Zoek.exe v5.0.0.0 Updated 17-10-2014 Tool run by Wendy on za 18/10/2014 at 8:21:42,02. Microsoft Windows 8.1 6.3.9600 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\Wendy\Desktop\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== System Restore Info ====================== 18/10/2014 8:22:27 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\Users\Wendy\AppData\Local\Adobe deleted successfully C:\Users\Wendy\AppData\Local\VirtualStore deleted successfully ==== Registry Fix Code x64 ====================== Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] ""=- ==== Deleting Files \ Folders ====================== C:\Users\Wendy\AppData\Roaming\InstallShield deleted C:\Users\Wendy\AppData\Roaming\WinBatch deleted C:\Program Files (x86)\DriverTuner deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\Wendy\AppData\Local\Temp ==== 2014-10-17 11:43:31 E3A25C80E2375B2D42C3D4729769BDF3 10240 ----a-w- C:\Users\Wendy\AppData\Local\Temp\SDIAG_3af0e5fc-38a9-4d22-819c-040f8070714d\NetworkDiagnosticSnapIn.dll 2014-10-17 11:28:25 B9C125314A025127FE562C116D614AA3 178824 ----a-r- C:\Users\Wendy\AppData\Local\Temp\ose00000.exe 2014-10-17 11:21:52 8FAB0A499A6A2EC348936340D0862786 2838528 ----a-w- C:\Users\Wendy\AppData\Local\Temp\ir_ext_temp_0\autorun.exe 2014-10-17 11:21:51 A38F725A0367F27E37BF2D01193FD8C7 1627352 ----a-w- C:\Users\Wendy\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\PowerISO47.exe 2014-10-17 09:01:42 E3A25C80E2375B2D42C3D4729769BDF3 10240 ----a-w- C:\Users\Wendy\AppData\Local\Temp\SDIAG_32204d81-20ae-4683-ba76-24d9294ed7b2\NetworkDiagnosticSnapIn.dll ====== Java Cache ===== ====== C:\Windows\SysWOW64 ===== ====== C:\Windows\SysWOW64\drivers ===== ====== C:\Windows\Sysnative ===== 2014-10-17 12:37:29 4AAA1E82E6CAF44408F03A0B015445CD 278152 ------w- C:\Windows\Sysnative\MpSigStub.exe ====== C:\Windows\Sysnative\drivers ===== 2014-10-17 11:41:06 D41D8CD98F00B204E9800998ECF8427E 0 ---ha-w- C:\Windows\Sysnative\drivers\Msft_User_LocationProvider_01_11_00.Wdf 2014-10-17 11:22:08 6CE6F98EA3D07A9C2CE3CD0A5A86352D 91568 ----a-w- C:\Windows\Sysnative\drivers\scdemu.sys 2014-10-17 11:21:06 D41D8CD98F00B204E9800998ECF8427E 0 ---ha-w- C:\Windows\Sysnative\drivers\Msft_User_WpdFs_01_11_00.Wdf ====== C:\Windows\Tasks ====== 2014-10-18 06:21:19 EF3B7AB7D3B56EB05CDFD031830D5AFC 3758 ----a-w- C:\Windows\Sysnative\Tasks\AutoKMS 2014-10-17 08:58:49 6478D249B25E7108A420502F7343507D 3594 ----a-w- C:\Windows\Sysnative\Tasks\Optimize Start Menu Cache Files-S-1-5-21-272354048-481336950-3082444135-1001 ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2014-10-17 18:00:00 -------- d-----w- C:\Program Files\trend micro 2014-10-17 11:34:04 -------- d-----w- C:\Program Files\Common Files\DESIGNER 2014-10-17 11:33:32 -------- d-----w- C:\Program Files\Microsoft.NET 2014-10-17 11:32:07 -------- d-----w- C:\Program Files\Microsoft SQL Server 2014-10-17 11:28:53 -------- d-----w- C:\Program Files\Microsoft Analysis Services 2014-10-17 11:28:37 -------- d-----w- C:\Program Files\Microsoft Office ======= C:\PROGRA~2 ===== 2014-10-17 14:54:11 -------- d-----w- C:\PROGRA~2\COMMON~1\Adobe 2014-10-17 14:54:11 -------- d-----w- C:\PROGRA~2\Adobe 2014-10-17 11:33:32 -------- d-----w- C:\PROGRA~2\Microsoft SQL Server 2014-10-17 11:28:53 -------- d-----w- C:\PROGRA~2\Microsoft Analysis Services 2014-10-17 11:22:08 -------- d-----w- C:\PROGRA~2\PowerISO ======= C: ===== ====== C:\Users\Wendy\AppData\Roaming ====== 2014-10-17 12:37:23 -------- d-----w- C:\Windows\serviceprofiles\Localservice\AppData\Local\PnrpSqm 2014-10-17 12:31:58 -------- d-----w- C:\Windows\serviceprofiles\Localservice\AppData\Roaming\PeerNetworking 2014-10-17 12:28:59 -------- d-----w- C:\Users\Wendy\AppData\Local\ElevatedDiagnostics 2014-10-17 11:41:12 -------- d-s---w- C:\Windows\serviceprofiles\Localservice\AppData\Locallow\Microsoft 2014-10-17 11:28:43 -------- d-----w- C:\Users\Wendy\AppData\Local\Microsoft Help 2014-10-17 10:56:23 -------- d-----w- C:\Users\Wendy\AppData\Roaming\Spotify 2014-10-17 10:56:23 -------- d-----w- C:\Users\Wendy\AppData\Local\Spotify 2014-10-17 10:49:14 -------- d-----w- C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google 2014-10-17 10:37:49 -------- d-sh--w- C:\Users\Wendy\AppData\Locallow\EmieUserList 2014-10-17 10:37:46 -------- d-sh--w- C:\Users\Wendy\AppData\Local\EmieUserList 2014-10-17 10:37:46 -------- d-sh--w- C:\Users\Wendy\AppData\Local\EmieSiteList 2014-10-17 10:37:37 -------- d-sh--w- C:\Users\Wendy\AppData\Locallow\EmieSiteList 2014-10-17 10:33:33 -------- d-s---w- C:\Users\Wendy\AppData\Locallow\Microsoft 2014-10-17 09:03:02 -------- d-----w- C:\Users\Wendy\AppData\Local\Diagnostics 2014-10-17 08:59:06 -------- d-----w- C:\Users\Wendy\AppData\Roaming\ATI 2014-10-17 08:59:06 -------- d-----w- C:\Users\Wendy\AppData\Local\ATI 2014-10-17 08:54:03 -------- d-----w- C:\Users\Wendy\AppData\Local\TOSHIBA 2014-10-17 08:52:16 -------- d-----r- C:\Users\Wendy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-10-17 08:52:16 -------- d-----r- C:\Users\Wendy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-10-17 08:51:59 -------- d-----w- C:\Users\Wendy\AppData\Local\Packages 2014-10-17 08:51:58 -------- d-----w- C:\Users\Wendy\AppData\Roaming\Adobe 2014-10-17 08:51:27 -------- d-s---w- C:\Users\Wendy\AppData\Roaming\Microsoft 2014-10-17 08:51:27 -------- d-----w- C:\Users\Wendy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-10-17 08:51:27 -------- d-----w- C:\Users\Wendy\AppData\Local\Temp 2014-10-17 08:51:27 -------- d-----w- C:\Users\Wendy\AppData\Local\Microsoft 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility ====== C:\Users\Wendy ====== 2014-10-17 17:59:41 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\Users\Wendy\Downloads\RSITx64.exe 2014-10-17 14:53:45 -------- d-----w- C:\ProgramData\Adobe 2014-10-17 14:38:26 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner 2014-10-17 11:55:43 -------- d-----w- C:\ProgramData\Microsoft Toolkit 2014-10-17 11:55:35 -------- d-----w- C:\ProgramData\TOSHIBA Tempro 2014-10-17 11:55:35 -------- d-----w- C:\ProgramData\IsolatedStorage 2014-10-17 11:35:12 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2014-10-17 11:28:36 -------- d-----w- C:\ProgramData\Microsoft Help 2014-10-17 11:22:19 