Zoek.exe v5.0.0.0 Updated 22-05-2014 Tool run by Anke on di 27/05/2014 at 7:50:13,18. Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x86 Running in: Normal Mode Internet Access Detected Launched: C:\Users\Anke\Downloads\zoek (4).exe [Scan all users] [Script inserted] [Checkboxes used] ==== Older Logs ====================== C:\zoek-results2013-11-27-171918.log 25361 bytes C:\zoek-results2013-11-27-175820.log 57874 bytes C:\zoek-results2014-05-27-054916.log 578 bytes ==== Empty Folders Check ====================== C:\PROGRA~2\Freemake deleted successfully C:\PROGRA~2\Oracle deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-766547166-3330058944-3535508039-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} deleted successfully HKEY_CLASSES_ROOT\CLSID\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ca82e1a5 deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ca82e1a5 deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Update Kozaka deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Update Kozaka deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Update Kozaka deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Update Kozaka deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Util Kozaka deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util Kozaka deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Util Kozaka deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Util Kozaka deleted successfully ==== FireFox Fix ====================== ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\ad6ajl7f.default ---- Lines search.net removed from prefs.js ---- user_pref("browser.search.defaultenginename", "default-search.net"); user_pref("browser.search.order.1", "default-search.net"); user_pref("browser.search.selectedEngine", "default-search.net"); user_pref("browser.startup.homepage", "http://www.default-search.net?sid=476&aid=155&itype=a&ver=12692&tm=358&src=hmp"); user_pref("keyword.URL", "http://www.default-search.net/search?sid=476&aid=155&itype=a&ver=12692&tm=358&src=ds&p="); ---- FireFox user.js and prefs.js backups ---- user_20142705_0809_.backup prefs_20142705_0809_.backup ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "mobilegeni daemon"=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "iLivid"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe] ==== Deleting Files \ Folders ====================== C:\Program Files\Mobogenie not found C:\Program Files\Optimizer Pro not found C:\Users\Anke\AppData\Local\iLivid not found C:\Program Files\Common Files\DVDVideoSoft not found C:\Users\Anke\AppData\Roaming\DVDVideoSoftIEHelpers not found C:\Program Files\Kozaka not found C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\ad6ajl7f.default\extensions\{F836D9F3-F6E0-FA80-2A43-F346ED664151} deleted C:\Program Files\Linkey deleted C:\Program Files\PKR deleted C:\ProgramData\1690 deleted C:\Program Files\Mozilla Firefox\searchplugins\default-search.xml deleted C:\Program Files\Mozilla Firefox\defaults\preferences\autoconfig.js deleted C:\Users\Anke\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\BearShare.lnk deleted C:\Users\Anke\AppData\Local\BearShare deleted C:\Users\Anke\AppData\Local\WebPlayer deleted C:\Users\Anke\Downloads\iLividSetup-r1235-n-bc.exe deleted C:\Users\Anke\Downloads\iLividSetup-r420-n-bc.exe deleted C:\Users\Anke\Downloads\SoftonicDownloader_for_pkr.exe deleted C:\Users\Anke\Documents\PC Speed Maximizer deleted C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\ad6ajl7f.default\searchplugins\default-search.xml deleted "C:\ProgramData\systemk\coordinator.cfg" not deleted "C:\ProgramData\systemk\general.cfg" not deleted "C:\ProgramData\systemk\S-1-5-21-766547166-3330058944-3535508039-1000.cfg" not deleted "C:\ProgramData\systemk\S-1-5-32.cfg" not deleted "C:\Program Files\Settings Manager\systemk\del_DM_DLL_nsb580.dll" not deleted "C:\Program Files\Settings Manager\systemk\del_DM_LL_nsb580.dll" not deleted "C:\Program Files\Settings Manager\systemk\del_mg_nsb580.dll" not deleted "C:\Program Files\Settings Manager\systemk\favicon.ico" not deleted "C:\Program Files\Settings Manager\systemk\Helper.dll" not deleted "C:\Program Files\Settings Manager\systemk\Internet Explorer Settings.exe" not deleted "C:\Program Files\Settings Manager\systemk\sysapcrt.dll" not deleted "C:\Program Files\Settings Manager\systemk\syskldr.dll" not deleted "C:\Program Files\Settings Manager\systemk\syskldr_u.dll" not deleted "C:\Program Files\Settings Manager\systemk\systemk.dll" not deleted "C:\Program Files\Settings Manager\systemk\systemkbho.dll" not deleted "C:\Program Files\Settings Manager\systemk\systemkChrome.dll" not deleted "C:\Program Files\Settings Manager\systemk\systemkmgrc1.cfg" not deleted "C:\Program Files\Settings Manager\systemk\SystemkService.exe" not deleted "C:\Program Files\Settings Manager\systemk\systemku.exe" not deleted "C:\Program Files\Settings Manager\systemk\tbicon.exe" not deleted "C:\Program Files\Settings Manager\systemk\Uninstall.exe" not deleted "C:\ProgramData\systemk" not deleted "C:\Program Files\Settings Manager" not deleted "C:\Program Files\Settings Manager\systemk" not deleted ==== Folders Found In C:\Users\Anke\AppData\Roaming\tixati ====================== 2013-10-02 18:30:59 d-----w- C:\Users\Anke\AppData\Roaming\tixati\incomplete-pieces ==== Files Found In C:\Users\Anke\AppData\Roaming\tixati ====================== 2013-10-02 18:30:59 12390 ----a-w- AF6F78F4DA891FD602682C7A73B99CAE C:\Users\Anke\AppData\Roaming\tixati\colors2.dat 2014-04-25 19:32:46 9156 ----a-w- 2872FE1E4C3702D32E092DE41EE1DF13 C:\Users\Anke\AppData\Roaming\tixati\settings.dat 2014-05-18 15:00:21 11202 ----a-w- 1EC201ED1BB3E2B2DB4E0096F805DE87 C:\Users\Anke\AppData\Roaming\tixati\uisettings2.dat.lastloadok.dat 2014-05-18 15:00:21 2802 ----a-w- F29F37A7628049BA4A389EC5C7C50744 C:\Users\Anke\AppData\Roaming\tixati\settings2.dat.lastloadok.dat 2014-05-18 15:00:22 123 ----a-w- C2A0AF174A3F9A2C41A91E22C142EE1E C:\Users\Anke\AppData\Roaming\tixati\scheduler2.dat.lastloadok.dat 2014-05-18 15:00:22 12390 ----a-w- AF6F78F4DA891FD602682C7A73B99CAE C:\Users\Anke\AppData\Roaming\tixati\colors2.dat.lastloadok.dat 2014-05-18 15:00:22 3050 ----a-w- 9ECD9E138ABB1B726920729642B1E081 C:\Users\Anke\AppData\Roaming\tixati\core2.dat.lastloadok.dat 2014-05-18 15:00:22 36933 ----a-w- 085DEE70A2C11A36800025978F01AD70 C:\Users\Anke\AppData\Roaming\tixati\dht2.dat.lastloadok.dat 2014-05-18 15:00:22 71 ----a-w- F33788B647D28AA290645CF280BB080A C:\Users\Anke\AppData\Roaming\tixati\rss2.dat.lastloadok.dat 2014-05-18 15:00:23 105 ----a-w- 809C23ED97BC63E236A8F6C8CC625F73 C:\Users\Anke\AppData\Roaming\tixati\bwpresets2.dat.lastloadok.dat 2014-05-18 15:00:23 1153 ----a-w- 1F34B116BF267DA9E3A71E9FD33B89AE C:\Users\Anke\AppData\Roaming\tixati\autothrottle2.dat.lastloadok.dat 2014-05-18 15:00:23 156 ----a-w- B3EE1D643CFB61828D091D8AEBBA16C4 C:\Users\Anke\AppData\Roaming\tixati\channels2.dat.lastloadok.dat 2014-05-25 13:53:04 11284 ----a-w- E7EC80503803F067FA1C08B425B7A4B9 C:\Users\Anke\AppData\Roaming\tixati\uisettings2.dat 2014-05-25 13:53:04 2802 ----a-w- 96141ED28853E5BD423E8704F73E97C1 C:\Users\Anke\AppData\Roaming\tixati\settings2.dat 2014-05-25 14:01:02 1300 ----a-w- 554300B8575835B6F9C25C38AE7F71F6 