Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan and Backdoor agents removed, but other issues could be apparent?


  • This topic is locked This topic is locked
46 replies to this topic

#1 compbuff

compbuff

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 30 July 2016 - 05:18 PM

Hi,

 

I am running Windows 8.1 on my Acer Aspire laptop.

 

My malwarebytesHome premium detected the Trojan.Agent, Backdoor.Agent.CHGen and Backdoor.Agent.E but after I scanned my PC and not before. I removed them, following this guide from Malwaretips for removing a Trojan.agent:

 

https://malwaretips.com/blogs/trojan-agent-removal/

 

following the steps below:

 

STEP 1: Remove Trojan.Agent Master Boot Record infection with Kaspersky TDSSKiller
STEP 2: Remove Trojan.Agent virus with Malwarebytes Anti-Malware Free
STEP 3: Remove Trojan.Agent trojan with RogueKiller
STEP 4:  Remove Trojan.Agent infection with HitmanPro
STEP 5: Double check for any left over infections with Emsisoft Emergency Kit
STEP 6: Remove Trojan.Agent adware with AdwCleaner

 

After following the guide, it appeared to have removed the Trojan Agent and the Backdoor agents mentioned from my laptop. However, I would like to know what the items shown from the RogueKiller log are (i did not remove them, since I have not ascertained if they are safe to do so yet or not). As in accordance with the preparation guide, I have attached the FRST and Addition logs, as well as the RogueKiller log I saved. The Addition file was stated as too big to upload here, so will try to do so in a separate post.

 

Basically the RogueKiller log is stating I have suspicious paths and PUMS from my home page and DNS in the registry as well as. It did also originally show suspicious paths and a VT unknown in the processes but not when it was rescanned today.


Edited by compbuff, 30 July 2016 - 06:13 PM.


BC AdBot (Login to Remove)

 


#2 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 30 July 2016 - 05:22 PM

I can't seem to attach my Addition log file as it still says the file was too big to upload?



#3 nasdaq

nasdaq

  • Malware Response Team
  • 39,214 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:05 AM

Posted 31 July 2016 - 09:15 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Press the windows key Windows_Logo_key.gif+ r on your keyboard at the same time. This will open the RUN BOX.
Type Notepad and and click the OK key.
Please copy the entire contents of the code box below to the a new file.
 
start


CreateRestorePoint:
EmptyTemp:
CloseProcesses:

Winsock: Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [55296 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\napinsp.dll"
Winsock: Catalog5 02 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70144 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\pnrpnsp.dll"
Winsock: Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70144 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\pnrpnsp.dll"
Winsock: Catalog5 04 C:\WINDOWS\SysWOW64\NLAapi.dll [65536 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [286208 2016-05-13] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [23040 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\System32\winrnr.dll"
URLSearchHook: [S-1-5-21-1438436151-582650635-3674040208-1001] ATTENTION => Default URLSearchHook is missing
URLSearchHook: [S-1-5-21-1438436151-582650635-3674040208-1002] ATTENTION => Default URLSearchHook is missing
FF Extension: Block site - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2016-04-27]
FF HKU\S-1-5-21-1438436151-582650635-3674040208-1003\...\Firefox\Extensions: [{b9aa91db-385d-4c69-8a2f-96790aa9405b}] - c:\program files (x86)\copernic\desktopsearch\firefoxconnector => not found
CHR Extension: (Avast SafePrice) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-01-29]
CHR Extension: (Privacy manager) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\giccehglhacakcfemddmfhdkahamfcmd [2016-07-24]
CHR Extension: (Avast Online Security) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-06-29]
CHR Extension: (WorkFlowy) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\koegeopamaoljbmhnfjbclbocehhgmkm [2016-07-28]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-11]
CHR HKU\S-1-5-21-1438436151-582650635-3674040208-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [cnnbdaahphjgdgfhliignpepgnbnfomp] - c:\program files (x86)\copernic\desktopsearch\ChromeConnector\ChromeConnector.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
S3 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]
S2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [X]
cmd: netsh winsock reset catalog

End
Save the file as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Temporarily disable your AV program so it does not interfere.
Info on how to disable your security applications How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides.

Download Zeok tool from here

When the download appears, save to the Desktop.
On the Desktop, right-click the Zoek.exe file and select: Run as Administrator
(Give it a few seconds to appear.)

