Ads by browse to save virus - help

zon_ · 3 april 2013

Hoi, Ik heb een virus of malware opgelopen vrees ik, ads by browse to save. Ik zie het vooral op FB. Ben al een week bezig om alle handleidingen die op Inet bestaan te handhaven om het virus weg te krijgen, maar niets werkt. Ik kan het nergens vinden... Weet iemand raad?

kape · 3 april 2013

1. Download HijackThis. (klik er op)

Klik op HijackThis.msi en de download start automatisch na 5 seconden.

Bestand HijackThis.msi opslaan. Daarna kiezen voor "uitvoeren".

Hijackthis wordt nu op je PC geïnstalleerd, een snelkoppeling wordt op je bureaublad geplaatst.

Als je geen netwerkverbinding meer hebt, kan je de download doen met een andere pc en het bestand met een usb stick overbrengen

Als je enkel nog in veilige modus kan werken, moet je de executable (HijackThis.exe) downloaden.

Sla deze op in een nieuwe map op de C schijf (bvb C:\\hijackthis) en start hijackthis dan vanaf deze map.

De logjes kan je dan ook in die map terugvinden.

2. Klik op de snelkoppeling om HijackThis te starten. (lees eerst de rode tekst hieronder!)

Klik ofwel op "Do a systemscan and save a logfile", ofwel eerst op "Scan" en dan op "Savelog".

Er opent een kladblokvenster, hou gelijktijdig de CTRL en A-toets ingedrukt, nu is alles geselecteerd. Hou gelijktijdig de CTRL en C-toets ingedrukt, nu is alles gekopieerd. Plak nu het HJT logje in je bericht door CTRL en V-toets.

Krijg je een melding ""For some reason your system denied writing to the Host file ....", klik dan gewoon door op de OK-toets.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\\Program Files\\Trend Micro\\HiJackThis of C:\\Program Files (x86)\\Trend Micro\\HiJackThis. (Bekijk hier de afbeelding ---> Klik hier)

3. Na het plaatsen van je logje wordt dit door een expert nagekeken en hij begeleidt jou verder door het ganse proces.

Tip!

Wil je in woord en beeld weten hoe je een logje met HijackThis maakt en plaatst op het forum, klik dan HIER.

zon_ · 3 april 2013

Al met het downloaden van HijackThis.msi krijg ik een virusmelding. Weet je zeker dat dit goed is?

Hier de screenshot van de virusmelding.

smeenk · 3 april 2013

Valse melding van je virusscanner, die had zich beter bezig kunnen houden met het voorkomen van je infectie

HijackThis is te vertrouwen, het is door de jaren heen wellicht de meest gebruikte anti-malware tool van allemaal.

Wellicht moet je je virusscanner beter maar even uitzetten?

zon_ · 4 april 2013

dank je, vanavond na het werk ga ik alles doen zoals opgedragen

kape · 4 april 2013

OK, dan lezen we hier de resultaten wel ;-)

zon_ · 5 april 2013

komt ie dan eindelijk ...

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 18:31:22, on 5-4-2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v10.0 (10.00.9200.16521)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe

C:\Users\zon\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe

C:\Windows\AsScrPro.exe

C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe

C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe

C:\Program Files (x86)\VoipDiscount.com\VoipDiscount\VoipDiscount.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Analysis of program downloads scanned for viruses and spyware.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, Messenger, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O2 - BHO: PNBHO - {FBAAD182-3C7A-4BC4-A5E9-207B8E0F02FD} - C:\Program Files (x86)\DeLorme\SendToGPS\PNPluginForIE.dll

O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

O2 - BHO: GrabberObj Class - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files (x86)\SpeedBit Video Downloader\Toolbar\grabber.dll

O2 - BHO: SimpleAdblock Class - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files (x86)\Common Files\Simple Adblock\SimpleAdblock.dll

O3 - Toolbar: (no name) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - (no file)

O4 - HKLM\..\Run: [boingo Wi-Fi] "C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk"

O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r

O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

O4 - HKLM\..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [ToolboxFX] "C:\Program Files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [Facebook Update] "C:\Users\zon\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"

O4 - HKCU\..\Run: [Google Update] "C:\Users\zon\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [spotify Web Helper] "C:\Users\zon\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

O4 - HKCU\..\Run: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB

O16 - DPF: {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe

O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE

O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update-service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: HP LaserJet Service - HP - C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: lxbk_device - - C:\Windows\system32\lxbkcoms.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: RosettaStoneLtdController - Rosetta Stone Ltd. - C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneLtdController.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: TomTomHOMEService - TomTom - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe

O23 - Service: VMware View USB (vmware-view-usbd) - VMware, Inc. - C:\Program Files\VMware\VMware View\Client\bin\vmware-view-usbd.exe

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

O23 - Service: VMware View Client (wsnm) - VMware, Inc. - C:\Program Files\VMware\VMware View\Client\bin\wsnm.exe

--

End of file - 13546 bytes

kape · 5 april 2013

Start Hijackthis op. Selecteer “Scan”. Selecteer alleen de items die hieronder zijn genoemd:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Analysis of program downloads scanned for viruses and spyware.

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: PNBHO - {FBAAD182-3C7A-4BC4-A5E9-207B8E0F02FD} - C:\Program Files (x86)\DeLorme\SendToGPS\PNPluginForIE.dll

O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

O2 - BHO: GrabberObj Class - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files (x86)\SpeedBit Video Downloader\Toolbar\grabber.dll

O3 - Toolbar: (no name) - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - (no file)

Klik op 'Fix checked' om de items te verwijderen.

