conduit, search gol, babylon en andere lastige browser hijackers

houseofharriet · 19 januari 2014

Wie kan mij helpen?

Hoe verwijder ik conduit, search gol, babylon en andere lastige browser hijackers?

Ik probeer al een tijd Babylon, ask enz. weg te krijgen zonder succes.

kape · 19 januari 2014

Download RSIT van de onderstaande locaties en sla deze op het bureaublad op.

Hier staat een beschrijving hoe je kan kijken of je een 32- of 64-bitversie van Windows heeft.

RSIT 32 bit (RSIT.exe)
RSIT 64 bit (RSITx64.exe)

Dubbelklik op RSIT.exe om de tool te starten.

Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Vervolgens wordt de "Disclaimer of warranty" getoond, klik vervolgens op "Continue"
Wanneer de tool gereed is wordt er een kladblok bestand genaamd "Log" geopend.
Plaats de inhoud hiervan in het volgende bericht.

Bekijk ook de instructievideo.

houseofharriet · 19 januari 2014

Logfile of random's system information tool 1.09 (written by random/random)

Run by jet at 2014-01-19 13:52:38

Microsoft Windows 7 Home Premium Service Pack 1

System drive C: has 18 GB (30%) free of 60 GB

Total RAM: 3574 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 13:52:43, on 19-1-2014

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.16428)

Boot mode: Normal

Running processes:

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\system32\Dwm.exe

C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe

C:\Windows\system32\taskhost.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Real\RealPlayer\Update\realsched.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Windows Live\Mail\wlmail.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Mozilla Firefox\firefox.exe

c:\program files\real\realplayer\RealPlay.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe

D:\Users\jet\Downloads\RSIT(3).exe

C:\Windows\system32\DllHost.exe

C:\Program Files\trend micro\jet.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN NL: Hotmail, Outlook, Skype, het laatste nieuws, entertainment en meer!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"

O4 - HKLM\..\Run: [snpstd] C:\Windows\vsnpstd.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\program files\real\realplayer\update\realsched.exe" -osboot

O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll

O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\OFFICE11\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (file missing)

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour-service (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: CrossLoop Service (CrossLoopService) - CrossLoop Inc - C:\Users\jet\AppData\Local\CrossLoop\CrossLoopService.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updateservice (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update-service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe

O23 - Service: TightVNC Server (tvnserver) - GlavSoft LLC. - C:\Users\jet\AppData\Local\CrossLoop\tvnserver.exe

--

End of file - 9617 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\5jisvizc.default

prefs.js - "browser.search.useDBForOrder" - true

prefs.js - "browser.startup.homepage" - "http://search.conduit.com/?ctid=CT3320133&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPA843E233-278A-47DF-8339-EDF9839E060C&SSPV="

"{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]

"Description"=Adobe® Flash® Player 11.9.900.170 Plugin

"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]

"Description"=iTunes Detector Plug-in

"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]

"Description"=

"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@canon.com/EPPEX]

"Description"=Canon Easy-PhotoPrint EX

"Path"=C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Google.com/GoogleEarthPlugin]

"Description"=Google Earth in your browser

"Path"=C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.45.2]

"Description"=Java™ Deployment Toolkit

"Path"=C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2]

"Description"=Oracle® Next Generation Java™ Plug-In

"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@mcafee.com/McAfeeMssPlugin]

"Description"=McAfee Mss Plugin

"Path"=C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]

"Description"=

"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]

"Description"=Ag Player Plugin

"Path"=C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308]

"Description"=WLPG Install MIME type

"Path"=C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53]

"Description"=RealPlayer LiveConnect-Enabled Plug-In

"Path"=c:\program files\real\realplayer\Netscape6\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53]

"Description"=RealJukebox Netscape Plugin

"Path"=c:\program files\real\realplayer\Netscape6\nprjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53]

"Description"=RealNetworks RealPlayer Chrome Background Extension Plug-In

"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53]

"Description"=RealPlayer HTML5VideoShim Plug-In

"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53]

"Description"=RealPlayer Download Plugin

"Path"=c:\program files\real\realplayer\Netscape6\nprpplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]

"Description"=Google Update

"Path"=C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]

"Description"=Google Update

"Path"=C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10]

"Description"=WebTablet Plugin API

"Path"=C:\Program Files\TabletPlugins\npwacom.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]

"Description"=Handles PDFs in-place in Firefox

"Path"=C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\

staged

C:\Program Files\Mozilla Firefox\plugins\

NPOFFICE.DLL

nppdf32.dll

nppdf32.NLD

C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\5jisvizc.default\searchplugins\

bingp.xml

conduit-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

Adobe PDF Reader Help bij koppelingen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2012-09-23 72336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E8A89AD-95D7-40EB-8D9D-083EF7066A01}]

MSS+ Identifier - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll [2013-09-06 95648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]

RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2012-05-18 425680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

Java Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-10-08 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]