Next, copy/paste the entire script inside the code box below to the input field of Zoek:
createsrpoint;
autoclean;
emptyclsid;
emptyffcache;
FFdefaults;
emptyiecache;
iedefaults;
emptychrcache;
CHRdefaults;
emptyalltemp;
emptyfolderscheck;delete
ipconfig /flushdns;b
Now...
Close any open Browsers.
Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed, the log is opened after the reboot.

Please attach/paste the zoek-results.log in your reply.
===

Also, please provide an update on how the computer is behaving after running the above script.

#4 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 31 July 2016 - 11:40 AM

Hi Nasdaq,

 

Thank you for your reply. I have copied the entire contents of the code in a new notepad file as instructed and saved in as fixlist.txt in the same folder/place as where my farbar tool is running from. I have then run FRST and clicked fix once, and I am still waiting since clicking fix an hour ago. At first you could see the progress bar move and what was being done detail wise; however, now when I place the mouse cursor over the program, the cursor is just going round and round, the progess bar has frozen although it is not say the program is not responding. I admit I have not disable my AV progran as suggested, having already clicked it before i saw that; I am currently posting from my other laptop but as of the moment, the farbar program is still perhaps frozen? Please advise.


Edited by compbuff, 31 July 2016 - 11:45 AM.


#5 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 31 July 2016 - 01:38 PM

Hi Nasdaq,

I seem to be seeing no activity from the FARBAR program, so I decided to restart my system, as I'm certain it should not be taking this long. Scotty has detected, on start up, the following cmd/ /c rd/q/s c:\FRST\Temp and asking if I want to accept the change; I have accepted the change, pending your advice. I've noticed a Fixlog.text on my desktop, timed at 16.44 (UK time) which was 3 minutes after clicking fix, though it just seemed to crash? I will attach it here and await your reply before proceeding further with the Zeok tool.


Edited by compbuff, 31 July 2016 - 01:39 PM.


#6 nasdaq

nasdaq

  • Malware Response Team
  • 39,214 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:05 AM

Posted 31 July 2016 - 01:40 PM

Disabling the AV was just for the time that Zoek is running.


As for the Farbar fix, it not already done, terminate the process.

Restart the computer normally.

Run Farbar normally and post a fresh FRST log for my review.

Run the Zoek tool and paste the log also.

Let me know what problem persists.

#7 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 31 July 2016 - 01:49 PM

Sorry if you missed one of my replies. I attached a fixlog file which saved on my hard drive 3 minutes after running the farbar tool over 2 hours ago. However I'll re-run it again. You say run farbar normally? As before clicking Fix? If so please advise and I shall do so, before doing the other.

 

Thank you



#8 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 31 July 2016 - 01:53 PM

Ok I have done so anyway, and this time it completed and has asked me to restart my laptop, which I have now done, and on restarting I will attach the fresh new fixlog here on this post presently, then proceed with the Zoek tool.


Edited by compbuff, 31 July 2016 - 02:04 PM.


#9 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 31 July 2016 - 02:06 PM

Unable to attach log in previous post saying it was too big to upload even though it is only 6kb. Therefore I shall post the fixlog file here:

 

Fix result of Farbar Recovery Scan Tool (x64) Version:13-04-2016
Ran by Marcus 1 (2016-07-31 19:50:45) Run:2
Running from C:\Users\Marcus 2\Desktop
Loaded Profiles: UpdatusUser & Marcus 1 & Marcus 2 (Available Profiles: UpdatusUser & Marcus 1 & Marcus 2)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start


CreateRestorePoint:
EmptyTemp:
CloseProcesses:

Winsock: Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [55296 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\napinsp.dll"
Winsock: Catalog5 02 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70144 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\pnrpnsp.dll"
Winsock: Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [70144 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\pnrpnsp.dll"
Winsock: Catalog5 04 C:\WINDOWS\SysWOW64\NLAapi.dll [65536 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [286208 2016-05-13] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [23040 2014-10-29] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\System32\winrnr.dll"
URLSearchHook: [S-1-5-21-1438436151-582650635-3674040208-1001] ATTENTION => Default URLSearchHook is missing
URLSearchHook: [S-1-5-21-1438436151-582650635-3674040208-1002] ATTENTION => Default URLSearchHook is missing
FF Extension: Block site - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2016-04-27]
FF HKU\S-1-5-21-1438436151-582650635-3674040208-1003\...\Firefox\Extensions: [{b9aa91db-385d-4c69-8a2f-96790aa9405b}] - c:\program files (x86)\copernic\desktopsearch\firefoxconnector => not found
CHR Extension: (Avast SafePrice) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-01-29]
CHR Extension: (Privacy manager) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\giccehglhacakcfemddmfhdkahamfcmd [2016-07-24]
CHR Extension: (Avast Online Security) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-06-29]
CHR Extension: (WorkFlowy) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\koegeopamaoljbmhnfjbclbocehhgmkm [2016-07-28]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-11]
CHR HKU\S-1-5-21-1438436151-582650635-3674040208-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [cnnbdaahphjgdgfhliignpepgnbnfomp] - c:\program files (x86)\copernic\desktopsearch\ChromeConnector\ChromeConnector.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
S3 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]
S2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [X]
cmd: netsh winsock reset catalog

