Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Menu
Install the app
Install
Reply to thread
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Support
Windows Malware Removal Help & Support
Help Remove BuyNSave From Chrome
Message
<blockquote data-quote="mut1234" data-source="post: 332734" data-attributes="member: 31141"><p>Here is the info.... i could not save it and upload.. i save it as txt but then i can not find in the folder.</p><p></p><p>-----</p><p></p><p>Zoek.exe v5.0.0.0 Updated 09-January-2015</p><p>Tool run by mason on Mon 01/12/2015 at 14:56:24.25.</p><p>Microsoft Windows 8.1 6.3.9600 x64</p><p>Running in: Normal Mode Internet Access Detected</p><p>Launched: C:\Users\Alex\Desktop\zoek.exe [Scan all users] [Script inserted] </p><p></p><p>==== System Restore Info ======================</p><p></p><p>1/12/2015 2:58:34 PM Zoek.exe System Restore Point Created Succesfully.</p><p></p><p>==== Empty Folders Check ======================</p><p></p><p>C:\PROGRA~2\AGEIA Technologies deleted successfully</p><p>C:\PROGRA~2\DeltaFix deleted successfully</p><p>C:\PROGRA~3\Oracle deleted successfully</p><p>C:\Users\Alex\AppData\Roaming\Apple Computer deleted successfully</p><p>C:\Users\Alex\AppData\Local\VirtualStore deleted successfully</p><p>C:\Users\mason\AppData\Local\MediaShow deleted successfully</p><p>C:\Users\mason\AppData\Local\VirtualStore deleted successfully</p><p></p><p>==== Deleting CLSID Registry Keys ======================</p><p></p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\SearchScopes\{4E881DA5-89C9-4ACA-8FCA-0F99DA0DC208} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1003\Software\Microsoft\Internet Explorer\SearchScopes\{4E881DA5-89C9-4ACA-8FCA-0F99DA0DC208} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{16AEDB24-E364-44CB-B15A-B0501577BFF3} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1899D72D-9786-4ADA-B7C5-4E14A8F2DB09} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F0EFEBD-5098-4618-9DC6-E2A31B502884} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{20C397F0-9AA3-48DB-AD22-32379A536BB5} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{24733CE0-9458-440B-B007-5FAFB016837A} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2945C42B-C534-4E25-B08C-30CAA91482C1} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2C4404B0-AE0B-4EAD-9DA4-DC846ED39B8E} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2EBBD66D-6BC5-45D6-BC98-74EDF4ACAF6A} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{33FA0A9C-593A-4D31-BA74-3CB102DFB202} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{38C0C2D6-5479-4E11-831D-45F73E4A89B1} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3CB7442B-D56F-42D0-9EBA-3F70E731963E} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4D718DD3-72FF-419A-8F5F-ECE5796F2814} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{946B343C-E287-46D3-80D6-322090307F35} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A058BDD0-6C7D-4D1E-95F9-1B5C0E1CE747} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2E8A415-A271-4DCF-A692-04572DD7F6B5} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BA395891-85B9-4697-A9B4-B3D5330C126D} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BC27A70D-6E8D-4B83-80F8-05BBEF3721B6} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C2CED1BD-1045-4AA8-B154-B4113189CD5A} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C405E5AA-7221-4098-87BC-55E875855B6C} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C75E443E-B1DA-4F58-8E9C-3C63C63409B2} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CEBB188C-1613-4C0C-B1CA-C60E1FC2B531} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D6444500-CBCA-450E-B4A1-8103AF9A3EDC} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DE539915-E594-432B-8691-9D5AB5A0C60C} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DF5800DE-3F57-4EF3-B6F2-0046F3844CE5} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E2EE5CFD-B0C6-42CE-9A1F-703966A99CBB} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E4176C7E-8EFA-4DA4-A981-40AEB20895C3} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E85851E0-4ED2-4587-A11C-AC10816FB6AB} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E9781AA6-D8DB-404B-8258-D1D7EF5A5741} deleted successfully</p><p>HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F5532FF1-2A6C-4133-AC45-E4202A92BD63} deleted successfully</p><p></p><p>==== Deleting CLSID Registry Values ======================</p><p></p><p></p><p>==== Deleting Services ======================</p><p></p><p></p><p>==== Batch Command(s) Run By Tool======================</p><p></p><p></p><p>==== Deleting Files \ Folders ======================</p><p></p><p>C:\PROGRA~3\eoegelpfbkigmafifmfghefleiideobl