Windows Live Messenger Companion Helper - C:\Program Files\Windows Live\Companion\companioncore.dll [2012-03-08 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-12-11 194128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-10-08 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2013-12-11 194128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]

"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]

"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]

"Adobe Photo Downloader"=C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe [2007-09-10 67488]

"snpstd"=C:\Windows\vsnpstd.exe [2005-10-11 339968]

"TkBellExe"=C:\program files\real\realplayer\update\realsched.exe [2012-05-18 296056]

"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2013-10-23 948440]

"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

"APSDaemon"=C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [2013-09-13 59720]

"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2013-11-02 152392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]

C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"ConsentPromptBehaviorAdmin"=5

"ConsentPromptBehaviorUser"=3

"EnableUIADesktopToggle"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]

"vidc.mrle"=msrle32.dll

"vidc.msvc"=msvidc32.dll

"msacm.imaadpcm"=imaadp32.acm

"msacm.msg711"=msg711.acm

"msacm.msgsm610"=msgsm32.acm

"msacm.msadpcm"=msadp32.acm

"midimapper"=midimap.dll

"wavemapper"=msacm32.drv

"VIDC.UYVY"=msyuv.dll

"VIDC.YUY2"=msyuv.dll

"VIDC.YVYU"=msyuv.dll

"VIDC.IYUV"=iyuv_32.dll

"vidc.i420"=iyuv_32.dll

"VIDC.YVU9"=tsbyuv.dll

"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

"vidc.cvid"=iccvid.dll

"wave"=wdmaud.drv

"midi"=wdmaud.drv

"mixer"=wdmaud.drv

"aux"=wdmaud.drv

"msacm.siren"=sirenacm.dll

"wave1"=wdmaud.drv

"midi1"=wdmaud.drv

"mixer1"=wdmaud.drv

"aux1"=wdmaud.drv

"wave2"=wdmaud.drv

"midi2"=wdmaud.drv

"mixer2"=wdmaud.drv

"aux2"=wdmaud.drv

"wave3"=wdmaud.drv

"midi3"=wdmaud.drv

"mixer3"=wdmaud.drv

"aux3"=wdmaud.drv

"MSVideo8"=VfWWDM32.dll

"wave4"=wdmaud.drv

"midi4"=wdmaud.drv

"mixer4"=wdmaud.drv

"aux4"=wdmaud.drv

"wave5"=wdmaud.drv

"midi5"=wdmaud.drv

"mixer5"=wdmaud.drv

"aux5"=wdmaud.drv

"wave6"=wdmaud.drv

"midi6"=wdmaud.drv

"mixer6"=wdmaud.drv

"aux6"=wdmaud.drv

"wave7"=wdmaud.drv

"midi7"=wdmaud.drv

"mixer7"=wdmaud.drv

"aux7"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-01-19 12:51:15 ----D---- C:\rsit

2014-01-18 10:21:37 ----D---- C:\ProgramData\McAfee Security Scan

2014-01-18 10:21:31 ----D---- C:\Program Files\McAfee Security Scan

2014-01-16 20:00:25 ----A---- C:\Windows\system32\win32k.sys

2014-01-16 20:00:24 ----A---- C:\Windows\system32\drivers\netio.sys

2014-01-16 20:00:23 ----A---- C:\Windows\system32\drivers\usbport.sys

2014-01-16 20:00:23 ----A---- C:\Windows\system32\drivers\usbhub.sys

2014-01-16 20:00:23 ----A---- C:\Windows\system32\drivers\usbehci.sys

2014-01-16 20:00:22 ----A---- C:\Windows\system32\drivers\usbuhci.sys

2014-01-16 20:00:22 ----A---- C:\Windows\system32\drivers\usbohci.sys

2014-01-16 20:00:22 ----A---- C:\Windows\system32\drivers\usbd.sys

2014-01-16 20:00:22 ----A---- C:\Windows\system32\drivers\usbccgp.sys

2014-01-07 15:39:21 ----D---- C:\Program Files\iPod

2014-01-07 15:39:20 ----D---- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-01-07 15:39:20 ----D---- C:\Program Files\iTunes

