opstart pc

ricardo425 · 28 april 2014

Hallo beste vrienden,

Na een hele tijd zonder problemen krijg ik sinds enkele dagen bij het opstarten van mijn pc dit als melding.

Hoe komt dit, en wat kan ik ertegen doen.

iEscape · 28 april 2014

@ ricardo425,

Download RSIT van de onderstaande locaties en sla deze op het bureaublad op.

Hier staat een beschrijving hoe je kan kijken of je een 32- of 64-bitversie van Windows heeft.

RSIT 32 bit (RSIT.exe)
RSIT 64 bit (RSITx64.exe)

Dubbelklik op RSIT.exe om de tool te starten.

Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Vervolgens wordt de "Disclaimer of warranty" getoond, klik vervolgens op "Continue"
Wanneer de tool gereed is worden er twee kladblok bestanden geopend genaamd "Log.txt" en "Info.txt" .

RSIT Logbestanden plaatsen

Voeg het logbestand met de naam "Log.txt" als bijlage toe aan het volgende bericht. (Dit logbestand kunt u tevens terug vinden in de map ""C:\\rsit")
Het logbestand met de naam "Info.txt" wat geminimaliseerd is hoeft u niet te plaatsen. (Dit logbestand wordt enkel de eerst keer bij het uitvoeren aangemaakt).
Hoe u een bijlage kunt toevoegen aan het bericht leest u hier.

Bekijk ook de instructievideo.

ricardo425 · 29 april 2014

Logfile of random's system information tool 1.09 (written by random/random)

Run by Richard at 2014-04-29 20:18:26

Microsoft Windows 7 Home Premium Service Pack 1

System drive C: has 413 GB (58%) free of 706 GB

Total RAM: 4061 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:18:29, on 29/04/2014

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.17041)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe

C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe

C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe

C:\Program Files (x86)\AVG\AVG2014\avgui.exe

C:\Windows\SysWOW64\ctfmon.exe

C:\PROGRA~2\SearchProtect\SearchProtect\bin\cltmng.exe

C:\PROGRA~2\SearchProtect\UI\bin\cltmngui.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe

C:\Program Files\trend micro\Richard.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Zoeken

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: Aanmeldhulp voor Microsoft-account - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O2 - BHO: DVDVideoSoft.WebPageAdjuster - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

O4 - HKLM\..\Run: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m

O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

O4 - HKLM\..\Run: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"

O4 - HKLM\..\Run: [NBAgent] "C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O4 - HKCU\..\Run: [DellSystemDetect] C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms

O4 - HKCU\..\Run: [NextLive] C:\Windows\SysWOW64\rundll32.exe "C:\Users\Richard\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l

O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')

O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe

O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

O9 - Extra 'Tools' menuitem: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O15 - Trusted Zone: *.dell.com

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O20 - AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2014\avgfws.exe

O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Search Protect by Conduit Service (CltMngSvc) - Conduit - C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe

O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Freemake Improver - Freemake - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 11008 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe

c:\PROGRA~2\AVG\AVG2014\avgrsa.exe /boot

C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe /pipeName=14d3590b-2dfa-4808-b02d-774c44152772 /coreSdkOptions=4382 /logConfFile="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014\temp\209ddb6b-60f1-460e-bb86-985f61c7e917-1a8-oopp.tmp" /loggerName=AVG.RS.Core /binaryPath="C:\Program Files (x86)\AVG\AVG2014\" /tempPath="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014\temp\" /logPath="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014\log\"

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

wininit.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

"C:\Program Files\Dell\DellDock\DockLogin.exe"

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"

"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"

"taskhost.exe"

"C:\Program Files (x86)\AVG\AVG2014\avgfws.exe"

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

"C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe"

"C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe"

"C:\Program Files\Bonjour\mDNSResponder.exe"

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

"C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe"

"C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe"

"C:\Windows\System32\igfxtray.exe"

"C:\Windows\System32\hkcmd.exe"

"C:\Windows\System32\igfxpers.exe"

"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s

"C:\Windows\WindowsMobile\wmdc.exe"

"C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe"

"C:\Program Files (x86)\AVG\AVG2014\avgemca.exe"

"C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m

"C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

"C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"

"C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE"

C:\Windows\system32\svchost.exe -k imgsvc

"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"

WLIDSvcM.exe 3180

"C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart

"C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY

"C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe"

C:\Windows\system32\wbem\wmiprvse.exe

ctfmon.exe

"C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe"

"C:\Users\Richard\AppData\Local\Apps\2.0\C32B01GH.KYQ\LGHOY23L.WH5\dell..tion_0f612f649c4a10af_0005.0004_3ddfe37344028d2c\DellSystemDetect.exe"

C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe /pipeName=2624b270-4e03-4203-8403-5665ba9b980d /coreSdkOptions=4114 /logConfFile="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014\temp\c5cf1f26-2542-4826-894f-520a3b07e75c-bd4-oopp.tmp" /loggerName=AVG.NS.Core /binaryPath="C:\Program Files (x86)\AVG\AVG2014\" /tempPath="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2014\temp\"

C:\Windows\system32\svchost.exe -k WindowsMobile

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-5e72db5c-a75c-4232-a14a-d42ac81e9dc2 -SystemEventPortName:HostProcess-36c5f768-c301-4c6c-97ed-7eddb362a755 -IoCancelEventPortName:HostProcess-843fb7bf-18a9-4dbc-bad7-46e765e90cf1 -NonStateChangingEventPortName:HostProcess-9e2cd5d3-0a2c-4d57-bb05-c8added7b8ee -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:819cf0c3-6bc4-4ad1-b2b6-7b88229180b4 -DeviceGroupId:WpdFsGroup

C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe

"C:\Program Files (x86)\Nero\Update\NASvc.exe"

C:\PROGRA~2\SearchProtect\SearchProtect\bin\cltmng.exe

C:\PROGRA~2\SearchProtect\UI\bin\cltmngui.exe

"C:\Program Files\Vuze\Azureus.exe"

"taskhost.exe"

"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "http://www.pc-helpforum.be/"

"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=5724.1a855ce0.1552312986 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" E7CF176E110C211B 5724 "\\.\pipe\gecko-crash-server-pipe.5724" plugin

"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe" --proxy-stub-channel=Flash4884.5FB57F48.13218 --host-broker-channel=Flash4884.5FB57F48.11243 --host-pid=4884 --host-npapi-version=27 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll"

"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe" --channel=6464.003EF21C.1323486157 --proxy-stub-channel=Flash4884.5FB57F48.13218 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll" --host-npapi-version=27 --type=renderer

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe16_ Global\UsGthrCtrlFltPipeMssGthrPipe16 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524

"C:\Users\Richard\Downloads\RSITx64(1).exe"

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000Core.job

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137

prefs.js - "browser.search.useDBForOrder" - "false"

prefs.js - "browser.startup.homepage" - "http://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPCD66168D-CE8C-4E71-B4E5-C81522053613&SSPV="

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]

"Description"=Adobe® Flash® Player 13.0.0.206 Plugin

"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]

"Description"=Adobe Shockwave Player

"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.55.2]

"Description"=Java™ Deployment Toolkit

"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2]

"Description"=Oracle® Next Generation Java™ Plug-In

"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@mcafee.com/McAfeeMssPlugin]

"Description"=McAfee Mss Plugin

"Path"=C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@mcafee.com/MVT]

"Description"=McAfee Virtual Technician Plugin

"Path"=C:\Program Files (x86)\McAfee\Supportability\MVT\npmvtplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]

"Description"=

"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]

"Description"=Ag Player Plugin

"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.2]

"Description"=VLC Multimedia Plugin

"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.8]

"Description"=VLC Multimedia Plugin

"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.1]

"Description"=VLC Multimedia Plugin

"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.2]

"Description"=VLC Multimedia Plugin

"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.3]

"Description"=VLC Multimedia Plugin

"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]

"Description"=Handles PDFs in-place in Firefox

"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]

"Description"=Adobe® Flash® Player 13.0.0.206 Plugin

"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.13.2]

"Description"=Java™ Deployment Toolkit

"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2]

"Description"=Oracle® Next Generation Java™ Plug-In

"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]

"Description"=

"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]

"Description"=Ag Player Plugin

"Path"=c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll

C:\Program Files (x86)\Mozilla Firefox\components\

nsIQTScriptablePlugin.xpt

C:\Program Files (x86)\Mozilla Firefox\plugins\

nppdf32.dll

npqtplugin.dll

npqtplugin2.dll

npqtplugin3.dll

npqtplugin4.dll

npqtplugin5.dll

QuickTimePlugin.class

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137\searchplugins\

ask-web-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

DVDVideoSoft IE Extension - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2013-12-30 357432]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}]

MSS+ Identifier - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll [2014-01-16 96128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-04-14 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Aanmeldhulp voor Microsoft-account - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-04-14 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

DVDVideoSoft IE Extension - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2013-12-30 294456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"=C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [2009-06-04 186904]

"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06 500208]

"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-08-25 161304]

"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-08-25 386584]

"Persistence"=C:\Windows\system32\igfxpers.exe [2010-08-25 415256]

"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2009-10-21 8306208]

"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 660360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"=C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-06-19 138096]

"DellSystemDetect"=C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms [2013-10-08 370]

"NextLive"=C:\Windows\SysWOW64\rundll32.exe [2009-07-14 44544]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]

"Dell DataSafe Online"=C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe [2009-11-13 1807600]

"PDVDDXSrv"=C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [2009-12-29 140520]

"Desktop Disc Tool"=c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [2009-10-15 498160]

"NBAgent"=C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2010-02-22 1226024]

"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2013-09-13 59720]

"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]

"AVG_UI"=C:\Program Files (x86)\AVG\AVG2014\avgui.exe [2014-04-06 5180432]

"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2014-01-17 421888]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"="C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist]

C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]

C:\Windows\system32\igfxdev.dll [2010-08-25 271360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2013-11-26 243200]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\GoToAssist]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcpltsvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=0