End
*****************

Restore point was successfully created.
Processes closed successfully.
Winsock: Catalog5 000000000001\\LibraryPath => restored successfully (%SystemRoot%\system32\napinsp.dll)
Winsock: Catalog5 000000000002\\LibraryPath => restored successfully (%SystemRoot%\system32\pnrpnsp.dll)
Winsock: Catalog5 000000000003\\LibraryPath => restored successfully (%SystemRoot%\system32\pnrpnsp.dll)
Winsock: Catalog5 000000000004\\LibraryPath => restored successfully (%SystemRoot%\system32\NLAapi.dll)
Winsock: Catalog5 000000000005\\LibraryPath => restored successfully (%SystemRoot%\System32\mswsock.dll)
Winsock: Catalog5 000000000006\\LibraryPath => restored successfully (%SystemRoot%\System32\winrnr.dll)
Could not restore Default URLSearchHook.
Could not restore Default URLSearchHook.
C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} => not found.
FF Extension: Block site - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\Extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc} [2016-04-27] => not found
HKU\S-1-5-21-1438436151-582650635-3674040208-1003\Software\Mozilla\Firefox\Extensions\\{b9aa91db-385d-4c69-8a2f-96790aa9405b} => value not found.
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck => not found
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\giccehglhacakcfemddmfhdkahamfcmd => not found
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki => not found
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\koegeopamaoljbmhnfjbclbocehhgmkm => not found
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => not found
HKU\S-1-5-21-1438436151-582650635-3674040208-1003\SOFTWARE\Google\Chrome\Extensions\cnnbdaahphjgdgfhliignpepgnbnfomp => key not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck => key not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gomekmidlodglbbmalcneegieacbdmki => key not found.
AvastVBoxSvc => service could not remove
BstHdUpdaterSvc => service not found.

=========  netsh winsock reset catalog =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========

EmptyTemp: => 167.1 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 19:51:18 ====



#10 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 31 July 2016 - 02:33 PM

As of yet, the Zoek tool is still running, and since I don't know how long it is expected to do so, I'm noting for your information that it is still running an =d if this is correct then I shall post the zoek results log file when it has completed.



#11 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 31 July 2016 - 03:58 PM

I have now found a worrying process called PEVZ.exe running as a service which I killed instantly, since running the zoek tool which never automatically closed it's window and I killed the process to restart windows and my AV program restarted automatically. I shall post the zoek-results log that I was surprised even to find in the C drive. Is it a full results log? since I'm not even sure if it fully completed I don't know. I'm now running a full malwarebytes antimalware scan to see if it detects this PEVZ.exe process.

 

The research stated it as follows:

 

Little is known about the PEVZ.exe process, since there is no reference to the producer within the file.

 

Description: PEVZ.exe is not essential for Windows and will often cause problems. The file PEVZ.exe is located in the C:\Windows folder. Known file sizes on Windows 10/8/7/XP are 256,000 bytes (75% of all occurrences) or 261,632 bytes. space.gif 
The program has no file description. The file is an unknown file in the Windows folder. The program has no visible window. The PEVZ.exe file is not a Windows core file. Therefore the technical security rating is 84% dangerous, however you should also read the user reviews.

 

If PEVZ.exe is located in a subfolder of C:\, the security rating is 56% dangerous. The file size is 256,000 bytes (50% of all occurrences) or 256,512 bytes. There is no description of the program. The program has no visible window. The PEV.exe file is not a Windows system file.

 

Important: Some malware camouflages itself as PEVZ.exe.

