Zoek.exe v5.0.0.0 Updated 22-05-2014 Tool run by harrie on Thu 05/29/2014 at 21:56:27.57. Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x86 Running in: Normal Mode Internet Access Detected Launched: C:\Users\harrie\Downloads\zoek (1).exe [Scan all users] [Script inserted] ==== System Restore Info ====================== 5/29/2014 10:00:36 PM Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\Program Files\eSobi deleted successfully C:\Program Files\FastestTube deleted successfully C:\Program Files\VLC deleted successfully C:\Program Files\VLC player deleted successfully C:\PROGRA~2\Bic deleted successfully C:\PROGRA~2\Canon IJ Network Tool deleted successfully C:\PROGRA~2\Oracle deleted successfully C:\Users\harrie\AppData\Roaming\Nico Mak Computing deleted successfully C:\Users\harrie\AppData\Roaming\Outlook deleted successfully C:\Users\harrie\AppData\Roaming\The Complete Genealogy Reporter - FTB deleted successfully C:\Users\harrie\AppData\Local\Savings Addon deleted successfully ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\0287631304244904mcinstcleanup deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\0287631304244904mcinstcleanup deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\0287631304244904mcinstcleanup deleted successfully ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E87806B5-E908-45FD-AF5E-957D83E58E68}] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iLivid] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HF_G_Jul] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ROC_ROC_JULY_P1] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt] ==== Deleting Files \ Folders ====================== C:\Program Files\Softonic not found "C:\Windows\tasks\RegClean Prosch.job" deleted "C:\Windows\tasks\RegClean Pro_DEFAULT.job" deleted "C:\Windows\tasks\RegClean Pro_UPDATES.job" deleted "C:\Windows\tasks\schedule!3036567561.job" deleted "C:\Windows\tasks\Updater.job" deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\harrie\AppData\Local\Temp ==== 2014-05-29 11:07:35 5634C601025C31032A0AF1590B4C0CA6 43008 ----a-w- C:\Users\harrie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbdfpjp.dll ====== Java Cache ===== ====== C:\Windows\system32 ===== ====== C:\Windows\system32\drivers ===== ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2014-05-25 16:08:51 -------- d-----w- C:\Program Files\Dropbox 2014-05-23 20:22:26 -------- d-----w- C:\Program Files\trend micro ======= C: ===== ====== C:\Users\harrie\AppData\Roaming ====== 2014-05-16 18:32:07 -------- d-----w- C:\Users\harrie\AppData\Roaming\DropboxMaster ====== C:\Users\harrie ====== 2014-05-24 21:23:27 69CA82A7482A00D8EE063D2B97FC4338 781383 ----a-w- C:\Users\harrie\Downloads\RSIT (1).exe 2014-05-23 20:21:08 69CA82A7482A00D8EE063D2B97FC4338 781383 ----a-w- C:\Users\harrie\Downloads\RSIT.exe 2014-05-23 19:47:40 7FFE531FC3065DE780E683F4197B5F67 4892480 ----a-w- C:\Users\harrie\Downloads\wzmp_8.exe 2014-05-23 19:43:19 C7613503E8FE311D1DAA9A61E384C1F8 10094400 ----a-w- C:\Users\harrie\Downloads\HitmanPro (1).exe 2014-05-23 19:41:51 C7613503E8FE311D1DAA9A61E384C1F8 10094400 ----a-w- C:\Users\harrie\Downloads\HitmanPro.exe ====== C: exe-files == 2014-05-25 16:08:51 CCCDC7B64CFF96C977B0FADC24434628 33322312 ----a-w- C:\Program Files\Dropbox\DropboxProxy.exe 2014-05-23 20:55:02 3AF5806AAB54D86CDA7AAA034FD2C35E 38382160 ----a-w- C:\Program Files\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\35.0.1916.114\35.0.1916.114_chrome_installer.exe 2014-05-23 15:57:12 29198D93029027C9BB4DA8E9C70AF13E 26832976 ----a-w- C:\Program Files\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\35.0.1916.114\35.0.1916.114_34.0.1847.137_chrome_updater.exe === C: other files == 2014-05-27 17:23:44 BABAE36630BA1C7146C5D5044C6BE007 2211808 ----a-w- C:\Users\harrie\Downloads\Naamloos_bericht.zip 2014-05-22 20:29:50 D3F7FB40012382F7B206200AE794FBD7 384728 ----a-w- C:\Windows\System32\drivers\N360\1503000.00C\symtdiv.sys 2014-05-22 20:29:50 CCD9B61DD6AB649B69143523C0D6391B 447704 ----a-w- C:\Windows\System32\drivers\N360\1503000.00C\symnets.sys 2014-05-22 20:29:49 B70A98F20B4180F2751CFD7656116342 936152 ----a-w- C:\Windows\System32\drivers\N360\1503000.00C\symefa.sys 2014-05-22 20:29:49 4C3DEF736D3857570166DE5C858600F5 367704 ----a-r- C:\Windows\System32\drivers\N360\1503000.00C\symds.sys 2014-05-22 20:29:49 02F3073C3933190DFD24BC35800172B4 21520 ----a-r- C:\Windows\System32\drivers\N360\1503000.00C\symelam.sys 2014-05-22 20:29:48 E3A3CA230C7547364BB3D9DA0C301A36 206936 ----a-r- C:\Windows\System32\drivers\N360\1503000.00C\ironx86.sys 2014-05-22 20:29:48 91C966DE2058116525748050A22C8170 664280 ----a-w- C:\Windows\System32\drivers\N360\1503000.00C\srtsp.sys 2014-05-22 20:29:48 1B6D68043F488F70E889276E1585B7AA 32344 ----a-r- C:\Windows\System32\drivers\N360\1503000.00C\srtspx.sys 2014-05-22 20:29:47 56C2811FD0D7B727808A69407B5BFAE0 127064 ----a-r- C:\Windows\System32\drivers\N360\1503000.00C\ccsetx86.sys ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /detectMem" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="rundll32.exe oobefldr.dll,ShowWelcomeCenter" "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /detectMem" [HKEY_USERS\S-1-5-21-2971273702-3882408664-4228624218-1000\Software\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" "HTC Sync Loader"="C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe -startup" "RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe" "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "Acer ePower Management"="C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" ==== Startup Registry Disabled ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Adobe Reader Speed Launcher" "hkey"="HKLM" "command"="\"C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\APSDaemon] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="APSDaemon" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Apple\\Apple Application Support\\APSDaemon.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DVBLink MediaCenter Launcher] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="DVBLink MediaCenter Launcher" "hkey"="HKLM" "command"="C:\\Program Files\\DVBLogic\\DVBLink2\\DVBLinkMCLauncher.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Family Tree Builder Update] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Family Tree Builder Update" "hkey"="HKLM" "command"="C:\\Program Files\\MyHeritage\\Bin\\FTBCheckUpdates.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Google Update] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Google Update" "hkey"="HKCU" "command"="\"C:\\Users\\harrie\\AppData\\Local\\Google\\Update\\GoogleUpdate.exe\" /c" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MyDriveConnect.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MyDriveConnect.exe" "hkey"="HKCU" "command"="\"C:\\Program Files\\MyDrive Connect\\MyDriveConnect.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MyTomTomSA.exe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MyTomTomSA.exe" "hkey"="HKCU" "command"="\"C:\\Program Files\\MyTomTom 3\\MyTomTomSA.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PowerSuite] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PowerSuite" "hkey"="HKCU" "command"="\"C:\\PROGRA~1\\Uniblue\\POWERS~1\\launcher.exe\" delay 20000 -m" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="QuickTime Task" "hkey"="HKLM" "command"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Reader Application Helper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Reader Application Helper" "hkey"="HKLM" "command"="C:\\Program Files\\Sony\\ReaderDesktop\\appHelper\\ReaderAppHelper.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Remote Control Editor] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Remote Control Editor" "hkey"="HKCU" "command"="\"C:\\Program Files\\Common Files\\TerraTec\\Remote\\TTTvRc.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Skytel] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Skytel" "hkey"="HKLM" "command"="C:\\Program Files\\Realtek\\Audio\\HDA\\Skytel.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SynTPEnh] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SynTPEnh" "hkey"="HKLM" "command"="%ProgramFiles%\\Synaptics\\SynTP\\SynTPEnh.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\uTorrent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="uTorrent" "hkey"="HKCU" "command"="\"C:\\Program Files\\Utorrent\\uTorrent.exe\" /MINIMIZED" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk] "path"="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Acer VCM.lnk" "backup"="C:\\Windows\\pss\\Acer VCM.lnk.CommonStartup" "backupExtension"=".CommonStartup" "command"="C:\\PROGRA~1\\Acer\\ACERVC~1\\AcerVCM.exe " "item"="Acer VCM" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WG111v2 Smart Wizard Wireless Setting.lnk] "path"="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WG111v2 Smart Wizard Wireless Setting.lnk" "backup"="C:\\Windows\\pss\\WG111v2 Smart Wizard Wireless