Let op : Windows Vista & 7 gebruikers dienen HijackThis als “administrator” uit te voeren via rechtermuisknop “als administrator uitvoeren". Indien dit via de snelkoppeling niet lukt voer je HijackThis als administrator uit in de volgende map : C:\\Program Files\\Trend Micro\\HiJackThis of C:\\Program Files (x86)\\Trend Micro\\HiJackThis.

Download zoek.exe naar het bureaublad.

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe
(hier of hier) kan je lezen hoe je dat doet.
Dubbelklik op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkwaardig probleem.

 
startupall; 
filesrcm;

Klik op de knop "Options" en vink nu de onderstaande opties aan.
- Installed Programs
- HijackThis Log
- Firefox Look
- Chrome Look
- Firefox Defaults
- Reset Chrome
- Reset IE proxy
- Empty Temp Folders
- IE Defaults
- Auto Clean
[*] Klik daarna op de knop "Run script".

[*] Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).

[*] Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.

[*] Post nu de inhoud van het geopende logje in het volgende bericht.

zon_ · 5 april 2013

Zoek.exe Version 4.0.0.2 Updated 31-03-2013

Tool run by zon on vr 05-04-2013 at 23:44:59,13.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

==== Older Logs ======================

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-648035464-3342752320-20647198-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully

HKEY_USERS\S-1-5-21-648035464-3342752320-20647198-1001\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Installed Programs ======================

Update for Microsoft Office 2007 (KB2508958)

64 Bit HP CIO Components Installer

Aangifte inkomstenbelasting 2010

Aangifte inkomstenbelasting 2011

Aangifte inkomstenbelasting 2012

Acrobat.com

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9.5.4 MUI

Alcor Micro USB Card Reader

ASUS AI Recovery

ASUS AP Bank

ASUS CopyProtect

ASUS Data Security Manager

ASUS FancyStart

ASUS LifeFrame3

ASUS Live Update

ASUS MultiFrame

ASUS Power4Gear Hybrid

ASUS SmartLogon

ASUS Splendid Video Enhancement Technology

ASUS Virtual Camera

ASUS WebStorage

Asus_Camera_ScreenSaver

ATK Package

Audacity 2.0

Avira Free Antivirus

Boingo Wi-Fi

ControlDeck

D3DX10

DAEMON Tools Lite

DealPly

DeLorme Send To GPS 1.2

DivX Setup

Dropbox

Druckerdeinstallation fr EPSON Stylus SX200 Series

ETDWare PS/2-x64 7.0.5.12_WHQL

Facebook Video Calling 1.2.0.287

Fast Boot

FireArc Arcade

FoxTab Video To MP3

Game Park Console

Garmin BaseCamp

Garmin Trip and Waypoint Manager v5

Garmin USB Drivers

Google Chrome

Google Update Helper

HiJackThis

HP LaserJet Professional CP1520 Series

HP Update

HPLaserJetHelp_LearnCenter

HPLJUT

hppCP1520LaserJetService

hppLaserJetService

hppTLBXFXCP1520

hpzTLBXFX

iLivid

Intel® Control Center

Intel® Graphics Media Accelerator Driver

IrfanView (remove only)

Java Auto Updater

Java 6 Update 37

Lexmark X1100 Series

Malwarebytes Anti-Malware versie 1.60.0.1800

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office 2010

Microsoft Office Access MUI (Dutch) 2007

Microsoft Office Click-to-Run 2010

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (Dutch) 2007

Microsoft Office File Validation Add-In

Microsoft Office Groove MUI (Dutch) 2007

Microsoft Office InfoPath MUI (Dutch) 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (Dutch) 2007

Microsoft Office Outlook MUI (Dutch) 2007

Microsoft Office PowerPoint MUI (Dutch) 2007

Microsoft Office Proof (Dutch) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proofing (Dutch) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (Dutch) 2007

Microsoft Office Shared 64-bit MUI (Dutch) 2007

Microsoft Office Shared MUI (Dutch) 2007

Microsoft Office Starter 2010 - English

Microsoft Office Word MUI (Dutch) 2007

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Mozilla Firefox 19.0.2 (x86 nl)

Mozilla Thunderbird 17.0.5 (x86 nl)

MSVCRT

MSXML 4.0 SP3 Parser (KB2721691)

MSXML 4.0 SP3 Parser (KB2758694)

MSXML 4.0 SP3 Parser (KB973685)

Neuratron PhotoScore Ultimate Demo

OSM generic routable

OSM World Routable

PDFCreator

Platform

PowerISO

Revo Uninstaller Pro 2.5.5

Rosetta Stone Ltd Services

Rosetta Stone Version 3

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition

Sibelius 6 Demo

Simple Adblock

SkypeT 6.1

SpeedBit Video Downloader

Speedy MIDI Version 1.0

Spotify

TomTom HOME 2.8.3.2499

TomTom HOME Visual Studio Merge Modules

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768024) 32-Bit Edition

Update voor Microsoft Office Excel 2007 Help (KB963678)

Update voor Microsoft Office Powerpoint 2007 Help (KB963669)

Update voor Microsoft Office Word 2007 Help (KB963665)

USB 2.0 1.3M UVC WebCam

VC80CRTRedist - 8.0.50727.6195

Verzoek of wijziging voorlopige aanslag 2012

VIA Platform Device Manager

VLC media player 1.0.1

VMware View Client

VoipDiscount

Vuze

Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000)

Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405)

Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800)

Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Messenger

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Sync

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Media Player Firefox Plugin

WinFlash

Wireless Console 3

Yontoo 1.10.02

==== FireFox Fix ======================

Deleted from C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\zzvbh57h.default\prefs.js:

