Zoek.exe v5.0.0.0 Updated 14-April-2014 Tool run by peter on do 15/05/2014 at 12:17:22,18. Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86 Running in: Normal Mode Internet Access Detected Launched: C:\Users\peter\Downloads\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 15/05/2014 12:19:49 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\Users\Kristelke\AppData\Roaming\Apple Computer deleted successfully C:\Users\Kristelke\AppData\Local\VirtualStore deleted successfully ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\peter\AppData\Local\Temp ==== ====== Java Cache ===== ====== C:\Windows\system32 ===== 2014-05-14 21:20:19 FBCF3F01177953EBF1E735643621CCF5 69632 ----a-w- C:\Windows\System32\mshtmled.dll 2014-05-14 21:20:17 EB5347F6149D3FF25F4D609A21A3BD67 17382912 ----a-w- C:\Windows\System32\mshtml.dll 2014-05-14 21:20:16 10D531ADC7B8FB36C7361D44AF6E8AB6 2724864 ----a-w- C:\Windows\System32\mshtml.tlb 2014-05-14 13:10:44 1DA49BFA5B76D128851C9474C1A69B21 369664 ----a-w- C:\Windows\System32\aepdu.dll 2014-05-14 13:10:43 94CDF4D11590ABC56BD6EAD81A1017E9 302592 ----a-w- C:\Windows\System32\aeinv.dll 2014-05-14 13:10:36 4D59F470985D08139E42D15842816C47 3969984 ----a-w- C:\Windows\System32\ntkrnlpa.exe 2014-05-14 13:10:35 9DE19EA21DF99AF15BA5A947E5317F9E 550912 ----a-w- C:\Windows\System32\kerberos.dll 2014-05-14 13:10:35 31FA2485DFC773F1E718A4D19F443FA9 3914176 ----a-w- C:\Windows\System32\ntoskrnl.exe 2014-05-14 13:10:34 ED195AC76E10F17F6DD60C49666F2A83 259584 ----a-w- C:\Windows\System32\msv1_0.dll 2014-05-14 13:10:34 4D50D7654EB38B8385FA9EF3DA14D4BE 1059840 ----a-w- C:\Windows\System32\lsasrv.dll 2014-05-14 13:10:33 995B39A08421C7725D1DF8DACEBBFC89 538112 ----a-w- C:\Windows\System32\objsel.dll 2014-05-14 13:10:32 FD25B74DC1A18C56BF1A879BF086555A 293376 ----a-w- C:\Windows\System32\KernelBase.dll 2014-05-14 13:10:32 541BB9B4C899ADCC5D3DB89208C1F409 65536 ----a-w- C:\Windows\System32\TSpkg.dll 2014-05-14 13:10:32 3A1ABE045A3E30799576E83A2D012B43 172032 ----a-w- C:\Windows\System32\wdigest.dll 2014-05-14 13:10:31 62C0798CC68EBF42F29C92E6CD6DC3D6 36864 ----a-w- C:\Windows\System32\dimsroam.dll 2014-05-14 13:10:30 FBC78B5D12A4F5A62D9C91E0E0E46D46 49664 ----a-w- C:\Windows\System32\adprovider.dll 2014-05-14 13:10:30 828185688FDAAE6C7959B884ABED1766 247808 ----a-w- C:\Windows\System32\schannel.dll 2014-05-14 13:10:30 335FA669FC952BC4888CEDBDB42607E2 51200 ----a-w- C:\Windows\System32\cngprovider.dll 2014-05-14 13:10:29 834A859BB331B0B2CCAE25BB1986F80D 47616 ----a-w- C:\Windows\System32\dpapiprovider.dll 2014-05-14 13:10:29 38A30B8E4216BE24D30F766EF3BAC2C7 48128 ----a-w- C:\Windows\System32\capiprovider.dll 2014-05-14 13:10:27 DD17E1573651293D4ED31053795B3471 22528 ----a-w- C:\Windows\System32\lsass.exe 2014-05-14 13:10:27 CAA3039FFA0CDF8C2A9845C1609CDE00 100352 ----a-w- C:\Windows\System32\sspicli.dll 2014-05-14 13:10:27 5E11C55CC4D9330E55CCB22B1F20BB33 35328 ----a-w- C:\Windows\System32\wincredprovider.dll 2014-05-14 13:10:27 2A86C18CE6869C77FCEB62F3B47D4D5B 17408 ----a-w- C:\Windows\System32\credssp.dll 2014-05-14 13:10:26 C94CE65AE7701E9FDBA889045543E27C 22016 ----a-w- C:\Windows\System32\secur32.dll 2014-05-14 13:10:26 61BC8ACDEC57469B22EC519B22FB3642 15872 ----a-w- C:\Windows\System32\sspisrv.dll 2014-05-14 13:09:51 E9D88493FBDB36D4B65C6F2F7F122C95 12874240 ----a-w- C:\Windows\System32\shell32.dll ====== C:\Windows\system32\drivers ===== 2014-05-14 13:10:30 D3964885F0A11ACF51DA3AAA776973B2 136640 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys 2014-05-14 13:10:27 4120DA10AA42A9996F4575DB9E3E6E6E 67520 ----a-w- C:\Windows\System32\drivers\ksecdd.sys 2014-04-26 16:49:53 D41D8CD98F00B204E9800998ECF8427E 0 ---ha-w- C:\Windows\System32\drivers\Msft_Kernel_netaapl_01009.Wdf 2014-04-19 09:39:28 AC6B4AABF92867584445D0C435B9248F 101248 ----a-w- C:\Windows\System32\drivers\ewusbdev.sys ====== C:\Windows\Tasks ====== 2014-04-24 11:01:35 6D51778BF0CF8EFCE2A12F602FE67D62 3256 ----a-w- C:\Windows\system32\Tasks\{78F5A7E0-19AC-4297-AC22-CB9391C9EEE4} ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2014-05-14 21:24:25 -------- d-----w- C:\Program Files\Common Files\DESIGNER 2014-05-08 16:22:16 -------- d-----w- C:\Program Files\Microsoft Silverlight 2014-04-24 10:54:26 -------- d-----w- C:\Program Files\DriverTuner 2014-04-19 09:38:58 -------- d-----w- C:\Program Files\MobileVikings ======= C: ===== ====== C:\Users\peter\AppData\Roaming ====== 2014-05-01 11:33:56 -------- d-----w- C:\Windows\serviceprofiles\Localservice\AppData\Local\PnrpSqm 2014-05-01 11:33:37 -------- d-----w- C:\Windows\serviceprofiles\Localservice\AppData\Roaming\PeerNetworking 2014-04-22 20:39:24 -------- d-----w- C:\Users\Kristelke\AppData\Local\Apple 2014-04-22 20:36:15 -------- d-----w- C:\Users\Kristelke\AppData\Local\Diagnostics 2014-04-22 20:30:38 B19FB3CD1CD11851EFE0F7ADA19790E3 109280 ----a-w- C:\Users\Kristelke\AppData\Local\GDIPFONTCACHEV1.DAT 2014-04-22 20:30:17 -------- d-----r- C:\Users\Kristelke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-04-22 20:30:17 -------- d-----r- C:\Users\Kristelke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-04-22 20:30:03 -------- d-----w- C:\Users\Kristelke\AppData\Roaming\Identities 2014-04-22 20:29:49 -------- d-----w- C:\Users\Kristelke\AppData\Roaming\Adobe 2014-04-22 20:29:33 -------- d-----w- C:\Users\Kristelke\AppData\Roaming\Media Center Programs 2014-04-22 20:29:33 -------- d-----w- C:\Users\Kristelke\AppData\Local\Temp 2014-04-22 20:29:33 -------- d-----w- C:\Users\Kristelke\AppData\Local\Microsoft Help 2014-04-22 20:29:33 -------- d-----w- C:\Users\Kristelke\AppData\Local\Microsoft 2014-04-22 20:29:32 -------- d-s---w- C:\Users\Kristelke\AppData\Roaming\Microsoft 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories ====== C:\Users\peter ====== 2014-05-15 08:04:29 69CA82A7482A00D8EE063D2B97FC4338 781383 ----a-w- C:\Users\peter\Downloads\RSIT.exe 2014-05-11 11:46:23 -------- d-----r- C:\Windows\system32\config\systemprofile\Searches 2014-05-08 16:22:29 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-05-08 16:21:29 141AC75146C3A0CA4DEAF5528EFC16AB 6957280 ----a-w- C:\Users\peter\Downloads\Silverlight.exe 2014-04-22 20:30:17 -------- d-----r- C:\Users\Kristelke\Searches 2014-04-22 20:30:00 -------- d-----r- C:\Users\Kristelke\Contacts 2014-04-22 20:29:37 6FC234AD3752E1267B34FB12BCD6718B 20 --sha-w- C:\Users\Kristelke\ntuser.ini 2014-04-22 20:29:32 -------- d--h--w- C:\Users\Kristelke\AppData 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\Videos 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\Saved Games 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\Pictures 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\Music 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\Links 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\Favorites 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\Downloads 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\Documents 2014-04-22 20:29:32 -------- d-----r- C:\Users\Kristelke\Desktop ====== C: exe-files == 2014-05-15 08:04:29 69CA82A7482A00D8EE063D2B97FC4338 781383 ----a-w- C:\Users\peter\Downloads\RSIT.exe 2014-05-14 20:58:20 A742CCF738AEFEF3078683BD0E803215 739808 ----a-w- C:\Program Files\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\34.0.1847.137\34.0.1847.137_34.0.1847.131_chrome_updater.exe 2014-05-14 13:10:44 53FF04461F9362482E0874EC80B8E357 135584 ----a-w- C:\Windows\System32\CompatTel\QueryAppBlock.exe 2014-05-14 13:10:36 4D59F470985D08139E42D15842816C47 3969984 ----a-w- C:\Windows\System32\ntkrnlpa.exe 2014-05-14 13:10:35 31FA2485DFC773F1E718A4D19F443FA9 3914176 ----a-w- C:\Windows\System32\ntoskrnl.exe 2014-05-14 13:10:27 DD17E1573651293D4ED31053795B3471 22528 ----a-w- C:\Windows\System32\lsass.exe 2014-05-09 19:52:02 BE472797288F53AA9F56974B1A1FC18F 918672 ----a-w- C:\Program Files\Google\Update\1.3.24.7\GoogleUpdateSetup.exe 2014-05-09 19:52:02 6FC454773ABF8DE9A33B35E03525140D 51080 ----atw- C:\Program Files\Google\Update\1.3.24.7\GoogleUpdateOnDemand.exe 2014-05-09 19:52:02 49B70FBEEC01A69CA9AC115C109E9CDD 51080 ----atw- C:\Program Files\Google\Update\1.3.24.7\GoogleUpdateBroker.exe 2014-05-09 19:51:54 D893431503D5112DC3B799DF963D2AC8 114568 ----atw- C:\Program Files\Google\Update\1.3.24.7\GoogleUpdateComRegisterShell64.exe 2014-05-09 19:51:54 D5A444B63637EC0932172C6719A10252 263048 ----atw- C:\Program Files\Google\Update\1.3.24.7\GoogleCrashHandler.exe 2014-05-09 19:51:54 720546B84ED5229E1584C8F3533A2F12 328072 ----atw- C:\Program Files\Google\Update\1.3.24.7\GoogleCrashHandler64.exe 2014-05-09 19:51:53 506708142BC63DABA64F2D3AD1DCD5BF 116648 ----atw- C:\Program Files\Google\Update\1.3.24.7\GoogleUpdate.exe 2014-05-09 19:51:45 BE472797288F53AA9F56974B1A1FC18F 918672 ----a-w- C:\Program Files\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.24.7\GoogleUpdateSetup.exe 2014-05-08 16:21:29 141AC75146C3A0CA4DEAF5528EFC16AB 6957280 ----a-w- C:\Users\peter\Downloads\Silverlight.exe === C: other files == 2014-05-14 13:10:30 D3964885F0A11ACF51DA3AAA776973B2 136640 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys 2014-05-14 13:10:27 4120DA10AA42A9996F4575DB9E3E6E6E 67520 ----a-w- C:\Windows\System32\drivers\ksecdd.sys ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="C:\Windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="C:\Windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey" "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe -atboottime" ==== Task Scheduler Jobs ====================== C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:0C:\ProgramC:Files\Google\Update\GoogleUpdate.exe [] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [11/02/2014 12:28] ==== Other Scheduled Tasks ====================== "C:\Windows\system32\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\Windows\system32\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files\Apple Software Update\SoftwareUpdate.exe] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "belgiumeid@eid.belgium.be"="C:\Program Files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be" [26/03/2014 11:37] ==== Chrome Look ====================== Google Docs - peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Google Wallet - peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Gmail - peter\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}" ==== Empty IE Cache ====================== C:\Users\Kristelke\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\peter\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\peter\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\peter\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== No Flash Cache Found ==== Empty All Java Cache ====================== No Java Cache Found ==== C:\zoek_backup content ====================== C:\zoek_backup (files=2146 folders=376 79654426 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\Kristelke\AppData\Local\Temp emptied successfully C:\Users\peter\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\peter\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== EOF on do 15/05/2014 at 12:41:22,53 ======================