deleted</p><p>C:\PROGRA~3\fkgjacdgpbocobknjplodipddldlocha deleted</p><p>C:\PROGRA~3\jmbaodfkemhmlhiajobcnljgngaabjoa deleted</p><p>C:\PROGRA~3\7474421577882953399 deleted</p><p>C:\PROGRA~2\Optimizer Pro deleted</p><p>C:\Users\mason\AppData\Roaming\EZDownloader deleted</p><p>C:\Users\mason\AppData\Roaming\Optimizer Pro deleted</p><p>C:\PROGRA~3\APN deleted</p><p>C:\PROGRA~3\Trusted Publisher deleted</p><p>C:\PROGRA~3\boost_interprocess deleted</p><p>C:\PROGRA~3\Package Cache deleted</p><p>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services deleted</p><p>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted</p><p>C:\Users\mason\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup deleted</p><p>C:\Windows\tasks\MasterAssembler-S-2352028903.job deleted</p><p>C:\Windows\tasks\SectionTurbo-S-4103547571.job deleted</p><p>C:\Windows\tasks\SoftwarePreserver-S-2224761535.job deleted</p><p>C:\windows\SysNative\tasks\MasterAssembler-S-2352028903 deleted</p><p>C:\windows\SysNative\tasks\SectionTurbo-S-4103547571 deleted</p><p>C:\windows\SysNative\tasks\SoftwarePreserver-S-2224761535 deleted</p><p>C:\END deleted</p><p>C:\windows\SysNative\drivers\wStLibG64.sys deleted</p><p>C:\Users\mason\Documents\Optimizer Pro deleted</p><p></p><p>==== Firefox Extensions Registry ======================</p><p></p><p>[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]</p><p>"{BBDA0591-3099-440a-AA10-41764D9DB4DB}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.0.100\IPSFF" [08/16/2014 06:00 PM]</p><p></p><p>==== Chromium Look ======================</p><p></p><p>Google Chrome Version: 39.0.2171.71 (Possible outdated, latest Stable version: 39.0.2171.95)</p><p></p><p>HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions</p><p>iikflkcanblccfahdhdonehdalibjnif - No path found[]</p><p>mkfokfffehpeedafpekjeddnmnjhmcmk - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx[09/20/2014 03:52 AM]</p><p></p><p>Google Voice Search Hotword (Beta) - Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn</p><p>Validity - mason\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbicmjjbohdfglopkidebfccilipgeif</p><p>Google Voice Search Hotword (Beta) - mason\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn</p><p>Norton Security Toolbar - mason\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk</p><p></p><p>==== Chromium Startpages ======================</p><p></p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Preferences</p><p>"homepage": "<a href="http://www.google.com/" target="_blank">http://www.google.com/</a>",</p><p>"startup_urls": [ "<a href="https://www.google.com/" target="_blank">https://www.google.com/</a>", "<a href="http://websearch.searchfix.info/?pid=724&r=2014/12/02&hid=17653192733140471748&lg=EN&cc=US" target="_blank">http://websearch.searchfix.info/?pid=724&r=2014/12/02&hid=17653192733140471748&lg=EN&cc=US</a>" ],</p><p></p><p></p><p>==== Chromium Fix ======================</p><p></p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_<a href="http://www.superfish.com_0.localstorage" target="_blank">www.superfish.com_0.localstorage</a> deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_<a href="http://www.superfish.com_0.localstorage-journal" target="_blank">www.superfish.com_0.localstorage-journal</a> deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_<a href="http://www.superfish.com_0.localstorage" target="_blank">www.superfish.com_0.localstorage</a> deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_<a href="http://www.superfish.com_0.localstorage-journal" target="_blank">www.superfish.com_0.localstorage-journal</a> deleted successfully</p><p>C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage deleted successfully</p><p>C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage-journal deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage-journal deleted successfully</p><p>C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage deleted successfully</p><p>C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage-journal deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage-journal deleted successfully</p><p>C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_<a href="http://www.goodsearch.com_0.localstorage" target="_blank">www.goodsearch.com_0.localstorage</a> deleted successfully</p><p>C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_<a href="http://www.goodsearch.com_0.localstorage-journal" target="_blank">www.goodsearch.com_0.localstorage-journal</a> deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbicmjjbohdfglopkidebfccilipgeif deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbicmjjbohdfglopkidebfccilipgeif_0.localstorage deleted successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbicmjjbohdfglopkidebfccilipgeif_0.localstorage-journal