"ConsentPromptBehaviorUser"=3

"EnableLUA"=0

"EnableUIADesktopToggle"=0

"PromptOnSecureDesktop"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableLinkedConnections"=1

"DisableTaskMgr"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDrives"=0

"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDrives"=0

"NoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"vidc.uyvy"=msyuv.dll

"vidc.yuy2"=msyuv.dll

"vidc.yvyu"=msyuv.dll

"vidc.iyuv"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"vidc.yvu9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

"wave2"=wdmaud.drv

"midi2"=wdmaud.drv

"mixer2"=wdmaud.drv

"aux2"=wdmaud.drv

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"aux"=wdmaud.drv

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"aux1"=wdmaud.drv

"wave3"=wdmaud.drv

"midi3"=wdmaud.drv

"mixer3"=wdmaud.drv

"aux3"=wdmaud.drv

"wave4"=wdmaud.drv

"midi4"=wdmaud.drv

"mixer4"=wdmaud.drv

"aux4"=wdmaud.drv

"wave5"=wdmaud.drv

"midi5"=wdmaud.drv

"mixer5"=wdmaud.drv

"aux5"=wdmaud.drv

"wave6"=wdmaud.drv

"midi6"=wdmaud.drv

"mixer6"=wdmaud.drv

"aux6"=wdmaud.drv

"wave7"=wdmaud.drv

"midi7"=wdmaud.drv

"mixer7"=wdmaud.drv

"aux7"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2014-04-28 19:31:49 ----D---- C:\ProgramData\Allmyapps

2014-04-28 14:32:21 ----D---- C:\Users\Richard\AppData\Roaming\DVD Flick

2014-04-28 14:28:14 ----D---- C:\Program Files (x86)\Systweak Support Dock

2014-04-28 14:27:27 ----D---- C:\Program Files (x86)\Advanced System Protector

2014-04-28 14:27:11 ----A---- C:\Windows\system32\roboot64.exe

2014-04-28 14:27:09 ----D---- C:\Users\Richard\AppData\Roaming\systweak

2014-04-23 20:19:49 ----D---- C:\ProgramData\YTD Video Downloader

2014-04-23 20:19:38 ----D---- C:\Program Files (x86)\GreenTree Applications

2014-04-22 08:30:23 ----A---- C:\Windows\SYSWOW64\ieui.dll

2014-04-22 08:30:23 ----A---- C:\Windows\system32\ieui.dll

2014-04-22 08:30:22 ----A---- C:\Windows\SYSWOW64\vbscript.dll

2014-04-22 08:30:22 ----A---- C:\Windows\system32\vbscript.dll

2014-04-22 08:30:18 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-04-22 08:30:18 ----A---- C:\Windows\system32\iernonce.dll

2014-04-22 08:30:18 ----A---- C:\Windows\system32\ieetwcollectorres.dll

2014-04-22 08:30:18 ----A---- C:\Windows\system32\ie4uinit.exe

2014-04-22 08:30:16 ----A---- C:\Windows\SYSWOW64\msrating.dll

2014-04-22 08:30:16 ----A---- C:\Windows\SYSWOW64\msfeeds.dll

2014-04-22 08:30:16 ----A---- C:\Windows\SYSWOW64\jsproxy.dll

2014-04-22 08:30:16 ----A---- C:\Windows\SYSWOW64\dxtrans.dll

2014-04-22 08:30:16 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll

2014-04-22 08:30:16 ----A---- C:\Windows\system32\msrating.dll

2014-04-22 08:30:16 ----A---- C:\Windows\system32\msfeeds.dll

2014-04-22 08:30:16 ----A---- C:\Windows\system32\jsproxy.dll

2014-04-22 08:30:16 ----A---- C:\Windows\system32\jscript9diag.dll

2014-04-22 08:30:16 ----A---- C:\Windows\system32\dxtrans.dll

2014-04-22 08:30:16 ----A---- C:\Windows\system32\dxtmsft.dll

2014-04-22 08:30:15 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe

2014-04-22 08:30:15 ----A---- C:\Windows\SYSWOW64\iesetup.dll

2014-04-22 08:30:15 ----A---- C:\Windows\SYSWOW64\iernonce.dll

2014-04-22 08:30:15 ----A---- C:\Windows\system32\ieUnatt.exe

2014-04-22 08:30:15 ----A---- C:\Windows\system32\iesetup.dll

2014-04-22 08:30:14 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll

2014-04-22 08:30:14 ----A---- C:\Windows\system32\mshtml.dll

2014-04-22 08:30:13 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll

2014-04-22 08:30:13 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll

2014-04-22 08:30:13 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll

2014-04-22 08:30:13 ----A---- C:\Windows\system32\ieetwproxystub.dll

2014-04-22 08:30:13 ----A---- C:\Windows\system32\ieapfltr.dll

2014-04-22 08:30:12 ----A---- C:\Windows\SYSWOW64\iertutil.dll

2014-04-22 08:30:12 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe

2014-04-22 08:30:12 ----A---- C:\Windows\system32\ieetwcollector.exe

2014-04-22 08:30:11 ----A---- C:\Windows\SYSWOW64\wininet.dll

2014-04-22 08:30:11 ----A---- C:\Windows\SYSWOW64\urlmon.dll

2014-04-22 08:30:11 ----A---- C:\Windows\system32\wininet.dll

2014-04-22 08:30:11 ----A---- C:\Windows\system32\urlmon.dll

2014-04-22 08:30:11 ----A---- C:\Windows\system32\iertutil.dll

2014-04-22 08:30:10 ----A---- C:\Windows\system32\ieframe.dll

2014-04-22 08:30:09 ----A---- C:\Windows\SYSWOW64\ieframe.dll

2014-04-22 08:30:08 ----A---- C:\Windows\SYSWOW64\mshtml.dll

2014-04-22 08:30:08 ----A---- C:\Windows\SYSWOW64\jscript9.dll

2014-04-22 08:30:08 ----A---- C:\Windows\system32\jscript9.dll

2014-04-22 07:36:13 ----A---- C:\Windows\SYSWOW64\javaws.exe

2014-04-22 07:36:08 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll

2014-04-22 07:36:08 ----A---- C:\Windows\SYSWOW64\javaw.exe

2014-04-22 07:36:08 ----A---- C:\Windows\SYSWOW64\java.exe

2014-04-18 18:57:29 ----D---- C:\ProgramData\Avg_Update_0414b

2014-04-18 15:01:30 ----A---- C:\Windows\system32\drivers\avgidsdrivera.sys

2014-04-09 22:45:32 ----A---- C:\Windows\SYSWOW64\iologmsg.dll

2014-04-09 22:45:32 ----A---- C:\Windows\system32\iologmsg.dll

2014-04-09 22:45:32 ----A---- C:\Windows\system32\drivers\storport.sys

2014-04-09 22:45:32 ----A---- C:\Windows\system32\drivers\msiscsi.sys

2014-04-09 22:45:32 ----A---- C:\Windows\system32\drivers\Diskdump.sys

2014-04-09 22:45:30 ----A---- C:\Windows\SYSWOW64\kernel32.dll

2014-04-09 22:45:30 ----A---- C:\Windows\system32\wow64.dll

2014-04-09 22:45:30 ----A---- C:\Windows\system32\kernel32.dll

2014-04-09 22:45:29 ----A---- C:\Windows\SYSWOW64\wow32.dll

2014-04-09 22:45:29 ----A---- C:\Windows\SYSWOW64\user.exe

2014-04-09 22:45:29 ----A---- C:\Windows\SYSWOW64\setup16.exe

2014-04-09 22:45:29 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll

2014-04-09 22:45:29 ----A---- C:\Windows\SYSWOW64\instnm.exe

2014-04-09 22:45:29 ----A---- C:\Windows\system32\wow64win.dll

2014-04-09 22:45:29 ----A---- C:\Windows\system32\wow64cpu.dll

2014-04-09 22:45:29 ----A---- C:\Windows\system32\ntvdm64.dll

2014-04-09 22:45:28 ----A---- C:\Windows\system32\drivers\ntfs.sys

2014-03-31 16:20:54 ----A---- C:\Windows\system32\drivers\avgtdia.sys

2014-03-31 16:06:26 ----A---- C:\Windows\system32\drivers\avgmfx64.sys

======List of files/folders modified in the last 1 month======

2014-04-29 20:18:29 ----D---- C:\Windows\Prefetch

2014-04-29 20:18:28 ----D---- C:\Program Files\trend micro

2014-04-29 20:14:09 ----D---- C:\Users\Richard\AppData\Roaming\Azureus

2014-04-29 20:11:30 ----D---- C:\Windows\Temp

2014-04-29 20:07:31 ----D---- C:\ProgramData\MFAData

2014-04-29 18:52:35 ----D---- C:\Windows\system32\config

2014-04-29 16:00:15 ----D---- C:\Windows\SysWOW64

2014-04-29 16:00:14 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

2014-04-29 11:02:51 ----D---- C:\Users\Richard\AppData\Roaming\vlc

2014-04-29 10:19:57 ----RD---- C:\Program Files (x86)

