Zoek.exe v5.0.0.0 Updated 24-February-2015 Tool run by HP on wo 25-02-2015 at 8:18:29.88. Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86 Running in: Normal Mode Internet Access Detected Launched: C:\Users\HP\Downloads\zoek.exe [Scan all users] [Script inserted] [Checkboxes used] ==== Older Logs ====================== C:\zoek-results2015-02-24-215724.log 22036 bytes ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\3f17c95f deleted successfully HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\3f17c95f deleted successfully ==== FireFox Fix ====================== ProfilePath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\neeq75e9.default-1416383897378 user.js not found ---- Lines ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129 removed from prefs.js ---- user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.InstallationThankYouPage", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.InstallationTime", 1419165983); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.active", true); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.addressbar", "NA"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.addressbarenhanced", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.asyncdb.was_copied", "true"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.asyncinternaldb.was_copied", "true"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.backgroundver", 1); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.certdomaininstaller", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.changeprevious", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.InstallationTime.value", "%221419165983%22"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:00: user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.InstallerParams.value", "%7B%22source_id%22%3A%22001 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.uc.expiration", "Sun Jan 04 2015 14:26:17 GMT+0100 ( user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.cookie.uc.value", "%22%5C%22BE%5C%22%22"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.description", "Ge-Force"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.domain", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.e2b0dff561784e3db84ed9e@2815a71a2f5d474691ed6bbee47c02.coma user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.enablesearch", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.homepage", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.iframe", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 20 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerIdentifiers.value", "%7B%22installer_bi user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerParams.expiration", "Fri Feb 01 2030 00 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerParams.value", "%7B%22source_id%22%3A%2 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerParamsCache.expiration", "Fri Feb 01 20 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerParamsCache.value", "%7B%22source_id%22 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerUserIdentifiersCache.expiration", "Fri user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.InstallerUserIdentifiersCache.value", "%7B%22ins user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 0 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_appVer.value", "8"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_lastVersion.value", "1"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00: user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_nextCheck.expiration", "Tue Dec 23 201 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_nextCheck.value", "true"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_queue.value", "%7B%7D"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_remote_resources.expiration", "Fri Feb user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_remote_resources.value", "%7B%22remote