 

To help you analyze the PEVZ.exe process on your computer, the following programs have proven to be helpful: Security Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

 

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

 

This day is not going well and i have spent hours already and it's 10pm and I now have to head to bed to be up for work. I'm afraid the zoek-results log will not upload due to being 'too big a file' It's only 32 bytes. I shall post tomorrow as I now cannot assign any more time tonight to this problem.


Edited by compbuff, 31 July 2016 - 04:16 PM.


#12 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 31 July 2016 - 04:13 PM

I also shortly after just found  this article as well:

 

https://www.hybrid-analysis.com/sample/0080253e617db80cf3e4652357cb1eb05f17cbfc704e704e77aabec63065982e?environmentId=1

 

which states that the zoek tool spawns a lot of processes, including the PEVZ.exe process as well, and detected as malicious by trusted AV engines; even if it could still be a false positive, until then it is very worrying after reading that. Right now I don't know what to make of this, whilst my malwarebytes antimalware is still scanning.



#13 nasdaq

nasdaq

  • Malware Response Team
  • 39,214 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:05 AM

Posted 01 August 2016 - 06:57 AM

I trust the Zoek tool. It uses the PEVZ.exe and is safe when run in the context of the tool.

Do not run Zoek if other tool are running.
Close all processes and Windows then run the Zoek.

#14 compbuff

compbuff
  • Topic Starter

  • Members
  • 117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:05 PM

Posted 01 August 2016 - 08:23 AM

Thank you for your reply and explanation. I researched elsewhere earlier today that was the case, when run in the context of the tool. I will paste the original log, assuming it is the full log as explained above, since the Zoek window never closed yet a log was shown in the C drive. Otherwise if it should have closed and then let me know if I should do it again.

 

 

 

Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by Marcus 1 on 31/07/2016 at 20:15:42.95.
Microsoft Windows 8.1 6.3.9600  x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Marcus 2\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