deleted successfully</p><p></p><p>==== Set IE to Default ======================</p><p></p><p>Old Values:</p><p>[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]</p><p>[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]</p><p>No DefaultScope Set For HKCU</p><p></p><p>New Values:</p><p>[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]</p><p>"Start Page"="<a href="http://go.microsoft.com/fwlink/?LinkId=69157" target="_blank">http://go.microsoft.com/fwlink/?LinkId=69157</a>"</p><p>[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]</p><p>"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"</p><p></p><p>==== All HKCU SearchScopes ======================</p><p></p><p>HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes</p><p>{012E1000-F331-11DB-8314-0800200C9A66} Google Url="<a href="http://www.google.com/search?q={searchTerms}" target="_blank">http://www.google.com/search?q={searchTerms}</a>"</p><p>{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="<a href="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" target="_blank">http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC</a>"</p><p>{D944BB61-2E34-4DBF-A683-47E505C587DC} eBay Url="<a href="http://rover.ebay.com/rover/1/711-154371-11896-2/4" target="_blank">http://rover.ebay.com/rover/1/711-154371-11896-2/4</a>"</p><p></p><p>==== Deleting Registry Keys ======================</p><p></p><p>HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully</p><p></p><p>==== Empty IE Cache ======================</p><p></p><p>C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully</p><p>C:\Users\Alex\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully</p><p>C:\Users\Alex\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully</p><p>C:\Users\mason\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully</p><p>C:\Users\mason\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully</p><p>C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully</p><p>C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully</p><p>C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully</p><p>C:\Users\Alex\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully</p><p>C:\Users\Alex\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully</p><p>C:\Users\mason\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully</p><p>C:\Users\mason\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully</p><p>C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully</p><p>C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully</p><p></p><p>==== Empty FireFox Cache ======================</p><p></p><p>No FireFox Profiles found</p><p></p><p>==== Empty Chrome Cache ======================</p><p></p><p>C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully</p><p>C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully</p><p></p><p>==== Empty All Flash Cache ======================</p><p></p><p>Flash Cache Emptied Successfully</p><p></p><p>==== Empty All Java Cache ======================</p><p></p><p>Java Cache cleared successfully</p><p></p><p>==== C:\zoek_backup content ======================</p><p></p><p>C:\zoek_backup (files=74 folders=42 15696727 bytes)</p><p></p><p>==== Empty Temp Folders ======================</p><p></p><p>C:\Users\Alex\AppData\Local\Temp emptied successfully</p><p>C:\Users\Default\AppData\Local\Temp emptied successfully</p><p>C:\Users\Default User\AppData\Local\Temp emptied successfully</p><p>C:\Users\mason\AppData\Local\Temp will be emptied at reboot</p><p>C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully</p><p>C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully</p><p>C:\Windows\Temp will be emptied at reboot</p><p></p><p>==== After Reboot ======================</p><p></p><p>==== Empty Temp Folders ======================</p><p></p><p>C:\Windows\Temp successfully emptied</p><p>C:\Users\mason\AppData\Local\Temp successfully emptied</p><p></p><p>==== Empty Recycle Bin ======================</p><p></p><p>C:\$RECYCLE.BIN successfully emptied</p><p></p><p>==== EOF on Mon 01/12/2015 at 15:51:40.63 ======================</p></blockquote><p></p>
