Scan with ZOEK
Please download
ZOEK by Smeenk and save it to your desktop (preferred version is the
*.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions
here.
- Right-click on
icon and select
Run as Administrator to start the tool.
- Wait patiently until the main console will appear, it may take a minute or two.
- In the main box please paste in the following script:
Code:
createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b
- Make sure that Scan All Users option is checked.
- Push Run Script and wait patiently. The scan may take a couple of minutes.
- When the scan completes, a zoek-results logfile should open in notepad.
- If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
Post its content into your next reply.
Zoek.exe v5.0.0.0 Updated 10-February-2015
Tool run by User on Tue 02/10/2015 at 11:32:07.85.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\User\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
2/10/2015 11:33:28 AM Zoek.exe System Restore Point Created Succesfully.
==== Empty Folders Check ======================
C:\Program Files\Acro Software deleted successfully
C:\Program Files\Nitro PDF deleted successfully
C:\PROGRA~2\Log deleted successfully
C:\Users\User\AppData\Local\CutePDF Writer deleted successfully
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== Batch Command(s) Run By Tool======================
==== Deleting Files \ Folders ======================
C:\Users\User\AppData\Local\genienext deleted
C:\Users\User\daemonprocess.txt deleted
C:\Users\User\.android deleted
C:\Program Files\File Type Assistant deleted
C:\Users\User\AppData\Roaming\newnext.me deleted
C:\Users\User\AppData\Roaming\Baidu deleted
C:\PROGRA~2\baidu deleted
C:\Users\User\AppData\Local\FileTypeAssistant deleted
C:\Users\User\AppData\Local\Mobogenie deleted
C:\Users\User\AppData\Local\cache deleted
C:\Windows\system32\config\systemprofile\AppData\Local\FileTypeAssistant deleted
C:\Users\User\AppData\LocalLow\IAC deleted
C:\Windows\system32\Tasks\LaunchSignup deleted
C:\Windows\system32\config\systemprofile\Searches deleted
C:\Windows\system32\GroupPolicy\Machine deleted
C:\Windows\system32\GroupPolicy\User deleted
C:\Windows\system32\GroupPolicy\gpt.ini deleted
C:\Windows\System32\SET20CC.tmp deleted
C:\Windows\System32\SET26D4.tmp deleted
C:\Windows\System32\SET2F5C.tmp deleted
C:\Windows\System32\SET3BA.tmp deleted
C:\Windows\System32\SET3EA8.tmp deleted
C:\Windows\System32\SET49BF.tmp deleted
C:\Windows\System32\SET4A5B.tmp deleted
C:\Windows\System32\SET5297.tmp deleted
C:\Windows\System32\SET56BB.tmp deleted
C:\Windows\System32\SET5861.tmp deleted
C:\Windows\System32\SET7D1F.tmp deleted
C:\Windows\System32\SET7D3D.tmp deleted
C:\Windows\System32\SET9E15.tmp deleted
C:\Windows\System32\SETA0A5.tmp deleted
C:\Windows\System32\SETA23A.tmp deleted
C:\Windows\System32\SETAC39.tmp deleted
C:\Windows\System32\SETB157.tmp deleted
C:\Windows\System32\SETB8E5.tmp deleted
C:\Windows\System32\SETBE81.tmp deleted
C:\Windows\System32\SETC361.tmp deleted
C:\Windows\System32\SETCFE.tmp deleted
C:\Windows\System32\SETD31E.tmp deleted
C:\Windows\System32\SETD6E3.tmp deleted
C:\Windows\System32\SETE552.tmp deleted
C:\Windows\System32\SETE66B.tmp deleted
C:\Windows\System32\SETF0AB.tmp deleted
C:\Windows\System32\SETF3F.tmp deleted
C:\Windows\System32\SETF8D2.tmp deleted
C:\Windows\System32\SETF930.tmp deleted
C:\Windows\System32\SETF99D.tmp deleted
C:\Windows\System32\SETFCB.tmp deleted
C:\Users\User\Documents\Mobogenie deleted
"C:\Users\User\AppData\Roaming\SPK\SPK.exe" deleted
"C:\Users\User\AppData\Roaming\miaul\RJFC.exe" deleted
"C:\Users\User\AppData\Roaming\SPK" deleted
"C:\Users\User\AppData\Roaming\miaul" deleted
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"
online_banking@kaspersky.com"="C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\FFExt\
online_banking@kaspersky.com" [02/04/2015 09:25 AM]
==== Chromium Look ======================
Google Chrome Version: 40.0.2214.111 (Possible outdated, latest Stable version: 40.0.2214.94)
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dchlnpcodkpfdpacogkljefecpegganj - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\ChromeExt\urladvisor.crx[12/02/2013 04:42 PM]
hakdifolhalapjijoafobooafbilfakh - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\ChromeExt\online_banking_chrome.crx[12/02/2013 04:42 PM]
hghkgaeecgjhjkannahfamoehjmkjail - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\ChromeExt\content_blocker_chrome.crx[12/02/2013 04:38 PM]
jagncdcchgajhfhijbbhecadmaiegcmh - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\ChromeExt\virtkbd.crx[12/02/2013 04:38 PM]