C:\Users\Anke\AppData\Roaming\tixati\core.dat 2014-05-25 14:01:02 3050 ----a-w- 1D3F03479B5AA0902D700C9A8D81330C C:\Users\Anke\AppData\Roaming\tixati\core2.dat 2014-05-25 14:01:03 105 ----a-w- 809C23ED97BC63E236A8F6C8CC625F73 C:\Users\Anke\AppData\Roaming\tixati\bwpresets2.dat 2014-05-25 14:01:03 1153 ----a-w- 1F34B116BF267DA9E3A71E9FD33B89AE C:\Users\Anke\AppData\Roaming\tixati\autothrottle2.dat 2014-05-25 14:01:03 123 ----a-w- C2A0AF174A3F9A2C41A91E22C142EE1E C:\Users\Anke\AppData\Roaming\tixati\scheduler2.dat 2014-05-25 14:01:03 156 ----a-w- B3EE1D643CFB61828D091D8AEBBA16C4 C:\Users\Anke\AppData\Roaming\tixati\channels2.dat 2014-05-25 14:01:03 19 ----a-w- C2F700C9CEA9A80047F0AD90E2CD7FAA C:\Users\Anke\AppData\Roaming\tixati\rss.dat 2014-05-25 14:01:03 41942 ----a-w- F1A0E0F3AF5A612F5B93D57F65F57101 C:\Users\Anke\AppData\Roaming\tixati\dht.dat 2014-05-25 14:01:03 442 ----a-w- DD9862F1C67EC6AA9AA1E4A998CCBE49 C:\Users\Anke\AppData\Roaming\tixati\autothrottle.dat 2014-05-25 14:01:03 45127 ----a-w- E7AAA0B88B7EF226584E4698C27354D7 C:\Users\Anke\AppData\Roaming\tixati\dht2.dat 2014-05-25 14:01:03 71 ----a-w- F33788B647D28AA290645CF280BB080A C:\Users\Anke\AppData\Roaming\tixati\rss2.dat 2014-05-25 14:01:06 189943 ----a-w- EDD9B496FE4EA2598D038A2B193B7002 C:\Users\Anke\AppData\Roaming\tixati\upnp_diagnostic_log.txt ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\Anke\AppData\Local\Temp ==== ====== Java Cache ===== ====== C:\Windows\system32 ===== 2014-05-26 08:55:34 6EA69D2312F3571F6F8BEADD224165E8 264616 ----a-w- C:\Windows\System32\javaws.exe 2014-05-26 08:55:11 B42338F92D3BDADA79B6BE553E72587C 94632 ----a-w- C:\Windows\System32\WindowsAccessBridge.dll 2014-05-26 08:55:11 9533FE0A942E00114047140B42DF8E3D 175016 ----a-w- C:\Windows\System32\java.exe 2014-05-26 08:55:11 37C15684482B4D596316735DCEEE939A 175528 ----a-w- C:\Windows\System32\javaw.exe 2014-05-15 01:00:47 FBCF3F01177953EBF1E735643621CCF5 69632 ----a-w- C:\Windows\System32\mshtmled.dll 2014-05-15 01:00:45 EB5347F6149D3FF25F4D609A21A3BD67 17382912 ----a-w- C:\Windows\System32\mshtml.dll 2014-05-15 01:00:44 10D531ADC7B8FB36C7361D44AF6E8AB6 2724864 ----a-w- C:\Windows\System32\mshtml.tlb 2014-05-14 04:11:04 1DA49BFA5B76D128851C9474C1A69B21 369664 ----a-w- C:\Windows\System32\aepdu.dll 2014-05-14 04:11:03 94CDF4D11590ABC56BD6EAD81A1017E9 302592 ----a-w- C:\Windows\System32\aeinv.dll 2014-05-14 04:10:56 9DE19EA21DF99AF15BA5A947E5317F9E 550912 ----a-w- C:\Windows\System32\kerberos.dll 2014-05-14 04:10:56 4D59F470985D08139E42D15842816C47 3969984 ----a-w- C:\Windows\System32\ntkrnlpa.exe 2014-05-14 04:10:55 4D50D7654EB38B8385FA9EF3DA14D4BE 1059840 ----a-w- C:\Windows\System32\lsasrv.dll 2014-05-14 04:10:55 31FA2485DFC773F1E718A4D19F443FA9 3914176 ----a-w- C:\Windows\System32\ntoskrnl.exe 2014-05-14 04:10:54 ED195AC76E10F17F6DD60C49666F2A83 259584 ----a-w- C:\Windows\System32\msv1_0.dll 2014-05-14 04:10:53 995B39A08421C7725D1DF8DACEBBFC89 538112 ----a-w- C:\Windows\System32\objsel.dll 2014-05-14 04:10:52 FD25B74DC1A18C56BF1A879BF086555A 293376 ----a-w- C:\Windows\System32\KernelBase.dll 2014-05-14 04:10:52 541BB9B4C899ADCC5D3DB89208C1F409 65536 ----a-w- C:\Windows\System32\TSpkg.dll 2014-05-14 04:10:52 3A1ABE045A3E30799576E83A2D012B43 172032 ----a-w- C:\Windows\System32\wdigest.dll 2014-05-14 04:10:51 828185688FDAAE6C7959B884ABED1766 247808 ----a-w- C:\Windows\System32\schannel.dll 2014-05-14 04:10:51 62C0798CC68EBF42F29C92E6CD6DC3D6 36864 ----a-w- C:\Windows\System32\dimsroam.dll 2014-05-14 04:10:50 FBC78B5D12A4F5A62D9C91E0E0E46D46 49664 ----a-w- C:\Windows\System32\adprovider.dll 2014-05-14 04:10:50 