2014-04-29 10:19:28 ----D---- C:\Windows\system32\Tasks

2014-04-29 10:19:27 ----D---- C:\Windows\Tasks

2014-04-28 19:31:49 ----D---- C:\ProgramData

2014-04-28 19:18:57 ----SHD---- C:\Windows\Installer

2014-04-28 19:18:57 ----D---- C:\Config.Msi

2014-04-28 19:18:29 ----D---- C:\Windows\system32\drivers

2014-04-28 19:18:26 ----D---- C:\Windows\inf

2014-04-28 19:18:20 ----D---- C:\Windows\system32\DriverStore

2014-04-28 19:18:20 ----D---- C:\Windows\system32\catroot

2014-04-28 19:17:32 ----SHD---- C:\System Volume Information

2014-04-28 14:58:58 ----A---- C:\Windows\NeroDigital.ini

2014-04-28 14:32:05 ----D---- C:\Program Files (x86)\DVD Flick

2014-04-28 14:28:10 ----D---- C:\Windows\System32

2014-04-22 13:21:55 ----D---- C:\Windows\rescache

2014-04-22 11:56:43 ----A---- C:\Windows\system32\PerfStringBackup.INI

2014-04-22 11:52:02 ----D---- C:\Windows\winsxs

2014-04-22 11:51:13 ----D---- C:\Windows\SYSWOW64\nl-NL

2014-04-22 11:51:13 ----D---- C:\Windows\SYSWOW64\en-US

2014-04-22 11:51:13 ----D---- C:\Program Files\Internet Explorer

2014-04-22 11:51:11 ----D---- C:\Windows\system32\nl-NL

2014-04-22 11:51:11 ----D---- C:\Windows\system32\en-US

2014-04-22 11:51:11 ----D---- C:\Windows\PolicyDefinitions

2014-04-22 11:51:08 ----D---- C:\Program Files (x86)\Internet Explorer

2014-04-22 08:30:59 ----D---- C:\Windows\system32\catroot2

2014-04-22 07:36:24 ----D---- C:\ProgramData\Oracle

2014-04-22 07:36:08 ----D---- C:\Program Files (x86)\Java

2014-04-13 20:56:05 ----D---- C:\Program Files (x86)\SearchProtect

2014-04-10 03:18:56 ----D---- C:\Windows

2014-04-10 03:17:52 ----D---- C:\Windows\AppPatch

2014-04-10 03:02:26 ----D---- C:\Windows\system32\MRT

2014-04-10 03:00:58 ----D---- C:\Windows\debug

2014-04-10 03:00:56 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHA;AVGIDSHA; C:\Windows\system32\DRIVERS\avgidsha.sys [2014-03-27 192792]

R0 Avgloga;AVG Logging Driver; C:\Windows\system32\DRIVERS\avgloga.sys [2014-03-27 324376]

R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys [2014-03-31 130840]

R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys [2014-03-27 32536]

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2009-06-05 408600]

R0 PxHlpa64;PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [2011-03-04 55856]

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]

R1 Avgdiska;AVG Disk Driver; C:\Windows\system32\DRIVERS\avgdiska.sys [2014-03-27 153368]

R1 Avgfwfd;AVG network filter service; C:\Windows\system32\DRIVERS\avgfwd6a.sys [2013-09-26 57144]

R1 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\avgidsdrivera.sys [2014-04-18 237336]

R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys [2014-03-27 236824]

R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys [2014-03-31 274200]

R2 RtNdPt60;Realtek NDIS Protocol Driver; C:\Windows\system32\DRIVERS\RtNdPt60.sys [2009-07-20 27136]

R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2010-08-25 10611552]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2009-10-21 2012832]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI; C:\Windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752]

R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-08-19 239616]

S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]

S3 BTHPORT;Stuurprogramma voor Bluetooth-poort; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]

S3 BTHUSB;USB-stuurprogramma voor Bluetooth-radio; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]

S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []

S3 cpuz132;cpuz132; \??\C:\Users\Richard\AppData\Local\Temp\cpuz132\cpuz132_x64.sys []

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2012-07-30 102368]

S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2012-07-28 57280]

S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]

S3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2); C:\Windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]

S3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2); C:\Windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 24064]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2012-07-30 203104]

S3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2); C:\Windows\system32\DRIVERS\RtTeam60.sys [2008-10-24 43008]

S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2010-04-19 50688]

S3 usbscan;Stuurprogramma voor USB-scanner; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]

S3 WimFltr;WimFltr; C:\Windows\system32\DRIVERS\wimfltr.sys [2006-11-01 151656]

S3 WinUsb;WinUsb-stuurprogramma; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2013-09-07 55624]

R2 avgfws;AVG Firewall; C:\Program Files (x86)\AVG\AVG2014\avgfws.exe [2014-04-03 1473280]

R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [2014-04-18 3645456]

R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [2014-03-27 291912]

R2 Bonjour Service;Bonjour-service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]

R2 CltMngSvc;Search Protect by Conduit Service; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [2014-04-08 2470688]

R2 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]

R2 Freemake Improver;Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2013-12-20 103936]

R2 IAANTMON;Intel® Matrix Storage Event Monitor; C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2009-06-04 354840]

R2 NAUpdate;@C:\Program Files (x86)\Nero\Update\NASvc.exe,-200; C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]

R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 27136]

R2 SftService;SoftThinks Agent Service; C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472]

R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 27136]

R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 2292480]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-29 257712]

S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-09-12 1512448]

S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-03-06 111616]

S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [2014-01-16 289256]

S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-03-18 119408]

S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-15 1255736]

S4 aspnet_state;ASP.NET-statusservice; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]

S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

kweezie wabbit · 30 april 2014

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe (hier en hier) kan je lezen hoe je dat doet.

Download Zoek.exe naar het bureaublad (niet de .zip- of .rar-versie)

Wanneer Internet Explorer of een andere browser of virusscanner melding geeft dat dit bestand onveilig zou zijn kun je negeren, dit is namelijk een onterechte waarschuwing.
Dubbelklik op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.

{0E8A89AD-95D7-40EB-8D9D-083EF7066A01};c
{EE932B49-D5C0-4D19-A3DA-CE0849258DE6};c
C:\Program Files\McAfee Security Scan;fs
C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll;f
C:\Users\Richard\AppData\Roaming\newnext.me;fs
C:\PROGRA~2\SearchProtect;fs
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk;f
NextLive;s
CltMngSvc;s
McComponentHostService;s
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@mcafee.com/McAfeeMssPlugin];r64
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@mcafee.com/MVT];r64
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run];r64
"NextLive"=-;r64
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run];r
"NextLive"=-;r
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows];r64
"AppInit_DLLs"=-;r64
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows];r
"AppInit_DLLs"=-r
emptyclsid;
chromelook; 
firefoxlook; 
emptyfolderscheck;delete 
startupall; 
filesrcm;

Klik op de knop "Options" en vink nu de onderstaande opties aan.
Do a Deep Scan
Installed Programs
Running Processes
Auto Clean
De optie "Scan All Users" staat standaard aangevinkt.
Klik nu op de knop "Run script".
Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
Mocht er geen logje verschijnen, start zoek.exe dan opnieuw en klik op de knop zoek-results.log, de log verschijnt dan alsnog.
Post het geopende logje in het volgende bericht als bijlage.

Zoek.exe logbestand plaatsen

Voeg het logbestand met de naam "Zoek-results.log" als bijlage toe aan het volgende bericht. (Dit logbestand kunt u tevens terug vinden op de systeemschijf als C:\\Zoek-results.log.)
Hoe u een bijlage kunt toevoegen aan het bericht leest u hier.

ricardo425 · 5 mei 2014

Zoek.exe v5.0.0.0 Updated 14-April-2014

Tool run by Richard on ma 05/05/2014 at 9:27:23,58.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Richard\AppData\Local\Temp\Rar$EX08.472\zoek.exe [scan all users] [script inserted] [Checkboxes used]

==== Older Logs ======================

C:\zoek-results2013-12-13-072205.log 24488 bytes

==== Empty Folders Check ======================

C:\PROGRA~2\Advanced System Protector deleted successfully

C:\PROGRA~2\Optimizer Pro deleted successfully

C:\PROGRA~2\PacFunction deleted successfully

C:\PROGRA~2\SimilarSites deleted successfully

C:\PROGRA~3\Oracle deleted successfully

C:\Users\Richard\AppData\Roaming\SimilarSites deleted successfully

C:\Users\Richard\AppData\Local\DataSafeOnline deleted successfully

C:\Users\Richard\AppData\Local\genienext deleted successfully

C:\Users\Richard\AppData\Local\Lollipop deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} deleted successfully

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Installed Programs ======================

ACE-HIGH MP3 WAV WMA OGG Converter

Adobe AIR

Adobe Community Help

Adobe Flash Player 13 ActiveX

Adobe Flash Player 13 Plugin

Adobe Media Player

Adobe Reader XI (11.0.06) - Nederlands

Adobe Shockwave Player 12.0

Apple Application Support

Apple Mobile Device Support

Apple Software Update

AVG 2014

Bonjour

BS.Player FREE

Business Card Designer Plus 10.1.0.0

CCleaner

Chessmaster Grandmaster Edition

Compatibiliteitspakket voor het 2007 Microsoft Office system

D3DX10

Dell DataSafe Local Backup - Support Software

Dell DataSafe Local Backup

Dell DataSafe Online

Dell Dock

Dell Edoc Viewer

Dell Getting Started Guide

Dell Support Center

Dell System Detect

Diagnostic Utility

DVD Flick 1.3.0.7

Express Rip

Facebook Video Calling 2.0.0.447

Free YouTube to MP3 Converter version 3.12.29.304

Freemake Audio Converter versie 1.1.0

High-Definition Video Playback 10

ImgBurn

Intel® Graphics Media Accelerator Driver

Intel© Matrix Storage Manager

Java 7 Update 13 (64-bit)

Java 7 Update 55

Java Auto Updater

Java 6 Update 22

Junk Mail filter update

McAfee Security Scan Plus

Microsoft .NET Framework 4.5.1

Microsoft .NET Framework 4.5.1 (Nederlands)

Microsoft .NET Framework 4.5.1 (NLD)

Microsoft Application Error Reporting

Microsoft Office 2003 Web Components

Microsoft Office PowerPoint Viewer 2007 (Dutch)

Microsoft Primary Interoperability Assemblies 2005

Microsoft Silverlight

Microsoft SkyDrive

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU

Microsoft Visual Studio 2005 Tools for Applications - ENU

Microsoft Works

Microsoft_VC80_ATL_x86

Microsoft_VC80_ATL_x86_x64

Microsoft_VC80_CRT_x86

Microsoft_VC80_CRT_x86_x64

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFC_x86_x64

Microsoft_VC80_MFCLOC_x86

Microsoft_VC80_MFCLOC_x86_x64

Microsoft_VC90_ATL_x86

Microsoft_VC90_ATL_x86_x64

Microsoft_VC90_CRT_x86

Microsoft_VC90_CRT_x86_x64

Microsoft_VC90_MFC_x86

Microsoft_VC90_MFC_x86_x64

Movie Maker

Mozilla Firefox 28.0 (x86 nl)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSVCRT110