lpoimibckejjdjcfbdnajaicnklhfplh -
https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh[]
pjldcfjmnllhmgjclecdnfampinooman - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\ChromeExt\ab.crx[12/02/2013 04:42 PM]
Google Voice Search Hotword (Beta) - User\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
Sejda - PDF Split and Merge - User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhcknfplofcnpdjalbhnjognbpncojbi
==== Chromium Fix ======================
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_onlineservices.bupa.com.sa_0.localstorage deleted successfully
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_onlineservices.bupa.com.sa_0.localstorage-journal deleted successfully
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="
http://www.google.com"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="
http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="
http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"
==== shortcuts on Users Desktops ======================
C:\Users\Najd\Desktop\Documents.lnk - C:\Users\User\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
C:\Users\Najd\Desktop\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\User\Desktop\Amazon.lnk - C:\Program Files\Internet Explorer\iexplore.exe
http://go.mail.com/br/ie_desktop_amazon
C:\Users\User\Desktop\Documents.lnk - C:\Users\User\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
C:\Users\User\Desktop\Dropbox.lnk - C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe /home
C:\Users\User\Desktop\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\User\Desktop\mail.com.lnk - C:\Program Files\Internet Explorer\iexplore.exe
http://go.mail.com/br/ie_menu_home
C:\Users\User\Desktop\Safe Money.lnk - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\starter_avp.exe -hidden safebanking
==== shortcuts on All Users Desktop ======================
C:\Users\Public\Desktop\Adobe Reader XI.lnk - C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\Public\Desktop\HP LaserJet 100 color MFP M175 - مركز المساعدة والمعرفة.lnk -
C:\Users\Public\Desktop\HP LJ100 M175 Scan.lnk - C:\Program Files\HP\HP LJ100 M175\bin\HPScan.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files\iTunes\iTunes.exe
C:\Users\Public\Desktop\Kaspersky Small Office Security 3.lnk - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\starter_avp.exe
C:\Users\Public\Desktop\Payroll File Generator and Validation v.9.8.lnk - C:\Program Files\Payroll File Generator and Validation\PFGV_CORP\Payroll File Generator and Validation v.9.8.xls
C:\Users\Public\Desktop\Qawaem Program.lnk - C:\MCI iFile\MCI iFile\FilingInformation.exe
C:\Users\Public\Desktop\RealPlayer Cloud.lnk - C:\program files\real\realplayer\RealPlay.exe /launch:desktop
C:\Users\Public\Desktop\Skype.lnk - C:\Windows\Installer\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}\SkypeIcon.exe
C:\Users\Public\Desktop\SOCPACLIENT.lnk - C:\SOCPA\socpaclient.exe
C:\Users\Public\Desktop\µTorrent.lnk -
==== shortcuts in Users Start Menu ======================
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk - C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe /home
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Uninstall Dropbox.lnk - C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxUninstaller.exe
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qawaem Program\Qawaem Program.lnk - C:\MCI iFile\MCI iFile\FilingInformation.exe
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qawaem Program\Uninstall Qawaem Program.lnk - C:\MCI iFile\MCIUninstall.exe
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
==== shortcuts in All Users Start Menu ======================
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk - C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AB0000000001}\SC_Reader.ico
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apago\PDF Shrink\PDF Shrink Users Guide.pdf.lnk - C:\Users\User\Desktop\PDF Shrink\PDF Shrink Users Guide.pdf