2014-01-03 12:06:34 ----D---- C:\Program Files\Mozilla Maintenance Service

2014-01-02 11:43:56 ----D---- C:\ProgramData\Tarma Installer

2013-12-25 11:50:52 ----D---- C:\Windows\Migration

======List of files/folders modified in the last 1 month======

2014-01-19 13:52:42 ----D---- C:\Windows\Temp

2014-01-19 13:52:42 ----D---- C:\Program Files\trend micro

2014-01-19 13:42:53 ----D---- C:\Windows\Prefetch

2014-01-19 12:42:19 ----D---- C:\Windows\system32\NDF

2014-01-19 10:53:43 ----D---- C:\Windows\System32

2014-01-19 10:53:43 ----D---- C:\Windows\inf

2014-01-19 10:53:43 ----A---- C:\Windows\system32\PerfStringBackup.INI

2014-01-19 10:47:31 ----SHD---- C:\Config.Msi

2014-01-19 07:54:21 ----D---- C:\Windows\system32\config

2014-01-18 10:21:41 ----SHD---- C:\System Volume Information

2014-01-18 10:21:37 ----HD---- C:\ProgramData

2014-01-18 10:21:31 ----RD---- C:\Program Files

2014-01-18 10:21:29 ----SHD---- C:\Windows\Installer

2014-01-18 10:21:09 ----D---- C:\ProgramData\Adobe

2014-01-18 10:21:08 ----D---- C:\Program Files\Common Files\Adobe

2014-01-18 10:21:07 ----D---- C:\Program Files\Adobe

2014-01-18 10:05:02 ----DC---- C:\Windows\system32\DRVSTORE

2014-01-18 10:05:02 ----D---- C:\Windows\system32\drivers

2014-01-17 07:54:19 ----D---- C:\Windows\winsxs

2014-01-17 03:19:10 ----D---- C:\Windows\system32\DriverStore

2014-01-17 03:03:27 ----A---- C:\Windows\win.ini

2014-01-17 03:02:50 ----D---- C:\Windows\system32\MRT

2014-01-17 03:00:54 ----A---- C:\Windows\system32\MRT.exe

2014-01-16 20:00:19 ----D---- C:\Windows\system32\catroot

2014-01-16 20:00:14 ----D---- C:\Windows\system32\catroot2

2014-01-07 15:39:20 ----D---- C:\Program Files\Common Files\Apple

2014-01-03 12:06:36 ----D---- C:\Program Files\Mozilla Firefox

2013-12-25 11:59:13 ----D---- C:\Windows\Microsoft.NET

2013-12-25 11:51:04 ----D---- C:\Windows\system32\en-US

2013-12-25 11:50:52 ----SD---- C:\ProgramData\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-09-27 214696]

R0 PenClass;Pen Class; C:\Windows\System32\Drivers\PenClass.sys [2001-04-09 8138]

R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2011-04-07 43528]

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]

R1 MpKsl93d30d99;MpKsl93d30d99; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3032291B-890B-40AD-B1FB-68C248C54526}\MpKsl93d30d99.sys [2014-01-19 40392]

R2 cpuz135;cpuz135; \??\C:\Windows\system32\drivers\cpuz135_x32.sys [2011-09-21 21992]

R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 104768]

R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]

R2 sbapifs;sbapifs; C:\Windows\system32\DRIVERS\sbapifs.sys [2012-01-12 77816]

R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller; C:\Windows\system32\DRIVERS\l160x86.sys [2009-10-13 49152]

R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]

R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\Windows\System32\Drivers\LUsbFilt.Sys [2008-02-29 28944]

R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]

R3 usbscan;Stuurprogramma voor USB-scanner; C:\Windows\system32\drivers\usbscan.sys [2013-07-03 36352]

R3 wacommousefilter;Wacom Mouse Filter Driver; C:\Windows\system32\DRIVERS\wacommousefilter.sys [2011-03-17 11312]

R3 wacomvhid;Wacom Virtual Hid Driver; C:\Windows\system32\DRIVERS\wacomvhid.sys [2011-03-17 14120]

S1 SBRE;SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys []

S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]

S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]

S3 AVFSFilter;AVFSFilter; C:\Windows\system32\DRIVERS\avfsfilter.sys []

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]

S3 esgiguard;esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys []

S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2012-03-08 39272]

S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]

S3 Revoflt;Revoflt; C:\Windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]

S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]

S3 snpstd;Trust Webcam 14823; C:\Windows\system32\DRIVERS\snpstd.sys [2006-05-03 390784]

S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]

S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]

S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]

S3 wacmoumonitor;Wacom Mode Helper; C:\Windows\system32\DRIVERS\wacmoumonitor.sys [2011-03-17 10752]

S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6; C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-10 124832]

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2013-09-07 55624]

R2 Bonjour Service;Bonjour-service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 390504]

R2 CrossLoopService;CrossLoop Service; C:\Users\jet\AppData\Local\CrossLoop\CrossLoopService.exe [2010-08-17 560848]

R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-10-23 22208]

R2 TabletServiceWacom;TabletServiceWacom; C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe [2011-06-06 5429624]

R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 1713536]

R3 iPod Service;iPod-service; C:\Program Files\iPod\bin\iPodService.exe [2013-11-02 553288]

R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-10-23 280288]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]

S2 gupdate;Google Updateservice (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-07 136176]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10 257416]

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2011-04-07 654848]

S3 fsssvc;Windows Live Family Safety Service; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2012-03-08 1492840]

S3 gupdatem;Google Update-service (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-04-07 136176]

S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2012-11-11 194032]

S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]

S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2013-11-26 108032]

S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [2013-09-06 235216]

S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2013-12-05 119408]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 tvnserver;TightVNC Server; C:\Users\jet\AppData\Local\CrossLoop\tvnserver.exe [2010-07-21 814080]

S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-03-26 1343400]

S4 aspnet_state;ASP.NET-statusservice; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]

S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

-----------------EOF-----------------

kape · 19 januari 2014

Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe (hier en hier) kan je lezen hoe je dat doet.