MSVCRT110_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP3 Parser

MSXML 4.0 SP3 Parser (KB2758694)

Nero 10 ClipartPack

Nero 10 Menu TemplatePack 1

Nero 10 Menu TemplatePack 2

Nero 10 Menu TemplatePack 3

Nero 10 Menu TemplatePack Basic

Nero 10 Movie ThemePack 1

Nero 10 Movie ThemePack 2

Nero 10 Movie ThemePack Basic

Nero 10 Sample ImagePack

Nero 10 Sample Videos

Nero BackItUp 10

Nero BackItUp 10 Help (CHM)

Nero Burning ROM 10

Nero BurningROM 10 Help (CHM)

Nero BurnRights 10

Nero BurnRights 10 Help (CHM)

Nero Control Center 10

Nero Core Components 10

Nero CoverDesigner 10

Nero CoverDesigner 10 Help (CHM)

Nero DiscSpeed 10

Nero DiscSpeed 10 Help (CHM)

Nero Dolby Files 10

Nero Express 10

Nero Express 10 Help (CHM)

Nero InfoTool 10

Nero InfoTool 10 Help (CHM)

Nero MediaHub 10

Nero MediaHub 10 Help (CHM)

Nero Multimedia Suite 10

Nero Recode 10

Nero Recode 10 Help (CHM)

Nero RescueAgent 10

Nero RescueAgent 10 Help (CHM)

Nero SoundTrax 10

Nero SoundTrax 10 Help (CHM)

Nero StartSmart 10

Nero StartSmart 10 Help (CHM)

Nero Update

Nero Vision 10

Nero Vision 10 Help (CHM)

Nero WaveEditor 10

Nero WaveEditor 10 Help (CHM)

OpenOffice.org 3.3

Photo Common

Photo Gallery

PowerDVD DX

QuickTime 7

Realtek High Definition Audio Driver

Roxio Burn

Search Protect

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)

Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)

Shared C Run-time for x64

SubSync

swMSM

Toolbar Cleaner 1.0

TuneUp Utilities Language Pack (nl-NL)

UnderCoverXP 1.23

Unity Web Player

VC80CRTRedist - 8.0.50727.6195

Visual Studio 2010 x64 Redistributables

Visual Studio 2012 x64 Redistributables

Visual Studio 2012 x86 Redistributables

VLC media player 2.1.3

Vuze

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live MIME IFilter

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Windows Mobile Apparaatcentrum

WinRAR 4.01 (32-bit)

Youtube Music Downloader V3.8.3

YTD Video Downloader 4.8

==== Running Processes ======================

C:\Program Files\Dell\DellDock\DockLogin.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\AVG\AVG2014\avgfws.exe

C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe

C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe

C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe

C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe

C:\Program Files (x86)\AVG\AVG2014\avgui.exe

C:\Windows\SysWOW64\ctfmon.exe

C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe

C:\PROGRA~2\SearchProtect\SearchProtect\bin\cltmng.exe

C:\Program Files (x86)\Nero\Update\NASvc.exe

C:\PROGRA~2\SearchProtect\UI\bin\cltmngui.exe

C:\Users\Richard\AppData\Local\Temp\Rar$EX08.472\zoek.exe

C:\Windows\SysWOW64\cmd.exe

C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CltMngSvc deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\CltMngSvc deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\McComponentHostService deleted successfully

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\McComponentHostService deleted successfully

==== FireFox Fix ======================

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\0

user.js not found

---- FireFox user.js and prefs.js backups ----

prefs_20140505_0942_.backup

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137

user.js not found

---- Lines CT2504091 removed from prefs.js ----

user_pref("CT2504091.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT2504091.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT2504091.FF19Solved", "true");

user_pref("CT2504091.FirstTime", "true");

user_pref("CT2504091.FirstTimeFF3", "true");

user_pref("CT2504091.PG_ENABLE", "dHJ1ZQ==");

user_pref("CT2504091.UserID", "UN31896208814433251");

user_pref("CT2504091.addressBarTakeOverEnabledInHidden", "true");

user_pref("CT2504091.appOptions", "{\"price-gong\":{\"disabled\":false,\"render\":true},\"129079849636241789\":{\"render\":true,\"disabled\":false,\"a

user_pref("CT2504091.cbfirsttime.enc", "TW9uIEZlYiAxNyAyMDE0IDIwOjU0OjQ2IEdNVCswMTAwIChSb21hbmNlIChzdGFuZGFhcmR0aWpkKSk=");

user_pref("CT2504091.countryCode", "BE");

user_pref("CT2504091.defaultSearch", "false");

user_pref("CT2504091.embeddedsData", "[{\"appId\":\"129079840422026594\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"get

user_pref("CT2504091.enableAlerts", "true");

user_pref("CT2504091.enableSearchFromAddressBar", "false");

user_pref("CT2504091.firstTimeDialogOpened", "true");

user_pref("CT2504091.fixPageNotFoundError", "false");

user_pref("CT2504091.fixPageNotFoundErrorByUser", "false");

user_pref("CT2504091.fixPageNotFoundErrorInHidden", "true");

user_pref("CT2504091.fullUserID", "UN31896208814433251.IN.20140217205333");

user_pref("CT2504091.installDate", "17/02/2014 20:53:35");

user_pref("CT2504091.installSessionId", "{B0D040BA-BDFF-4F6A-81FA-CDF57153BB12}");

user_pref("CT2504091.installSp", "false");

user_pref("CT2504091.installType", "conduitnsisintegration");

user_pref("CT2504091.installUsage", "2014-02-17T22:53:43.4796142+03:00");

user_pref("CT2504091.installUsageEarly", "2014-02-17T22:53:42.7152044+03:00");

user_pref("CT2504091.installerVersion", "1.8.1.4");

user_pref("CT2504091.isCheckedStartAsHidden", true);

user_pref("CT2504091.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT2504091.isFirstTimeToolbarLoading", "false");

user_pref("CT2504091.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

user_pref("CT2504091.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"http://search.conduit.com/?ctid=CT2504091&octid=CT2504091&SearchSource

user_pref("CT2504091.lastVersion", "10.23.0.822");

user_pref("CT2504091.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

user_pref("CT2504091.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"http%3A%2F%2Fpirateproxy.net%2Ftorrent%2F9549210%2FHome

user_pref("CT2504091.openThankYouPage", "false");

user_pref("CT2504091.openUninstallPage", "true");

user_pref("CT2504091.price-gong.isManagedApp", "true");

user_pref("CT2504091.revertSettingsEnabled", "false");

user_pref("CT2504091.search.searchAppId", "129079840422026594");

user_pref("CT2504091.search.searchCount", "0");

user_pref("CT2504091.searchInNewTabEnabledByUser", "false");

user_pref("CT2504091.searchInNewTabEnabledInHidden", "true");

user_pref("CT2504091.searchRevert", "false");

user_pref("CT2504091.searchSuggestEnabledByUser", "false");

user_pref("CT2504091.searchUninstallUserMode", "1");

user_pref("CT2504091.searchUserMode", "1");

user_pref("CT2504091.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT2504091.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");

user_pref("CT2504091.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");

user_pref("CT2504091.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2504091\"}");

user_pref("CT2504091.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"http://VuzeRemote.OurToolbar.com//x

user_pref("CT2504091.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"Vuze Remote \"}");

user_pref("CT2504091.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT2504091.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");

user_pref("CT2504091.serviceLayer_services_Configuration_lastUpdate", "1392666823292");

user_pref("CT2504091.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1392666824055");

user_pref("CT2504091.serviceLayer_services_appsMetadata_lastUpdate", "1392666823843");

user_pref("CT2504091.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1392666823898");

user_pref("CT2504091.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1392666823434");

user_pref("CT2504091.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1392666824394");

user_pref("CT2504091.serviceLayer_services_login_10.23.0.722_lastUpdate", "1392666824240");

user_pref("CT2504091.serviceLayer_services_login_10.23.0.822_lastUpdate", "1392667255415");

user_pref("CT2504091.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1392666823933");

user_pref("CT2504091.serviceLayer_services_searchAPI_lastUpdate", "1392666823963");

user_pref("CT2504091.serviceLayer_services_serviceMap_lastUpdate", "1392666823118");

user_pref("CT2504091.serviceLayer_services_toolbarContextMenu_lastUpdate", "1392666823854");

user_pref("CT2504091.serviceLayer_services_toolbarSettings_lastUpdate", "1392666823315");

user_pref("CT2504091.serviceLayer_services_translation_lastUpdate", "1392666823987");

user_pref("CT2504091.settingsINI", true);

user_pref("CT2504091.shouldFirstTimeDialog", "false");

user_pref("CT2504091.showToolbarPermission", "false");

user_pref("CT2504091.smartbar.CTID", "CT2504091");

user_pref("CT2504091.smartbar.Uninstall", "0");

user_pref("CT2504091.smartbar.toolbarName", "Vuze Remote ");

user_pref("CT2504091.startPage", "false");

user_pref("CT2504091.toolbarBornServerTime", "17-2-2014");

user_pref("CT2504091.toolbarCurrentServerTime", "17-2-2014");

user_pref("CT2504091.toolbarInstallDate", "17-02-2014 20:53:33");

user_pref("CT2504091.toolbarLoginClientTime", "Mon Feb 17 2014 20:53:44 GMT+0100 (Romance (standaardtijd))");

user_pref("CT2504091.url_history0001.enc", "aHR0cDovL3NlY3VyZS5wbi1pbnN0YWxsZXI5LmNvbS9vL2lyaXNfZ2V0cHJpdmF0ZS9HZXRQcml2YXRlX1NldHVwLmV4ZT9zdWJpZD1pcm