user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948852.expiration", "Sat Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948853.expiration", "Mon Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948854.expiration", "Mon Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948855.expiration", "Sat Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948856.expiration", "Mon Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948857.expiration", "Sat Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948857.value", "%22//Javascri user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948858.expiration", "Mon Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948859.expiration", "Mon Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948860.expiration", "Sat Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.Resources_resource_948861.expiration", "Mon Mar user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.__defualt_browser__.expiration", "Fri Feb 01 203 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.__defualt_browser__.value", "%22ff%22"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.installer.expiration", "Fri Feb 01 2030 00:00:00 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.installer.value", "%7B%22InstallerIdentifiers%22 user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_bundledUrls.expiration", "Fr user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_bundledWithHash.expiration", user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_bundledWithHash.value", "nul user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_notBundledArr_.expiration", user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_notBundledArr_.value", "%5B% user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_regBundledWithSoftware.expir user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.internaldb.monetization_plugin_regBundledWithSoftware.value user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.lastDailyReport", "1419335530689"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.lastUpdate", "1419335554059"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.manifesturl", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.name", "Ge-Force"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.newtab", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.opensearch", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.pluginsurl", "http://js.newstaticinputserv.com/plugin/apps/ user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.pluginsversion", 4); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.publisher", "iWebar"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.searchstatus", 0); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.setnewtab", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.thankyou", ""); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.updateinterval", 360); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.69129.ver", 8); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.apps", "69129"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.bic", "14a6cefcd5068d4d63eab1f498ce38be"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.cid", 69129); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.firstrun", false); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.hadappinstalled", true); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.installationdate", 1419166863); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.modetype", "production"); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.reportInstall", true); user_pref("extensions.ae2b0dff561784e3db84ed9e2815a71a2f5d474691ed6bbee47c02com69129.statsDailyCounter", 5); ---- Lines finder removed from prefs.js ---- user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"private ---- Lines extensions.0hYOTiiDC8Xd6x5G removed from prefs.js ---- user_pref("extensions.0hYOTiiDC8Xd6x5G.epoch", "1419421910"); ---- Lines extensions.SQFkppDNWEH2pYB4 removed from prefs.js ---- user_pref("extensions.SQFkppDNWEH2pYB4.epoch", "1419421909"); user_pref("extensions.SQFkppDNWEH2pYB4.url", "http://veterants.net/sync2/?q=hfZ9ofV9CShEAen0rHC6tMqLDe49CNU0nUkMCMlNhd9FqdwGrTwFrTs5rTkMBzqUojw9rjsGrj ---- FireFox