Added to C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\zzvbh57h.default\prefs.js:

user_pref("browser.startup.homepage", "http://www.google.com");

user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.newtab.url", "http://www.google.com/");

user_pref("browser.search.defaultengine", "Google");

user_pref("browser.search.defaultenginename", "Google");

user_pref("browser.search.selectedEngine", "Google");

user_pref("browser.search.order.1", "Google");

user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.search.suggest.enabled", true);

user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\zon\AppData\Roaming\Mozilla\Firefox\Profiles\sratwpzb.default\prefs.js:

user_pref("browser.startup.homepage", "http://www.google.nl/");

user_pref("browser.newtab.url", "www.google.nl");

user_pref("browser.search.defaultenginename", "Search the web (Babylon)");

user_pref("browser.search.selectedEngine", "Search the web (Babylon)");

user_pref("browser.search.order.1", "Search the web (Babylon)");

user_pref("keyword.URL", "http://search.babylon.com/?AF=109217&babsrc=adbartrp&mntrId=78f7b34800000000000020cf303038e8&q=");

Added to C:\Users\zon\AppData\Roaming\Mozilla\Firefox\Profiles\sratwpzb.default\prefs.js:

user_pref("browser.startup.homepage", "http://www.google.com");

user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.newtab.url", "http://www.google.com/");

user_pref("browser.search.defaultengine", "Google");

user_pref("browser.search.defaultenginename", "Google");

user_pref("browser.search.selectedEngine", "Google");

user_pref("browser.search.order.1", "Google");

user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.search.suggest.enabled", true);

user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\zzvbh57h.default

user.js not found

---- Lines BabylonToolbar removed from prefs.js ----

---- Lines BabylonToolbar modified from prefs.js ----

---- Lines speedbit removed from prefs.js ----

---- Lines speedbit modified from prefs.js ----

user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"searchpredict@speedbit.com\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\SearchPredict\\\\PRFireFox\",\"mtime\":1309527330116},\"{0329E7D6-6F54-462D-93F6-F5C3118BADF2}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\SpeedBit Video Downloader\\\\SPFireFox\",\"mtime\":1309527334735},\"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\DivX\\\\DivX Plus Web Player\\\\firefox\\\\DivXHTML5\",\"mtime\":1326224654778}}},{\"name\":\"app-global\",\"addons\":{\"{906305f7-aafc-45e9-8bbd-941950a84dad}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{906305f7-aafc-45e9-8bbd-941950a84dad}\",\"mtime\":1325200159990},\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\",\"mtime\":1329586206658}}}]");

---- Lines y2layers removed from prefs.js ----

---- Lines y2layers modified from prefs.js ----

---- Lines Downloader.com removed from prefs.js ----

---- Lines Downloader.com modified from prefs.js ----

---- Lines OneClickDownload removed from prefs.js ----

---- Lines OneClickDownload modified from prefs.js ----

---- FireFox user.js and prefs.js backups ----

prefs_06-04-2013_0001_.backup

ProfilePath: C:\Users\zon\AppData\Roaming\Mozilla\Firefox\Profiles\sratwpzb.default

---- Lines BabylonToolbar removed from prefs.js ----

user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

user_pref("extensions.BabylonToolbar_i.babExt", "");

user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109217");

user_pref("extensions.BabylonToolbar_i.hardId", "78f7b34800000000000020cf303038e8");

user_pref("extensions.BabylonToolbar_i.id", "78f7b34800000000000020cf303038e8");

user_pref("extensions.BabylonToolbar_i.instlDay", "15398");

user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

user_pref("extensions.BabylonToolbar_i.newTab", true);

user_pref("extensions.BabylonToolbar_i.newTabUrl", "http://search.babylon.com/?AF=109217&babsrc=NT_ss&mntrId=78f7b34800000000000020cf303038e8");

user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1718:55:14");

---- Lines BabylonToolbar modified from prefs.js ----

---- Lines BabylonToolbar removed from user.js ----

user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109217");

user_pref("extensions.BabylonToolbar_i.babExt", "");

user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

user_pref("extensions.BabylonToolbar_i.id", "78f7b34800000000000020cf303038e8");

user_pref("extensions.BabylonToolbar_i.hardId", "78f7b34800000000000020cf303038e8");

user_pref("extensions.BabylonToolbar_i.instlDay", "15398");

user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1718:55:14");

user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

---- Lines speedbit removed from prefs.js ----

user_pref("extensions.searchpredict@speedbit.com.install-event-fired", true);

---- Lines speedbit modified from prefs.js ----

user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"searchpredict@speedbit.com\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\SearchPredict\\\\PRFireFox\",\"mtime\":1309527330116},\"{0329E7D6-6F54-462D-93F6-F5C3118BADF2}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\SpeedBit Video Downloader\\\\SPFireFox\",\"mtime\":1309527334735},\"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\DivX\\\\DivX Plus Web Player\\\\firefox\\\\DivXHTML5\",\"mtime\":1326224654778}}},{\"name\":\"app-global\",\"addons\":{\"{906305f7-aafc-45e9-8bbd-941950a84dad}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{906305f7-aafc-45e9-8bbd-941950a84dad}\",\"mtime\":1325200159990},\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\",\"mtime\":1362819616117},\"{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\",\"mtime\":1340163807649},\"{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\",\"mtime\":1349349833245},\"{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\",\"mtime\":1351413243959}}},{\"name\":\"app-profile\",\"addons\":{\"50bb149ba0fa4@50bb149ba0fdd.com\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\50bb149ba0fa4@50bb149ba0fdd.com.xpi\",\"mtime\":1354436927571},\"OneClickDownloader@OneClickDownloader.com\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\OneClickDownloader@OneClickDownloader.com.xpi\",\"mtime\":1359575970539},\"userzoom_survey_tool@jetpack\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\userzoom_survey_tool@jetpack\",\"mtime\":1346343678742},\"{a3a5c777-f583-4fef-9380-ab4add1bc2a8}\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\{a3a5c777-f583-4fef-9380-ab4add1bc2a8}.xpi\",\"mtime\":1342469080588},\"{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\",\"mtime\":1360824541400},\"{dc572301-7619-498c-a57d-39143191b318}\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\{dc572301-7619-498c-a57d-39143191b318}.xpi\",\"mtime\":1361770521048}}}]");