31/07/2016 20:18:56 Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\Program Files\mcafee deleted successfully
C:\Program Files\mcafee.com deleted successfully
C:\PROGRA~3\Copernic deleted successfully
C:\Users\Marcus 1\AppData\Roaming\HpUpdate deleted successfully
C:\Users\Marcus 1\AppData\Roaming\Mozilla deleted successfully
C:\Users\Marcus 1\AppData\Roaming\stayfocused2 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_223433 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_223434 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_223435 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_223436 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_223437 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_223438 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_224133 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_224134 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_224828 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_224829 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225430 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225431 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225432 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225433 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225434 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225435 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225436 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225437 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225438 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225439 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225440 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225441 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225444 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225445 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160208_225446 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160209_010734 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160209_010735 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160209_010736 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160209_010737 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160209_020553 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160209_021658 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160209_023811 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_004018 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_025902 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_030155 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_030156 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_030858 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_041155 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_041619 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_042431 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_042646 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_042928 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_042929 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_044154 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_044319 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_044824 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_050234 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_050646 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_050844 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_151033 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_151034 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160210_161538 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_001626 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_001627 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_015614 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_021816 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_021934 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022020 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022042 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022043 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022044 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022045 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022046 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022047 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022048 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022049 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022053 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022056 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022058 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022059 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022100 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_022105 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_023137 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_025432 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_030337 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_032524 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_034348 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_035219 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_035557 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_144740 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_144741 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_144836 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_145828 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_145931 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_150309 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_150609 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_151257 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_152310 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_154806 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_154945 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_155401 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_155710 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_155905 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160211_224852 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001536 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001537 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001538 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001539 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001827 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001830 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001831 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001832 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001833 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001834 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001835 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001838 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001839 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001840 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001847 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001849 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001850 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001851 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001852 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001853 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001854 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001859 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001901 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001902 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001904 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001905 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001906 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001908 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001916 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001918 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001919 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001920 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001928 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001932 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001934 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001937 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001938 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_001939 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_002049 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_002919 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_004230 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_052830 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_052952 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_053115 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_053311 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_053609 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_053656 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_054508 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_054602 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_054736 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_054842 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160217_055442 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160218_112828 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_012546 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_012547 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_012548 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_013029 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_013033 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_013034 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_013035 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_013044 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_013046 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_013100 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_013110 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_013318 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_022734 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160220_022735 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160221_041707 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160221_041708 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160221_042118 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160221_042131 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160221_042151 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160221_042450 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160221_042452 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160221_044139 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160221_044258 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160222_023953 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160222_024340 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160222_214134 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160222_220902 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160222_222435 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160222_222505 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160222_222528 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_110415 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_180041 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_182403 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_183142 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_184222 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_185350 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_190434 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_190854 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_191536 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_192131 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_210914 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_211834 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_213906 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_215435 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_215437 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_224403 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_224856 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_225155 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_232326 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_233324 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160223_234916 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_105351 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_110018 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_110559 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_111704 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_112107 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_112400 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_112845 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_114138 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_114140 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_114631 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_114633 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_131331 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_131333 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_131941 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_131942 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_131943 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132730 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132734 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132735 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132736 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132738 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132739 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132740 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132741 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132742 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132754 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132801 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132806 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132812 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132822 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132823 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132834 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132836 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132842 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132851 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132855 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132900 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_132901 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_133646 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_145944 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_150939 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_160155 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_202138 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_202140 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_204748 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_204750 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_215303 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_215305 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_215413 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_221337 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_221339 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_222654 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_222656 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_224710 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_224712 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_224755 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_224757 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_231214 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_231216 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_232314 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_232316 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_235732 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_235734 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_235905 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_235907 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_235925 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_235927 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_235945 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160224_235947 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_002037 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_002039 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_002107 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_002109 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_002128 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_002130 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_002153 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_002155 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_003348 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_003350 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_003432 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_003435 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_003818 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_004230 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_004233 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_004817 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_004819 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011245 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011247 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011307 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011309 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011328 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011330 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011359 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011401 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011427 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_011429 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014434 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014436 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014502 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014504 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014531 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014533 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014559 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014602 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014627 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014630 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014701 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014703 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014751 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014753 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014818 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_014821 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_021254 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_021256 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_185948 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_185949 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_185950 