user_pref("CT2504091.versionFromInstaller", "10.23.0.722");

user_pref("CT2504091.xpeMode", "1");

user_pref("CT2504091_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1392667389497,\"isWithState\":\"\",\"timeFromStar

user_pref("valueApps.CT2504091./9B+7E+x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E,x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E-x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E.:2z527.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E.x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E/x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E06CG5EL8:", "6E6D68706D6E6F6E7473");

user_pref("valueApps.CT2504091./9B+7E06CG5EL8:.storedInFile", false);

user_pref("valueApps.CT2504091./9B+7E06CG5EL;8I:K", "247E2D2F226A74736E76737475747A79242F4B49474F42357D5D5C3D");

user_pref("valueApps.CT2504091./9B+7E06CG5EL;8I:K.storedInFile", false);

user_pref("valueApps.CT2504091./9B+7E0x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E1x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E2x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E31;CJC<=FBJ#OM.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E3x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E4x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E5x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E6x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E7x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E8x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E9x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E:x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E;x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E<x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E=x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E>x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E?x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7E@x305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7EAx305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7EBE3G=;D9N9=D", "372C2D326975762E3A3C7B3A39434A494841434B265146492965504656496571734D334B57");

user_pref("valueApps.CT2504091./9B+7EBE3G=;D9N9=D.storedInFile", false);

user_pref("valueApps.CT2504091./9B+7EBx305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7ECx305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7EDx305.storedInFile", true);

user_pref("valueApps.CT2504091./9B+7Etx305.storedInFile", true);

user_pref("valueApps.CT2504091./9B-0?3G>D", "6E6C6A3F414373707A457975472075777A7725507D4F262A21575524232C5B2C2F5A602D");

user_pref("valueApps.CT2504091./9B-0?3G>D.storedInFile", false);

user_pref("valueApps.CT2504091./9B-0?3G@6:5;", "");

user_pref("valueApps.CT2504091./9B-0?3G@6:5;.storedInFile", false);

user_pref("valueApps.CT2504091./9B-0?3GFA7EF", "2B2E2C3D");

user_pref("valueApps.CT2504091./9B-0?3GFA7EF.storedInFile", false);

user_pref("valueApps.CT2504091./9B-3=3ECCJA=F>", "247E333D2C452F4135276F297B7E7D21202F26313E4249357D37382F3A494D5D513F283338435D6554695B65546D57695D5D

user_pref("valueApps.CT2504091./9B-3=3ECCJA=F>.storedInFile", false);

user_pref("valueApps.CT2504091./9B/>01=9A6K6<IM;KRIE@PDAWM", "6A696B7273747576");

user_pref("valueApps.CT2504091./9B/>01=9A6K6<IM;KRIE@PDAWM.storedInFile", false);

user_pref("valueApps.CT2504091./9B3=>@44I48?", "372C2D3269757633423633414847203E3D474E4D4C45474F2A554A4D2D5858585E4B554E366352564F");

user_pref("valueApps.CT2504091./9B3=>@44I48?.storedInFile", false);

user_pref("valueApps.CT2504091./9B5BA==9CJAG", "663C713D737472447A75757948777C4A76784C4E7E");

user_pref("valueApps.CT2504091./9B5BA==9CJAG.storedInFile", false);

user_pref("valueApps.CT2504091./9B6B11G4C56B>F;P;ANR@P", "6E6D68706D6E6F6E7474707278");

user_pref("valueApps.CT2504091./9B6B11G4C56B>F;P;ANR@P.storedInFile", false);

user_pref("valueApps.CT2504091./9B90E@.3C;7B=?OFB>>RHIQS", "393F352F3E");

user_pref("valueApps.CT2504091./9B90E@.3C;7B=?OFB>>RHIQS.storedInFile", false);

user_pref("valueApps.CT2504091./9B9643G3/9E", "6A");

user_pref("valueApps.CT2504091./9B9643G3/9E.storedInFile", false);

user_pref("valueApps.CT2504091./9B;45>:BI9I7IE", "2B2E2C3D");

user_pref("valueApps.CT2504091./9B;45>:BI9I7IE.storedInFile", false);

user_pref("valueApps.CT2504091./9B<:222H64<", "393F352F3E");

user_pref("valueApps.CT2504091./9B<:222H64<.storedInFile", false);

user_pref("valueApps.CT2504091./9B<:222H64<L8DAJ", "6D70706E7674737976712A797272787B757B7C");

user_pref("valueApps.CT2504091./9B<:222H64<L8DAJ.storedInFile", false);

user_pref("valueApps.CT2504091./9B=+03EH8H8J?:", "4443");

user_pref("valueApps.CT2504091./9B=+03EH8H8J?:.storedInFile", false);

user_pref("valueApps.CT2504091./9B?+E2A52D8", "372C2D326975762E3A3C7B3A39434A494841434B2651464929655046566470727951555E5E52");

user_pref("valueApps.CT2504091./9B?+E2A52D8.storedInFile", false);

user_pref("valueApps.CT2504091./9B?B0D:8AJ62<H", "6D");

user_pref("valueApps.CT2504091./9B?B0D:8AJ62<H.storedInFile", false);

user_pref("valueApps.CT2504091./9BA@0<0BI6A7GN:6@L?", "6C");

user_pref("valueApps.CT2504091./9BA@0<0BI6A7GN:6@L?.storedInFile", false);

user_pref("valueApps.CT2504091.PG_ENABLE", "74727565");

user_pref("valueApps.CT2504091.PG_ENABLE.storedInFile", false);

user_pref("valueApps.CT2504091._key_cl_active", "36636164373964622D396238622D346165372D393230362D626364346133653462353665");

user_pref("valueApps.CT2504091._key_cl_active.storedInFile", false);

user_pref("valueApps.CT2504091.cbfirsttime", "4D6F6E2046656220313720323031342032303A35333A353320474D542B303130302028526F6D616E636520287374616E64616172

user_pref("valueApps.CT2504091.cbfirsttime.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_appStateReportTime", "31333932363636383236393139");

user_pref("valueApps.CT2504091.mam_gk_appStateReportTime.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_appState_Clarity_Active", "6F6E");

user_pref("valueApps.CT2504091.mam_gk_appState_Clarity_Active.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_appState_CouponBuddy", "6F6E");

user_pref("valueApps.CT2504091.mam_gk_appState_CouponBuddy.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_appState_Easytobook", "6F6E");

user_pref("valueApps.CT2504091.mam_gk_appState_Easytobook.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_appState_Easytobook_targeted", "6F6E");

user_pref("valueApps.CT2504091.mam_gk_appState_Easytobook_targeted.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_appState_PriceGong", "6F6E");

user_pref("valueApps.CT2504091.mam_gk_appState_PriceGong.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_appsConfig.storedInFile", true);

user_pref("valueApps.CT2504091.mam_gk_appsDefaultEnabled", "6E756C6C");

user_pref("valueApps.CT2504091.mam_gk_appsDefaultEnabled.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_calledSetupService", "31");

user_pref("valueApps.CT2504091.mam_gk_calledSetupService.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_currentVersion", "312E31332E302E3137");

user_pref("valueApps.CT2504091.mam_gk_currentVersion.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_eventsCache", "7B2231646437616131322D656532382D346364382D623762652D373336656465386439373461223A7B22746F706963223

user_pref("valueApps.CT2504091.mam_gk_eventsCache.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_existingUsersRecoveryDone", "31");

user_pref("valueApps.CT2504091.mam_gk_existingUsersRecoveryDone.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_first_time", "31");

user_pref("valueApps.CT2504091.mam_gk_first_time.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_gadgetOpen", "30");

user_pref("valueApps.CT2504091.mam_gk_gadgetOpen.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_lastLoginTime", "31333932363636383237323239");

user_pref("valueApps.CT2504091.mam_gk_lastLoginTime.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_localization.storedInFile", true);

user_pref("valueApps.CT2504091.mam_gk_mamEnabled", "66616C7365");

user_pref("valueApps.CT2504091.mam_gk_mamEnabled.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_migrated_from_ls", "31");

user_pref("valueApps.CT2504091.mam_gk_migrated_from_ls.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_new_welcome_experience", "31");

user_pref("valueApps.CT2504091.mam_gk_new_welcome_experience.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_settings1.13.0.17.storedInFile", true);

user_pref("valueApps.CT2504091.mam_gk_showWelcomeGadget", "66616C7365");

user_pref("valueApps.CT2504091.mam_gk_showWelcomeGadget.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_stamp", "35345F30");

user_pref("valueApps.CT2504091.mam_gk_stamp.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_userBornDate", "4E2F41");

user_pref("valueApps.CT2504091.mam_gk_userBornDate.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_userId", "37663063333832352D363335622D346238332D393766632D623437643235323136616162");

user_pref("valueApps.CT2504091.mam_gk_userId.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_user_approval_interacted", "31");

user_pref("valueApps.CT2504091.mam_gk_user_approval_interacted.storedInFile", false);

user_pref("valueApps.CT2504091.mam_gk_welcomeDialogMode", "31");

user_pref("valueApps.CT2504091.mam_gk_welcomeDialogMode.storedInFile", false);

user_pref("valueApps.CT2504091.url_history0001", "687474703A2F2F70697261746570726F78792E6E65742F746F7272656E742F393534393231302F486F6D6566726F6E745F28

user_pref("valueApps.CT2504091.url_history0001.storedInFile", true);

---- Lines conduit removed from prefs.js ----

user_pref("browser.newtab.url", "http://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=2&UP=SPCD66168D-

user_pref("browser.search.defaultenginename", "Conduit Search");

user_pref("browser.search.selectedEngine", "Conduit Search");

user_pref("browser.startup.homepage", "http://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPCD66168D-CE8C-4

user_pref("plugin.state.npconduitfirefoxplugin", 2);

---- Lines valueApps removed from prefs.js ----

user_pref("valueApps.storage.mam_gk_userId", "37663063333832352D363335622D346238332D393766632D623437643235323136616162");