---- Lines speedbit removed from user.js ----

---- Lines y2layers removed from prefs.js ----

user_pref("extentions.y2layers.defaultEnableAppsList", "Buzzdock,BuzzdockTease,DropDownDeals,BestVideoDownloader,TopRelatedTopics,BestVideoDownloader,");

user_pref("extentions.y2layers.installId", "c15b43b2-ccaf-455d-825c-bc61fa7642b7");

user_pref("extentions.y2layers.lastDnsTest", 371995);

---- Lines y2layers modified from prefs.js ----

---- Lines y2layers removed from user.js ----

user_pref("extentions.y2layers.installId", "c15b43b2-ccaf-455d-825c-bc61fa7642b7");

user_pref("extentions.y2layers.defaultEnableAppsList", "Buzzdock,BuzzdockTease,DropDownDeals,BestVideoDownloader,TopRelatedTopics,BestVideoDownloader,");

---- Lines Downloader.com removed from prefs.js ----

user_pref("extensions.OneClickDownloader@OneClickDownloader.com.install-event-fired", true);

---- Lines Downloader.com modified from prefs.js ----

user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"searchpredict@disabled.com\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\SearchPredict\\\\PRFireFox\",\"mtime\":1309527330116},\"{0329E7D6-6F54-462D-93F6-F5C3118BADF2}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\disabled Video Downloader\\\\SPFireFox\",\"mtime\":1309527334735},\"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\DivX\\\\DivX Plus Web Player\\\\firefox\\\\DivXHTML5\",\"mtime\":1326224654778}}},{\"name\":\"app-global\",\"addons\":{\"{906305f7-aafc-45e9-8bbd-941950a84dad}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{906305f7-aafc-45e9-8bbd-941950a84dad}\",\"mtime\":1325200159990},\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\",\"mtime\":1362819616117},\"{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\",\"mtime\":1340163807649},\"{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\",\"mtime\":1349349833245},\"{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\",\"mtime\":1351413243959}}},{\"name\":\"app-profile\",\"addons\":{\"50bb149ba0fa4@50bb149ba0fdd.com\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\50bb149ba0fa4@50bb149ba0fdd.com.xpi\",\"mtime\":1354436927571},\"OneClickDownloader@OneClickDownloader.com\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\OneClickDownloader@OneClickDownloader.com.xpi\",\"mtime\":1359575970539},\"userzoom_survey_tool@jetpack\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\userzoom_survey_tool@jetpack\",\"mtime\":1346343678742},\"{a3a5c777-f583-4fef-9380-ab4add1bc2a8}\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\{a3a5c777-f583-4fef-9380-ab4add1bc2a8}.xpi\",\"mtime\":1342469080588},\"{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\",\"mtime\":1360824541400},\"{dc572301-7619-498c-a57d-39143191b318}\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\{dc572301-7619-498c-a57d-39143191b318}.xpi\",\"mtime\":1361770521048}}}]");

---- Lines Downloader.com removed from user.js ----

---- Lines OneClickDownload removed from prefs.js ----

user_pref("extensions.OneClickDownloader.last_register", "2012-6-30");

user_pref("extensions.OneClickDownloader.SupportedSite", "[]");

user_pref("extensions.OneClickDownloader.UserID", "10.54.14.1674f9cf6184f0960.22965686");

---- Lines OneClickDownload modified from prefs.js ----

user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"searchpredict@disabled.com\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\SearchPredict\\\\PRFireFox\",\"mtime\":1309527330116},\"{0329E7D6-6F54-462D-93F6-F5C3118BADF2}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\disabled Video Downloader\\\\SPFireFox\",\"mtime\":1309527334735},\"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\DivX\\\\DivX Plus Web Player\\\\firefox\\\\DivXHTML5\",\"mtime\":1326224654778}}},{\"name\":\"app-global\",\"addons\":{\"{906305f7-aafc-45e9-8bbd-941950a84dad}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{906305f7-aafc-45e9-8bbd-941950a84dad}\",\"mtime\":1325200159990},\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\",\"mtime\":1362819616117},\"{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\",\"mtime\":1340163807649},\"{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}\",\"mtime\":1349349833245},\"{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}\",\"mtime\":1351413243959}}},{\"name\":\"app-profile\",\"addons\":{\"50bb149ba0fa4@50bb149ba0fdd.com\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\50bb149ba0fa4@50bb149ba0fdd.com.xpi\",\"mtime\":1354436927571},\"OneClickDownloader@OneClickdisabled\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\OneClickDownloader@OneClickdisabled.xpi\",\"mtime\":1359575970539},\"userzoom_survey_tool@jetpack\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\userzoom_survey_tool@jetpack\",\"mtime\":1346343678742},\"{a3a5c777-f583-4fef-9380-ab4add1bc2a8}\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\{a3a5c777-f583-4fef-9380-ab4add1bc2a8}.xpi\",\"mtime\":1342469080588},\"{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\",\"mtime\":1360824541400},\"{dc572301-7619-498c-a57d-39143191b318}\":{\"descriptor\":\"C:\\\\Users\\\\zon\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sratwpzb.default\\\\extensions\\\\{dc572301-7619-498c-a57d-39143191b318}.xpi\",\"mtime\":1361770521048}}}]");