Download Zoek.exe naar het bureaublad (niet de .zip- of .rar-versie)

Wanneer Internet Explorer of een andere browser of virusscanner melding geeft dat dit bestand onveilig zou zijn kun je negeren, dit is namelijk een onterechte waarschuwing.
Dubbelklik op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.

  C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\5jisvizc.default\searchplugins\conduit-search.xml;f
 emptyfolderscheck;delete 
startupall; 
filesrcm;

Klik op de knop "Options" en vink nu de onderstaande opties aan.
Do a Quick Scan
Shortcut Fix
IE Defaults
Auto Clean
De optie "Scan All Users" staat standaard aangevinkt.
Klik nu op de knop "Run script".
Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
Mocht er geen logje verschijnen, start zoek.exe dan opnieuw en klik op de knop zoek-results.log, de log verschijnt dan alsnog.
Post het geopende logje in het volgende bericht.

houseofharriet · 19 januari 2014

Excuses Kape, Ik denk dat ik de vorige mail niet volledig heb verstuurd. Hier is de langere versie:

Zoek.exe v5.0.0.0 Updated 18-Januari-2014

Tool run by jet on zo 19-01-2014 at 14:49:21,39.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86

Running in: Normal Mode Internet Access Detected

Launched: D:\Users\jet\Downloads\zoek.exe [scan all users] [script inserted] [Checkboxes used]

===== Runcheck 14:51:27,36 =====

--- Create Environment Variables 14:51:27,84

--- Create System Restore Point 14:51:35,20

--- Checking Input 14:51:56,80

--- AU AppData Check 14:52:00,60

--- Remove From Windows Installer 14:52:06,52

--- Empty Folders Check 14:52:32,80

--- IE Startpage Check 14:52:50,47

--- Program Files DB Check 14:53:06,72

--- C:\Users\Default\AppData\Roaming DB Check 14:53:38,01

--- C:\Users\Default User\AppData\Roaming DB Check 14:53:38,01

--- C:\Users\jet\AppData\Roaming DB Check 14:53:38,01

--- C:\Windows\system32\config\systemprofile\AppData\Roaming DB Check 14:53:38,01

--- C:\Windows\serviceprofiles\networkservice\AppData\Roaming DB Check 14:53:38,01

--- C:\Windows\serviceprofiles\Localservice\AppData\Roaming DB Check 14:53:38,01

--- C:\Users\jet DB Check 14:54:44,89

--- C:\ProgramData DB Check 14:55:02,62

--- C:\Users\Default\AppData\Local DB Check 14:55:03,08

--- C:\Users\Default User\AppData\Local DB Check 14:55:03,08

--- C:\Users\jet\AppData\Local DB Check 14:55:03,08

--- C:\Windows\system32\config\systemprofile\AppData\Local DB Check 14:55:03,08

--- C:\Windows\serviceprofiles\networkservice\AppData\Local DB Check 14:55:03,08

--- C:\Windows\serviceprofiles\Localservice\AppData\Local DB Check 14:55:03,08

--- C:\ProgramData\Microsoft\Windows\Start Menu\Programs DB Check 14:55:49,83

--- C:\Users\jet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs DB Check 14:55:55,29

--- Tasks DB Check 14:55:58,34

--- Downloads DB Check 14:56:00,66

--- C:\Users\jet\AppData\LocalLow DB Check 14:56:04,01

--- C:\Windows\system32\config\systemprofile\AppData\LocalLow DB Check 14:56:04,01

--- C:\Windows\serviceprofiles\networkservice\AppData\LocalLow DB Check 14:56:04,01

--- C:\Windows\serviceprofiles\Localservice\AppData\LocalLow DB Check 14:56:04,01

--- Tasks2 DB Check 14:56:37,51

--- Documents DB Check 14:56:49,10

--- C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\5jisvizc.default DB Check 14:56:51,30

--- C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\9ncyt38c.default DB Check 14:56:51,30

--- C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\ki3bg865.default DB Check 14:56:51,30

--- C:\Users\Public\Desktop DB Check 14:56:57,63

--- C:\Users\jet\Desktop DB Check 14:56:59,24

--- Services DB Check 14:57:03,71

--- FF prefs.js DB Check 14:57:10,34

--- Del by CLSID 14:58:15,63

Zoek.exe v5.0.0.0 Updated 18-Januari-2014

Tool run by jet on zo 19-01-2014 at 14:49:21,39.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86

Running in: Normal Mode Internet Access Detected

Launched: D:\Users\jet\Downloads\zoek.exe [scan all users] [script inserted] [Checkboxes used]