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_185951 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204040 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204620 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204623 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204624 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204625 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204627 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204628 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204629 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204630 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204641 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204646 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204647 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204649 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204659 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204701 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204703 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204704 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204707 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204708 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204709 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204710 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204712 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204714 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204715 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204724 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204725 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204726 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204730 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204737 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204743 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204746 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204748 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204753 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204802 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204803 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204804 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204813 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204814 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_204817 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_205108 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_205110 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_205137 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_205140 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_205203 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_205206 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_225016 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160225_225019 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160228_002335 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_210628 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_210629 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_210840 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_211031 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_211033 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_211117 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_224505 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_224508 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_225807 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_225810 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_230443 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_230445 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_230810 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_230812 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_231503 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_231506 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_231718 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_231721 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_231921 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_231923 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_232050 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_232406 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160302_232408 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160303_001015 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160303_011746 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160303_011747 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160303_012137 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160303_012138 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160303_012209 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_213619 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_213620 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_215102 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_215103 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_220112 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_220113 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_220702 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_220703 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_221122 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_221511 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_221712 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_221713 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_221914 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_221915 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_222339 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160311_222340 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160326_005410 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160326_005411 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160326_005808 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160326_010639 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160326_011220 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160326_012656 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_005649 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_005650 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_010344 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_010345 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_010407 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_010429 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_010456 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_010457 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_010514 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_010544 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_012345 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160330_012346 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160331_060502 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160331_060503 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160331_060647 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160331_061603 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160331_061604 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160412_211718 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160412_211719 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160412_211754 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160412_211755 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160412_211816 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160412_214009 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160412_214415 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160423_213809 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160423_213810 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160423_213811 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160423_215442 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160423_220123 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160423_220214 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160423_220301 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160423_220302 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160423_230730 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160507_233105 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160507_233106 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160507_234055 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160507_234730 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160507_235205 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160507_235206 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160508_000425 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_181159 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_181200 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_183930 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_183931 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_184014 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_184041 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_184111 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_184135 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_185735 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_191154 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_191155 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_235541 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160510_235542 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160511_000115 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160511_000116 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160511_000138 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160511_000139 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160511_000206 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_225935 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_225936 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_230402 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_230403 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_230443 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_230444 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_231300 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_231330 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_231355 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_231426 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_231427 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_231536 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160517_232550 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160518_005843 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_020000 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_020848 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_020849 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_020927 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021014 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021015 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021057 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021133 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021200 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021224 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021225 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021253 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021406 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021407 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021519 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021602 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_021650 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_034150 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_034232 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160519_034233 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_000034 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_000107 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_000108 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_000241 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_000242 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_021916 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_021917 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_202702 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_202703 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160520_203202 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160524_234736 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160524_234737 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160524_234811 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160524_234844 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160524_234845 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160524_234919 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160524_234948 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160524_234949 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160525_003226 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160525_003245 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160525_003246 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160525_003304 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160525_003305 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160525_011118 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160525_011119 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160531_234003 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160531_234004 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160531_234609 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_220104 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_220105 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_230518 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_230519 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_230928 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_231155 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_231156 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_231328 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_231531 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160602_234708 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160603_233934 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160603_233935 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160603_234506 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160603_234545 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160604_220043 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160604_220044 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160604_225026 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160604_225047 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_162010 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_164603 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_165401 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_165402 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_224954 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_230615 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_230616 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_230644 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_230707 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_230740 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160605_232241 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160607_235647 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_000009 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_000110 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_000111 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_000350 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_002246 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_002247 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_002953 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_003633 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_011412 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_012615 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_012616 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_235841 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160608_235842 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_001027 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_001028 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_001044 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_001113 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_152612 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_152613 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_233752 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_233753 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_234124 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_234125 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_234204 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160609_234205 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160610_010649 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160610_010650 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160610_011726 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160610_011758 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160611_033942 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160611_034356 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160611_034357 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160611_034456 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160611_034546 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160611_034639 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160611_034640 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160706_142930 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160706_142931 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160706_143743 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124538 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124539 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124540 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124541 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124542 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124543 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124544 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124545 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124546 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124547 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124548 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124549 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124550 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\ebook_convert_20160707_124551 deleted successfully
C:\Users\Marcus 2\AppData\Roaming\EncryptStick deleted successfully
C:\Users\Marcus 2\AppData\Roaming\Kindlian deleted successfully
C:\Users\Marcus 2\AppData\Roaming\Windows Live Writer deleted successfully
C:\Users\Marcus 1\AppData\Local\EmieSiteList deleted successfully
C:\Users\Marcus 1\AppData\Local\EmieUserList deleted successfully
C:\Users\Marcus 2\AppData\Local\EmieSiteList deleted successfully
C:\Users\Marcus 2\AppData\Local\EmieUserList deleted successfully
C:\Users\Marcus 2\AppData\Local\MediaShow deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\0011931469923826mcinstcleanup deleted successfully