[QUOTE="mut1234, post: 332734, member: 31141"] Here is the info.... i could not save it and upload.. i save it as txt but then i can not find in the folder. ----- Zoek.exe v5.0.0.0 Updated 09-January-2015 Tool run by mason on Mon 01/12/2015 at 14:56:24.25. Microsoft Windows 8.1 6.3.9600 x64 Running in: Normal Mode Internet Access Detected Launched: C:\Users\Alex\Desktop\zoek.exe [Scan all users] [Script inserted] ==== System Restore Info ====================== 1/12/2015 2:58:34 PM Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== C:\PROGRA~2\AGEIA Technologies deleted successfully C:\PROGRA~2\DeltaFix deleted successfully C:\PROGRA~3\Oracle deleted successfully C:\Users\Alex\AppData\Roaming\Apple Computer deleted successfully C:\Users\Alex\AppData\Local\VirtualStore deleted successfully C:\Users\mason\AppData\Local\MediaShow deleted successfully C:\Users\mason\AppData\Local\VirtualStore deleted successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\SearchScopes\{4E881DA5-89C9-4ACA-8FCA-0F99DA0DC208} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1003\Software\Microsoft\Internet Explorer\SearchScopes\{4E881DA5-89C9-4ACA-8FCA-0F99DA0DC208} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{16AEDB24-E364-44CB-B15A-B0501577BFF3} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1899D72D-9786-4ADA-B7C5-4E14A8F2DB09} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F0EFEBD-5098-4618-9DC6-E2A31B502884} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{20C397F0-9AA3-48DB-AD22-32379A536BB5} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{24733CE0-9458-440B-B007-5FAFB016837A} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2945C42B-C534-4E25-B08C-30CAA91482C1} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2C4404B0-AE0B-4EAD-9DA4-DC846ED39B8E} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2EBBD66D-6BC5-45D6-BC98-74EDF4ACAF6A} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{33FA0A9C-593A-4D31-BA74-3CB102DFB202} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{38C0C2D6-5479-4E11-831D-45F73E4A89B1} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3CB7442B-D56F-42D0-9EBA-3F70E731963E} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4D718DD3-72FF-419A-8F5F-ECE5796F2814} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{946B343C-E287-46D3-80D6-322090307F35} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A058BDD0-6C7D-4D1E-95F9-1B5C0E1CE747} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2E8A415-A271-4DCF-A692-04572DD7F6B5} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BA395891-85B9-4697-A9B4-B3D5330C126D} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BC27A70D-6E8D-4B83-80F8-05BBEF3721B6} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C2CED1BD-1045-4AA8-B154-B4113189CD5A} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C405E5AA-7221-4098-87BC-55E875855B6C} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C75E443E-B1DA-4F58-8E9C-3C63C63409B2} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CEBB188C-1613-4C0C-B1CA-C60E1FC2B531} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D6444500-CBCA-450E-B4A1-8103AF9A3EDC} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DE539915-E594-432B-8691-9D5AB5A0C60C} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DF5800DE-3F57-4EF3-B6F2-0046F3844CE5} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E2EE5CFD-B0C6-42CE-9A1F-703966A99CBB} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E4176C7E-8EFA-4DA4-A981-40AEB20895C3} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E85851E0-4ED2-4587-A11C-AC10816FB6AB} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E9781AA6-D8DB-404B-8258-D1D7EF5A5741} deleted successfully HKEY_USERS\S-1-5-21-3054414466-3625893618-1030323560-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F5532FF1-2A6C-4133-AC45-E4202A92BD63} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Batch Command(s) Run By Tool====================== ==== Deleting Files \ Folders ====================== C:\PROGRA~3\eoegelpfbkigmafifmfghefleiideobl deleted C:\PROGRA~3\fkgjacdgpbocobknjplodipddldlocha deleted C:\PROGRA~3\jmbaodfkemhmlhiajobcnljgngaabjoa deleted C:\PROGRA~3\7474421577882953399 deleted C:\PROGRA~2\Optimizer Pro deleted C:\Users\mason\AppData\Roaming\EZDownloader deleted C:\Users\mason\AppData\Roaming\Optimizer Pro deleted C:\PROGRA~3\APN deleted C:\PROGRA~3\Trusted Publisher deleted C:\PROGRA~3\boost_interprocess deleted C:\PROGRA~3\Package Cache deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted C:\Users\mason\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup deleted C:\Windows\tasks\MasterAssembler-S-2352028903.job deleted C:\Windows\tasks\SectionTurbo-S-4103547571.job deleted C:\Windows\tasks\SoftwarePreserver-S-2224761535.job deleted C:\windows\SysNative\tasks\MasterAssembler-S-2352028903 deleted C:\windows\SysNative\tasks\SectionTurbo-S-4103547571 deleted C:\windows\SysNative\tasks\SoftwarePreserver-S-2224761535 deleted C:\END deleted C:\windows\SysNative\drivers\wStLibG64.sys deleted C:\Users\mason\Documents\Optimizer Pro deleted ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions] "{BBDA0591-3099-440a-AA10-41764D9DB4DB}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.0.100\IPSFF" [08/16/2014 06:00 PM] ==== Chromium Look ====================== Google Chrome Version: 