Setting.lnk.CommonStartup" "backupExtension"=".CommonStartup" "command"="C:\\PROGRA~1\\NETGEAR\\WG111V~1\\WG111v2.exe " "item"="WG111v2 Smart Wizard Wireless Setting" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^harrie^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk] "path"="C:\\Users\\harrie\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Dropbox.lnk" "backup"="C:\\Windows\\pss\\Dropbox.lnk.Startup" "backupExtension"=".Startup" "command"="C:\\Users\\harrie\\AppData\\Roaming\\Dropbox\\bin\\Dropbox.exe /systemstartup" "item"="Dropbox" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^harrie^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] "path"="C:\\Users\\harrie\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneNote 2007 Screen Clipper and Launcher.lnk" "backup"="C:\\Windows\\pss\\OneNote 2007 Screen Clipper and Launcher.lnk.Startup" "backupExtension"=".Startup" "command"="C:\\PROGRA~1\\MICROS~2\\Office12\\ONENOTEM.EXE /tsr" "item"="OneNote 2007 Screen Clipper and Launcher" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\odserv] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\p2psvc] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\SDRSVC] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\Sony SCSI Helper Service] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\Update melondrea] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\Util melondrea] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\WinDefend] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\WinRM] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\WMPNetworkSvc] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\WPCSvc] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\wscsvc] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\Services\WSearch] ==== Startup Folders ====================== 2014-05-16 18:32:32 956 ----a-w- C:\Users\harrie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [05/15/2014 10:15 PM] C:\Windows\tasks\GoogleUpdateTaskMachineCore1cd0ad5aff79aa0.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [05/02/2011 10:03 PM] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [05/02/2011 10:03 PM] C:\Windows\tasks\WinMaximizer-harrie-Startup.job --a------ C:\Program Files\WinMaximizer\WinMaximizer.exe [] ==== Other Scheduled Tasks ====================== "C:\Windows\system32\tasks\Adobe Flash Player Updater" [C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\system32\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore1cd0ad5aff79aa0" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\Launch HTC Sync Loader" [C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe] "C:\Windows\system32\tasks\Norton WSC Integration" ["C:\Program Files\Norton 360\Engine\21.3.0.12\WSCStub.exe"] "C:\Windows\system32\tasks\RegClean Pro" [C:\Program Files\RegClean Pro\RegCleanPro.exe] "C:\Windows\system32\tasks\WinMaximizer-harrie-Startup" [C:\Program Files\WinMaximizer\WinMaximizer.exe] "C:\Windows\system32\tasks\{478CFAD0-E0C6-4629-BC2C-2D6630BD2F99}" [C:\Program Files\Skype\\Phone\Skype.exe] "C:\Windows\system32\tasks\Acer\Burn Notification" [C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe] "C:\Windows\system32\tasks\Norton 360\Norton Error Analyzer" [C:\Program Files\Norton 360\Engine\21.3.0.12\SymErr.exe] "C:\Windows\system32\tasks\Norton 360\Norton Error Processor" [C:\Program Files\Norton 360\Engine\21.3.0.12\SymErr.exe] ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "{BBDA0591-3099-440a-AA10-41764D9DB4DB}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF" [03/12/2014 06:41 PM] ==== Firefox Extensions ====================== ProfilePath: C:\Users\harrie\AppData\Roaming\Mozilla\Firefox\Profiles\nl5nammo.default - Undetermined - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.2.1\IPSFFPlgn - Undetermined - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.2.1\coFFPlgn - Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension ==== Firefox Plugins ====================== Profilepath: C:\Users\harrie\AppData\Roaming\Mozilla\Firefox\Profiles\nl5nammo.default AE84791D996D1F05A2446B0C447D937A - C:\Program Files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll - Adobe Acrobat AB87EEFFD18F2BAAFC274E7075EA6C67 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation AAA414455FE1AA87E424BDFCAE249B50 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live® Photo Gallery ==== C:\zoek_backup content ====================== C:\zoek_backup (files=5 folders=0 1448 bytes) ==== EOF on Thu 05/29/2014 at 22:14:25.75 ======================