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO 2014-10-17 10:34:06 -------- d-----w- C:\ProgramData\ToshibaEurope 2014-10-17 08:52:16 -------- d-----r- C:\Users\Wendy\Searches 2014-10-17 08:52:15 -------- d-----r- C:\Users\Wendy\Contacts 2014-10-17 08:51:28 6FC234AD3752E1267B34FB12BCD6718B 20 --sh--w- C:\Users\Wendy\ntuser.ini 2014-10-17 08:51:27 -------- d--h--w- C:\Users\Wendy\AppData 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\Videos 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\Saved Games 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\Pictures 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\Music 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\Links 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\Favorites 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\Downloads 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\Documents 2014-10-17 08:51:27 -------- d-----r- C:\Users\Wendy\Desktop 2014-10-17 08:44:15 -------- d--h--r- C:\Users\Public\AccountPictures ====== C: exe-files == 2014-10-17 18:00:00 9A2347903D6EDB84C10F288BC0578C1C 388608 ----a-w- C:\Program Files\trend micro\Wendy.exe 2014-10-17 17:59:41 8045ABB21A3BDD66A48E1ED5C0F0EF6A 1222144 ----a-w- C:\Users\Wendy\Downloads\RSITx64.exe 2014-10-17 17:49:56 602C842C9B9063DB76B09E1F8FFE25EA 1678013 ----a-w- C:\Users\Wendy\AppData\Local\Microsoft\Windows\INetCache\IE\0RH0D8UP\pc-decrapifier-2.3.1.exe 2014-10-17 14:37:45 EAB202AB2CE8CD86D5FA2BB2CEBCC68C 3111312 ----a-w- C:\Users\Wendy\AppData\Local\Microsoft\Windows\INetCache\IE\3NP4INAX\setup.exe 2014-10-17 14:05:41 32CBECF1C0B588EF3AB1C700F5BD7C8D 991232 ----a-w- C:\oude laptop\Pirate-1005.exe 2014-10-17 14:05:40 684F591A367954D74E6A729715E62904 2002320 ----a-w- C:\oude laptop\HousecallLauncher.exe 2014-10-17 14:05:38 563BF35AF0004597B725AE550F0365D8 900384 ----a-w- C:\oude laptop\chromeinstall.exe 2014-10-17 14:05:38 563BF35AF0004597B725AE550F0365D8 900384 ----a-w- C:\oude laptop\chromeinstall (1).exe 2014-10-17 14:05:26 32CBECF1C0B588EF3AB1C700F5BD7C8D 991232 ----a-w- C:\oude laptop\Downloads\Pirate-1005.exe 2014-10-17 14:05:25 684F591A367954D74E6A729715E62904 2002320 ----a-w- C:\oude laptop\Downloads\HousecallLauncher.exe 2014-10-17 14:05:24 563BF35AF0004597B725AE550F0365D8 900384 ----a-w- C:\oude laptop\Downloads\chromeinstall.exe 2014-10-17 14:05:23 563BF35AF0004597B725AE550F0365D8 900384 ----a-w- C:\oude laptop\Downloads\chromeinstall (1).exe 2014-10-17 14:05:10 C88DC3D751D61E437698C72029DC579C 20488704 ----a-w- C:\oude laptop\Desktop\IKEA_Home_Planner_FY10.exe 2014-10-17 12:37:29 4AAA1E82E6CAF44408F03A0B015445CD 278152 ------w- C:\Windows\System32\MpSigStub.exe 2014-10-17 11:57:31 DD3A4BEBE7EA3E75F71F3D9E9E2AA016 3798528 ----a-w- C:\Windows\AutoKMS\AutoKMS.exe 2014-10-17 11:28:25 B9C125314A025127FE562C116D614AA3 178824 ----a-r- C:\Users\Wendy\AppData\Local\Temp\ose00000.exe 2014-10-17 11:22:18 62F4D70DAF8A8C4B3F9C88D2DFAEEBA0 41448 ----a-w- C:\Program Files (x86)\PowerISO\uninstall.exe 2014-10-17 11:21:52 8FAB0A499A6A2EC348936340D0862786 2838528 ----a-w- C:\Users\Wendy\AppData\Local\Temp\ir_ext_temp_0\autorun.exe 2014-10-17 11:21:51 A38F725A0367F27E37BF2D01193FD8C7 