Zoek.exe v5.0.0.1 Updated 31-December-2015 Tool run by Administrator on ma 07-03-2016 at 20:45:17,75. Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64 Running in: Normal Mode Internet Access Detected Launched: D:\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 7-3-2016 20:50:30 Zoek.exe System Restore Point Created Successfully. ==== Empty Folders Check ====================== C:\PROGRA~2\Malwarebytes Anti-Malware deleted successfully C:\PROGRA~3\DigitalPersona deleted successfully C:\PROGRA~3\eSellerate deleted successfully C:\PROGRA~3\Hitman Pro deleted successfully C:\PROGRA~3\PDFC deleted successfully C:\PROGRA~3\Validity deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Roaming\Google deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\EmieBrowserModeList deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\EmieSiteList deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\EmieUserList deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-3595944866-693938193-2649264113-500\Software\Microsoft\Internet Explorer\SearchScopes\{08A0841F-BC00-47E4-BA28-DF8A17DBC388} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Registry Fix Code x64 ====================== Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run] ""=- ==== Deleting Files \ Folders ====================== C:\Program Files\ReviverSoft not found C:\Users\0041\AppData\Roaming\WSE_AS~1 not found "C:\windows\tasks\WSE_Astromenda.job" not found C:\PROGRA~2\HP Port Replicator Software Installer deleted C:\PROGRA~3\{DDB686B4-4F6B-46EB-B3F0-E73DAF04B8F0} deleted C:\windows\SysNative\config\systemprofile\Searches deleted C:\windows\SysNative\GroupPolicy\User deleted "C:\Users\Administrator.L0023-IDS-IT\AppData\Local\{42398E4F-231C-4852-BA25-0046ECF74367}" deleted "C:\Users\Administrator.L0023-IDS-IT\AppData\Local\{58E559B7-8D1F-4299-BB97-F2069F513643}" deleted "C:\Users\Administrator.L0023-IDS-IT\AppData\Local\{5BFDBB8B-8019-45EA-B108-633A7B063111}" deleted "C:\Users\Administrator.L0023-IDS-IT\AppData\Local\{6787D141-2A36-494E-A1B1-F48C1AD60C27}" deleted "C:\Users\Administrator.L0023-IDS-IT\AppData\Local\{9CD7C0F9-C495-479A-8F48-7ADDD59C5FA6}" deleted "C:\Users\Administrator.L0023-IDS-IT\AppData\Local\{CB772FAB-637E-4402-BF10-FE6641F12404}" deleted "C:\Users\Administrator.L0023-IDS-IT\AppData\Local\{F959E3D4-BB9C-43DE-9185-9E7AB77A8566}" deleted ==== Files Recently Created / Modified ====================== ====== C:\windows ==== 2016-02-14 12:02:53 9D77CC4A36FEEA644D002CFB9B2D42C0 3231232 ----a-w- C:\windows\explorer.exe ====== C:\Users\ADMINI~1.L00\AppData\Local\Temp ==== 2016-03-07 19:39:15 21D18E65BBA9CA0E968F0C3C9D091F44 131344 ----a-w- C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Temp\mccspuninstall.exe 2016-03-07 19:39:15 21D18E65BBA9CA0E968F0C3C9D091F44 131344 ----a-w- C:\Users\ADMINI~1.L00\AppData\Local\Temp\mccspuninstall.exe 2016-03-07 19:38:45 4F40E70842F3539968180F28DD65A9B3 918056 ----a-w- C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Temp\0295521457379525mcinst.exe 2016-03-07 19:38:45 4F40E70842F3539968180F28DD65A9B3 918056 ----a-w- C:\Users\ADMINI~1.L00\AppData\Local\Temp\0295521457379525mcinst.exe 2016-03-05 21:49:41 8741E6DF191C805028B92CEC44B1BA88 27320 ----a-w- C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Temp\cpuz138\cpuz138_x64.sys 2016-03-05 21:49:41 8741E6DF191C805028B92CEC44B1BA88 27320 ----a-w- C:\Users\ADMINI~1.L00\AppData\Local\Temp\cpuz138\cpuz138_x64.sys ====== Java Cache ===== ====== C:\windows\SysWOW64 ===== ====== C:\windows\SysWOW64\drivers ===== ====== C:\windows\Sysnative ===== ====== C:\windows\Sysnative\drivers ===== 2016-03-06 00:16:06 D018C0E0A97905D0859DCD970BE4CE2A 49584 ----a-w- C:\windows\Sysnative\drivers\hitmanpro37.sys 2016-02-14 12:03:50 BA500732D160C61E889E8180EE53C86F 154560 ----a-w- C:\windows\Sysnative\drivers\ksecpkg.sys 2016-02-14 12:03:50 7BDDD24C5A148534D3737DBFA96B3E69 95680 ----a-w- C:\windows\Sysnative\drivers\ksecdd.sys 2016-02-14 12:03:48 A16FC9323A85CAEA5804D04646A91CF9 290816 ----a-w- C:\windows\Sysnative\drivers\mrxsmb10.sys 2016-02-14 12:03:48 355DF71D1DD1999E8AEDF986534B233C 159232 ----a-w- C:\windows\Sysnative\drivers\mrxsmb.sys 2016-02-14 12:03:47 2539BE615440BA1EA4CF84A66B6C0AF9 129024 ----a-w- C:\windows\Sysnative\drivers\mrxsmb20.sys ====== C:\windows\Tasks ====== 2016-03-04 14:04:28 -------- d-----w- C:\windows\Sysnative\Tasks\Taken voor Logboeken ====== C:\windows\Temp ====== ======= C:\Program Files ===== 2016-03-05 21:49:29 -------- d-----w- C:\Program Files\Speccy 