834A859BB331B0B2CCAE25BB1986F80D 47616 ----a-w- C:\Windows\System32\dpapiprovider.dll 2014-05-14 04:10:50 38A30B8E4216BE24D30F766EF3BAC2C7 48128 ----a-w- C:\Windows\System32\capiprovider.dll 2014-05-14 04:10:50 335FA669FC952BC4888CEDBDB42607E2 51200 ----a-w- C:\Windows\System32\cngprovider.dll 2014-05-14 04:10:49 DD17E1573651293D4ED31053795B3471 22528 ----a-w- C:\Windows\System32\lsass.exe 2014-05-14 04:10:49 CAA3039FFA0CDF8C2A9845C1609CDE00 100352 ----a-w- C:\Windows\System32\sspicli.dll 2014-05-14 04:10:49 C94CE65AE7701E9FDBA889045543E27C 22016 ----a-w- C:\Windows\System32\secur32.dll 2014-05-14 04:10:49 61BC8ACDEC57469B22EC519B22FB3642 15872 ----a-w- C:\Windows\System32\sspisrv.dll 2014-05-14 04:10:49 5E11C55CC4D9330E55CCB22B1F20BB33 35328 ----a-w- C:\Windows\System32\wincredprovider.dll 2014-05-14 04:10:49 2A86C18CE6869C77FCEB62F3B47D4D5B 17408 ----a-w- C:\Windows\System32\credssp.dll 2014-05-14 04:10:16 E9D88493FBDB36D4B65C6F2F7F122C95 12874240 ----a-w- C:\Windows\System32\shell32.dll ====== C:\Windows\system32\drivers ===== 2014-05-14 04:10:51 D3964885F0A11ACF51DA3AAA776973B2 136640 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys 2014-05-14 04:10:49 4120DA10AA42A9996F4575DB9E3E6E6E 67520 ----a-w- C:\Windows\System32\drivers\ksecdd.sys ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2014-05-25 13:52:58 -------- d-----w- C:\Program Files\Settings Manager ======= C: ===== ====== C:\Users\Anke\AppData\Roaming ====== 2014-05-25 13:52:32 -------- d-----w- C:\Users\Anke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PKR ====== C:\Users\Anke ====== 2014-05-26 08:55:11 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-05-26 07:19:56 8685FAF50C04F9A9C2F56FF64B0B7ACB 1107968 ----a-w- C:\Users\Anke\Downloads\RSIT.exe 2014-05-25 13:55:06 -------- d-----w- C:\ProgramData\systemk 2014-05-25 13:52:32 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PKR 2014-05-25 13:52:13 035A5825C50F965D6C0040C3E58C1494 858857 ----a-w- C:\Users\Anke\Desktop\pkrinstall.exe 2014-05-13 23:38:34 -------- d-----r- C:\Windows\system32\config\systemprofile\Searches ====== C: exe-files == 2014-05-26 08:55:34 6EA69D2312F3571F6F8BEADD224165E8 264616 ----a-w- C:\Windows\System32\javaws.exe 2014-05-26 08:55:11 9533FE0A942E00114047140B42DF8E3D 175016 ----a-w- C:\Windows\System32\java.exe 2014-05-26 08:55:11 37C15684482B4D596316735DCEEE939A 175528 ----a-w- C:\Windows\System32\javaw.exe 2014-05-26 08:46:14 3842C46F2FBC7522EF625F1833530804 145408 ----a-w- C:\Users\Anke\AppData\LocalLow\Sun\Java\jre1.7.0_55\lzma.exe 2014-05-26 07:19:56 8685FAF50C04F9A9C2F56FF64B0B7ACB 1107968 ----a-w- C:\Users\Anke\Downloads\RSIT.exe 2014-05-25 13:56:24 AEDDEA4D6D0495E782EC1C95047A74E9 78352 ----a-w- C:\Program Files\Settings Manager\systemk\tbicon.exe 2014-05-25 13:55:42 2DB1F384DB73AC6B835D722C65B25E53 3582992 ----a-w- C:\Program Files\Settings Manager\systemk\systemku.exe 2014-05-25 13:55:41 A392180ACD34EDC3680A4FA13991870B 3543056 ----a-w- C:\Program Files\Settings Manager\systemk\SystemkService.exe 2014-05-25 13:55:39 AB50F43288137E23BE78442E60821ACC 1195536 ----a-w- C:\Program Files\Settings Manager\systemk\Internet Explorer Settings.exe 2014-05-25 13:54:39 669DEF20E8B8F0CD4E23C113555710E1 8243088 ----a-w- C:\Windows\Temp\49176d5d\SettingsManagerSetup.exe 2014-05-25 13:52:13 035A5825C50F965D6C0040C3E58C1494 858857 ----a-w- C:\Users\Anke\Desktop\pkrinstall.exe 2014-05-24 16:22:12 3AF5806AAB54D86CDA7AAA034FD2C35E 38382160 ----a-w- C:\Program Files\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\35.0.1916.114\35.0.1916.114_chrome_installer.exe === C: other files == 2014-05-27 05:47:26 0BE568FD1E7D6C6D64D2272649F5C716 