===== Runcheck 14:51:27,36 =====

--- Create Environment Variables 14:51:27,84

--- Create System Restore Point 14:51:35,20

--- Checking Input 14:51:56,80

--- AU AppData Check 14:52:00,60

--- Remove From Windows Installer 14:52:06,52

--- Empty Folders Check 14:52:32,80

--- IE Startpage Check 14:52:50,47

--- Program Files DB Check 14:53:06,72

--- C:\Users\Default\AppData\Roaming DB Check 14:53:38,01

--- C:\Users\Default User\AppData\Roaming DB Check 14:53:38,01

--- C:\Users\jet\AppData\Roaming DB Check 14:53:38,01

--- C:\Windows\system32\config\systemprofile\AppData\Roaming DB Check 14:53:38,01

--- C:\Windows\serviceprofiles\networkservice\AppData\Roaming DB Check 14:53:38,01

--- C:\Windows\serviceprofiles\Localservice\AppData\Roaming DB Check 14:53:38,01

--- C:\Users\jet DB Check 14:54:44,89

--- C:\ProgramData DB Check 14:55:02,62

--- C:\Users\Default\AppData\Local DB Check 14:55:03,08

--- C:\Users\Default User\AppData\Local DB Check 14:55:03,08

--- C:\Users\jet\AppData\Local DB Check 14:55:03,08

--- C:\Windows\system32\config\systemprofile\AppData\Local DB Check 14:55:03,08

--- C:\Windows\serviceprofiles\networkservice\AppData\Local DB Check 14:55:03,08

--- C:\Windows\serviceprofiles\Localservice\AppData\Local DB Check 14:55:03,08

--- C:\ProgramData\Microsoft\Windows\Start Menu\Programs DB Check 14:55:49,83

--- C:\Users\jet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs DB Check 14:55:55,29

--- Tasks DB Check 14:55:58,34

--- Downloads DB Check 14:56:00,66

--- C:\Users\jet\AppData\LocalLow DB Check 14:56:04,01

--- C:\Windows\system32\config\systemprofile\AppData\LocalLow DB Check 14:56:04,01

--- C:\Windows\serviceprofiles\networkservice\AppData\LocalLow DB Check 14:56:04,01

--- C:\Windows\serviceprofiles\Localservice\AppData\LocalLow DB Check 14:56:04,01

--- Tasks2 DB Check 14:56:37,51

--- Documents DB Check 14:56:49,10

--- C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\5jisvizc.default DB Check 14:56:51,30

--- C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\9ncyt38c.default DB Check 14:56:51,30

--- C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\ki3bg865.default DB Check 14:56:51,30

--- C:\Users\Public\Desktop DB Check 14:56:57,63

--- C:\Users\jet\Desktop DB Check 14:56:59,24

--- Services DB Check 14:57:03,71

--- FF prefs.js DB Check 14:57:10,34

--- Del by CLSID 14:58:15,63

houseofharriet · 19 januari 2014

ogmaals excuus Kape, ik was te ongeduldig.Dit is de log na herstart:

Zoek.exe v5.0.0.0 Updated 18-Januari-2014

Tool run by jet on zo 19-01-2014 at 14:49:21,39.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x86

Running in: Normal Mode Internet Access Detected

Launched: D:\Users\jet\Downloads\zoek.exe [scan all users] [script inserted] [Checkboxes used]

==== System Restore Info ======================

19-1-2014 14:51:56 Zoek.exe System Restore Point Created Succesfully.

==== Empty Folders Check ======================

C:\ProgramData\AVAST Software deleted successfully

C:\ProgramData\CanonEPP deleted successfully

C:\ProgramData\CanonIJEPPEX2 deleted successfully

C:\ProgramData\Oracle deleted successfully

C:\Users\jet\AppData\Local\MigWiz deleted successfully

C:\Users\jet\AppData\Local\PDFCreator Uninstaller deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1969312171-3825827180-2787856495-1001\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} deleted successfully

HKEY_USERS\S-1-5-21-1969312171-3825827180-2787856495-1001\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\5jisvizc.default

---- Lines conduit removed from prefs.js ----

user_pref("browser.search.defaultenginename", "Conduit Search");

user_pref("browser.search.selectedEngine", "Conduit Search");

user_pref("browser.startup.homepage", "http://search.conduit.com/?ctid=CT3320133&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPA843E233-278A-4

---- FireFox user.js and prefs.js backups ----

user_02-10-2013_1009_.backup

user_02-10-2013_1536_.backup

user_19-01-2014_1459_.backup

prefs_02-10-2013_1009_.backup

prefs_02-10-2013_1536_.backup

prefs_19-01-2014_1459_.backup

ProfilePath: C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\9ncyt38c.default

---- FireFox user.js and prefs.js backups ----

user_02-10-2013_1009_.backup

user_02-10-2013_1536_.backup

user_19-01-2014_1459_.backup

prefs_02-10-2013_1009_.backup

prefs_02-10-2013_1536_.backup

prefs_19-01-2014_1459_.backup

ProfilePath: C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\ki3bg865.default