---- Lines OneClickDownload removed from user.js ----

---- FireFox user.js and prefs.js backups ----

user_06-04-2013_0001_.backup

prefs_06-04-2013_0001_.backup

==== Batch Command(s) Run By Tool======================

C:\Windows\System32\roboot64.exe deleted successfully

==== Deleting Files \ Folders ======================

"C:\Windows\SysNative\roboot64.exe" not found

"C:\user.js" deleted

"C:\Users\zon\AppData\Roaming\Mozilla\Firefox\Profiles\sratwpzb.default\extensions\OneClickDownloader@OneClickDownloader.com.xpi" deleted

"C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml" deleted

"C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml" deleted

"C:\Program Files (x86)\Mozilla Firefox\searchplugins\SearchResults.xml" deleted

"C:\Users\zon\lametritonus_en.dll" deleted

"C:\Users\zon\lame_enc_en.dll" deleted

"C:\user.js" deleted

"C:\Users\zon\AppData\Roaming\Mozilla\Firefox\Profiles\sratwpzb.default\extensions\OneClickDownloader@OneClickDownloader.com.xpi" deleted

"C:\Program Files (x86)\Bandoo" deleted

"C:\Program Files (x86)\speedbit video downloader\Toolbar" deleted

"C:\Program Files (x86)\SearchPredict" deleted

"C:\Program Files (x86)\BrowserCompanion" deleted

"C:\Program Files (x86)\DealPly" deleted

"C:\Program Files (x86)\Yontoo" deleted

"C:\Program Files (x86)\Conduit" deleted

"C:\found.000" deleted

"C:\found.001" deleted

"C:\Users\zon\AppData\Roaming\Babylon" deleted

"C:\Users\zon\AppData\Roaming\Systweak" deleted

"C:\Users\zon\AppData\Roaming\pdfforge" deleted

"C:\ProgramData\Partner" deleted

"C:\ProgramData\boost_interprocess" deleted

"C:\ProgramData\Tarma Installer" deleted

"C:\ProgramData\Babylon" deleted

"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly" deleted

"C:\Users\zon\AppData\Local\Ilivid Player" deleted

"C:\Users\zon\AppData\Local\PackageAware" deleted

"C:\Users\zon\AppData\Local\Babylon" deleted

"C:\Users\zon\AppData\Local\Conduit" deleted

"C:\Users\zon\AppData\LocalLow\boost_interprocess" deleted

"C:\Users\zon\AppData\LocalLow\DataMngr" deleted

"C:\Users\zon\AppData\LocalLow\searchquband" deleted

"C:\Users\zon\AppData\LocalLow\Conduit" deleted

"C:\Users\zon\AppData\LocalLow\Toolbar4" deleted

"C:\Users\zon\AppData\Local\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc" deleted

"C:\Users\zon\AppData\Roaming\Mozilla\Firefox\Profiles\sratwpzb.default\jetpack" deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\zon\AppData\Local\Temp ====

====== C:\Windows\SysWOW64 =====

2013-03-29 18:09:22 EC68C565EFEE1AAE6174C17F826C9384 493056 ----a-w- C:\Windows\SysWOW64\msfeeds.dll

2013-03-29 18:09:22 E3FA8AEAA2F40EC1BB00FEFB2C4F3AD9 14317568 ----a-w- C:\Windows\SysWOW64\mshtml.dll

2013-03-29 18:09:22 E14A07B768EC49D382CABCE2F078D576 232960 ----a-w- C:\Windows\SysWOW64\url.dll

2013-03-29 18:09:22 DEFB55D4FF094673DF31FA89A8A8A2F0 226816 ----a-w- C:\Windows\SysWOW64\dxtrans.dll

2013-03-29 18:09:22 C68FBBF01E86CB6CF0B797748FBD6C1A 357888 ----a-w- C:\Windows\SysWOW64\dxtmsft.dll

2013-03-29 18:09:22 C28A634CF127DA67D566B5E14D0A0170 719360 ----a-w- C:\Windows\SysWOW64\mshtmlmedia.dll

2013-03-29 18:09:22 C225E5307D8D4982A1687F2702C37C78 158720 ----a-w- C:\Windows\SysWOW64\msls31.dll

2013-03-29 18:09:22 BA15504FA59A8DC304F1CBAEBA6252A1 1766912 ----a-w- C:\Windows\SysWOW64\wininet.dll

2013-03-29 18:09:22 B96C13B5C85AC4240FE95DE115945D59 38400 ----a-w- C:\Windows\SysWOW64\imgutil.dll

2013-03-29 18:09:22 B3D105459BBA576A763E8C061E49F5C5 1129984 ----a-w- C:\Windows\SysWOW64\urlmon.dll

2013-03-29 18:09:22 AFE08AAD4D0D54FE2EF44739255AAA0F 2877440 ----a-w- C:\Windows\SysWOW64\jscript9.dll

2013-03-29 18:09:22 AF0332E09DDBE0172237D1958A7DADB8 79872 ----a-w- C:\Windows\SysWOW64\mshtmled.dll

2013-03-29 18:09:22 A7E8E3A9F92D9B0D495F636A1D282883 48640 ----a-w- C:\Windows\SysWOW64\mshtmler.dll

2013-03-29 18:09:22 A3DA36A9E63FD0F9B45781E326AC6501 39936 ----a-w- C:\Windows\SysWOW64\jsproxy.dll

2013-03-29 18:09:22 9DF7A7C74D8632CB5EBD37E3A374825E 204800 ----a-w- C:\Windows\SysWOW64\webcheck.dll

2013-03-29 18:09:22 96E0F0BED5D9EBABB899D8CA83C36A7E 523264 ----a-w- C:\Windows\SysWOW64\vbscript.dll