==== FireFox Fix ======================

Deleted from C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\prefs.js:
user_pref("browser.startup.homepage", "www.google.co.uk");

Added to C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\prefs.js:

Deleted from C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\krsmzvca.Extension Testing\prefs.js:

Added to C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\krsmzvca.Extension Testing\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\qc4gwy4a.Social media\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.co.uk/");

Added to C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\qc4gwy4a.Social media\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\prefs.js:
user_pref("browser.startup.homepage", "https://www.malwarebytes.org/restorebrowser//?s=acer&m=start");
user_pref("browser.search.defaultenginename", "Web Search");
user_pref("browser.search.selectedEngine", "Web Search");user_pref("network.proxy.type", );

Added to C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Users\MARCUS~2\AppData\Roaming\Zotero\Zotero\Profiles\qv2wl8a7.default\prefs.js:

Added to C:\Users\MARCUS~2\AppData\Roaming\Zotero\Zotero\Profiles\qv2wl8a7.default\prefs.js:

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_072016_2045_.backup

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\krsmzvca.Extension Testing

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_072016_2045_.backup

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\qc4gwy4a.Social media

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_072016_2045_.backup

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_072016_2045_.backup

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Zotero\Zotero\Profiles\qv2wl8a7.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_072016_2045_.backup

==== Batch Command(s) Run By Tool======================


==== Deleting Files \ Folders ======================

C:\Users\Marcus 1\AppData\Roaming\FireShot deleted
C:\windows\SysNative\Tasks\Open URL by RoboForm deleted
C:\PROGRA~2\Yahoo! deleted
C:\Users\Public\Pokki deleted
C:\Users\Marcus 1\AppData\Roaming\url.txt deleted
C:\Users\Marcus 2\AppData\Roaming\url.txt deleted
C:\Users\Marcus 2\AppData\Roaming\Yahoo! deleted
C:\PROGRA~3\win_mpwd_sys.dat deleted
C:\PROGRA~3\Yahoo! deleted
C:\PROGRA~3\InstallMate deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Marcus 2\AppData\Local\CrashRpt deleted
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\CrashRpt deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\WINDOWS\SysNative\config\systemprofile\Searches deleted
C:\Users\Marcus 1\Documents\Add-in Express deleted
C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\jetpack deleted
C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\qc4gwy4a.Social media\jetpack deleted
C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\jetpack deleted
C:\Users\Public\Desktop\YouTubeSongDownloader.lnk deleted
C:\Users\Marcus 2\Downloads\wpsetup.exe deleted
"C:\Windows\Installer\6cfae.msi" deleted