user.js and prefs.js backups ---- prefs_25-02-2015_0904_.backup ProfilePath: C:\Users\HP\AppData\Roaming\Thunderbird\Profiles\xlp493qy.default user.js not found ---- FireFox user.js and prefs.js backups ---- prefs_25-02-2015_0904_.backup ==== Deleting Files \ Folders ====================== "C:\Users\HP\AppData\Roaming\FRVOIK.exe " not found "C:\Users\HP\AppData\Roaming\WF.exe" not found C:\98ccf8a200c9dfe87a deleted C:\5d28617de8f70cedca4b81ac14b5 deleted C:\Program Files\Common Files\System\SysMenu.dll deleted C:\PROGRA~2\Package Cache deleted C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted C:\Windows\system32\tasks\Microsoft\Windows\Maintenance\SMupdate2 deleted C:\Windows\system32\tasks\Microsoft\Windows\Multimedia\SMupdate3 deleted C:\Windows\system32\config\systemprofile\Searches deleted C:\Windows\system32\GroupPolicy\Machine deleted C:\Windows\system32\GroupPolicy\User deleted C:\Windows\system32\GroupPolicy\gpt.ini deleted C:\Windows\System32\REN1F6E.tmp deleted C:\Windows\System32\REN1F6F.tmp deleted C:\Windows\System32\REN7A45.tmp deleted C:\Windows\System32\REN7A55.tmp deleted C:\Windows\System32\RENA427.tmp deleted C:\Windows\System32\RENA437.tmp deleted C:\Windows\System32\RENACC9.tmp deleted C:\Windows\System32\RENACDA.tmp deleted C:\Users\HP\Documents\Add-in Express deleted C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\neeq75e9.default-1416383897378\jetpack deleted "C:\Windows\tasks\FRVOIK.job" deleted "C:\Windows\tasks\WF.job" deleted "C:\Users\HP\AppData\Roaming\FRVOIK" deleted "C:\Windows\tasks\FRVOIK.job" deleted "C:\Windows\system32\tasks\FRVOIK" deleted "C:\Users\HP\AppData\Roaming\WF" deleted "C:\Windows\tasks\WF.job" deleted "C:\Windows\system32\tasks\WF" deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== C:\Users\HP\AppData\Local\Temp ==== ====== Java Cache ===== ====== C:\Windows\system32 ===== 2015-02-19 07:05:26 01BD2653F2185218837CF4A175617F8A 620032 ----a-w- C:\Windows\System32\jscript9diag.dll 2015-02-19 07:05:25 4FD3763F3917201856B0CBCE310003EA 4300800 ----a-w- C:\Windows\System32\jscript9.dll 2015-02-18 12:43:44 793F6658ED65839FDB2957A4884CB63C 1230336 ----a-w- C:\Windows\System32\WindowsCodecs.dll 2015-02-18 12:35:51 A580CFFC56EE72550B803AED2EFD5442 27136 ----a-w- C:\Windows\System32\powertracker.dll 2015-02-18 12:35:50 DDE994E9159497D0D5AB2CDF66D1EAD6 76800 ----a-w- C:\Windows\System32\wdi.dll 2015-02-18 12:35:50 1115D5A98043254A0E787F888FC273C0 635904 ----a-w- C:\Windows\System32\perftrack.dll 2015-02-18 12:35:46 15E13FB1C22A47A128965287194D1906 2380288 ----a-w- C:\Windows\System32\win32k.sys 2015-02-18 12:35:37 F2A743912D404A8866362836CFE7A648 686080 ----a-w- C:\Windows\System32\adtschema.dll 2015-02-18 12:35:37 4775E1A0E15BF148098C35A19135F881 1061376 ----a-w- C:\Windows\System32\lsasrv.dll 2015-02-18 12:35:35 F29BC66CE4A5507A49FB20744A056E61 22016 ----a-w- C:\Windows\System32\secur32.dll 2015-02-18 12:35:35 CEFE50761B7681715C66AE3488363985 100352 ----a-w- C:\Windows\System32\sspicli.dll 2015-02-18 12:35:35 BF08DE8E4FA1F143D41B3241F7FCE5F6 22528 ----a-w- C:\Windows\System32\lsass.exe 2015-02-18 12:35:35 ACF312F6CCFC9249F739BF439DD4B80C 15872 ----a-w- C:\Windows\System32\sspisrv.dll 2015-02-18 12:35:35 4E6934926B4C923CC0FF61C6D77814EF 50176 ----a-w- C:\Windows\System32\auditpol.exe 2015-02-18 12:35:35 43791D2F736C4E9BE9FE0B33A1E92A5D 60416 ----a-w- C:\Windows\System32\msobjs.dll 2015-02-18 12:35:35 36F152AE2F64B12771A44EA77124332B 146432 ----a-w- C:\Windows\System32\msaudite.dll 2015-02-18 12:33:14 6D227897A458DA8A9518DACDC88F1947 3917760 ----a-w- C:\Windows\System32\ntoskrnl.exe 2015-02-18 12:33:14 62C93E47A424A8EC79F3CF1719A2DCC6 3972544 ----a-w- C:\Windows\System32\ntkrnlpa.exe 2015-02-18 12:31:28 A208DAC2932649CFF82A6A684D8BB1F6 571904 ----a-w- C:\Windows\System32\oleaut32.dll 2015-02-18 12:31:21 EEA1C649DBE9628150207BC563DA77F2 482304 ----a-w- C:\Windows\System32\generaltel.dll 2015-02-18 12:31:21 76293EF1A6BFCCBD901107E514E48624 886784 ----a-w- C:\Windows\System32\aeinv.dll 2015-02-18 12:31:21 48D5B4FC2235E069A444C105B65D40BD 767488 ----a-w- C:\Windows\System32\appraiser.dll 2015-02-18 12:31:20 1C562DF669A412EF40A9871C8856AEE4 621056 ----a-w- C:\Windows\System32\invagent.dll 2015-02-18 12:31:20 048FD5432E4C2B42EE39FD9F54ED162F 325632 ----a-w- C:\Windows\System32\devinv.dll 2015-02-18 12:31:19 F57E1D225AE5C2C8F475A99BFDF018F4 1167520 ----a-w- C:\Windows\System32\aitstatic.exe 2015-02-18 12:31:16 EE0759179FC7EB0012AF1A69C8AAE185 202752 ----a-w- C:\Windows\System32\aepdu.dll 2015-02-18 12:31:15 0389CAF21A50D13A90D2699750D499B5 159744 ----a-w- C:\Windows\System32\aepic.dll 2015-02-18 12:30:56 B63A6FF4339C9B701A93D3973C7FB6D2 550912 ----a-w- C:\Windows\System32\kerberos.dll 2015-02-18 12:30:56 7C893DBA0A58855A99DA68B751FD223B 248832 ----a-w- C:\Windows\System32\schannel.dll 2015-02-18 12:30:55 7D94A9161E8432B8521E60E064B1D737 259584 ----a-w- C:\Windows\System32\msv1_0.dll 2015-02-18 12:30:54 F3F6BE20A03215209B61CA85B4A83E1F 65536 ----a-w- C:\Windows\System32\TSpkg.dll 2015-02-18 12:30:54 3BB446DE24501FEA5FDB9A9DB23A22AE 221184 ----a-w- C:\Windows\System32\ncrypt.dll 2015-02-18 12:30:53 A12D64A94EC57079C2D96A741CB4FF53 172032 ----a-w- C:\Windows\System32\wdigest.dll 2015-02-18 12:30:50 C256EFD3655EC782F8094E96094E8F9E 17408 ----a-w- C:\Windows\System32\credssp.dll 2015-02-18 12:29:50 94B1F7CE1AAA5542923E0AD63C4D0050 60416 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll 2015-02-18 12:29:49 B0F7BD3492C2D60A70F15AEADCE1E2A6 47616 ----a-w- C:\Windows\System32\ieetwproxystub.dll 2015-02-18 12:29:49 71189E2787179666BDCD1374AE92BF62 102912 ----a-w- C:\Windows\System32\ieetwcollector.exe 2015-02-18 12:29:47 E1A4D24281526DDFEA418F729CDA9DC6 30720 ----a-w- C:\Windows\System32\iernonce.dll 2015-02-18 12:29:47 73AFBF165241EB4502CD15107AA12CBA 684544 ----a-w- C:\Windows\System32\ie4uinit.exe 2015-02-18 12:29:46 C4F2424A0671907FD3AC44EBE43C3C66 667648 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe 2015-02-18 12:29:45 8E8137569741D3693F88DDF94CC38C20 1307136 ----a-w- C:\Windows\System32\urlmon.dll 2015-02-18 12:29:45 74EA6C792F57E453261DA210C1BCEB53 342712 ----a-w- C:\Windows\System32\iedkcs32.dll 2015-02-18 12:29:45 55A84600EAAF8F1D3F0E6206E2EF6D48 47104 ----a-w- C:\Windows\System32\jsproxy.dll 2015-02-18 12:29:44 28B2D3CB1B4306D476200D80AF7D87AD 115712 ----a-w- C:\Windows\System32\ieUnatt.exe 2015-02-18 12:29:43 FD6AF61AF029B9BC2CF4EFF57CDD5821 710144 ----a-w- C:\Windows\System32\ieapfltr.dll 2015-02-18 12:29:43 EF05E63ACC834470A07A2E73D519B5FA 418304 ----a-w- C:\Windows\System32\dxtmsft.dll 2015-02-18 12:29:42 8FBC9680719ACDA9351B67D906C682F4 688640 ----a-w- C:\Windows\System32\msfeeds.dll 2015-02-18 12:29:42 47B26D89EF9973E2DD586D0C827F61A9 2724864 ----a-w- C:\Windows\System32\mshtml.tlb 2015-02-18 12:29:39 AD3F5926EC2C1F21FB45D1CDED6E2A47 2052608 ----a-w- C:\Windows\System32\inetcpl.cpl 2015-02-18 12:29:39 6F10743069DFFC56DEE079204960844E 168960 ----a-w- C:\Windows\System32\msrating.dll 2015-02-18 12:29:38 5FB7E9786F70F4072663746072C9E6CE 62464 ----a-w- C:\Windows\System32\iesetup.dll 2015-02-18 12:29:37 44791AA90DF93DD79E63ED3A38657964 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll 2015-02-18 12:29:36 F285D499EC42969D963CA49EADA63218 1888256 ----a-w- C:\Windows\System32\wininet.dll 2015-02-18 12:29:33 6FA05244FD2E40A3DC08337146B3C425 285696 ----a-w- C:\Windows\System32\dxtrans.dll 2015-02-18 12:29:32 994E7459260D315573DD72783D1B78A7 478208 ----a-w- C:\Windows\System32\ieui.dll 2015-02-18 12:29:30 78A1A938D51D4F83A772123B93EE1612 12829184 ----a-w- C:\Windows\System32\ieframe.dll 2015-02-18 12:29:27 D87759889FE7BCAE4461439139E62BAA 76288 ----a-w- C:\Windows\System32\mshtmled.dll 2015-02-18 12:29:26 180168942E4A133C55E7BBF17DA3C142 1155072 ----a-w- C:\Windows\System32\mshtmlmedia.dll 2015-02-18 12:29:24 3B9EF1B8E154D202D32A7765E2F33554 64000 ----a-w- C:\Windows\System32\MshtmlDac.dll 2015-02-18 12:29:23 9A91F9B5035F54C2D0BA92CF9B16EE34 2277888 ----a-w- C:\Windows\System32\iertutil.dll 2015-02-18 12:29:17 61C74D794C14E9FC94D93F5F0F72A3F9 19740160 ----a-w- C:\Windows\System32\mshtml.dll 2015-02-18 12:29:13 9DEE691C8FDBC2DE6957F1AE873C78FC 503296 ----a-w- C:\Windows\System32\vbscript.dll 2015-02-18 12:28:10 0C96A745A76C7DD75C5503E86D968E49 1174528 ----a-w- C:\Windows\System32\crypt32.dll 2015-02-18 12:27:15 B3BC38B886CA53C92D52EF724A9F0D45 308224 ----a-w- C:\Windows\System32\scesrv.dll ====== C:\Windows\system32\drivers ===== 2015-02-18 12:35:37 F516F1167EFBBC5ABC90687C94497869 369968 ----a-w- C:\Windows\System32\drivers\cng.sys 2015-02-18 12:35:36 EF88BAC2B489D9C46F4E41ACF0219CD0 67520 ----a-w- C:\Windows\System32\drivers\ksecdd.sys 2015-02-18 12:35:36 49D70660EE8266988C1F99A0297A1430 136640 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys 2015-01-26 13:39:09 8E2E9CCD873ABF180F48BCAEEEBE347D 114904 ----a-w- C:\Windows\System32\drivers\6E9A7634.sys 2015-01-26 12:32:13 8E2E9CCD873ABF180F48BCAEEEBE347D 114904 ----a-w- C:\Windows\System32\drivers\70F642FD.sys ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== 2015-02-23 18:04:00 -------- d-----w- C:\Program Files\Speccy 2015-02-22 15:50:31 -------- d-----w- C:\Program Files\Mozilla Maintenance Service ======= C: ===== ====== C:\Users\HP\AppData\Roaming ====== 2015-02-11 11:19:04 85828A54D85BAE5256CE61FDA700D22E 108816 ----a-w- C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT 2015-01-27 09:53:17 -------- d-----w- C:\Users\HP\AppData\Local\Popcorn-Time 2015-01-27 09:53:02 -------- d-----w- C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Popcorn Time 2015-01-27 09:51:09 -------- d-----w- C:\Users\HP\AppData\Local\Popcorn Time ====== C:\Users\HP ====== 2015-02-24 16:20:14 8685FAF50C04F9A9C2F56FF64B0B7ACB 1107968 ----a-w- C:\Users\HP\Downloads\RSIT.exe 2015-02-23 18:04:09 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy 2015-02-23 18:00:28 6DC6EBDF9391271098C40F6BA7779430 4890736 ----a-w- C:\Users\HP\Downloads\spsetup126.exe 2015-02-22 17:13:04 729CDAB7188F18358F6610BEC517EF04 6958304 ----a-w- C:\Users\HP\Downloads\Silverlight.exe 2015-02-22 16:25:19 FC77986C2F2B9752EE344FACA1880BA2 2194432 ----a-w- C:\Users\HP\Desktop\AdwCleaner.exe 2015-02-22 15:44:06 1F4C7A565EF81D3666AD8FBDBAF48870 305664 ----a-w- C:\Users\HP\Downloads\Ninite Firefox Installer.exe 2015-02-22 14:52:10 E03031CF5CBC7442D044CAC999B83582 243600 ----a-w- C:\Users\HP\Downloads\Firefox Setup Stub 35.0.1.exe 2015-02-12 18:47:01 095CD2CE6EEE6663778E594C57C69EFA 564 ----a-w- C:\Users\HP\cline theo en vic.txt 2015-02-02 17:38:44 0556DF3CA5E6158AF5B4A251E8CAF081 372 ----a-w- C:\Users\HP\email.txt ====== C: exe-files == 2015-02-24 16:20:14 8685FAF50C04F9A9C2F56FF64B0B7ACB 1107968 ----a-w- C:\Users\HP\Downloads\RSIT.exe 2015-02-24 10:00:39 A0D35EC0B1954DC90EA0B5DD52587DA9 37745864 ----a-w- C:\ProgramData\Garmin\Core Update Service\APP-express-windows-3.2.29.0\GarminExpressInstaller.exe 2015-02-23 18:00:28 6DC6EBDF9391271098C40F6BA7779430 4890736 ----a-w- C:\Users\HP\Downloads\spsetup126.exe 2015-02-22 17:13:04 729CDAB7188F18358F6610BEC517EF04 6958304 ----a-w- C:\Users\HP\Downloads\Silverlight.exe 2015-02-22 16:25:19 FC77986C2F2B9752EE344FACA1880BA2 2194432 ----a-w- C:\Users\HP\Desktop\AdwCleaner.exe 2015-02-22 15:50:36 989AA1F2E39C89B5EE3C767465E83982 103588 ----a-w- C:\Program Files\Mozilla Maintenance Service\Uninstall.exe 2015-02-22 15:50:32 345477F02C308B7480702767218C86A2 114800 ----a-w- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe 2015-02-22 15:44:06 1F4C7A565EF81D3666AD8FBDBAF48870 305664 ----a-w- C:\Users\HP\Downloads\Ninite Firefox Installer.exe 2015-02-22 14:52:10 E03031CF5CBC7442D044CAC999B83582 243600 ----a-w- C:\Users\HP\Downloads\Firefox Setup Stub 35.0.1.exe 2015-02-21 19:10:58 F4CC03D0A936AD6780ADA614AE81B413 840272 ----a-w- C:\Program Files\Google\Update\Install\{6FDADE4D-2E44-4D01-9013-AD47C0DA9F50}\40.0.2214.115_40.0.2214.111_chrome_updater.exe 2015-02-21 19:10:55 F4CC03D0A936AD6780ADA614AE81B413 840272 ----a-w- C:\Program Files\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\40.0.2214.115\40.0.2214.115_40.0.2214.111_chrome_updater.exe 2015-02-18 19:05:18 10C915F39C291AF809CE76E9F2F2D659 41213008 ----a-w- C:\Program Files\Google\Update\Install\{DB89A955-5935-4960-AA2F-2E5815CFD77C}\40.0.2214.111_chrome_installer.exe 