API tools faq
paste
MrMcShroom

Untitled

MrMcShroom
Nov 9th, 2015
336
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.35 KB | None | 0 0
raw download clone embed print report
  1. Start
  2. CreateRestorePoint:
  3. CloseProcesses:
  4. (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
  5. (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
  6. (IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
  7. (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
  8. (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
  9. (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
  10. (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
  11. (@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
  12. (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
  13. (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
  14. Startup: C:\Users\Noël Verleye\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NetflixAccountChecker.lnk [2015-03-10]
  15. ShortcutTarget: NetflixAccountChecker.lnk -> C:\ProgramData\{62789556-86ab-47cf-6278-8955686a555a}\NetflixAccountChecker.exe (Geen bestand)
  16. CHR HKLM\SOFTWARE\Policies\Google: Restrictie <======= AANDACHT
  17. HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restrictie <======= AANDACHT
  18. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS
  19. HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&q={searchTerms}
  20. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&q={searchTerms}
  21. HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS
  22. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS
  23. HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&q={searchTerms}
  24. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&q={searchTerms}
  25. HKU\S-1-5-21-2740513759-825887423-2586404379-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCON/2
  26. HKU\S-1-5-21-2740513759-825887423-2586404379-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS
  27. SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
  28. SearchScopes: HKLM -> {ADC3C57D-964B-4E3E-9D64-A2955CAED3BD} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
  29. SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/1553-111073-34115-5/4?mpre=hxxp://www.benl.ebay.be/sch/i.html?_nkw={searchTerms}
  30. SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
  31. SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
  32. SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  33. SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  34. SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  35. SearchScopes: HKU\S-1-5-21-2740513759-825887423-2586404379-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
  36. SearchScopes: HKU\S-1-5-21-2740513759-825887423-2586404379-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
  37. SearchScopes: HKU\S-1-5-21-2740513759-825887423-2586404379-1003 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&ts=1425084744&type=default&q={searchTerms}
  38. SearchScopes: HKU\S-1-5-21-2740513759-825887423-2586404379-1003 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&ts=1425084744&type=default&q={searchTerms}
  39. SearchScopes: HKU\S-1-5-21-2740513759-825887423-2586404379-1003 -> {ADC3C57D-964B-4E3E-9D64-A2955CAED3BD} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&ts=1425084744&type=default&q={searchTerms}
  40. SearchScopes: HKU\S-1-5-21-2740513759-825887423-2586404379-1003 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&ts=1425084744&type=default&q={searchTerms}
  41. SearchScopes: HKU\S-1-5-21-2740513759-825887423-2586404379-1003 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&ts=1425084744&type=default&q={searchTerms}
  42. SearchScopes: HKU\S-1-5-21-2740513759-825887423-2586404379-1003 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&ts=1425084744&type=default&q={searchTerms}
  43. SearchScopes: HKU\S-1-5-21-2740513759-825887423-2586404379-1003 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.istartsurf.com/web/?utm_source=b&utm_medium=pcs&utm_campaign=install_ie&utm_content=ds&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&ts=1425084744&type=default&q={searchTerms}
  44. DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  45. StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS
  46. CHR dev: Chrome dev build gedetecteerd! <======= AANDACHT
  47. CHR HomePage: Default -> hxxp://www.istartsurf.com/?type=hp&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS
  48. CHR StartupUrls: Default -> "hxxp://www.istartsurf.com/?type=hp&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS"
  49. CHR DefaultSearchURL: Default -> hxxp://www.istartsurf.com/web/?type=ds&ts=1425084688&from=pcs&uid=TOSHIBAXMK7575GSX_1244F0QISXX1244F0QIS&q={searchTerms}
  50. CHR DefaultSearchKeyword: Default -> istartsurf
  51. CHR Profile: C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default
  52. CHR Extension: (Google Presentaties) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-26]
  53. CHR Extension: (Google Documenten) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-26]
  54. CHR Extension: (Google Drive) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-26]
  55. CHR Extension: (YouTube) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-26]
  56. CHR Extension: (Google Search) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-02]
  57. CHR Extension: (Website Logon) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\debkinhcgejcbfgjiaalomcmkedjmiaa [2015-02-26]
  58. CHR Extension: (ZenMate Security, Privacy & Unblock VPN) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2015-11-02]
  59. CHR Extension: (Google Spreadsheets) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-26]
  60. CHR Extension: (Offline Documenten) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-02]
