Zoek.exe v5.0.0.1 Updated 31-December-2015 Tool run by Patric2 on za 14/05/2016 at 18:12:52,32. Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86 Running in: Normal Mode Internet Access Detected Launched: C:\Documents and Settings\Patric2\Bureaublad\zoek.exe [Scan all users] [Script inserted] ==== Older Logs ====================== C:\zoek-results2016-05-11-141255.log 66606 bytes C:\zoek-results2016-05-12-134144.log 7729 bytes C:\zoek-results2016-05-13-062026.log 48321 bytes C:\zoek-results2016-05-13-075811.log 946 bytes C:\zoek-results2016-05-13-140428.log 574623 bytes ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [-HKEY_USERS\S-1-5-21-1275210071-573735546-725345543-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\lavasoftfirewall.com] [-HKEY_USERS\S-1-5-21-1275210071-573735546-725345543-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\lavasoftpersonalfirewall.com] [-HKEY_USERS\S-1-5-21-1275210071-573735546-725345543-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\lavasoftpersonallfirewall.com] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\CH] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\FF] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\IE] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize\CONFIGXML] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize\CP] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize\DSP] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize\General] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize\HOSTS] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize\HP] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize\IGTB] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize\NT] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize\STATS] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search\Initialize] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Secure Search] [-HKEY_LOCAL_MACHINE\SOFTWARE\AVG Security Toolbar] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\\Program Files\\AVG\\AVG2015\\Tuneup\\"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI\CLSID] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI\CurVer] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1\CLSID] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.PugiObj\CLSID] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.PugiObj\CurVer] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.PugiObj] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.PugiObj.1\CLSID] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG Secure Search.PugiObj.1] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1152F8E0-69DB-4935-AFC3-59F8A5A86A30}\Elevation] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1152F8E0-69DB-4935-AFC3-59F8A5A86A30}\LocalServer32] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1152F8E0-69DB-4935-AFC3-59F8A5A86A30}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7BDA79B31AD34694CB018683B46A6AF6\SourceList] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7BDA79B31AD34694CB018683B46A6AF6] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\7AD06DF49CB3A9D4CB51C9351D827390] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\D5C17343E668F26498A6AB57CEE0DEEA\SourceList] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\D5C17343E668F26498A6AB57CEE0DEEA] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{66694099-FBD8-4A98-AB9F-F19EAB4144C0}\1.0\0\win32] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{66694099-FBD8-4A98-AB9F-F19EAB4144C0}\1.0\HELPDIR] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}\1.0\0\win32] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}\1.0\HELPDIR] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}\1.0\0\win32] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}\1.0\HELPDIR] [-HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{34371C5D-866E-462F-896A-BA75EC0EEDAE}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3B97ADB7-3DA1-4964-BC10-68384BA6A66F}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FD60DA7-3BC9-4D9A-BC15-9C53D1283709}] [-HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSHX\backup_avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVGIDSHX\backup_avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avglogx\backup_avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avglogx\backup_avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgmfx86\backup_avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Avgmfx86\backup_avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\AVGIDSHX\backup_avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\AVGIDSHX\backup_avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Avglogx\backup_avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Avglogx\backup_avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Avgmfx86\backup_avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Avgmfx86\backup_avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVGIDSHX\backup_avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVGIDSHX\backup_avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Avglogx\backup_avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Avglogx\backup_avg\AVG2014] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Avgmfx86\backup_avg\AVG2014\CacheServer] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Avgmfx86\backup_avg\AVG2014] [-HKEY_USERS\.DEFAULT\Software\Avg Secure Update\Campaigns\0814tb] [-HKEY_USERS\.DEFAULT\Software\Avg Secure Update\Campaigns] [-HKEY_USERS\.DEFAULT\Software\Avg Secure Update] [-HKEY_USERS\.DEFAULT\Software\AVG Secure Search\IE] [-HKEY_USERS\.DEFAULT\Software\AVG Secure Search\IEG] [-HKEY_USERS\.DEFAULT\Software\AVG Secure Search] ==== Deleting Files \ Folders ====================== C:\Program Files\AVG\AVG2015\Tuneup not found "C:\WINDOWS\Installer\ebce0.msi" deleted "C:\WINDOWS\Installer\ceddf.msi" deleted ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "{ABDE892B-13A8-4d1b-88E6-365A6E755758}"="C:\WINDOWS\Profiles\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext" [28/11/2013 15:33] [HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions] "smartwebprinting@hp.com"="C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3" [22/06/2010 13:40] ==== Chromium Look ====================== Google Chrome Version: 46.0.2490.86 HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions idhngdhcfkoamngbedgpaokgjbnpdiji - C:\WINDOWS\Profiles\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[14/08/2013 16:24] RealDownloader - Patric2\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji ==== Chromium Startpages ====================== C:\Documents and Settings\Patric2\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences "homepage": "http://www.google.com/", "urls_to_restore_on_startup": [ "http://www.google.com/" ] ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.be/" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.be/" ==== All HKLM and HKCU SearchScopes ====================== HKLM\SearchScopes "DefaultScope"="{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}" HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} HKLM\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms} HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC HKCU\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADRA_nl ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1110F57186925394F8073301C8A6D43E deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C88D1A60201E7254FA0792FF7DFA12A5 deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{175F0111-2968-4935-8F70-33108C6A4DE3} deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{06A1D88C-E102-4527-AF70-29FFD7AF215A} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\1110F57186925394F8073301C8A6D43E deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\C88D1A60201E7254FA0792FF7DFA12A5 deleted successfully ==== Empty IE Cache ====================== C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5 emptied successfully C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5 emptied successfully C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5 emptied successfully C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5 emptied successfully C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot C:\Documents and Settings\Patric2\Local Settings\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Documents and Settings\Patric2\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== No Java Cache Found ==== C:\zoek_backup content ====================== C:\zoek_backup (files=355 folders=186 179724692 bytes) ==== Empty Temp Folders ====================== C:\Documents and Settings\Default User\Local Settings\Temp emptied successfully C:\Documents and Settings\LocalService\Local Settings\Temp emptied successfully C:\Documents and Settings\NetworkService\Local Settings\Temp emptied successfully C:\Documents and Settings\Patric2\Local Settings\Temp will be emptied at reboot C:\WINDOWS\Temp will be emptied at reboot