2013-03-29 18:09:22 8C3D32A4A46326031309A43C52539D7F 1400416 ----a-w- C:\Windows\SysWOW64\ieapfltr.dat

2013-03-29 18:09:22 8A45166CD9874463AB76B552C9C2D3AD 110592 ----a-w- C:\Windows\SysWOW64\IEAdvpack.dll

2013-03-29 18:09:22 87E71F2A83681F41B796CA685818EF2D 163840 ----a-w- C:\Windows\SysWOW64\msrating.dll

2013-03-29 18:09:22 87513A002B7B0F9C259F2431DFD008DC 137216 ----a-w- C:\Windows\SysWOW64\ieUnatt.exe

2013-03-29 18:09:22 84AC80FCD61D389948B8C0E47623B79B 71680 ----a-w- C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-03-29 18:09:22 828B4A41BE891A7AEC07E693422B4A3A 117248 ----a-w- C:\Windows\SysWOW64\iepeers.dll

2013-03-29 18:09:22 81C4D657D37C3A5418B54BFECE821B84 57344 ----a-w- C:\Windows\SysWOW64\pngfilt.dll

2013-03-29 18:09:22 80B47F0F45C3EBF41C30E0BA367D25D3 125440 ----a-w- C:\Windows\SysWOW64\occache.dll

2013-03-29 18:09:22 6DF2C6438CFF6EFCBBB88AEE01795501 73728 ----a-w- C:\Windows\SysWOW64\SetIEInstalledDate.exe

2013-03-29 18:09:22 66D8CDC28A0AADDA34133AE733934658 2046464 ----a-w- C:\Windows\SysWOW64\iertutil.dll

2013-03-29 18:09:22 56E51C26745FF7413514EA4DDF33BC6C 11776 ----a-w- C:\Windows\SysWOW64\msfeedssync.exe

2013-03-29 18:09:22 52A7D73D5570F757D865DDECD087FB41 138752 ----a-w- C:\Windows\SysWOW64\wextract.exe

2013-03-29 18:09:22 50EE6790FBBCE920FFABAD5D747F2788 391680 ----a-w- C:\Windows\SysWOW64\ieui.dll

2013-03-29 18:09:22 4BF21D1946E8119D9C23F6F925D43F01 2706432 ----a-w- C:\Windows\SysWOW64\mshtml.tlb

2013-03-29 18:09:22 4A47CAEA8D3B82DE439A79771ECED4B1 361984 ----a-w- C:\Windows\SysWOW64\html.iec

2013-03-29 18:09:22 49C9634AD2516448A0250812B7F5325C 690688 ----a-w- C:\Windows\SysWOW64\jscript.dll

2013-03-29 18:09:22 414A3D9AAE072CDEFE0B64C2EBEE18D2 61952 ----a-w- C:\Windows\SysWOW64\tdc.ocx

2013-03-29 18:09:22 404FAD93ABFBD86D1AAAB47D5DFA6505 242200 ----a-w- C:\Windows\SysWOW64\iedkcs32.dll

2013-03-29 18:09:22 3AB2A38F7EA9E62D176A78FB58761E24 12800 ----a-w- C:\Windows\SysWOW64\mshta.exe

2013-03-29 18:09:22 338520304B99471BD0ED121954FE7863 82432 ----a-w- C:\Windows\SysWOW64\inseng.dll

2013-03-29 18:09:22 2D7A29C35D0894481A69FA3AC45F18F0 41984 ----a-w- C:\Windows\SysWOW64\msfeedsbs.dll

2013-03-29 18:09:22 1DACF9167B6544536B6E9813EC026703 13761024 ----a-w- C:\Windows\SysWOW64\ieframe.dll

2013-03-29 18:09:22 0F44172A5B34E8F208CD0F209EDD4A73 629248 ----a-w- C:\Windows\SysWOW64\ieapfltr.dll

2013-03-29 18:09:22 059F9C59DAEDE8AF2C8C55BE278A99B0 109056 ----a-w- C:\Windows\SysWOW64\iesysprep.dll

2013-03-29 18:09:22 0402BFC25AB49E02256BC24E32829773 185344 ----a-w- C:\Windows\SysWOW64\elshyph.dll

2013-03-29 18:09:22 038F76279EC64878A072D988DE13C7B2 150528 ----a-w- C:\Windows\SysWOW64\iexpress.exe

2013-03-29 18:09:21 F0D4AE074D9BC0741DC6E91C741F2F8C 23040 ----a-w- C:\Windows\SysWOW64\licmgr10.dll

2013-03-29 18:09:21 9D9AC6CE9A9D951AC40DE91CD6F0A620 1441280 ----a-w- C:\Windows\SysWOW64\inetcpl.cpl

2013-03-29 18:09:21 932571EFF79B93F94E84ADF4989A277F 69120 ----a-w- C:\Windows\SysWOW64\icardie.dll

2013-03-29 18:09:21 826D75A36336858B004774792DC4CF4F 33280 ----a-w- C:\Windows\SysWOW64\iernonce.dll

2013-03-29 18:09:21 1FF56AC32B38A94C3C88497BD6E00C96 25185 ----a-w- C:\Windows\SysWOW64\ieuinit.inf

2013-03-29 18:09:21 06A2617B25C920887D80E8A79B7E48EA 61440 ----a-w- C:\Windows\SysWOW64\iesetup.dll

====== C:\Windows\SysWOW64\drivers =====

====== C:\Windows\Sysnative =====

2013-03-29 18:09:22 5051BB40FFB2BA4870C0A059CA03294F 1054720 ----a-w- C:\Windows\Sysnative\MsSpellCheckingFacility.exe