2016-03-05 10:30:07 -------- d-----w- C:\Program Files\trend micro 2016-03-03 18:20:19 -------- d-----w- C:\Program Files\SUPERAntiSpyware ======= C:\PROGRA~2 ===== 2016-03-05 22:12:27 -------- d-----w- C:\PROGRA~2\HD Tune ======= C: ===== ====== C:\Users\Administrator.L0023-IDS-IT\AppData\Roaming ====== 2016-03-03 18:20:36 -------- d-----w- C:\Users\Administrator.L0023-IDS-IT\AppData\Roaming\SUPERAntiSpyware.com 2016-03-03 18:20:36 -------- d-----w- C:\Users\ADMINI~1.L00\AppData\Roaming\SUPERAntiSpyware.com 2016-02-13 17:11:07 -------- d-----w- C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Spotify 2016-02-13 17:11:07 -------- d-----w- C:\Users\ADMINI~1.L00\AppData\Local\Spotify ====== C:\Users\Administrator.L0023-IDS-IT ====== 2016-03-07 18:56:50 08FF7DDF9A44142E60E5148EBA5D4BD1 7486008 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\MCPR.exe 2016-03-07 18:56:50 08FF7DDF9A44142E60E5148EBA5D4BD1 7486008 ----a-w- C:\Users\ADMINI~1.L00\Downloads\MCPR.exe 2016-03-06 13:52:26 C88FF17D0AF4A0BAD05F5A578ADB7F22 4748384 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\wzdu32.exe 2016-03-06 13:52:26 C88FF17D0AF4A0BAD05F5A578ADB7F22 4748384 ----a-w- C:\Users\ADMINI~1.L00\Downloads\wzdu32.exe 2016-03-06 09:28:49 A9957DE6D8A104DEC49CC3F3C17A657E 132551448 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\msert.exe 2016-03-06 09:28:49 A9957DE6D8A104DEC49CC3F3C17A657E 132551448 ----a-w- C:\Users\ADMINI~1.L00\Downloads\msert.exe 2016-03-05 23:49:14 49E3825ACB348F848D9B841E4D48FD3B 22908888 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\mbam-setup-2.2.0.1024.exe 2016-03-05 23:49:14 49E3825ACB348F848D9B841E4D48FD3B 22908888 ----a-w- C:\Users\ADMINI~1.L00\Downloads\mbam-setup-2.2.0.1024.exe 2016-03-05 23:30:28 51799DA44BA436FA961057AD156BA062 1518592 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\adwcleaner_5.037.exe 2016-03-05 23:30:28 51799DA44BA436FA961057AD156BA062 1518592 ----a-w- C:\Users\ADMINI~1.L00\Downloads\adwcleaner_5.037.exe 2016-03-05 22:12:28 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune 2016-03-05 22:11:38 088812A121E0A9CEB40CE9C808C8A90C 642632 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\hdtune_255.exe 2016-03-05 22:11:38 088812A121E0A9CEB40CE9C808C8A90C 642632 ----a-w- C:\Users\ADMINI~1.L00\Downloads\hdtune_255.exe 2016-03-05 21:47:56 FF70EB133BE86B9F9EB18E274DAA6B6C 5111240 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\spsetup129 (1).exe 2016-03-05 21:47:56 FF70EB133BE86B9F9EB18E274DAA6B6C 5111240 ----a-w- C:\Users\ADMINI~1.L00\Downloads\spsetup129 (1).exe 2016-03-05 21:47:53 FF70EB133BE86B9F9EB18E274DAA6B6C 5111240 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\spsetup129.exe 2016-03-05 21:47:53 FF70EB133BE86B9F9EB18E274DAA6B6C 5111240 ----a-w- C:\Users\ADMINI~1.L00\Downloads\spsetup129.exe 2016-03-05 08:37:36 -------- d-----w- C:\ProgramData\HitmanPro 2016-03-03 18:20:19 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com 2016-02-20 10:49:57 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox ====== C: exe-files == 2016-03-07 19:39:15 21D18E65BBA9CA0E968F0C3C9D091F44 131344 ----a-w- C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Temp\mccspuninstall.exe 2016-03-07 19:38:45 4F40E70842F3539968180F28DD65A9B3 918056 ----a-w- C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Temp\0295521457379525mcinst.exe 2016-03-07 18:56:50 08FF7DDF9A44142E60E5148EBA5D4BD1 7486008 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\MCPR.exe 2016-03-06 13:52:26 C88FF17D0AF4A0BAD05F5A578ADB7F22 4748384 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\wzdu32.exe 2016-03-06 09:28:49 A9957DE6D8A104DEC49CC3F3C17A657E 132551448 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\msert.exe 2016-03-05 23:49:14 49E3825ACB348F848D9B841E4D48FD3B 22908888 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\mbam-setup-2.2.0.1024.exe 2016-03-05 23:30:28 51799DA44BA436FA961057AD156BA062 1518592 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\adwcleaner_5.037.exe 2016-03-05 22:12:27 F8FC2D14DF813CC920A39B3CB7E59CBC 401408 ----a-w- C:\Program Files (x86)\HD Tune\HDTune.exe 2016-03-05 22:12:27 CEFC20D14D9940D53505E9B9769139E7 682266 ----a-w- C:\Program Files (x86)\HD Tune\unins000.exe 2016-03-05 22:11:38 088812A121E0A9CEB40CE9C808C8A90C 642632 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\hdtune_255.exe 2016-03-05 21:47:56 FF70EB133BE86B9F9EB18E274DAA6B6C 5111240 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\spsetup129 (1).exe 2016-03-05 21:47:53 