Hello TwinHeadedEagle,
Thank you so much for helping me.
I did as you asked and this is the result of the script.
Zoek.exe v5.0.0.0 Updated 16-November-2014
Tool run by Sarah on 19/11/2014 at 9:53:48.09.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Sarah\Downloads\zoek (1).exe [Scan all users] [Script inserted]
==== System Restore Info ======================
19/11/2014 9:55:07 AM Zoek.exe System Restore Point Created Succesfully.
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== FireFox Fix ======================
ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\3v0xfmfv.default
user.js not found
---- Lines extensions.3YvsgKvdjwjpIMMr removed from prefs.js ----
user_pref("extensions.3YvsgKvdjwjpIMMr.epoch", "1416443728");
user_pref("extensions.3YvsgKvdjwjpIMMr.url", "
http://allshareforallguide.net/sync...9tMqLDe49CNU0n9wMCMlNhd9FqdwFrjrEqdr9rjnMBzqU
---- Lines extensions.rXaaXeCrphGcUA4y removed from prefs.js ----
user_pref("extensions.rXaaXeCrphGcUA4y.epoch", "1416443728");
user_pref("extensions.rXaaXeCrphGcUA4y.url", "
http://syncjpi.info/sync2/?q=hfZ9of...t4okqbtNtVh7n0rjnFrjwHrdnHrHa7tMFHhd9FqdwFrjr
---- FireFox user.js and prefs.js backups ----
prefs_112014_1007_.backup
==== Batch Command(s) Run By Tool======================
==== Deleting Files \ Folders ======================
C:\PROGRA~2\YoutubeAdBlocke deleted
C:\PROGRA~2\GoSave deleted
C:\PROGRA~3\dhpbdihjbdliabadoglhgechcphmfhdo deleted
C:\PROGRA~3\11264832300369511714 deleted
C:\PROGRA~2\DeltaFix deleted
C:\Users\Sarah\AppData\Roaming\EZDownloader deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\3v0xfmfv.default\jetpack deleted
C:\Users\Sarah\jre-7u51-windows-i586.exe deleted
C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\3v0xfmfv.default\extensions\
5dp@8.edu deleted
C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\3v0xfmfv.default\extensions\
IyRQ0WX@Y8g.com deleted
C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\3v0xfmfv.default\extensions\jid1-4P0kohSJxU1qGg@jetpack deleted
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"
online_banking@kaspersky.com"="C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\
online_banking@kaspersky.com" [14/11/2014 04:32 PM]
==== Firefox Extensions ======================
ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\3v0xfmfv.default
- Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\
anti_banner@kaspersky.com
- Undetermined -
anti_banner@kaspersky.com
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==== Firefox Plugins ======================
Profilepath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\3v0xfmfv.default
67D325B5AEB28E381B84E8DE1A90C7A8 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll - Shockwave Flash
==== Chromium Look ======================
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dchlnpcodkpfdpacogkljefecpegganj - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\urladvisor.crx[11/11/2013 10:21 PM]
hakdifolhalapjijoafobooafbilfakh - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\online_banking_chrome.crx[11/11/2013 10:21 PM]
hghkgaeecgjhjkannahfamoehjmkjail - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\content_blocker_chrome.crx[11/11/2013 10:18 PM]
jagncdcchgajhfhijbbhecadmaiegcmh - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\virtkbd.crx[11/11/2013 10:18 PM]
lpoimibckejjdjcfbdnajaicnklhfplh -
https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh[]
pjldcfjmnllhmgjclecdnfampinooman - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\ab.crx[11/11/2013 10:21 PM]
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
lmjegmlicamnimmfhcmpkclmigmmcbeh - No path found[]
Google Voice Search Hotword (Beta) - Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
Select and Speak - Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfjopfpjmkcfgjpogepmdjmcnihfpokn
Flash Player - Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdpbajmogfhlafbipjjklkdhloplicgc
Google Drive App Launcher - Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh
==== Chromium Startpages ======================
C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "
http://www.google.com/",
"startup_urls": [ "
http://www.google.com/" ],
==== Chromium Fix ======================
C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpoimibckejjdjcfbdnajaicnklhfplh deleted successfully
C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh deleted successfully
C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfjopfpjmkcfgjpogepmdjmcnihfpokn deleted successfully
C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gfjopfpjmkcfgjpogepmdjmcnihfpokn_0.localstorage deleted successfully
C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gfjopfpjmkcfgjpogepmdjmcnihfpokn_0.localstorage-journal deleted successfully
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="
https://www.google.ca/"
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="
https://www.google.ca/"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="
http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="
http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-4219524570-402072800-3859842921-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0770a50d-34d3-4bf0-8a42-537e50fd5035} deleted successfully
HKEY_USERS\S-1-5-21-4219524570-402072800-3859842921-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0770a50d-34d3-4bf0-8a42-537e50fd5035} deleted successfully
HKEY_USERS\S-1-5-21-4219524570-402072800-3859842921-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9050be9f-cded-49f2-9350-02db2d7846da} deleted successfully
HKEY_USERS\S-1-5-21-4219524570-402072800-3859842921-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9050be9f-cded-49f2-9350-02db2d7846da} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0770a50d-34d3-4bf0-8a42-537e50fd5035} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0770a50d-34d3-4bf0-8a42-537e50fd5035} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{0770a50d-34d3-4bf0-8a42-537e50fd5035} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{0770a50d-34d3-4bf0-8a42-537e50fd5035} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0770a50d-34d3-4bf0-8a42-537e50fd5035} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0770a50d-34d3-4bf0-8a42-537e50fd5035} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9050be9f-cded-49f2-9350-02db2d7846da} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9050be9f-cded-49f2-9350-02db2d7846da} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{9050be9f-cded-49f2-9350-02db2d7846da} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{9050be9f-cded-49f2-9350-02db2d7846da} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9050be9f-cded-49f2-9350-02db2d7846da} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9050be9f-cded-49f2-9350-02db2d7846da} deleted successfully
==== Deleting CLSID Registry Values ======================
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\lpoimibckejjdjcfbdnajaicnklhfplh deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C87834EB-A2A0-B9D4-AA9A-C263D1191051} deleted successfully
==== Empty IE Cache ======================
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Sarah\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Sarah\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Sarah\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
C:\Users\Sarah\AppData\Local\Mozilla\Firefox\Profiles\3v0xfmfv.default\cache2 emptied successfully
==== Empty Chrome Cache ======================
C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache is not empty, a reboot is needed
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=535 folders=88 33000073 bytes)
==== Empty Temp Folders ======================
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Sarah\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\Windows\Temp successfully emptied
C:\Users\Sarah\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== Deleting Files / Folders ======================
"C:\Users\Sarah\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\SA74RJM8\pdk.theplatform.com" not found
==== EOF on 19/11/2014 at 10:36:47.14 ======================