  61. CHR Extension: (FRQc - Flash Render Quality changer) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\jklnclajhlcbghmgkljidaofhcnmjffo [2015-03-17]
  62. CHR Extension: (Betalingen via Chrome Web Store) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-24]
  63. CHR Extension: (Gmail) - C:\Users\Noël Verleye\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-02]
  64. CHR HKLM-x32\...\Chrome\Extension: [debkinhcgejcbfgjiaalomcmkedjmiaa] - C:\Program Files (x86)\HP SimplePass 2012\tschrome.crx [2011-08-25]
  65. CHR HKLM-x32\...\Chrome\Extension: [jndeiekmdhemaggmkgljlpdeaomeplbp] - C:\Users\vdb\AppData\Local\CRE\jndeiekmdhemaggmkgljlpdeaomeplbp.crx <niet gevonden>
  66. CHR HKLM-x32\...\Chrome\Extension: [ofjmnfomkccdicagklbadodogeimbhlm] - C:\ProgramData\Bcool\ofjmnfomkccdicagklbadodogeimbhlm.crx <niet gevonden>
  67. S3 clwvd; system32\DRIVERS\clwvd.sys [X]
  68. S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
  69. S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [X]
  70. S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [X]
  71. S3 X6va027; \??\C:\Windows\SysWOW64\Drivers\X6va027 [X]
  72. S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
  73. 2015-04-16 02:11 - 2015-04-16 02:11 - 4461721 _____ () C:\Users\Noël Verleye\AppData\Roaming\ddos.exe
  74. 2015-04-16 00:45 - 2015-04-16 00:45 - 4464145 _____ () C:\Users\Noël Verleye\AppData\Roaming\scan.exe
  75. 2012-08-15 00:16 - 2012-06-30 19:13 - 0003153 _____ () C:\Program Files (x86)\visit-nosteam-forum.html
  76. 2015-11-03 10:32 - 2015-11-03 10:32 - 0000030 _____ () C:\Users\Noël Verleye\AppData\Roaming\.runescape_cache.dat
  77. 2014-07-03 22:18 - 2014-07-03 22:18 - 0000000 _____ () C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
  78. C:\Windows\svchost.exe
  79. C:\Users\Gast\osrsps_cl_oldschool_LIVE.dat
  80. C:\Users\Noël Verleye\jagex_runescape_preferences.dat
  81. C:\Users\Noël Verleye\keystore.dat
  82. C:\Users\Noël Verleye\osrsps_cl_oldschool_LIVE.dat
  83. C:\Users\Noël Verleye\AppData\Local\Temp\Quarantine.exe
  84. Bitcoin Core (64-bit) (HKU\S-1-5-21-2740513759-825887423-2586404379-1003\...\Bitcoin Core (64-bit)) (Version: 0.10.0 - Bitcoin Core project)
  85. Cake Mania (x32 Version: 2.2.0.98 - WildTangent) Hidden
  86. Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
  87. Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
  88. Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
  89. Farmscapes (x32 Version: 2.2.0.98 - WildTangent) Hidden
  90. FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
  91. Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
  92. Fishdom (TM) 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
  93. MagniPic (HKLM\...\{298F8675-EE4B-4A2E-A8C5-A669F26CA483}) (Version: 1.0 - ) <==== AANDACHT
  94. opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
  95. Proxy Finder (HKLM-x32\...\Proxy Finder) (Version: - )
  96. Task: {0441C36A-2AE3-4CED-9615-ABAA1DFB7D46} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2740513759-825887423-2586404379-1000Core => C:\Users\vdb\AppData\Local\Facebook\Update\FacebookUpdate.exe
  97. C:\Users\vdb\AppData\Local\Facebook\Update\FacebookUpdate.exe
  98. Task: {0D56F738-FE11-432D-B2AB-B4BEFA39EA8F} - \Steam_x64-S-2-106-91 -> Geen bestand <==== AANDACHT
  99. Task: {1F9FCFF7-4449-4DD0-9C7D-5E5E5C8E92D2} - System32\Tasks\{DAC736CB-EACD-4B1F-A0CB-AB1D52578C8C} => pcalua.exe -a "C:\Program Files (x86)\Proxy Finder\Uninstal.exe"
  100. C:\Program Files (x86)\Proxy Finder\Uninstal.exe
  101. Task: {2CAD42A8-16C2-4F63-9B4F-36C5119CA660} - System32\Tasks\The weDownload Manager-enabler => C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-enabler.exe <==== AANDACHT
  102. C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-enabler.exe
  103. Task: {48AC067F-284F-48B3-B5A1-CDDBD0F02757} - \avayvxvaxc -> Geen bestand <==== AANDACHT
  104. Task: {70A617B8-048B-47D9-894A-106EF8B05265} - System32\Tasks\{87087AE9-3AE0-4FDE-BD51-9BE9F1B4A663} => pcalua.exe -a "C:\Program Files (x86)\ShopperPro\SPremove.exe" <==== AANDACHT
  105. C:\Program Files (x86)\ShopperPro\SPremove.exe
  106. Task: {71D00273-AED2-44F7-A6C5-F4C8AB4BEA8D} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2740513759-825887423-2586404379-1000UA => C:\Users\vdb\AppData\Local\Facebook\Update\FacebookUpdate.exe
  107. C:\Users\vdb\AppData\Local\Facebook\Update\FacebookUpdate.exe
  108. Task: {B7256903-5466-437B-BBB0-50E9DEDEE948} - System32\Tasks\The weDownload Manager-updater => C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-updater.exe <==== AANDACHT
  109. C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-updater.exe
  110. Task: {C00BB16D-150A-4291-A0F9-D7517D27D307} - System32\Tasks\The weDownload Manager-codedownloader => C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-codedownloader.exe <==== AANDACHT
  111. C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-codedownloader.exe
  112. Task: {C2F14151-7E4D-4BD4-BE3E-4E32B04E8D02} - System32\Tasks\{55D3DEDE-7237-46C2-B63F-5762240B5B14} => pcalua.exe -a G:\setup.exe -d G:\ -c /autorun
  113. Task: {EC75D6A2-6B5D-446A-84ED-096E2A181267} - System32\Tasks\The weDownload Manager-chromeinstaller => C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-chromeinstaller.exe <==== AANDACHT
  114. C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-chromeinstaller.exe
  115. Task: {EE7A612A-F573-4552-AA6C-F76F9E3E6008} - System32\Tasks\The weDownload Manager-firefoxinstaller => C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-firefoxinstaller.exe <==== AANDACHT
  116. C:\Program Files (x86)\The weDownload Manager\The weDownload Manager-firefoxinstaller.exe
  117. MSCONFIG\startupreg: Client.jar => C:\Users\vdb\Client.jar
  118. MSCONFIG\startupreg: File => "C:\Program Files\Java\jre1.8.0_25\bin\javaw.exe" -jar "C:\Users\vdb\Desktop\JRAT\ExodusPK.jar"
  119. EmptyTemp:
  120. Hosts:
  121. Reboot:
  122. End
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!