FF70EB133BE86B9F9EB18E274DAA6B6C 5111240 ----a-w- C:\Users\Administrator.L0023-IDS-IT\Downloads\spsetup129.exe 2016-03-05 15:30:49 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\windows\Temp\GURF353.exe === C: other files == 2016-03-06 00:16:06 D018C0E0A97905D0859DCD970BE4CE2A 49584 ----a-w- C:\windows\System32\drivers\hitmanpro37.sys 2016-03-05 21:49:41 8741E6DF191C805028B92CEC44B1BA88 27320 ----a-w- C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Temp\cpuz138\cpuz138_x64.sys 2016-03-03 18:43:18 05C9CA255F8A03BF0020232AA0D64AFA 1758885 ----a-w- C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Temp\sophos_bootstrap_20160303184241\savxp\Sophos UI\home.zip ==== Orphaned Tasks deleted from Registry ====================== HPCeeScheduleFor0023 deleted HPCeeScheduleFor0041 deleted HPCeeScheduleForAdministrator deleted Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse deleted Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse deleted ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-21-3595944866-693938193-2649264113-500\Software\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun" "Spotify Web Helper"="C:\Users\Administrator.L0023-IDS-IT\AppData\Roaming\Spotify\SpotifyWebHelper.exe" "Spotify"="C:\Users\Administrator.L0023-IDS-IT\AppData\Roaming\Spotify\Spotify.exe -autostart -minimized" "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner64.exe /MONITOR" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="C:\windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="C:\windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "File Sanitizer"="C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe" "DTRun"="c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe" "HPUsageTracking"="C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe C:\Program Files (x86)\HP\HP UT\" "NUSB3MON"="c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" "SgfxConfig"="C:\Program Files\SGFX\sgfxconfig.exe" "Dropbox"="C:\Program Files (x86)\Dropbox\Client\Dropbox.exe /systemstartup" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun" "Spotify Web Helper"="C:\Users\Administrator.L0023-IDS-IT\AppData\Roaming\Spotify\SpotifyWebHelper.exe" "Spotify"="C:\Users\Administrator.L0023-IDS-IT\AppData\Roaming\Spotify\Spotify.exe -autostart -minimized" "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner64.exe /MONITOR" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\windows\system32\igfxtray.exe" "HotKeysCmds"="C:\windows\system32\hkcmd.exe" "Persistence"="C:\windows\system32\igfxpers.exe" "HP Color LaserJet CM2320 MFP Series Fax"="C:\Program Files (x86)\HP\HP Color LaserJet CM2320 MFP Series\hppfaxprintersrv.exe HP Color LaserJet CM2320 MFP Series Fax" "AtherosBtStack"="C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" "AthBtTray"="C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" "SysTrayApp"="C:\Program Files\IDT\WDM\sttray64.exe" "SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe " ==== Startup Folders ====================== 2014-12-29 12:23:56 2059 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ==== Task Scheduler Jobs ====================== C:\windows\tasks\Adobe Flash Player Updater.job --a------ C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [15-03-2015 13:32] C:\windows\tasks\DropboxUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [08-06-2015 13:23] C:\windows\tasks\DropboxUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [08-06-2015 13:23] C:\windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [12-02-2015 21:14] C:\windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [12-02-2015 21:14] C:\windows\tasks\HPCeeScheduleForL0023-IDS-IT$.job --a------ C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [14-09-2010 06:15] C:\windows\tasks\McAfee Cleanup.job --a------ C:\Users\ADMINI1.L00\AppData\Local\Temp\MCPR\mccleanup.exe [] C:\windows\tasks\McAfeeLogon.job --a------ C:\PROGRA1\COMMON1\McAfee\Platform\McUICnt.exe [] ==== Other Scheduled Tasks ====================== "C:\windows\SysNative\tasks\Adobe Acrobat Update Task" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\windows\SysNative\tasks\Adobe Flash Player Updater" [C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\windows\SysNative\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\windows\SysNative\tasks\DropboxUpdateTaskMachineCore" [C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe] "C:\windows\SysNative\tasks\DropboxUpdateTaskMachineUA" [C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe] "C:\windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\windows\SysNative\tasks\HPCeeScheduleForL0023-IDS-IT$" [C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe] "C:\windows\SysNative\tasks\McAfee