---- Lines mindspark removed from prefs.js ----

user_pref("extensions.toolbar.mindspark.hp.enabled", false);

user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "");

user_pref("extensions.toolbar.mindspark.lastInstalled", "videodownloadconverter@mindspark.com");

---- Lines crossrider removed from prefs.js ----

user_pref("extensions.crossrider.bic", "144d49f4131dd200caea14cf689f5040");

---- Lines smartbar removed from prefs.js ----

user_pref("smartbar.machineId", "7SGOR2YCANS9N/ZANPAC4GXRGH12UYHUDY7VM7WRFOG8L3KR4IB+PRPC0XY3STLRHW6KC5GK69BYX+IFREZDEW");

---- FireFox user.js and prefs.js backups ----

prefs_20140505_0942_.backup

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default

user.js not found

---- Lines conduit removed from prefs.js ----

user_pref("browser.newtab.url", "http://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=2&UP=SPCD66168D-

user_pref("browser.search.selectedEngine", "Conduit Search");

user_pref("browser.startup.homepage", "http://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPCD66168D-CE8C-4

---- FireFox user.js and prefs.js backups ----

prefs_20140505_0942_.backup

ProfilePath: C:\Users\Richard\AppData\Roaming\Thunderbird\Profiles\wvia9ila.default

user.js not found

---- FireFox user.js and prefs.js backups ----

prefs_20140505_0942_.backup

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"NextLive"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

==== Registry Fix Code x64 ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@mcafee.com/McAfeeMssPlugin]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@mcafee.com/MVT]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"NextLive"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=-

==== Deleting Files \ Folders ======================

C:\Users\Richard\AppData\Roaming\newnext.me deleted

C:\PROGRA~2\SearchProtect deleted

C:\Users\Richard\daemonprocess.txt deleted

C:\Users\Richard\.android deleted

C:\PROGRA~2\Mobogenie deleted

C:\PROGRA~2\Toolbar Cleaner deleted

C:\PROGRA~2\GreenTree Applications deleted

C:\PROGRA~2\Systweak Support Dock deleted

C:\Users\Richard\AppData\Roaming\DefaultTab deleted

C:\Users\Richard\AppData\Roaming\systweak deleted

C:\Users\Richard\Documents\Vuze Downloads\Nero Autobackup\20130630_160912_Local Autobackup\C\Users\Richard\Music\Qtrax Media Library deleted

C:\PROGRA~3\Allmyapps deleted

C:\PROGRA~3\YTD Video Downloader deleted

C:\Users\Richard\AppData\Local\SearchProtect deleted

C:\Users\Richard\AppData\Local\Mobogenie deleted

C:\Users\Richard\AppData\Local\cache deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD Video Downloader deleted

C:\Windows\SysNative\roboot64.exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(1).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(2).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter.exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_free-wma-to-mp3-converter.exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_toolbar-cleaner.exe deleted

C:\Users\Richard\AppData\LocalLow\BS_Player deleted

C:\END deleted

C:\Windows\Syswow64\SearchProtect deleted

C:\Users\Richard\Documents\Optimizer Pro deleted

C:\Users\Richard\Documents\Mobogenie deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137\searchplugins\ask-web-search.xml deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137\valueApps deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137\CT2504091 deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\searchplugins\conduit-search.xml deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\extensions\staged deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137\smartbar deleted

"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk" deleted

"C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\extensions\addon@defaulttab.com.xpi" deleted

"C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe" deleted

"C:\Program Files\McAfee Security Scan" not deleted

"C:\PROGRA~2\COMMON~1\DVDVideoSoft\bin" deleted

"C:\Program Files\McAfee Security Scan\3.8.141" not deleted

==== System Specs ======================

Windows: Windows 7 Home Premium Edition (64-bit) Service Pack 1 (Build 7601)

Memory (RAM): 4061 MB

CPU Info: Intel® Core2 Duo CPU E7500 @ 2.93GHz

CPU Speed: 2990,3 MHz

Sound Card: Luidsprekers (3- USB Sound Devi |

Display Adapters: Intel® G45/G43 Express Chipset | Intel® G45/G43 Express Chipset | RDPDD Chained DD | RDP Encoder Mirror Driver | RDP Reflector Display Driver

Monitors: 1x; Algemeen PnP-beeldscherm |

Screen Resolution: 1280 X 1024 - 32 bit

Network: Network Present

Network Adapters: Realtek PCIe GBE Family Controller

CD / DVD Drives: 1x (D: | ) D: TSSTcorpDVD+-RW TS-H653G

Ports: COM Ports NOT Present. LPT Port NOT Present.

Mouse: 3 Button Wheel Mouse Present

Hard Disks: C: 689,7GB

Hard Disks - Free: C: 403,5GB

Manufacturer *: Dell Inc.

BIOS Info: AT/AT COMPATIBLE | 08/16/32 | DELL - 20100226

Time Zone: Romance (standaardtijd)

Motherboard *: Dell Inc. 0K83V0

Country: Belgi‰

Language: NLB

==== System Specs (Software) ======================

Anti-Virus: AVG Internet Security 2014 On-access scanning disabled (Outdated)

Anti-Spyware: Windows Defender disabled (Outdated)

Anti-Spyware: AVG Internet Security 2014 disabled (Outdated)

Firewall: AVG Internet Security 2014 disabled

Default Browser: Firefox 28.0

Internet Explorer Version: 11.0.9600.17105

Mozilla Firefox version: 28.0 (x86 nl)

Mozilla Firefox version: (3.6.15)

Adobe Reader version: 11.0.06.70

Sun Java version: 1.7.0_55 (32-bit)

Sun Java version: 1.7.0_13 (64-bit)

Flash Player version: 13.0.0.206

Shockwave Player version: 12.0r112

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\Richard\AppData\Local\Temp ====

2014-04-28 12:33:01 F5C0CEF8B88B0A3EFA3D2681C76DC564 299008 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\ssleay32.dll

2014-04-28 12:33:01 C5285FB18C566309BDEAC87ED37F45C9 26624 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\imageformats\qgif4.dll

2014-04-28 12:33:01 BC83108B18756547013ED443B8CDB31B 421200 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\msvcp100.dll

2014-04-28 12:33:01 B61F4E81044D1C3BEFD3C3212DEE286F 201216 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\imageformats\qjpeg4.dll

2014-04-28 12:33:01 A9FD9DD23C03AED462127ECC3E262590 13112320 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\QtWebKit4.dll

2014-04-28 12:33:01 A93C6C38EC6FE12117E3D73452C93A16 1199104 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\libeay32.dll

2014-04-28 12:33:01 8F8B55BDFD689BE50F7991196AB680FC 201728 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\QtSql4.dll

2014-04-28 12:33:01 8A2E025FD3DDD56C8E4F63416E46E2EC 1053696 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\QtNetwork4.dll

2014-04-28 12:33:01 84B9AAB23C24CB5C9C3F43165536BDAC 317304 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\AllmyappsUpdater.exe

2014-04-28 12:33:01 831BA3A8C9D9916BDF82E07A3E8338CC 8581632 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\QtGui4.dll

2014-04-28 12:33:01 70F47629EC62BAE2E371C104D4DA2517 55808 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\CrashRpt1301.dll

2014-04-28 12:33:01 6260A8A04E0D214C851AE35994124297 87040 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\qjson.dll

2014-04-28 12:33:01 503B2C4B64E17E7F4592C8E0D8119A5C 621432 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\AllmyappsManager.exe

2014-04-28 12:33:01 4D58AC6385F2EBD658BF79342D7D6EA8 28672 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\imageformats\qico4.dll

2014-04-28 12:33:01 4B5D9D024D8BFBEE770DB3D16FCE3E77 470528 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\sqldrivers\qsqlite4.dll

2014-04-28 12:33:01 215F565F4842E20E6BB66E59BDF22C87 1341440 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\QtScript4.dll

2014-04-28 12:33:01 1BDC06D69736939170FC3F61C33C891A 6782328 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\Allmyapps.exe

2014-04-28 12:33:01 17579FA06EB59761DAF434AD72EF6136 2598912 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\QtCore4.dll

2014-04-28 12:33:01 10E170AC0C8F73BA881107C94A72A0DC 654336 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\CrashSender1301.exe

2014-04-28 12:33:01 0E37FBFA79D349D672456923EC5FBBE3 773968 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\msvcr100.dll

2014-04-28 12:27:06 20612ACB94F364173094E91FD08D02DA 4624790 ----a-w- C:\Users\Richard\AppData\Local\Temp\n7704\systemspeedup_1203-72c8223c.exe

2014-04-28 12:26:23 29C1470CBF58838DC6A3F9D624B4527F 289280 ----atw- C:\Users\Richard\AppData\Local\Temp\n7704\s7704.exe

2014-04-23 18:19:49 45922155C9628E11441AA869C6287BB7 10372136 ----a-w- C:\Users\Richard\AppData\Local\Temp\BackupSetup.exe

====== Java Cache =====

====== C:\Windows\SysWOW64 =====

2014-05-04 01:00:42 5869FBC754578A59C8C8635B99DB79DE 17384448 ----a-w- C:\Windows\SysWOW64\mshtml.dll

2014-05-04 01:00:41 2518D1922371892ADEF1F07147DBD72A 2724864 ----a-w- C:\Windows\SysWOW64\mshtml.tlb

2014-04-22 06:30:23 AA12D7A960DB78DD9690AB5B5DAE6586 440832 ----a-w- C:\Windows\SysWOW64\ieui.dll

2014-04-22 06:30:22 CE6921D33682C6C3DB8A45853CC69402 455168 ----a-w- C:\Windows\SysWOW64\vbscript.dll

2014-04-22 06:30:16 EDACA6C44D9CE200F899B7DB0F201DFF 164864 ----a-w- C:\Windows\SysWOW64\msrating.dll

2014-04-22 06:30:16 EBC35FE64056910A84485BEEB6DCCAC6 524288 ----a-w- C:\Windows\SysWOW64\msfeeds.dll