39.0.2171.71 (Possible outdated, latest Stable version: 39.0.2171.95) HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions iikflkcanblccfahdhdonehdalibjnif - No path found[] mkfokfffehpeedafpekjeddnmnjhmcmk - C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\Exts\Chrome.crx[09/20/2014 03:52 AM] Google Voice Search Hotword (Beta) - Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn Validity - mason\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbicmjjbohdfglopkidebfccilipgeif Google Voice Search Hotword (Beta) - mason\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn Norton Security Toolbar - mason\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk ==== Chromium Startpages ====================== C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Preferences "homepage": "[url]http://www.google.com/[/url]", "startup_urls": [ "[url]https://www.google.com/[/url]", "[url]http://websearch.searchfix.info/?pid=724&r=2014/12/02&hid=17653192733140471748&lg=EN&cc=US[/url]" ], ==== Chromium Fix ====================== C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_[url="http://www.superfish.com_0.localstorage"]www.superfish.com_0.localstorage[/url] deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_[url="http://www.superfish.com_0.localstorage-journal"]www.superfish.com_0.localstorage-journal[/url] deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_[url="http://www.superfish.com_0.localstorage"]www.superfish.com_0.localstorage[/url] deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_[url="http://www.superfish.com_0.localstorage-journal"]www.superfish.com_0.localstorage-journal[/url] deleted successfully C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage deleted successfully C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage-journal deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.re-markable00.re-markable.net_0.localstorage-journal deleted successfully C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage deleted successfully C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage-journal deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.selectgo00.selectgo.net_0.localstorage-journal deleted successfully C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_[url="http://www.goodsearch.com_0.localstorage"]www.goodsearch.com_0.localstorage[/url] deleted successfully C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_[url="http://www.goodsearch.com_0.localstorage-journal"]www.goodsearch.com_0.localstorage-journal[/url] deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbicmjjbohdfglopkidebfccilipgeif deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbicmjjbohdfglopkidebfccilipgeif_0.localstorage deleted successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbicmjjbohdfglopkidebfccilipgeif_0.localstorage-journal deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] No DefaultScope Set For HKCU New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="[url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes {012E1000-F331-11DB-8314-0800200C9A66} Google Url="[url]http://www.google.com/search?q={searchTerms}[/url]" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="[url]http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC[/url]" {D944BB61-2E34-4DBF-A683-47E505C587DC} eBay Url="[url]http://rover.ebay.com/rover/1/711-154371-11896-2/4[/url]" ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully ==== Empty IE Cache ====================== C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Alex\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\Alex\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully C:\Users\mason\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\mason\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully C:\Users\Alex\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\Users\Alex\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully C:\Users\mason\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\Users\mason\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully ==== Empty FireFox Cache ====================== No FireFox Profiles found ==== Empty Chrome Cache ====================== C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully C:\Users\mason\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=74 folders=42 15696727 bytes) ==== Empty Temp Folders ====================== C:\Users\Alex\AppData\Local\Temp emptied successfully C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\mason\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\mason\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== EOF on Mon 01/12/2015 at 15:51:40.63 ====================== [/QUOTE]
Insert quotes…
Verification
Post reply
Top