Cleanup" [C:\Users\ADMINI~1.L00\AppData\Local\Temp\MCPR\mccleanup.exe] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Assistant\HPSA Upgrade" [C:\ProgramData\Hewlett-Packard\HPSAUpgrade3\HpSAUpgrade.exe] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\Ghost Resign Task" ["c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\HPResignFileLoader.exe"] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask" [C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe] "C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe] "C:\windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] ==== Chromium Look ====================== Google Chrome Version: 46.0.2490.86 HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[08-01-2016 10:47] Google Slides - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek Google Docs - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf Google Voice Search Hotword (Beta) - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn YouTube - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo ImprovedTube - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnomihfieiccainjcjblhegjgglakjdd Google Search - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Lucidchart Diagrams - Desktop - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\djejicklhojeokkfmdelnempiecmdomj HTTP Captive Portal Test - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\eemlkeanncmjljgehlbplemhmdmalhdc YouTube Search Engine - MotionPicker - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\enopcannacfkcidnfkdhchodkndiogja Google Sheets - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap WorkFlowy - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\koegeopamaoljbmhnfjbclbocehhgmkm Chrome Hotword Shared Module - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg Video Deck for YouTube™ - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpoakikepagdiphlmfaeifpojdmbnegj Google Wallet - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Gmail - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia Google Docs - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Google Docs Offline - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi Ask App for iLivid - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mppnoffgpafgpgbaigljliadgbnhljfl iLivid - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nafaimnnclfjfedmmabolbppcngeolgf Chrome Web Store Payments - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Bitdefender QuickScan - Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pdnkcidphdcakpkheohlhocaicfamjie Google Slides - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek Google Docs - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf Google Voice Search Hotword (Beta) - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn YouTube - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo ImprovedTube - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnomihfieiccainjcjblhegjgglakjdd Google Search - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Lucidchart Diagrams - Desktop - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\djejicklhojeokkfmdelnempiecmdomj HTTP Captive Portal Test - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\eemlkeanncmjljgehlbplemhmdmalhdc YouTube Search Engine - MotionPicker - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\enopcannacfkcidnfkdhchodkndiogja Google Sheets - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap WorkFlowy - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\koegeopamaoljbmhnfjbclbocehhgmkm Chrome Hotword Shared Module - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg Video Deck for YouTube™ - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpoakikepagdiphlmfaeifpojdmbnegj Google Wallet - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Gmail - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia Google Docs - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Google Docs Offline - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi Ask App for iLivid - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mppnoffgpafgpgbaigljliadgbnhljfl iLivid - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nafaimnnclfjfedmmabolbppcngeolgf Chrome Web Store Payments - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Bitdefender