2014-04-22 06:30:16 7E9FE7DB43BC204E44F159F843E35C15 367616 ----a-w- C:\Windows\SysWOW64\dxtmsft.dll

2014-04-22 06:30:16 34FC79C948EE2C5FD0CD699E7D7F91B7 244224 ----a-w- C:\Windows\SysWOW64\dxtrans.dll

2014-04-22 06:30:16 31385A6CAA31BE9D07B0B32E5AA99ABB 43008 ----a-w- C:\Windows\SysWOW64\jsproxy.dll

2014-04-22 06:30:15 82287FCFFA4A2D60FD744E3FEB3192C5 61952 ----a-w- C:\Windows\SysWOW64\iesetup.dll

2014-04-22 06:30:15 21BF6759685FD193715B483F2B3F21B1 112128 ----a-w- C:\Windows\SysWOW64\ieUnatt.exe

2014-04-22 06:30:15 0FDC1A576A3F40420882C0F7C4A66EAD 32768 ----a-w- C:\Windows\SysWOW64\iernonce.dll

2014-04-22 06:30:14 C9CA9803299EB6AFA34CB520BAAB083D 32256 ----a-w- C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-04-22 06:30:13 BB185D4A9362AA17CBCEC0768CDBF249 704512 ----a-w- C:\Windows\SysWOW64\ieapfltr.dll

2014-04-22 06:30:13 6557B48D53D653CFCCE3CB1CFA53A8E1 51200 ----a-w- C:\Windows\SysWOW64\ieetwproxystub.dll

2014-04-22 06:30:13 0F4A295516781897FFB09B4CCF2E8798 592896 ----a-w- C:\Windows\SysWOW64\jscript9diag.dll

2014-04-22 06:30:12 05BD47136DE62FAFE9F95B40E4100144 2178048 ----a-w- C:\Windows\SysWOW64\iertutil.dll

2014-04-22 06:30:11 E4E829EE073E046B0EB19B5FECB19B8C 1789440 ----a-w- C:\Windows\SysWOW64\wininet.dll

2014-04-22 06:30:11 C4A383FD50FBD7E274DD41CF571DF898 1967104 ----a-w- C:\Windows\SysWOW64\inetcpl.cpl

2014-04-22 06:30:11 76F58DB8F85C125E0D6B3AA42F3BF1D0 1143808 ----a-w- C:\Windows\SysWOW64\urlmon.dll

2014-04-22 06:30:09 2AFBB91BBD2378933B26E6D68C140D1B 11745792 ----a-w- C:\Windows\SysWOW64\ieframe.dll

2014-04-22 06:30:08 8C46360D6EF9D4C563FE834C4F287DA3 4254720 ----a-w- C:\Windows\SysWOW64\jscript9.dll

2014-04-22 05:36:13 6EA69D2312F3571F6F8BEADD224165E8 264616 ----a-w- C:\Windows\SysWOW64\javaws.exe

2014-04-22 05:36:08 9533FE0A942E00114047140B42DF8E3D 175016 ----a-w- C:\Windows\SysWOW64\java.exe

2014-04-22 05:36:08 3B10B54F50CD362537B9F2186267EDF8 96168 ----a-w- C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-04-22 05:36:08 37C15684482B4D596316735DCEEE939A 175528 ----a-w- C:\Windows\SysWOW64\javaw.exe

====== C:\Windows\SysWOW64\drivers =====

====== C:\Windows\Sysnative =====

2014-05-04 01:00:43 A98DA2EC1E56CF52C682D072F77D9874 23547904 ----a-w- C:\Windows\Sysnative\mshtml.dll

2014-05-04 01:00:42 DE5DE05946D6FC2DC494C55BC7BC4C6E 2724864 ----a-w- C:\Windows\Sysnative\mshtml.tlb

2014-04-22 06:30:23 7446786E7092ABE122D372F95E6ED74B 574976 ----a-w- C:\Windows\Sysnative\ieui.dll

2014-04-22 06:30:22 FFF555C177D9F2B79B5C3146BED09FB1 548352 ----a-w- C:\Windows\Sysnative\vbscript.dll

2014-04-22 06:30:18 D6067F7EE060C5D6D79008AD591B4E3B 33792 ----a-w- C:\Windows\Sysnative\iernonce.dll

2014-04-22 06:30:18 964C89BC8A52A260D68C90FDDEB862E2 38400 ----a-w- C:\Windows\Sysnative\JavaScriptCollectionAgent.dll

2014-04-22 06:30:18 72116CC377FF4281B0132C397026D911 4096 ----a-w- C:\Windows\Sysnative\ieetwcollectorres.dll

2014-04-22 06:30:18 3F498856C68725717195C16568FE19D0 586240 ----a-w- C:\Windows\Sysnative\ie4uinit.exe

2014-04-22 06:30:16 E7161E2C66FF9B1E87C30FC9D2497ABB 195584 ----a-w- C:\Windows\Sysnative\msrating.dll

2014-04-22 06:30:16 E0D95345D1EBB54F28E958782B9C0CE0 453120 ----a-w- C:\Windows\Sysnative\dxtmsft.dll

2014-04-22 06:30:16 CFBA793F678EB3855052ECF99357A9A1 296960 ----a-w- C:\Windows\Sysnative\dxtrans.dll

2014-04-22 06:30:16 CB57E934280D346AE0A9B053DAA284C5 51200 ----a-w- C:\Windows\Sysnative\jsproxy.dll

2014-04-22 06:30:16 75AD355828187145A60E3DC7BAF7B0F3 628736 ----a-w- C:\Windows\Sysnative\msfeeds.dll

2014-04-22 06:30:16 3F547245C78F4847B73EDDFD4A2F7E12 752640 ----a-w- C:\Windows\Sysnative\jscript9diag.dll

2014-04-22 06:30:15 A3F9A9E46BDDBB8B20B7CF3EEDB990F2 66048 ----a-w- C:\Windows\Sysnative\iesetup.dll

2014-04-22 06:30:15 1BF215FF4DF6DE10D2F81A2CE85157D2 139264 ----a-w- C:\Windows\Sysnative\ieUnatt.exe

2014-04-22 06:30:13 EBAD8A4D048ED257E4A45F6356541F86 846336 ----a-w- C:\Windows\Sysnative\ieapfltr.dll

2014-04-22 06:30:13 915D8A9E112C97C90C654F792B6B28B9 48640 ----a-w- C:\Windows\Sysnative\ieetwproxystub.dll

2014-04-22 06:30:12 A3A132CBE48AF0324466469F2CAAE8A2 111616 ----a-w- C:\Windows\Sysnative\ieetwcollector.exe

2014-04-22 06:30:12 710FD0E362A1A5C087DB90C1BAC46411 940032 ----a-w- C:\Windows\Sysnative\MsSpellCheckingFacility.exe

2014-04-22 06:30:11 F220BA78AB542C70211D73AE4729B2CD 2260480 ----a-w- C:\Windows\Sysnative\wininet.dll

2014-04-22 06:30:11 32417AE8280276968E5C551ED85D3525 1400832 ----a-w- C:\Windows\Sysnative\urlmon.dll

2014-04-22 06:30:11 1F8534A19A66275C863DE17645CB2A13 2767360 ----a-w- C:\Windows\Sysnative\iertutil.dll

2014-04-22 06:30:10 A14BB2F5F6457738AAA11367F5172A05 13551104 ----a-w- C:\Windows\Sysnative\ieframe.dll

2014-04-22 06:30:10 1654093C8BD3342997D27B71684ACCE8 2043904 ----a-w- C:\Windows\Sysnative\inetcpl.cpl

2014-04-22 06:30:08 BF25489459C7A762DD7B3186C7E3984D 5784064 ----a-w- C:\Windows\Sysnative\jscript9.dll

====== C:\Windows\Sysnative\drivers =====

2014-04-18 13:01:30 B7E17B7733C4266F140DD356817E5678 237336 ----a-w- C:\Windows\Sysnative\drivers\avgidsdrivera.sys

2014-04-09 20:45:32 B3222734D80013D2C73841B0C549FA63 27584 ----a-w- C:\Windows\Sysnative\drivers\Diskdump.sys

2014-04-09 20:45:32 A3F0BC5897F9D3786A3CB695B163633A 190912 ----a-w- C:\Windows\Sysnative\drivers\storport.sys

2014-04-09 20:45:32 96BB922A0981BC7432C8CF52B5410FE6 274880 ----a-w- C:\Windows\Sysnative\drivers\msiscsi.sys

2014-04-09 20:45:28 1A29A59A4C5BA6F8C85062A613B7E2B2 1684928 ----a-w- C:\Windows\Sysnative\drivers\ntfs.sys

====== C:\Windows\Tasks ======

====== C:\Windows\Temp ======

======= C:\Program Files =====

======= C:\PROGRA~2 =====

======= C: =====

====== C:\Users\Richard\AppData\Roaming ======

2014-04-28 12:32:21 -------- d-----w- C:\Users\Richard\AppData\Roaming\DVD Flick

====== C:\Users\Richard ======

2014-04-29 18:18:10 662C39FC1E27131551D557862CEC47F0 935175 ----a-w- C:\Users\Richard\Downloads\RSITx64(1).exe

2014-04-28 12:32:05 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVD Flick

2014-04-28 12:31:28 F35A01604C1B7294468D8397D6EE3787 12951423 ----a-w- C:\Users\Richard\Downloads\dvdflick_setup_1.3.0.7.exe

2014-04-23 18:18:01 BF4DC1AF973CB747A1849C8A2D073659 11113112 ----a-w- C:\Users\Richard\Downloads\YTDSetup.exe

====== C: exe-files ==

2014-04-29 18:18:10 662C39FC1E27131551D557862CEC47F0 935175 ----a-w- C:\Users\Richard\Downloads\RSITx64(1).exe

2014-04-28 12:33:01 84B9AAB23C24CB5C9C3F43165536BDAC 317304 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\AllmyappsUpdater.exe

2014-04-28 12:33:01 503B2C4B64E17E7F4592C8E0D8119A5C 621432 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\AllmyappsManager.exe