---- FireFox user.js and prefs.js backups ----

user_02-10-2013_1009_.backup

user_02-10-2013_1536_.backup

user_19-01-2014_1459_.backup

prefs_02-10-2013_1009_.backup

prefs_02-10-2013_1536_.backup

prefs_19-01-2014_1459_.backup

==== Deleting Files \ Folders ======================

C:\Users\jet\AppData\Roaming\GetRightToGo deleted

C:\ProgramData\APN deleted

C:\ProgramData\Tarma Installer deleted

C:\Users\jet\AppData\Local\avgchrome deleted

C:\Users\jet\AppData\LocalLow\dalesearch deleted

C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\5jisvizc.default\searchplugins\bingp.xml deleted

C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\5jisvizc.default\searchplugins\conduit-search.xml deleted

C:\Program Files\Mozilla Firefox\browser\searchplugins\Ask.xml deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\jet\AppData\Local\Temp ====

2014-01-18 08:48:36 9FB9D49C2DB7EDD1084AB765D619F5C6 66368 ----a-w- C:\Users\jet\AppData\Local\Temp\ins6395\searchprotect_2111-1a12a8ce.exe

====== Java Cache =====

====== C:\Windows\system32 =====

2014-01-16 19:00:25 1E882889A4314D6DF5DED4F6EC994E72 2349056 ----a-w- C:\Windows\System32\win32k.sys

====== C:\Windows\system32\drivers =====

2014-01-16 19:00:24 5DBD4F73E2A52FEED61DBAB3752E329C 240576 ----a-w- C:\Windows\System32\drivers\netio.sys

2014-01-16 19:00:23 EDF2DF71C4F1E13A6AC75F5224DE655A 258560 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2014-01-16 19:00:23 EC2C5AF37B76D7B58C642CB74423DB7A 284672 ----a-w- C:\Windows\System32\drivers\usbport.sys

2014-01-16 19:00:23 D40855F89B69305140BBD7E9A3BA2DA6 43520 ----a-w- C:\Windows\System32\drivers\usbehci.sys

2014-01-16 19:00:22 9828C8D14CC2676421778F0DE638CF97 20480 ----a-w- C:\Windows\System32\drivers\usbohci.sys

2014-01-16 19:00:22 800AABFD625EEFF899F7E5496BDE37AB 24064 ----a-w- C:\Windows\System32\drivers\usbuhci.sys

2014-01-16 19:00:22 74F805AB12EB0E3E49E469F19FF02640 6016 ----a-w- C:\Windows\System32\drivers\usbd.sys

2014-01-16 19:00:22 0803FBA9FE829D61AE26EC0BCC910C46 76288 ----a-w- C:\Windows\System32\drivers\usbccgp.sys

====== C:\Windows\Tasks ======

====== C:\Windows\Temp ======

======= C:\Program Files =====

2014-01-07 14:39:21 -------- d-----w- C:\Program Files\iPod

2014-01-07 14:39:20 -------- d-----w- C:\Program Files\iTunes

2014-01-03 11:06:34 -------- d-----w- C:\Program Files\Mozilla Maintenance Service

======= C: =====

====== C:\Users\jet\AppData\Roaming ======

====== C:\Users\jet ======

2014-01-18 09:05:03 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-01-07 14:39:20 -------- d-----w- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1

====== C: exe-files ==

2014-01-18 09:54:31 70D09276FE2AAA808813399245A2F493 1542696 ----a-w- C:\Windows\Temp\contentDATs.exe

2014-01-18 08:48:36 9FB9D49C2DB7EDD1084AB765D619F5C6 66368 ----a-w- C:\Users\jet\AppData\Local\Temp\ins6395\searchprotect_2111-1a12a8ce.exe

2014-01-17 07:53:07 6B11E9E8B6C4DDC773875D508A685253 904872 ----a-w- C:\Program Files\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\32.0.1700.76\32.0.1700.76_32.0.1700.72_chrome_updater.exe

=== C: other files ==

2014-01-16 19:00:25 1E882889A4314D6DF5DED4F6EC994E72 2349056 ----a-w- C:\Windows\System32\win32k.sys

2014-01-16 19:00:24 5DBD4F73E2A52FEED61DBAB3752E329C 240576 ----a-w- C:\Windows\System32\drivers\netio.sys

2014-01-16 19:00:23 EDF2DF71C4F1E13A6AC75F5224DE655A 258560 ----a-w- C:\Windows\System32\DriverStore\FileRepository\usbport.inf_x86_neutral_d53c05ca022d95f2\usbhub.sys

2014-01-16 19:00:23 EDF2DF71C4F1E13A6AC75F5224DE655A 258560 ----a-w- C:\Windows\System32\DriverStore\FileRepository\usb.inf_x86_neutral_4232097e28daf017\usbhub.sys