2013-03-29 18:09:22 3531FA12A76A32ECECD972196775DF7C 226304 ----a-w- C:\Windows\Sysnative\elshyph.dll

2013-03-29 18:09:21 FC6B4D5450871A4D5CB344AFF6C090EF 281600 ----a-w- C:\Windows\Sysnative\dxtrans.dll

2013-03-29 18:09:21 F651D95B5043EFC20A6108A853553984 92160 ----a-w- C:\Windows\Sysnative\SetIEInstalledDate.exe

2013-03-29 18:09:21 EC08E38751854C5B8899139B7DD29FF9 197120 ----a-w- C:\Windows\Sysnative\msrating.dll

2013-03-29 18:09:21 EBA7F74ACC7FF61FF92C2072C92CEF14 53760 ----a-w- C:\Windows\Sysnative\jsproxy.dll

2013-03-29 18:09:21 E965529C43D25F2BDA77D705098BF777 135680 ----a-w- C:\Windows\Sysnative\IEAdvpack.dll

2013-03-29 18:09:21 E1055A7FAD39F1F7C44F6152044056EA 905728 ----a-w- C:\Windows\Sysnative\mshtmlmedia.dll

2013-03-29 18:09:21 D9C10A4A0B3411146E6FC8936B079934 167424 ----a-w- C:\Windows\Sysnative\iexpress.exe

2013-03-29 18:09:21 D8DD5CBB9668EEE98915EA49C72F78FA 441856 ----a-w- C:\Windows\Sysnative\html.iec

2013-03-29 18:09:21 D8076F8A3C34064582035AE6696DC34A 27648 ----a-w- C:\Windows\Sysnative\licmgr10.dll

2013-03-29 18:09:21 D6FCE28376454CDED6E9B144B6EF309A 1365504 ----a-w- C:\Windows\Sysnative\urlmon.dll

2013-03-29 18:09:21 D2685013EEF64BB5DCD252BAB5C5FAD0 89600 ----a-w- C:\Windows\Sysnative\RegisterIEPKEYs.exe

2013-03-29 18:09:21 D0F66CFAED5B85543216EF526D380B8B 270848 ----a-w- C:\Windows\Sysnative\iedkcs32.dll

2013-03-29 18:09:21 D0D4CE6C6CE87269A34A184356475D17 149504 ----a-w- C:\Windows\Sysnative\occache.dll

2013-03-29 18:09:21 CF1387441D1096DBD4A23E155F1EE958 173568 ----a-w- C:\Windows\Sysnative\ieUnatt.exe

2013-03-29 18:09:21 C6EEC6399077E12FA902BD31F009699E 136704 ----a-w- C:\Windows\Sysnative\iesysprep.dll

2013-03-29 18:09:21 C2F21E3059AFF5E616F3E361D9FA10CD 62976 ----a-w- C:\Windows\Sysnative\pngfilt.dll

2013-03-29 18:09:21 C28A152C8F971B209C685F1B34B0CBF4 855552 ----a-w- C:\Windows\Sysnative\jscript.dll

2013-03-29 18:09:21 BC0D4AFBE94D8E1F81C8926D805C3366 247296 ----a-w- C:\Windows\Sysnative\webcheck.dll

2013-03-29 18:09:21 B3B0F58C489048D8DC1927164402EA31 3958784 ----a-w- C:\Windows\Sysnative\jscript9.dll

2013-03-29 18:09:21 ADE73A865A5F136E84F49BB6B1627C6E 1509376 ----a-w- C:\Windows\Sysnative\inetcpl.cpl

2013-03-29 18:09:21 A4DC3CD413A4D0E7CE805CAEC39CE724 15407616 ----a-w- C:\Windows\Sysnative\ieframe.dll

2013-03-29 18:09:21 9D8B838E173E6C69A735ADEF3C55D31D 603136 ----a-w- C:\Windows\Sysnative\msfeeds.dll

2013-03-29 18:09:21 96938C3BA9C09CEF29A7B909E3881538 2706432 ----a-w- C:\Windows\Sysnative\mshtml.tlb

2013-03-29 18:09:21 942E110384668EEFF44751A02EDDF5E4 48640 ----a-w- C:\Windows\Sysnative\mshtmler.dll

2013-03-29 18:09:21 8C3D32A4A46326031309A43C52539D7F 1400416 ----a-w- C:\Windows\Sysnative\ieapfltr.dat

2013-03-29 18:09:21 82D602EBBBA6D08E4691F32269FD3494 12800 ----a-w- C:\Windows\Sysnative\msfeedssync.exe

2013-03-29 18:09:21 7EC25F7ABF7CE6B0FE93787524EE537B 452096 ----a-w- C:\Windows\Sysnative\dxtmsft.dll

2013-03-29 18:09:21 7539E5B4A9763C22CE5CACE3E9A6246F 19221504 ----a-w- C:\Windows\Sysnative\mshtml.dll

2013-03-29 18:09:21 69F1D418B4C4EC23033D598E4CBC6B73 2240512 ----a-w- C:\Windows\Sysnative\wininet.dll

2013-03-29 18:09:21 658E8FEC79A4AB5BFDE032627B5C9667 13824 ----a-w- C:\Windows\Sysnative\mshta.exe

2013-03-29 18:09:21 63CAE56FE4215F98FEB0188748A99378 52224 ----a-w- C:\Windows\Sysnative\msfeedsbs.dll

2013-03-29 18:09:21 62077020B3106089469922A93EF3ECE1 39936 ----a-w- C:\Windows\Sysnative\iernonce.dll

2013-03-29 18:09:21 5B64B732BD620A873A2FD74862CC9018 51712 ----a-w- C:\Windows\Sysnative\ie4uinit.exe