2014-04-28 12:33:01 1BDC06D69736939170FC3F61C33C891A 6782328 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\Allmyapps.exe

2014-04-28 12:33:01 10E170AC0C8F73BA881107C94A72A0DC 654336 ----a-w- C:\Users\Richard\AppData\Local\Temp\Allmyapps_2.0.0.24\CrashSender1301.exe

2014-04-28 12:32:05 EEFCF1B5BFFCD96E7BDB28134F3EBD55 214528 ----a-w- C:\Program Files (x86)\DVD Flick\imgburn\imgburnpreview.exe

2014-04-28 12:32:05 1FC166D09C990EE9A14C496C20EF8190 1700352 ----a-w- C:\Program Files (x86)\DVD Flick\imgburn\imgburn.exe

2014-04-28 12:32:04 D0C955BCE42D4417B3ED93D7710E19C8 401408 ----a-w- C:\Program Files (x86)\DVD Flick\delaycut\delaycut.exe

2014-04-28 12:32:04 AF6588476BA21AC8C8ACCDE6ABF42347 1759232 ----a-w- C:\Program Files (x86)\DVD Flick\mkvextract\mkvextract.exe

2014-04-28 12:32:03 F2A284599115BA3D7923809A6170E90C 22016 ----a-w- C:\Program Files (x86)\DVD Flick\bin\cat.exe

2014-04-28 12:32:03 E59CBE4E3EB00803725F825DC7847C3C 69632 ----a-w- C:\Program Files (x86)\DVD Flick\bin\pulldown.exe

2014-04-28 12:32:03 E1965AF11829BDBB683FE8FA7708F490 187012 ----a-w- C:\Program Files (x86)\DVD Flick\bin\mpgtx.exe

2014-04-28 12:32:03 87A9126FAE9A2C94BEC164EB9328DEE9 576000 ----a-w- C:\Program Files (x86)\DVD Flick\bin\dvdauthor.exe

2014-04-28 12:32:03 82256AE8932658C3F142AC687C90C7A9 695578 ----a-w- C:\Program Files (x86)\DVD Flick\unins001.exe

2014-04-28 12:32:03 6C90415A6FA967E3746C32E7E6366B22 1110016 ----a-w- C:\Program Files (x86)\DVD Flick\dvdflick.exe

2014-04-28 12:32:03 53D42E6C91F3F7FCF80917ECCF303F27 2009088 ----a-w- C:\Program Files (x86)\DVD Flick\bin\spumux.exe

2014-04-28 12:32:03 50FD656A6B42D77CE78E58DD726B4CED 46592 ----a-w- C:\Program Files (x86)\DVD Flick\bin\bmp2png.exe

2014-04-28 12:32:03 398B96DD5B24DB4BCD4A4F1340274950 5739539 ----a-w- C:\Program Files (x86)\DVD Flick\bin\ffmpeg.exe

2014-04-28 12:32:03 226F1F1D0E92F2E05D74CAF1703EA5F0 188928 ----a-w- C:\Program Files (x86)\DVD Flick\bin\mplex.exe

2014-04-28 12:31:28 F35A01604C1B7294468D8397D6EE3787 12951423 ----a-w- C:\Users\Richard\Downloads\dvdflick_setup_1.3.0.7.exe

2014-04-28 12:27:06 20612ACB94F364173094E91FD08D02DA 4624790 ----a-w- C:\Users\Richard\AppData\Local\Temp\n7704\systemspeedup_1203-72c8223c.exe

2014-04-28 12:26:23 29C1470CBF58838DC6A3F9D624B4527F 289280 ----atw- C:\Users\Richard\AppData\Local\Temp\n7704\s7704.exe

=== C: other files ==

2014-04-28 17:59:23 8AF11EF119BDFC350FBF3786C31C32D8 1606588 ----a-w- C:\Users\Richard\AppData\Roaming\Azureus\plugins\aznettor\aznettor_0.6.2.zip

2014-04-28 17:59:19 B129BC13EEF057EE722D3A3489C392B4 185738 ----a-w- C:\Users\Richard\AppData\Roaming\Azureus\plugins\azutp\azutp_0.5.4.zip

2014-04-28 17:59:19 8AF11EF119BDFC350FBF3786C31C32D8 1606588 ----a-w- C:\Users\Richard\AppData\Local\Temp\aznettor-win32_0.6.2.zip

2014-04-28 17:59:16 B129BC13EEF057EE722D3A3489C392B4 185738 ----a-w- C:\Users\Richard\AppData\Local\Temp\azutp_0.5.4.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Dell DataSafe Online"="C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe /m"

"PDVDDXSrv"="C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

"Desktop Disc Tool"="c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"

"NBAgent"="C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe /WinStart"

"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"AVG_UI"="C:\Program Files (x86)\AVG\AVG2014\avgui.exe /TRAYONLY"

"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

"QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe -atboottime"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"="C:\\PROGRA~2\\SearchProtect\\SearchProtect\\bin\\SPVC32Loader.dll"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe"

"AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

"IgfxTray"="C:\Windows\system32\igfxtray.exe"

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"

"Persistence"="C:\Windows\system32\igfxpers.exe"

"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s"

"Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe "

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]

"QuickTime Task"="\"C:\\Program Files (x86)\\QuickTime\\QTTask.exe\" -atboottime"

"Adobe ARM"="\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\""

"SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""

==== Startup Folders ======================

2010-06-07 10:38:53 2000 ----a-w- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

2010-06-07 10:38:53 2000 ----a-w- C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [29/04/2014 16:00]

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000Core.job --a------ C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe [19/06/2013 18:51]

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000UA.job --a------ C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe [19/06/2013 18:51]

==== Other Scheduled Tasks ======================

"C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]

"C:\Windows\SysNative\tasks\Adobe-online actualiseringsprogramma" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe]

"C:\Windows\SysNative\tasks\AdobeAAMUpdater-1.0-Richard-PC-Richard" [C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe]

"C:\Windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files (x86)\CCleaner\CCleaner.exe"]

"C:\Windows\SysNative\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000Core" [C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe]

"C:\Windows\SysNative\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000UA" [C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe]

"C:\Windows\SysNative\tasks\Java Update Scheduler" [C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe]

"C:\Windows\SysNative\tasks\PCDEventLauncher" ["C:\Program Files\Dell Support Center\sessionchecker.exe"]

"C:\Windows\SysNative\tasks\Richard NBAgent 5 4" ["C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe"]

"C:\Windows\SysNative\tasks\SidebarExecute" [C:\Program Files\Windows Sidebar\sidebar.exe]

"C:\Windows\SysNative\tasks\{0D1F5378-CE5F-4070-A060-8C3F15A7F9CF}" [C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe]

"C:\Windows\SysNative\tasks\{1110D5EC-E363-45ED-89C5-920752F24C5D}" [C:\Program Files (x86)\Webteh\BSplayer\bsplayer.exe]

"C:\Windows\SysNative\tasks\{1D821C4C-874D-4298-B939-A66C634E60BB}" ["c:\program files (x86)\mozilla firefox\firefox.exe"]

"C:\Windows\SysNative\tasks\{49D6CC22-8EF2-4D0C-89F8-3B2F592BC7E5}" [C:\Program Files (x86)\Mozilla Firefox\firefox.exe]

"C:\Windows\SysNative\tasks\{755BF4F0-5808-4C54-9202-B114B124B895}" [C:\Program Files (x86)\Webteh\BSplayer\bsplayer.exe]

"C:\Windows\SysNative\tasks\{85500AFC-EC88-438B-985D-6B002A97E5C4}" [C:\Users\Richard\Videos\TETRIS.EXE]

"C:\Windows\SysNative\tasks\{A3B3BB82-1528-4018-96B0-E85CFC970F1B}" [C:\Program Files (x86)\Mozilla Firefox\firefox.exe]

"C:\Windows\SysNative\tasks\{DEA86D37-B63B-4EA6-B545-3589D3C3AB5A}" [C:\Program Files (x86)\Mozilla Firefox\firefox.exe]

"C:\Windows\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"{ACAA314B-EEBA-48e4-AD47-84E31C44796C}"="C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff" [10/12/2013 19:34]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137

- DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default

- Undetermined - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

- Undetermined - C:\Program Files\Web Assistant\Firefox

- Undetermined - C:\Program Files (x86)\McAfee\SiteAdvisor

ProfilePath: C:\Users\Richard\AppData\Roaming\Thunderbird\Profiles\wvia9ila.default

- McAfee Anti-Spam Thunderbird Extension - %ProfilePath%\extensions\msktbird@mcafee.com

AppDir: C:\Program Files (x86)\Mozilla Firefox

- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137

9FD6A1990289B9290563CA069CB74EF9 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll - Shockwave Flash

FF0D6F82A0EC13952E83B9439100E45D - C:\Users\Richard\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin

341B3AE026B143DBC17BA1E1E0BAE3D6 - C:\Users\Richard\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player

CF25FDD7CA6BC88442A58F74DBB6CFA6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll - Shockwave for Director / Shockwave for Director

045084E4F10D31E71057FE741D87FDB0 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll - Shockwave Flash

99F97C9FE748C37528C338A423577FCB - C:\Users\Richard\AppData\Roaming\Mozilla\plugins\np-mswmp.dll - Microsoft® Windows Media Player Firefox Plugin

Profilepath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default

045084E4F10D31E71057FE741D87FDB0 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll - Shockwave Flash

99F97C9FE748C37528C338A423577FCB - C:\Users\Richard\AppData\Roaming\Mozilla\plugins\np-mswmp.dll - Microsoft® Windows Media Player Firefox Plugin

15E298B5EC5B89C5994A59863969D9FF - C:\Windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

bopakagnckmlgajfccecajhnimjiiedh - No path found[]

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPCD66168D-CE8C-4E71-B4E5-C81522053613&SSPV="

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}] not found

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.google.com"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh deleted successfully

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect deleted successfully

==== HijackThis Entries ======================