2014-01-16 19:00:23 EDF2DF71C4F1E13A6AC75F5224DE655A 258560 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2014-01-16 19:00:23 EC2C5AF37B76D7B58C642CB74423DB7A 284672 ----a-w- C:\Windows\System32\DriverStore\FileRepository\usbport.inf_x86_neutral_d53c05ca022d95f2\usbport.sys

2014-01-16 19:00:23 EC2C5AF37B76D7B58C642CB74423DB7A 284672 ----a-w- C:\Windows\System32\drivers\usbport.sys

2014-01-16 19:00:23 D40855F89B69305140BBD7E9A3BA2DA6 43520 ----a-w- C:\Windows\System32\DriverStore\FileRepository\usbport.inf_x86_neutral_d53c05ca022d95f2\usbehci.sys

2014-01-16 19:00:23 D40855F89B69305140BBD7E9A3BA2DA6 43520 ----a-w- C:\Windows\System32\drivers\usbehci.sys

2014-01-16 19:00:22 9828C8D14CC2676421778F0DE638CF97 20480 ----a-w- C:\Windows\System32\DriverStore\FileRepository\usbport.inf_x86_neutral_d53c05ca022d95f2\usbohci.sys

2014-01-16 19:00:22 9828C8D14CC2676421778F0DE638CF97 20480 ----a-w- C:\Windows\System32\drivers\usbohci.sys

2014-01-16 19:00:22 800AABFD625EEFF899F7E5496BDE37AB 24064 ----a-w- C:\Windows\System32\DriverStore\FileRepository\usbport.inf_x86_neutral_d53c05ca022d95f2\usbuhci.sys

2014-01-16 19:00:22 800AABFD625EEFF899F7E5496BDE37AB 24064 ----a-w- C:\Windows\System32\drivers\usbuhci.sys

2014-01-16 19:00:22 74F805AB12EB0E3E49E469F19FF02640 6016 ----a-w- C:\Windows\System32\DriverStore\FileRepository\usbport.inf_x86_neutral_d53c05ca022d95f2\usbd.sys

2014-01-16 19:00:22 74F805AB12EB0E3E49E469F19FF02640 6016 ----a-w- C:\Windows\System32\drivers\usbd.sys

2014-01-16 19:00:22 0803FBA9FE829D61AE26EC0BCC910C46 76288 ----a-w- C:\Windows\System32\DriverStore\FileRepository\usb.inf_x86_neutral_4232097e28daf017\usbccgp.sys

2014-01-16 19:00:22 0803FBA9FE829D61AE26EC0BCC910C46 76288 ----a-w- C:\Windows\System32\drivers\usbccgp.sys

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-1969312171-3825827180-2787856495-1001\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\Windows\system32\igfxtray.exe"

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"

"Persistence"="C:\Windows\system32\igfxpers.exe"

"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"

"snpstd"="C:\Windows\vsnpstd.exe"

"TkBellExe"="C:\program files\real\realplayer\update\realsched.exe -osboot"

"MSC"="C:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey"

"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun"

==== Startup Folders ======================

2014-01-18 09:21:34 2019 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [10-12-2013 20:01]

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [07-04-2011 18:03]

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files\Google\Update\GoogleUpdate.exe [07-04-2011 18:03]

==== Other Scheduled Tasks ======================

"C:\Windows\system32\tasks\0" [c:\program files\internet explorer\iexplore.exe]

"C:\Windows\system32\tasks\4504" [wscript.exe C:\Users\jet\AppData\Local\Temp\launchie.vbs //B]

"C:\Windows\system32\tasks\Adobe Flash Player Updater" [C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe]

"C:\Windows\system32\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"]

"C:\Windows\system32\tasks\CreateChoiceProcessTask" [C:\Windows\System32\browserchoice.exe]

"C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files\Google\Update\GoogleUpdate.exe]

"C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files\Google\Update\GoogleUpdate.exe]

"C:\Windows\system32\tasks\RealUpgradeLogonTaskS-1-5-21-1969312171-3825827180-2787856495-1001" [C:\Program Files\Real\RealUpgrade\RealUpgrade.exe]

"C:\Windows\system32\tasks\RealUpgradeScheduledTaskS-1-5-21-1969312171-3825827180-2787856495-1001" [C:\Program Files\Real\RealUpgrade\RealUpgrade.exe]

"C:\Windows\system32\tasks\User_Feed_Synchronization-{FDF9C0E8-4230-4A96-8CEC-42711C784E52}" [C:\Windows\system32\msfeedssync.exe]

"C:\Windows\system32\tasks\{009AFF52-C018-43FA-9AB8-5EECB3106D39}" [C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe]

"C:\Windows\system32\tasks\{0D678670-CC0F-4CD5-9399-B5F3855DADF8}" [C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe]

