Zoek.exe v5.0.0.1 Updated 31-December-2015 Tool run by user on za 02/01/2016 at 10:08:35,91. Microsoft Windows 8.1 6.3.9600 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\user\Desktop\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 2/01/2016 10:14:50 Zoek.exe System Restore Point Created Successfully. ==== Torpig Check ====================== HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\FileSystem {217FC9C0-3AEA-1069-A2DB-08002B30309D} %SystemRoot%\system32\shell32.dll HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\Sharing {40dd6e20-7c17-11ce-a804-00aa003ca9f6} %SystemRoot%\system32\ntshrui.dll ==== Empty Folders Check ====================== C:\Users\user\AppData\Local\VirtualStore deleted successfully ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Deleting Files \ Folders ====================== C:\PROGRA~3\Package Cache deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted C:\WINDOWS\Syswow64\SETDDE9.tmp deleted "C:\windows\Installer\1b206.msi" deleted ==== Files Recently Created / Modified ====================== ====== C:\WINDOWS ==== ====== C:\Users\user\AppData\Local\Temp ==== 2016-01-02 08:34:23 8741E6DF191C805028B92CEC44B1BA88 27320 ----a-w- C:\Users\user\AppData\Local\Temp\cpuz138\cpuz138_x64.sys ====== Java Cache ===== ====== C:\WINDOWS\SysWOW64 ===== 2015-12-21 13:12:40 A4001C78F2806662B3BD91ACB44E6330 45 ----a-w- C:\WINDOWS\SysWOW64\initdebug.nfo ====== C:\WINDOWS\SysWOW64\drivers ===== ====== C:\WINDOWS\Sysnative ===== ====== C:\WINDOWS\Sysnative\drivers ===== 2015-12-21 18:52:57 78488AF2AB2111D67B3C4044707A519B 192216 ----a-w- C:\WINDOWS\Sysnative\drivers\MBAMSwissArmy.sys 2015-12-21 18:52:25 CFBC6C6D8A492697CABD1D353EE64933 25816 ----a-w- C:\WINDOWS\Sysnative\drivers\mbam.sys 2015-12-21 18:52:25 42B3F5C9FBC9B3F0E0BA6B5D7FC8E849 109272 ----a-w- C:\WINDOWS\Sysnative\drivers\mbamchameleon.sys 2015-12-21 18:52:25 08DECFCB9BA97786165A69AB1015BC30 64216 ----a-w- C:\WINDOWS\Sysnative\drivers\mwac.sys 2015-12-12 20:32:30 FF90227F4E05222A6F4E0559CC6C280A 25592 ----a-w- C:\WINDOWS\Sysnative\drivers\uvhid.sys 2015-12-12 20:32:30 8EDF40310364BCB32FC6C30C64D35957 7680 ----a-w- C:\WINDOWS\Sysnative\drivers\hidkmdf.sys 2015-12-10 19:01:38 A7D51169CA28B0AA9B5DE2B7EFB5C3C9 145408 ----a-w- C:\WINDOWS\Sysnative\drivers\rmcast.sys 2015-12-10 18:58:47 CD81683F4553677B9BF5163A922153EB 462168 -c--a-w- C:\WINDOWS\Sysnative\drivers\usbhub.sys 2015-12-10 18:58:46 FC974B03C8B87455F44F734C8F31A3C8 37376 -c--a-w- C:\WINDOWS\Sysnative\drivers\usbuhci.sys 2015-12-10 18:58:46 D25F0093A71FFB355160358DD70B0373 443224 -c--a-w- C:\WINDOWS\Sysnative\drivers\usbport.sys 2015-12-10 18:58:46 BBFD17B6B954FC9FA02E62D604052069 92504 -c--a-w- C:\WINDOWS\Sysnative\drivers\usbehci.sys 2015-12-10 18:58:46 A0F0484C97D6441ED6A75D7426ECCC9E 30208 -c--a-w- C:\WINDOWS\Sysnative\drivers\usbohci.sys 2015-12-10 18:58:46 9A2B3A98D7982372CA36A823F673EFB8 27992 -c--a-w- C:\WINDOWS\Sysnative\drivers\usbd.sys 2015-12-10 18:58:46 5C90D5379B53590FBB24BBAD4FA682EE 468824 -c--a-w- C:\WINDOWS\Sysnative\drivers\USBHUB3.SYS 2015-12-10 18:58:46 3AF1FA17F1C4ACBDB660D8F98B1A9C13 78848 -c--a-w- C:\WINDOWS\Sysnative\drivers\winusb.sys 2015-12-04 11:11:54 35DFC12FD7E44B7CB8CCD7E5A2B3975A 50472 ----a-w- C:\WINDOWS\Sysnative\drivers\nvvad64v.sys ====== C:\WINDOWS\Tasks ====== ====== C:\WINDOWS\Temp ====== ======= C:\Program Files ===== 2015-12-21 17:33:49 -------- d-----w- C:\Program Files\trend micro ======= C:\PROGRA~2 ===== 2015-12-27 15:46:05 -------- d-----w- C:\PROGRA~2\Toshiba TEMPRO 2015-12-21 13:12:40 -------- d-----w- C:\PROGRA~2\SpeedFan ======= C: ===== ====== C:\Users\user\AppData\Roaming ====== 2015-12-12 20:31:29 -------- d-----w- C:\Users\user\AppData\Local\Programs 2015-12-04 