1627352 ----a-w- C:\Users\Wendy\AppData\Local\Temp\ir_ext_temp_0\AutoPlay\Docs\PowerISO47.exe 2014-10-17 10:58:13 B66E0842FCF485F3E2D41BF0BA10966F 1514040 ----a-w- C:\Users\Wendy\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe 2014-10-17 10:58:13 45CB9401FCC23DE9C9306B0F275D56AE 613944 ----a-w- C:\Users\Wendy\AppData\Roaming\Spotify\Data\SpotifyHelper.exe 2014-10-17 10:58:13 2E8A5736739C6D23F5CBAE22973A1E3A 6553144 ----a-w- C:\Users\Wendy\AppData\Roaming\Spotify\spotify.exe 2014-10-17 10:58:13 25CDBD3A6A3834A7AE69EEC7C69773E8 61496 ----a-w- C:\Users\Wendy\AppData\Roaming\Spotify\SpotifyLauncher.exe === C: other files == 2014-10-17 17:51:24 AD1AEBF955ECF4B1CB4713DB729E5B5B 8720 ----a-w- C:\Users\Wendy\AppData\Local\Temp\pcdc-feedback.zip 2014-10-17 14:45:04 2E49C3213D447FD840D407BC6E69883F 17709869 ----a-w- C:\Users\Wendy\AppData\Local\Microsoft\Windows\INetCache\IE\9JZD9RYP\wlesslan-20140926081743.zip 2014-10-17 14:05:41 B71DE1386B82767AE21AB3C2FB9D5C2A 81392 ----a-w- C:\oude laptop\technically_but_not_actually.zip 2014-10-17 14:05:40 81659D1D2D49D5AF2A790637E59E71D9 50211 ----a-w- C:\oude laptop\john-k-barrow_peanuts.zip 2014-10-17 14:05:37 B395790637F7214432CC7BBCA790A9C8 594775 ----a-w- C:\oude laptop\candy_inc.zip 2014-10-17 14:05:26 B71DE1386B82767AE21AB3C2FB9D5C2A 81392 ----a-w- C:\oude laptop\Downloads\technically_but_not_actually.zip 2014-10-17 14:05:25 81659D1D2D49D5AF2A790637E59E71D9 50211 ----a-w- C:\oude laptop\Downloads\john-k-barrow_peanuts.zip 2014-10-17 14:05:20 B395790637F7214432CC7BBCA790A9C8 594775 ----a-w- C:\oude laptop\Downloads\candy_inc.zip 2014-10-17 11:22:08 6CE6F98EA3D07A9C2CE3CD0A5A86352D 91568 ----a-w- C:\Windows\System32\drivers\scdemu.sys 2014-10-17 10:58:13 A3A143ED4E572EB09B8CC63980E87119 12164996 ----a-w- C:\Users\Wendy\AppData\Roaming\Spotify\Data\apps.zip 2014-10-17 10:58:13 17EC931C831BB7386038C7BA40649F65 3238753 ----a-w- C:\Users\Wendy\AppData\Roaming\Spotify\Data\resources.zip ==== Startup Registry Enabled ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TSVU"="c:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TosSmartViewLauncher.exe" "PWRISOVM.EXE"="C:\Program Files (x86)\PowerISO\PWRISOVM.EXE" "Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s" "TecoResident"="C:\Program Files\TOSHIBA\Teco\TecoResident.exe" "TSSSrv"="C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe" "TCrdMain"="C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe" "TosWaitSrv"="%ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe " ==== Other Scheduled Tasks ====================== "C:\Windows\SysNative\tasks\AutoKMS" [C:\Windows\AutoKMS\AutoKMS.exe] "C:\Windows\SysNative\tasks\Synaptics TouchPad Enhancements" ["C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"] "C:\Windows\SysNative\tasks\TOSHIBA\CommonNotifier" [C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe] "C:\Windows\SysNative\tasks\TOSHIBA\Service Station" ["C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe"] ==== C:\zoek_backup content ====================== C:\zoek_backup (files=30 folders=9 20519371 bytes) ==== EOF on za 18/10/2014 at 8:28:03,64 ======================