"C:\Windows\system32\tasks\{1CE29E35-921C-4E21-B90F-CFD6FA3E9C86}" [C:\program files\real\realplayer\realplay.exe]

"C:\Windows\system32\tasks\{42F1C6A5-39C2-44A5-9459-6B00BECA8499}" ["c:\program files\mozilla firefox\firefox.exe"]

"C:\Windows\system32\tasks\{499140BA-4A81-45D7-B0BB-86096A295080}" [C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe]

"C:\Windows\system32\tasks\{4C62E20C-D9AA-4B02-A121-253998BB1417}" ["c:\program files\mozilla firefox\firefox.exe"]

"C:\Windows\system32\tasks\{537C4E57-42FF-4C68-80A0-5DCCD1785808}" ["c:\program files\mozilla firefox\firefox.exe"]

"C:\Windows\system32\tasks\{5A96EFB1-7C1C-4935-AF5B-CBC986B06748}" ["c:\program files\mozilla firefox\firefox.exe"]

"C:\Windows\system32\tasks\{5EB7BFE1-C01C-4406-B58F-BA28376CA4E5}" ["c:\program files\mozilla firefox\firefox.exe"]

"C:\Windows\system32\tasks\{7A0B2DF3-980B-4EB1-A6C4-92E9B8D681E7}" ["c:\program files\mozilla firefox\firefox.exe"]

"C:\Windows\system32\tasks\{8438185F-F146-41D5-A72E-95402DD8C7C0}" ["c:\program files\mozilla firefox\firefox.exe"]

"C:\Windows\system32\tasks\{B5A37EAD-77B1-427B-BF98-F3510DFCDEBB}" ["c:\program files\mozilla firefox\firefox.exe"]

"C:\Windows\system32\tasks\{C983A798-0834-463B-A082-719AC96F2107}" ["c:\program files\mozilla firefox\firefox.exe"]

"C:\Windows\system32\tasks\{CB33E6EC-D949-4188-93C5-A62017C719E9}" [C:\Program Files\Skype\\Phone\Skype.exe]

"C:\Windows\system32\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files\Apple Software Update\SoftwareUpdate.exe]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]

"{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}"="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext" [02-10-2013 05:59]

==== Firefox Extensions ======================

ProfilePath: C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\9ncyt38c.default

- Flash Video Downloader Youtube Downloader - %ProfilePath%\extensions\artur.dubovoy@gmail.com.xpi

- Awesome screenshot: Capture and Annotate - %ProfilePath%\extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack.xpi

AppDir: C:\Program Files\Mozilla Firefox

- Undetermined - %AppDir%\extensions\staged

- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\5jisvizc.default

F891089A6AB9E12FEDEBCC5EC0F40D66 - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll - Shockwave Flash

C36444D7301A8C881FC7296B092609C7 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll - Google Update

6768C724599214E4F9ADD9F8FF5097EB - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll - Java Platform SE 7 U45

F1CD6E22E5AE5CEEB7712E546A5FC853 - C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll - Java Deployment Toolkit 7.0.450.18

5B92CB0A3EEE50F6B9AE036B4F9B0F0C - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll - Google Earth Plugin

9D4A0B314CB9CF134CA27E1E0217E51E - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll - iTunes Application Detector

BE501CBC29B2025A263D80D399F1797A - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll - Silverlight Plug-In

7EF7E4C1325D533F5186E7118ABB0E7C - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMSS.dll - McAfee Security Scanner +

21FF3F07336CE4F8DF6AF1746BC26AAB - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat

E0BCE90537E4A41AF36D5BDD5963A09D - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat

90492E00EE4C916123BEC5D267894E8C - c:\program files\real\realplayer\Netscape6\nprjplug.dll - RealJukebox NS Plugin

10737B44923217BC0E67D26A9FC1F0AA - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll - RealNetworks Chrome Background Extension Plug-In (32-bit)

2645990C521342DCD08963D2DF6CD0D2 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll - RealPlayer HTML5VideoShim Plug-In (32-bit)

4D96A92905BE968000B6470996E670A7 - c:\program files\real\realplayer\Netscape6\nppl3260.dll - RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit)

1291BEEBB50451C80BF7719612196508 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll - RealPlayer Download Plugin

C517E5EA7CEE783F3681F62D2A362E5B - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live? Photo Gallery

FADBAA4892BD10FDE52D8546AE03AE2B - C:\Program Files\TabletPlugins\npwacom.dll - Wacom Dynamic Link Library

CE252B04FB9F4F773A7DB5338BFEEA5B - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL - CANON iMAGE GATEWAY Album Plugin Utility

D27CE4EAF23411589A33E0C99D176311 - C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll - Adobe Acrobat

B27CCB1168B1960AEC6E9D3E0E0F0D2A - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrlui.dll - Microsoft® Silverlight

Profilepath: C:\Users\jet\AppData\Roaming\Mozilla\Firefox\Profiles\9ncyt38c.default