2015-02-18 19:02:42 76B791736DEA557FAF9866F04F126A84 52040 ----atw- C:\Program Files\Google\Update\1.3.26.7\GoogleUpdateOnDemand.exe 2015-02-18 19:02:42 09F694DB1BCE2ACFBA69A00C46AC1275 52040 ----atw- C:\Program Files\Google\Update\1.3.26.7\GoogleUpdateWebPlugin.exe 2015-02-18 19:02:41 13E01206C175097EAFAE5AAD0B623FBE 52040 ----atw- C:\Program Files\Google\Update\1.3.26.7\GoogleUpdateBroker.exe 2015-02-18 19:02:40 A7533E9BA0C213D12F86111D2E3317C9 879696 ----atw- C:\Program Files\Google\Update\1.3.26.7\GoogleUpdateSetup.exe 2015-02-18 19:02:38 BE99918C2211431C6424EFFD087FD9C7 107848 ----atw- C:\Program Files\Google\Update\GoogleUpdate.exe 2015-02-18 19:02:27 BFAAA35608A43D2A0751F60326062E20 287048 ----atw- C:\Program Files\Google\Update\1.3.26.7\GoogleCrashHandler64.exe 2015-02-18 19:02:27 BE99918C2211431C6424EFFD087FD9C7 107848 ----atw- C:\Program Files\Google\Update\1.3.26.7\GoogleUpdate.exe 2015-02-18 19:02:27 AA90470AFFB14D5F651530AC784E1DC6 232264 ----atw- C:\Program Files\Google\Update\1.3.26.7\GoogleCrashHandler.exe 2015-02-18 19:02:27 0685DA704ACDCB3BC41ADD89DBA9FA1E 115528 ----atw- C:\Program Files\Google\Update\1.3.26.7\GoogleUpdateComRegisterShell64.exe 2015-02-18 19:02:06 B8AA392D11793C4F17D85D35D23C0908 1414472 ----a-w- C:\Users\HP\AppData\Local\Google\Chrome\User Data\recovery\101.3.26.8\ChromeRecovery.exe 2015-02-18 12:29:45 D674809F9EC7D6A409F553C0DF91E825 221184 ----a-w- C:\Program Files\Internet Explorer\ielowutil.exe 2015-02-18 12:29:40 8111C559DAD3A40200AE916874E7E62A 468992 ----a-w- C:\Program Files\Internet Explorer\ieinstal.exe 2015-02-18 12:29:37 363BC25BACB34E9D40441968B1B3D5BE 815288 ----a-w- C:\Program Files\Internet Explorer\iexplore.exe === C: other files == 2015-02-24 11:23:53 500246913C3C504FD2A65589CE192A8B 70737134 ----a-w- C:\Users\HP\Downloads\openhdf-cloud-ibox-3-238-20150222_usb.zip 2015-02-24 11:15:53 7D7B014579DB7B90E0CD356EF9C18EEF 732089 ----a-w- C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\neeq75e9.default-1416383897378\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi 2015-02-24 10:58:30 C176BC33BFF9BB7EE0296FDA2E761267 245252 ----a-w- C:\Users\HP\Downloads\bootloader-cloud-ibox-3-751mhz-20140805.zip 2015-02-18 12:35:46 15E13FB1C22A47A128965287194D1906 2380288 ----a-w- C:\Windows\System32\win32k.sys 2015-02-18 12:35:37 F516F1167EFBBC5ABC90687C94497869 369968 ----a-w- C:\Windows\System32\drivers\cng.sys 2015-02-18 12:35:36 EF88BAC2B489D9C46F4E41ACF0219CD0 67520 ----a-w- C:\Windows\System32\drivers\ksecdd.sys 2015-02-18 12:35:36 49D70660EE8266988C1F99A0297A1430 136640 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys ==== Startup Registry Enabled ====================== [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "GarminExpressTrayApp"="C:\Program Files\Garmin\Express Tray\ExpressTray.exe" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-21-4057013218-24429279-960758687-1000\Software\Microsoft\Windows\CurrentVersion\Run] "GarminExpressTrayApp"="C:\Program Files\Garmin\Express Tray\ExpressTray.exe" "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner.exe /MONITOR" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run] "GarminExpressTrayApp"="C:\Program Files\Garmin\Express Tray\ExpressTray.exe" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="C:\Windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="C:\Windows\System32\SPReview\SPReview.exe /sp:1 /errorfwlink:http://go.microsoft.com/fwlink/?LinkID=122915 /build:7601" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Monitor"="C:\Windows\PixArt\PAC207\Monitor.exe" "MSC"="c:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "GarminExpressTrayApp"="C:\Program Files\Garmin\Express Tray\ExpressTray.exe" "CCleaner Monitoring"="C:\Program Files\CCleaner\CCleaner.exe /MONITOR" ==== Startup Registry Disabled ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe ARM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Adobe ARM" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\GarminExpressTrayApp] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GarminExpressTrayApp" "hkey"="HKCU" "command"="\"C:\\Program