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apago\PDF Shrink\PDFShrink.lnk - C:\Users\User\Desktop\PDF Shrink\PDFShrink.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apago\PDF Shrink\Uninstall.lnk - C:\Users\User\Desktop\PDF Shrink\uninst.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apago\PDF Shrink\Website.lnk - C:\Users\User\Desktop\PDF Shrink\Apago PDF Shrink.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files\Google\Chrome\Application\chrome.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Small Office Security 3\ Kaspersky Small Office Security 3 Help.lnk - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\Doc\en\PURE\context.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Small Office Security 3\End User License Agreement.lnk - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\Doc\en\license.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Small Office Security 3\Kaspersky Small Office Security 3.lnk - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\starter_avp.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Small Office Security 3\Remove Kaspersky Small Office Security 3.lnk - C:\Windows\System32\msiexec.exe /i{EBAB5F5E-3487-4455-812B-EDE83DAC624B} REMOVE=ALL
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Small Office Security 3\Visit Kaspersky Lab on the Web.lnk - C:\Program Files\Kaspersky Lab\Kaspersky Small Office Security 3\kl.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Payroll File Generator and Validation\Payroll File Generator and Validation v.9.8.lnk - C:\Program Files\Payroll File Generator and Validation\PFGV_CORP\Payroll File Generator and Validation v.9.8.xls
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection\Start Trusteer Endpoint Protection.lnk - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe -userstart
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection\Stop Trusteer Endpoint Protection.lnk - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe -shutdown
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection\Trusteer Endpoint Protection Console.lnk - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe -config
==== shortcuts in Quick Launch ======================
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Najd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Najd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk - C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE /recycle
C:\Users\Najd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Najd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Najd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Najd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Najd\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\mail.com.lnk - C:\Program Files\Internet Explorer\iexplore.exe
http://go.mail.com/br/ie8_quicklaunch_home
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk - C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE /recycle
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk -
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Microsoft Office Outlook 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\HP LJ100 M175 Scan.lnk - C:\Program Files\HP\HP LJ100 M175\bin\HPScan.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\mail.com.lnk - C:\Program Files\Internet Explorer\iexplore.exe
http://go.mail.com/br/ie_pinned_home
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Office Outlook 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files\Windows Media Player\wmplayer.exe /prefetch:1
==== shortcuts After Repair ======================
C:\Users\User\Desktop\Amazon.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\User\Desktop\mail.com.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\mail.com.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\mail.com.lnk - C:\Program Files\Internet Explorer\iexplore.exe
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\Software\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Chromium deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\1&1 Mail & Media GmbH 1und1Softwareaktualisierung deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mobilegeni daemon deleted successfully
==== Empty IE Cache ======================
C:\Users\administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Najd\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Najd\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\User\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\User\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
No FireFox Profiles found
==== Empty Chrome Cache ======================
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=1344 folders=147 112340379 bytes)
==== Empty Temp Folders ======================
C:\Users\administrator\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Najd\AppData\Local\Temp emptied successfully
C:\Users\User\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\Windows\Temp successfully emptied
C:\Users\User\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on Tue 02/10/2015 at 12:00:07.04 ======================