Zoek.exe v5.0.0.0 Updated 10-November-2014
Tool run by Ramsey on Mon 11/10/2014 at 17:14:41.86.
Microsoft Windows 8 6.2.9200 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Ramsey\Desktop\zoek.exe [Scan all users] [Script inserted]
==== System Restore Info ======================
11/10/2014 5:27:38 PM Zoek.exe System Restore Point Created Succesfully.
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} deleted successfully
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} deleted successfully
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} deleted successfully
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Internet Explorer\SearchScopes\{CDCAB173-6936-4C30-BE8D-675FA374C61F} deleted successfully
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
==== Batch Command(s) Run By Tool======================
==== Deleting Files \ Folders ======================
C:\PROGRA~3\4f409866c2b7193a deleted
C:\PROGRA~2\YoutaubEAdBlockke deleted
C:\PROGRA~2\PricECChop deleted
C:\PROGRA~2\Bench deleted
C:\PROGRA~3\Ask deleted
C:\PROGRA~3\Trusted Publisher deleted
C:\PROGRA~3\PPriceeCuhop deleted
C:\PROGRA~3\PricECChop deleted
C:\PROGRA~3\YoutaubEAdBlockke deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services deleted
C:\Users\Ramsey\AppData\LocalLow\SkwConfig.bin deleted
C:\Users\Ramsey\AppData\LocalLow\{181F2C09-56DD-4F98-86D7-59BA2BC59B5A} deleted
C:\windows\SysNative\tasks\bench-sys deleted
C:\Windows\tasks\bench-sys.job deleted
C:\Windows\tasks\bench-Updater removing.job deleted
C:\END deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\GPT.INI deleted
C:\Windows\Syswow64\GroupPolicy\gpt.ini deleted
C:\Windows\Syswow64\SearchProtect deleted
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{BBDA0591-3099-440a-AA10-41764D9DB4DB}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\IPSFFPlgn" [01/07/2013 05:10 PM]
==== Fake Chromium Profiles Check ======================
Fake profile C:\Users\Administrator\AppData\Local\Torch deleted
Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Administrator\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Administrator\AppData\Local\Chromatic Browser deleted
Fake profile C:\Users\Guest\AppData\Local\Torch deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Guest\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Guest\AppData\Local\Chromatic Browser deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Torch deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser deleted
Fake profile C:\Users\Ramsey\AppData\Local\Torch deleted
Fake profile C:\Users\Ramsey\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Ramsey\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Ramsey\AppData\Local\Chromatic Browser deleted
==== Chromium Look ======================
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
bejnhdlplbjhffionohbdnpcbobfejcc - C:\Program Files (x86)\Norton Internet Security\Engine\20.5.0.28\Exts\Chrome.crx[04/29/2014 04:31 AM]
NextCoup - Ramsey\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmcbpdaeanmcimealfckbgaebjkoobka
==== Chromium Fix ======================
C:\Users\Ramsey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_
www.metrolyrics.com_0.localstorage deleted successfully
C:\Users\Ramsey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_
www.metrolyrics.com_0.localstorage-journal deleted successfully
C:\Users\Ramsey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_
www.superfish.com_0.localstorage deleted successfully
C:\Users\Ramsey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_
www.superfish.com_0.localstorage-journal deleted successfully
C:\Users\Ramsey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_
www.superfish.com_0.localstorage deleted successfully
C:\Users\Ramsey\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_
www.superfish.com_0.localstorage-journal deleted successfully
C:\Users\Ramsey\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmcbpdaeanmcimealfckbgaebjkoobka deleted successfully
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="
http://www.trovi.com/?gd=&ctid=CT33...=SPB5D4997A-D02B-4EA7-A88F-D4EEBE143CBD&SSPV="
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="
http://www.google.com"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="
http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="
http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=CPNTDFJS"
{D944BB61-2E34-4DBF-A683-47E505C587DC} eBay Url="
http://rover.ebay.com/rover/1/711-154371-11896-2/4"
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6306220F-8AD8-4E6A-9CFF-706F2A969D06} deleted successfully
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6306220F-8AD8-4E6A-9CFF-706F2A969D06} deleted successfully
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A4CA8809-5839-4D19-A8CA-2BCF4AB6858A} deleted successfully
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A4CA8809-5839-4D19-A8CA-2BCF4AB6858A} deleted successfully
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D42112BA-3BC2-47CE-AD27-609E92B260BD} deleted successfully
HKEY_USERS\S-1-5-21-2525577324-1425347712-1674995004-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D42112BA-3BC2-47CE-AD27-609E92B260BD} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6306220F-8AD8-4E6A-9CFF-706F2A969D06} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6306220F-8AD8-4E6A-9CFF-706F2A969D06} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{6306220F-8AD8-4E6A-9CFF-706F2A969D06} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{6306220F-8AD8-4E6A-9CFF-706F2A969D06} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A4CA8809-5839-4D19-A8CA-2BCF4AB6858A} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A4CA8809-5839-4D19-A8CA-2BCF4AB6858A} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{A4CA8809-5839-4D19-A8CA-2BCF4AB6858A} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{A4CA8809-5839-4D19-A8CA-2BCF4AB6858A} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D42112BA-3BC2-47CE-AD27-609E92B260BD} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D42112BA-3BC2-47CE-AD27-609E92B260BD} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{D42112BA-3BC2-47CE-AD27-609E92B260BD} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{D42112BA-3BC2-47CE-AD27-609E92B260BD} deleted successfully
==== Deleting CLSID Registry Values ======================
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
==== Empty IE Cache ======================
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Ramsey\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Ramsey\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
No FireFox Profiles found
==== Empty Chrome Cache ======================
C:\Users\Ramsey\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
Java Cache cleared successfully
==== C:\zoek_backup content ======================
C:\zoek_backup (files=79 folders=22 4525478 bytes)
==== Empty Temp Folders ======================
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Ramsey\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
C:\Windows\Temp successfully emptied
C:\Users\Ramsey\AppData\Local\Temp successfully emptied
==== Empty Recycle Bin ======================
C:\$RECYCLE.BIN successfully emptied
==== EOF on Mon 11/10/2014 at 18:14:42.85 ======================