Files\\Garmin\\Express Tray\\ExpressTray.exe\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Skype] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Skype" "hkey"="HKCU" "command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /minimized /regrun" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SunJavaUpdateSched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe\"" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run-] "AS2014"="" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-] "Adobe ARM"="\"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\"" ==== Task Scheduler Jobs ====================== C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [18-02-2015 18:49] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [18-02-2015 20:02] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [18-02-2015 20:02] ==== Other Scheduled Tasks ====================== "C:\Windows\system32\tasks\Adobe Acrobat Update Task" [C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\Windows\system32\tasks\Adobe Flash Player Updater" [C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe] "C:\Windows\system32\tasks\Adobe-online actualiseringsprogramma" [C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe] "C:\Windows\system32\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"] "C:\Windows\system32\tasks\GarminUpdaterTask" [C:\Program Files\Garmin\Express Self Updater\ExpressSelfUpdater.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe] "C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe] ==== Firefox Start and Search pages ====================== ProfilePath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\neeq75e9.default-1416383897378 user_pref("browser.startup.homepage", "about:home"); ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "belgiumeid@eid.belgium.be"="C:\Program Files\Mozilla Firefox\extensions\belgiumeid@eid.belgium.be" [28-01-2015 09:13] ==== Firefox Extensions ====================== ProfilePath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\neeq75e9.default-1416383897378 - Undetermined - {DDC359D1-844A-42a7-9AA1-88A850A938A8} - Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi - DownThemAll - %ProfilePath%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi ProfilePath: C:\Users\HP\AppData\Roaming\Thunderbird\Profiles\xlp493qy.default - Instrument Test - %ProfilePath%\extensions\tbtestpilot@labs.mozilla.com.xpi AppDir: C:\Program Files\Mozilla Firefox - Belgium eID - %AppDir%\extensions\belgiumeid@eid.belgium.be - Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} - Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi ==== Firefox Plugins ====================== Profilepath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\neeq75e9.default-1416383897378 886C8C9F4779D6BFB4724FDBC32C3404 - C:\Program Files\Google\Update\1.3.26.7\npGoogleUpdate3.dll - Google Update C62322C77D1AAB77B1CF1130FCC3673A - C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll - Shockwave Flash 225D76851EFC6144B4BAD941B3E8989D - C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll - Java(TM) Platform SE 8 U31 B66B4D28D7D0C6322FF235C782CD6B76 - C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npdeployJava1.dll - Java Deployment Toolkit 8.0.310.13 0806948270D853B709CCBBF38AF167E4 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat 9DF0C4F0CEF60158614EDD1B3AB441EE - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat 9419AA8A2799526EC32B473C2BB7A10D - C:\Program Files\Google\Picasa3\npPicasa3.dll - Picasa 0CA4180B21C6B728578F3B0433BB740E - C:\Program Files\VideoLAN\VLC\npvlc.dll - VLC Web Plugin 893BF7D2261C56C24F813405D9D018E0 - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll - Silverlight Plug-In 5B92CB0A3EEE50F6B9AE036B4F9B0F0C - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll - Google Earth Plugin 8DA2ED6B04EA33F2EAE8BA883F903729 - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrlui.dll - Microsoft® Silverlight ==== Fake Chromium Profiles Check ====================== Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome deleted Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome SxS deleted Fake profile C:\Users\Administrator\AppData\Local\Comodo\Dragon deleted Fake profile C:\Users\Gast\AppData\Local\Google\Chrome deleted Fake profile C:\Users\Gast\AppData\Local\Google\Chrome SxS deleted Fake profile C:\Users\Gast\AppData\Local\Comodo\Dragon deleted Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome deleted Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS deleted Fake profile C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon deleted Fake profile C:\Users\HP\AppData\Local\Google\Chrome SxS deleted Fake profile C:\Users\HP\AppData\Local\Comodo\Dragon deleted Fake profile C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome deleted ==== Chromium Look ====================== Google Chrome Version: 40.0.2214.115 (Up to date, latest Stable version: 40.0.2214.115) HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[14-07-2014 17:22] Google Docs - HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake Google Drive - HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf YouTube - HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Skype Click to Call - HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl Google Wallet - HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda Gmail - HP\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia Ge-Force - HP\AppData\Roaming\Opera Software\Opera Stable\Extensions\mgfbpopbgcnocgpncdjlmifdbcdipbfa ==== Chromium Fix ====================== C:\Users\HP\AppData\Roaming\Opera Software\Opera Stable\Extensions\mgfbpopbgcnocgpncdjlmifdbcdipbfa deleted successfully C:\Users\HP\AppData\Roaming\Opera Software\Opera Stable\Local Storage\chrome-extension_mgfbpopbgcnocgpncdjlmifdbcdipbfa_0.localstorage deleted successfully C:\Users\HP\AppData\Roaming\Opera Software\Opera Stable\databases\chrome-extension_mgfbpopbgcnocgpncdjlmifdbcdipbfa_0 deleted successfully C:\Users\HP\AppData\Roaming\Opera Software\Opera Stable\Local Extension Settings\mgfbpopbgcnocgpncdjlmifdbcdipbfa deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.msn.com/?pc=MSSE" "Use Search Asst"="yes" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Search Page"="http://www.google.com" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl] "(Default)"="http://search.msn.com/results.asp?q=%s" "Default"="www.google.com" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl] "(Default)"="http://search.msn.com/results.asp?q=%s" "Default"="www.google.com" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs] "Tabs"="www.google.com" "newtab"="about:tabs" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.msn.com/?pc=MSSE" "Use Search Asst"="no" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl] "(Default)"="http://search.msn.com/results.asp?q=%s" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl] "(Default)"="http://search.msn.com/results.asp?q=%s" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs] "Tabs"="about:newtab" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" {012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\Software\Policies\Google deleted successfully HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\363FB0CBBA367FF4E81FEAD0F717B142 deleted successfully ==== Empty IE Cache ====================== C:\Users\HP\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\HP\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully ==== Empty FireFox Cache ====================== C:\Users\HP\AppData\Local\Mozilla\Firefox\Profiles\neeq75e9.default-1416383897378\cache2 emptied successfully ==== Empty Chrome Cache ====================== C:\Users\HP\AppData\Local\Opera Software\Opera Stable\Cache emptied successfully C:\Users\HP\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=132 folders=46 53746295 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\HP\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\HP\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted ==== EOF on wo 25-02-2015 at 9:49:29.96 ======================