QuickScan - ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pdnkcidphdcakpkheohlhocaicfamjie ==== Chromium Fix ====================== C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\https_c.betrad.com_0.localstorage deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\https_c.betrad.com_0.localstorage-journal deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\http_c.betrad.com_0.localstorage deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\http_c.betrad.com_0.localstorage-journal deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\http_hitman-pro.nl.softonic.com_0.localstorage deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\http_hitman-pro.nl.softonic.com_0.localstorage-journal deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mppnoffgpafgpgbaigljliadgbnhljfl deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\chrome-extension_mppnoffgpafgpgbaigljliadgbnhljfl_0.localstorage deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\chrome-extension_mppnoffgpafgpgbaigljliadgbnhljfl_0.localstorage-journal deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nafaimnnclfjfedmmabolbppcngeolgf deleted successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\chrome-extension_nafaimnnclfjfedmmabolbppcngeolgf_0.localstorage deleted successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Extensions\djejicklhojeokkfmdelnempiecmdomj deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{08A0841F-BC00-47E4-BA28-DF8A17DBC388}" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{08A0841F-BC00-47E4-BA28-DF8A17DBC388}] not found New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" ==== All HKLM and HKCU SearchScopes ====================== HKLM\SearchScopes "DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - No_Url_Value HKLM\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 HKLM\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} - http://nl.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF HKLM\Wow6432Node\SearchScopes "DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - No_Url_Value HKLM\Wow6432Node\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 HKLM\Wow6432Node\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} - http://nl.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF HKLM\Wow6432Node\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43} - http://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms} HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02 HKCU\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 ==== Reset Google Chrome ====================== C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences.copy was reset successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences was reset successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences was reset successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences.copy was reset successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences was reset successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences was reset successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data was reset successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data-journal was reset successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data was reset successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data-journal was reset successfully ==== Empty IE Cache ====================== C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\ADMINI~1.L00\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\ADMINI~1.L00\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\ADMINI~1.L00\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== No Java Cache Found ==== C:\zoek_backup content ====================== C:\zoek_backup (files=5630 folders=488 161639481 bytes) ==== Empty Temp Folders ====================== C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Temp will be emptied at reboot C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\ADMINI~1.L00\AppData\Local\Temp will be emptied at reboot C:\windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\windows\Temp successfully emptied C:\Users\ADMINI~1.L00\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun.log" not found "C:\Users\Administrator.L0023-IDS-IT\AppData\Local\Google\Chrome\User Data\Default\Extensions\djejicklhojeokkfmdelnempiecmdomj" not found "C:\windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted ==== EOF on ma 07-03-2016 at 21:17:19,58 ======================