111 ----a-w- C:\Users\Anke\AppData\Local\Temp\scripttest.vbs ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-21-766547166-3330058944-3535508039-1000\Software\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "AGupdate"="C:\Program Files\AppGraffiti\AGupdate.exe" "Optimizer Pro"="C:\Program Files\Optimizer Pro\OptProLauncher.exe" "C:/Program Files/Media Freeware/Free Youtube To Video Converter/Free Youtube To Video Converter.exe"="C:\Program Files\Media Freeware\Free Youtube To Video Converter\Free Youtube To Video Converter.exe" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="C:\Windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="C:\Windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey" "AdobeAAMUpdater-1.0"="C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" "Adobe Creative Cloud"="C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe --showwindow=false --onOSstartup=true" "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" "AGupdate"="C:\Program Files\AppGraffiti\AGupdate.exe" "Optimizer Pro"="C:\Program Files\Optimizer Pro\OptProLauncher.exe" "C:/Program Files/Media Freeware/Free Youtube To Video Converter/Free Youtube To Video Converter.exe"="C:\Program Files\Media Freeware\Free Youtube To Video Converter\Free Youtube To Video Converter.exe" ==== Startup Registry Disabled ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BearShare] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="BearShare" "hkey"="HKCU" "command"="\"C:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe\" --lightmode" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk] "item"="McAfee Security Scan Plus" "path"="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\McAfee Security Scan Plus.lnk" "backup"="C:\\Windows\\pss\\McAfee Security Scan Plus.lnk.CommonStartup" "backupExtension"=".CommonStartup" "command"="C:\\PROGRA~1\\MCAFEE~1\\307523~1.318\\SSSCHE~1.EXE" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-] "Adobe ARM"="\"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\"" "SunJavaUpdateSched"="\"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\"" ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [14/05/2014 09:17] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [28/03/2013 22:31] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [28/03/2013 22:31] ==== Other Scheduled Tasks ====================== "C:\Windows\system32\tasks\Adobe Flash Player Updater" [C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\system32\tasks\Adobe online update program" [C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\Windows\system32\tasks\AdobeAAMUpdater-1.0-Zot_geval-Anke" [C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe] "C:\Windows\system32\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\Windows\system32\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\Java Update Scheduler" [C:\Program Files\Common Files\Java\Java Update\jusched.exe] "C:\Windows\system32\tasks\NCH Software\VideoPadDowngrade" [C:\Program Files\NCH Software\VideoPad\videopad.exe] ==== Firefox Extensions ====================== ProfilePath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\ad6ajl7f.default - Undetermined - C:\Program Files\Better-Surf\ff AppDir: C:\Program Files\Mozilla Firefox - Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi ==== Firefox Plugins ====================== Profilepath: C:\Users\Anke\AppData\Roaming\Mozilla\Firefox\Profiles\ad6ajl7f.default 14365399E83D7BC15760E8676E890C87 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat 14365399E83D7BC15760E8676E890C87 - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat B36641D2192E1E537A269FEFEA47F1FD - C:\Program Files\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll - AdobeAAMDetect 025BBEF5A248B09BDC6684747F6EB5BC - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll - Java(TM) Platform SE 7 U55 7ED046C92891B83CFAC5238650B6CD5E - C:\Program Files\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll - AdobeAAMDetect 15E298B5EC5B89C5994A59863969D9FF - C:\Windows\system32\npmproxy.dll - Microsoft® Windows® Operating System ==== Chrome Look ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[11/04/2014 19:46] Skype Click to Call - Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl Google Wallet - Anke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Docs - Anke\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - Anke\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - Anke\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Google Search - Anke\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf Gmail - Anke\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.default-search.net?sid=476&aid=155&itype=a&ver=12692&tm=358&src=hmp" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes "DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}" ==== Deleting Registry Keys ====================== HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\GoforFiles deleted successfully ==== Empty IE Cache ====================== C:\Users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Anke\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully ==== Empty FireFox Cache ====================== No FireFox Cache found ==== Empty Chrome Cache ====================== C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\Anke\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=322 folders=44 197502572 bytes) ==== Empty Temp Folders ====================== C:\Users\Anke\AppData\Local\Temp will be emptied at reboot C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\Anke\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\ProgramData\systemk\coordinator.cfg" deleted "C:\ProgramData\systemk\general.cfg" deleted "C:\ProgramData\systemk\S-1-5-21-766547166-3330058944-3535508039-1000.cfg" deleted "C:\ProgramData\systemk\S-1-5-32.cfg" deleted "C:\Program Files\Settings Manager\systemk\del_DM_DLL_nsb580.dll" not found "C:\Program Files\Settings Manager\systemk\del_DM_LL_nsb580.dll" not found "C:\Program Files\Settings Manager\systemk\del_mg_nsb580.dll" not found "C:\Program Files\Settings Manager\systemk\favicon.ico" not found "C:\Program Files\Settings Manager\systemk\Helper.dll" not found "C:\Program Files\Settings Manager\systemk\Internet Explorer Settings.exe" not found "C:\Program Files\Settings Manager\systemk\sysapcrt.dll" not found "C:\Program Files\Settings Manager\systemk\syskldr.dll" not found "C:\Program Files\Settings Manager\systemk\syskldr_u.dll" not found "C:\Program Files\Settings Manager\systemk\systemk.dll" not found "C:\Program Files\Settings Manager\systemk\systemkbho.dll" not found "C:\Program Files\Settings Manager\systemk\systemkChrome.dll" not found "C:\Program Files\Settings Manager\systemk\systemkmgrc1.cfg" not found "C:\Program Files\Settings Manager\systemk\SystemkService.exe" not found "C:\Program Files\Settings Manager\systemk\systemku.exe" not found "C:\Program Files\Settings Manager\systemk\tbicon.exe" not found "C:\Program Files\Settings Manager\systemk\Uninstall.exe" not found "C:\ProgramData\systemk" deleted "C:\Program Files\Settings Manager" not found "C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted ==== EOF on di 27/05/2014 at 8:23:40,26 ======================