11:30:49 -------- d-----w- C:\Users\user\AppData\Local\NVIDIA 2015-12-04 11:10:57 -------- d-----w- C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\NVIDIA ====== C:\Users\user ====== 2015-12-21 17:33:26 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\Users\user\Desktop\RSITx64.exe 2015-12-12 20:32:14 -------- d-----w- C:\ProgramData\Unified Remote 2015-12-04 11:05:02 -------- d-----w- C:\ProgramData\NVIDIA Corporation ====== C: exe-files == === C: other files == 2016-01-02 08:34:23 8741E6DF191C805028B92CEC44B1BA88 27320 ----a-w- C:\Users\user\AppData\Local\Temp\cpuz138\cpuz138_x64.sys ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-21-2466334782-3446324615-4245280384-1002\Software\Microsoft\Windows\CurrentVersion\Run] "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner64.exe /MONITOR" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Intel AppUp(SM) center"="C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe --domain-id F0399437-FD0C-4A48-B101-F0314A6172E4" "SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner64.exe /MONITOR" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" "Persistence"="C:\WINDOWS\system32\igfxpers.exe" "RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s" "Logitech Download Assistant"="C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch" "SRS Premium Sound 3D"="C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe /f=C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_PS3D.zip /h" "TecoResident"="C:\Program Files\TOSHIBA\Teco\TecoResident.exe" "TSleepSrv"="C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe" "TODDMain"="C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe" "TCrdMain"="%ProgramFiles%\TOSHIBA\Hotkey\TCrdMain_Win8.exe " "TosWaitSrv"="%ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe " "SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe " [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="C:\\windows\\system32\\nvinitx.dll" ==== Task Scheduler Jobs ====================== C:\WINDOWS\tasks\Adobe Flash Player PPAPI Notifier.job --a-------- C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_20_0_0_267_pepper.exe [28/12/2015 22:18] C:\WINDOWS\tasks\Adobe Flash Player Updater.job --a-------- C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [28/12/2015 22:18] C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [10/11/2015 21:02] C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job --a-------- [Undetermined Task] ==== Other Scheduled Tasks ====================== "C:\WINDOWS\SysNative\tasks\Adobe Acrobat Update Task" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\WINDOWS\SysNative\tasks\Adobe Flash Player PPAPI Notifier" [C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_20_0_0_267_pepper.exe] "C:\WINDOWS\SysNative\tasks\Adobe Flash Player Updater" [C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\WINDOWS\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\WINDOWS\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\WINDOWS\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\WINDOWS\SysNative\tasks\Opera scheduled Autoupdate 1445535522" [C:\Program Files (x86)\Opera\launcher.exe] "C:\WINDOWS\SysNative\tasks\User_Feed_Synchronization-{9C8CDD17-33BD-4444-B082-AD400F9012BB}" [C:\WINDOWS\system32\msfeedssync.exe] "C:\WINDOWS\SysNative\tasks\Toshiba\CommonNotifier" [C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe] "C:\WINDOWS\SysNative\tasks\Toshiba\Service Station" ["C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe"] ==== Folders in C:\PROGRA~3 0-6 Months Old ====================== 2015-10-22 19:52:48 -------- d-----w- C:\PROGRA~3\ToshibaEurope 2015-10-22 20:26:40 -------- d-----w- C:\PROGRA~3\Microsoft Help 2015-10-23 15:11:38 -------- d-----w- C:\PROGRA~3\dl_Cats 2015-10-23 18:02:43 -------- d-----w- C:\PROGRA~3\Skype 2015-10-23 22:30:05 -------- d-sh--we C:\PROGRA~3\Bureaublad 2015-10-23 22:30:05 -------- d-sh--we C:\PROGRA~3\Documenten 2015-10-23 22:30:05 -------- d-sh--we C:\PROGRA~3\Menu Start 2015-10-23 22:30:05 -------- d-sh--we C:\PROGRA~3\Sjablonen 2015-10-24 20:11:49 -------- d-----w- C:\PROGRA~3\Adobe 2015-10-25 22:04:26 -------- d-----w- C:\PROGRA~3\Codemasters 2015-10-27 09:21:15 -------- d-----w- C:\PROGRA~3\Oracle 2015-11-08 15:26:19 -------- d-----w- C:\PROGRA~3\IsolatedStorage 2015-11-08 15:26:19 -------- d-----w- C:\PROGRA~3\TOSHIBA Tempro 2015-12-04 11:05:02 -------- d-----w- C:\PROGRA~3\NVIDIA Corporation 2015-12-12 20:32:14 -------- d-----w- C:\PROGRA~3\Unified Remote 2015-12-21 18:52:24 -------- d-----w- C:\PROGRA~3\Malwarebytes ==== Chromium Look ====================== Google Slides - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek Google Docs - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Google Sheets - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap Google Docs Offline - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi Chrome Web Store Payments - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Gmail - user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia selector is not a valid CSS selector - user\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.msn.com/?pc=MSE1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{632BED6C-B104-46D5-BBB6-DBC98FB77769}" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.msn.com/?pc=MSE1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" ==== All HKLM and HKCU SearchScopes ====================== HKLM\SearchScopes "DefaultScope"="{632BED6C-B104-46D5-BBB6-DBC98FB77769}" HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC HKLM\SearchScopes\{632BED6C-B104-46D5-BBB6-DBC98FB77769} - http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS HKLM\Wow6432Node\SearchScopes "DefaultScope"="{632BED6C-B104-46D5-BBB6-DBC98FB77769}" HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC HKLM\Wow6432Node\SearchScopes\{632BED6C-B104-46D5-BBB6-DBC98FB77769} - http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms} HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02 HKCU\SearchScopes\{632BED6C-B104-46D5-BBB6-DBC98FB77769} - No_Url_Value ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\E40670FF068C9E042A033EF74AF101A3 deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{FF07604E-C860-40E9-A230-E37FA41F103A} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\E40670FF068C9E042A033EF74AF101A3 deleted successfully ==== Empty IE Cache ====================== C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\user\AppData\Local\Opera Software\Opera Stable\Cache will be emptied at reboot C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=27 folders=29 58582844 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\user\AppData\Local\Temp will be emptied at reboot C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\WINDOWS\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\WINDOWS\Temp successfully emptied C:\Users\user\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Users\user\AppData\Local\Opera Software\Opera Stable\Cache\data_0" deleted "C:\Users\user\AppData\Local\Opera Software\Opera Stable\Cache\data_1" deleted "C:\Users\user\AppData\Local\Opera Software\Opera Stable\Cache\data_2" deleted "C:\Users\user\AppData\Local\Opera Software\Opera Stable\Cache\data_3" deleted "C:\Users\user\AppData\Local\Opera Software\Opera Stable\Cache\index" deleted "C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun.log" not found ==== EOF on za 02/01/2016 at 10:41:44,38 ======================