Update" ["C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe"] "C:\Windows\SysNative\tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair" [C:\Program Files\Sony\VAIO Update\VUSR.exe] "C:\Windows\SysNative\tasks\Sony Corporation\Xperia Link\Xperia Link Logon Start" [C:\Program Files (x86)\Sony\Xperia Link\Xperia Link.exe] ==== Chromium Look ====================== ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.be/" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.be/" ==== All HKLM and HKCU SearchScopes ====================== HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - No_Url_Value HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - No_Url_Value HKCU\SearchScopes "DefaultScope"="{9DAB73A1-1557-440E-9848-1B54CB247C73}" HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms} HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02 HKCU\SearchScopes\{9DAB73A1-1557-440E-9848-1B54CB247C73} - http://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=SEJB HKCU\SearchScopes\{E97A4F6C-1B97-41D8-A282-4C96057F9D70} - http://rover.ebay.com/rover/1/1553-42507-16445-59/4?mpre=http://shop.benl.ebay.be/?oemInLn=ieSrch-&_nkw={searchTerms} ==== Empty IE Cache ====================== C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Low\IE\AI70KYUR will be deleted at reboot C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ECK0B1V1 will be deleted at reboot C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Low\IE\EQIZMR3B will be deleted at reboot C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Low\IE\RYCZEJ3N will be deleted at reboot ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\franneke\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== No Java Cache Found ==== C:\zoek_backup content ====================== C:\zoek_backup (files=24 folders=18 12531957 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\franneke\AppData\Local\Temp will be emptied at reboot C:\Users\UpdatusUser\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\franneke\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Low\IE\AI70KYUR" not found "C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ECK0B1V1" not found "C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Low\IE\EQIZMR3B" not found "C:\Users\franneke\AppData\Local\Microsoft\Windows\INetCache\Low\IE\RYCZEJ3N" not found ==== EOF on di 29/12/2015 at 0:26:36,15 ======================