2013-03-29 18:09:21 5B15164486C66B76699E1CD2CD2F3A2A 51200 ----a-w- C:\Windows\Sysnative\imgutil.dll

2013-03-29 18:09:21 4E426A67C46379B75A5E671B46FC07F6 102912 ----a-w- C:\Windows\Sysnative\inseng.dll

2013-03-29 18:09:21 4CFBEC37E4FAD530E623E1541E1EA958 599552 ----a-w- C:\Windows\Sysnative\vbscript.dll

2013-03-29 18:09:21 440104AEB9DAF8AC9842080AE59740FA 77312 ----a-w- C:\Windows\Sysnative\tdc.ocx

2013-03-29 18:09:21 40738329209CBE2C9B48F7E30F7C1414 144896 ----a-w- C:\Windows\Sysnative\wextract.exe

2013-03-29 18:09:21 402D797A7905DC3C6FE11E75CD5252EB 235008 ----a-w- C:\Windows\Sysnative\url.dll

2013-03-29 18:09:21 364D3FB12030D214433E794A67CD4C41 526848 ----a-w- C:\Windows\Sysnative\ieui.dll

2013-03-29 18:09:21 2AAE2B8FED8390879C2369FC63F7001F 97280 ----a-w- C:\Windows\Sysnative\mshtmled.dll

2013-03-29 18:09:21 23C80181B93AA17DACB08A7474A8558B 2647552 ----a-w- C:\Windows\Sysnative\iertutil.dll

2013-03-29 18:09:21 23556D116D5FB93395B2A648EEB24251 81408 ----a-w- C:\Windows\Sysnative\icardie.dll

2013-03-29 18:09:21 1FF56AC32B38A94C3C88497BD6E00C96 25185 ----a-w- C:\Windows\Sysnative\ieuinit.inf

2013-03-29 18:09:21 18A94D6E9D27D169D38DAB91F6A97518 136192 ----a-w- C:\Windows\Sysnative\iepeers.dll

2013-03-29 18:09:21 1456EECCB5CF6B91513200F95D61706E 762368 ----a-w- C:\Windows\Sysnative\ieapfltr.dll

2013-03-29 18:09:21 112183DF91C9BAECB498E4A86ECDE598 216064 ----a-w- C:\Windows\Sysnative\msls31.dll

2013-03-29 18:09:21 0524F299A1C79CBB537AA03376C552B7 67072 ----a-w- C:\Windows\Sysnative\iesetup.dll

====== C:\Windows\Sysnative\drivers =====

2013-03-30 09:32:29 490FA25161BF3E51993EB724ECF0ACEB 28600 ----a-w- C:\Windows\Sysnative\drivers\avkmgr.sys

2013-03-21 05:16:08 92B3172E8C14C1444682F510843A9988 19968 ----a-w- C:\Windows\Sysnative\drivers\usb8023.sys

2013-03-20 05:14:26 BF9A487F5DB57E339A27716582DA83AB 52376 ----a-w- C:\Windows\Sysnative\drivers\hcmon.sys

2013-03-20 05:14:24 415B167695C4B5960A13098622EF3D80 37680 ----a-w- C:\Windows\Sysnative\drivers\vmusb.sys

====== C:\Windows\Tasks ======

====== C:\Windows\Temp ======

======= C:\Program Files =====

2013-03-20 05:13:48 -------- d-----w- C:\Program Files\VMware

2013-03-14 07:11:44 -------- d-----w- C:\Program Files\Microsoft Silverlight

======= C:\Program Files (x86) =====

2013-03-20 05:13:48 -------- d-----w- C:\Program Files (x86)\Common Files\VMware

2013-03-14 07:11:44 -------- d-----w- C:\Program Files (x86)\Microsoft Silverlight

======= C: =====

====== C:\Users\zon\AppData\Roaming ======

2013-03-20 05:29:09 -------- d-----w- C:\users\zon\AppData\Roaming\VMware

2013-03-20 05:13:48 -------- d-----w- C:\users\zon\AppData\Local\VMware

====== C:\Users\zon ======

2013-03-20 05:14:28 -------- d-----w- C:\ProgramData\VMware

====== C: exe-files ==

2013-03-30 19:23:57 5945B121AC1E658F4049E0EEC68F2973 183208 ------r- C:\Program Files (x86)\Belastingdienst\Aangifte inkomstenbelasting\2012\ib2012u.exe

=== C: other files ==

2013-03-30 09:32:29 490FA25161BF3E51993EB724ECF0ACEB 28600 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avkmgr.sys

2013-03-30 09:32:29 488486DAD09A5B6C6DBB8B990A8B2307 130016 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avipbb.sys

2013-03-30 09:32:29 09E6069EF94B345061B4BD3CEBD974C8 100712 ----a-w- C:\Program Files (x86)\Avira\AntiVir Desktop\avgntflt.sys

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-648035464-3342752320-20647198-1001\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background"

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun"

"Facebook Update"="C:\Users\zon\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"

"TomTomHOME.exe"="C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"

"Google Update"="C:\Users\zon\AppData\Local\Google\Update\GoogleUpdate.exe /c"

"Spotify Web Helper"="C:\Users\zon\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

"DAEMON Tools Lite"="C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe -autorun"

"Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HDAudDeck"="C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r"

"ATKOSD2"="C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe"

"ATKMEDIA"="C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe"

"HControlUser"="C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe"

"Wireless Console 3"="C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe"

"PWRISOVM.EXE"="C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup"

"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher"="C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"DivXUpdate"="C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe /CHECKNOW"

"GrooveMonitor"="C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

"ToolboxFX"="C:\Program Files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on"

"HP Software Update"="C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe"

"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"avgnt"="C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe /min"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]