==== Orphaned Tasks deleted from Registry ======================

avast Emergency Update deleted
Open URL by RoboForm deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\krsmzvca.Extension Testing
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\qc4gwy4a.Social media
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{4ED1F68A-5463-4931-9384-8FFF5ED91D92}"="C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi" [24/05/2016 17:21]
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{4ED1F68A-5463-4931-9384-8FFF5ED91D92}"="C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi" [24/05/2016 17:21]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{22119944-ED35-4ab1-910B-E619EA06A115}"="C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox\roboform.xpi" [17/06/2016 20:15]

==== Firefox Extensions ======================

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931
- FEBE - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
- FireShot Pro - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\extensions\{5e11ab1e-083c-11e5-a6c0-1697f925ec7b}
- Zotero Word for Windows Integration - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\extensions\zoteroWinWordIntegration@zotero.org
- HTTPS-Everywhere - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\dfikk5fw.default-1461747430931\extensions\https-everywhere-eff@eff.org
- Anti-Aliasing Tuner - %ProfilePath%\extensions\aatuner@hotmint.com
- HTTPS-Everywhere - %ProfilePath%\extensions\https-everywhere-eff@eff.org
- Zotero Word for Windows Integration - %ProfilePath%\extensions\zoteroWinWordIntegration@zotero.org
- FireShot - %ProfilePath%\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
- FEBE - %ProfilePath%\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
- FireShot Pro - %ProfilePath%\extensions\{5e11ab1e-083c-11e5-a6c0-1697f925ec7b}
- LeechBlock - %ProfilePath%\extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}
- TextMarker Go - %ProfilePath%\extensions\{cd6c4ebf-366e-45a0-98b5-b8217288eed7}
- Bitdefender QuickScan - %ProfilePath%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
- Grammarly for Firefox - %ProfilePath%\extensions\87677a2c52b84ad3a151a4a72f5bd3c4@jetpack.xpi
- Netflix Super Browse - %ProfilePath%\extensions\@cyris.xpi
- about:addons-memory 2016 - %ProfilePath%\extensions\about-addons-memory@sturdiguns.org.xpi
- about:addons-memory - %ProfilePath%\extensions\about-addons-memory@tn123.org.xpi
- Fetching - %ProfilePath%\extensions\add-on@fetching.io.xpi
- Undetermined - %ProfilePath%\extensions\cam@sdrocking.com.xpi
- Facebook Disconnect - %ProfilePath%\extensions\facebook@disconnect.me.xpi
- F.B. Purity - Cleans Up Facebook - %ProfilePath%\extensions\fbp@fbpurity.com.xpi
- Unseen on Facebook TM - %ProfilePath%\extensions\fbunseen@jackem.org.xpi
- YouTube Video and Audio Downloader - %ProfilePath%\extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi
- GrabMyBooks - %ProfilePath%\extensions\info@grabMyBooks.com.xpi
- Bookmax - %ProfilePath%\extensions\jid0-fV7XvaHKKf7Fjf3aBynVQBq7bhY@jetpack.xpi
- Push to Kindle - %ProfilePath%\extensions\jid0-GokC6R49cBZciOKniufAR4QKFWc@jetpack.xpi
- Netflix Plus - %ProfilePath%\extensions\jid0-thbzZj1IIKe4A7ggnuyqMnmaa5U@jetpack.xpi
- Undetermined - %ProfilePath%\extensions\jid0-XZn6pYCdV3ANrfYigxlyyGDrxAM@jetpack.xpi
- Add to Wunderlist - %ProfilePath%\extensions\jid1-3gu11JeYBiIuJA@jetpack.xpi
- Shoptagr - %ProfilePath%\extensions\jid1-7Leo4L1PA6WjVw@jetpack.xpi
- Privacy Settings - %ProfilePath%\extensions\jid1-CKHySAadH4nL6Q@jetpack.xpi
- Google Translator - %ProfilePath%\extensions\jid1-dgnIBwQga0SIBw@jetpack.xpi
- Lightbeam - %ProfilePath%\extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi
- Policy Control JavaScript CSS Media ... - %ProfilePath%\extensions\jid1-gHwvGmJ8Ii9oOq@jetpack.xpi
- Media Converter and Muxer - %ProfilePath%\extensions\jid1-kps5PrGBNtzSLQ@jetpack.xpi
- Speed Tweaks SpeedyFox - %ProfilePath%\extensions\jid1-wZqm19rJzRkZUA@jetpack.xpi
- Double-click Image Downloader - %ProfilePath%\extensions\jid1-xgtdawe3yyUeBQ@jetpack.xpi
- list.it em:version0.5.0.2.1-signed.1-let-fixed.1-signed em:type2 em:creatoremax em:descriptionThe list.it project is a simple micro-note taking tool from MIT CSAIL for PIM Research. em:homepageURLhttp:welist.it em:optionsURLchrome:listitcontentaboutabout.htmlpreferences - %ProfilePath%\extensions\listit@csail.mit.edu.xpi
- NoSquint - %ProfilePath%\extensions\nosquint@urandom.ca.xpi
- Phrase Highlighter - %ProfilePath%\extensions\phrasehighlighter@techtoast.co.uk.xpi
- Previous Folders - %ProfilePath%\extensions\previousfolders@sapa.mine.nu.xpi
- Private Tab - %ProfilePath%\extensions\privateTab@infocatcher.xpi
- RescueTime - %ProfilePath%\extensions\rescuetime_firefox@rescuetime.com.xpi
- Restart - %ProfilePath%\extensions\Restart@schuzak.jp.xpi
- Save File to - %ProfilePath%\extensions\savefileto@mozdev.org.xpi
- Simple Timer - %ProfilePath%\extensions\simpletimer@grbradt.org.xpi
- Status-4-Evar - %ProfilePath%\extensions\status4evar@caligonstudios.com.xpi
- TinEye Reverse Image Search - %ProfilePath%\extensions\tineye@ideeinc.com.xpi
- Trafficlight - %ProfilePath%\extensions\trafficlight@bitdefender.com.xpi
- YesScript - %ProfilePath%\extensions\yesscript@userstyles.org.xpi
- Zoom Page - %ProfilePath%\extensions\zoompage@DW-dev.xpi
- Zotero - %ProfilePath%\extensions\zotero@chnm.gmu.edu.xpi
- Facebook Phishing Protector - %ProfilePath%\extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}.xpi
- URL Fixer - %ProfilePath%\extensions\{0fa2149e-bb2c-4ac2-a8d3-479599819475}.xpi
- Stylish - %ProfilePath%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
- Speed Dial - %ProfilePath%\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
- Video DownloadHelper - %ProfilePath%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi
- Saved From URL - %ProfilePath%\extensions\{be102f2d-bf47-49db-8dcc-a2ccd1c8d376}.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
- DownThemAll - %ProfilePath%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
- QuickJava - %ProfilePath%\extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi
- User Agent Switcher - %ProfilePath%\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi
- ProfileSwitcher - %ProfilePath%\extensions\{fa8476cf-a98c-4e08-99b4-65a69cb4b7d4}.xpi

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\krsmzvca.Extension Testing
- FireShot Pro - %ProfilePath%\extensions\{5e11ab1e-083c-11e5-a6c0-1697f925ec7b}

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\qc4gwy4a.Social media
- LastPass - %ProfilePath%\extensions\support@lastpass.com
- FEBE - %ProfilePath%\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
- FireShot Pro - %ProfilePath%\extensions\{5e11ab1e-083c-11e5-a6c0-1697f925ec7b}
- about:addons-memory 2016 - %ProfilePath%\extensions\about-addons-memory@sturdiguns.org.xpi
- Facebook Disconnect - %ProfilePath%\extensions\facebook@disconnect.me.xpi
- F.B. Purity - Cleans Up Facebook - %ProfilePath%\extensions\fbp@fbpurity.com.xpi
- Status-4-Evar - %ProfilePath%\extensions\status4evar@caligonstudios.com.xpi
- Zoom Page - %ProfilePath%\extensions\zoompage@DW-dev.xpi
- Facebook Phishing Protector - %ProfilePath%\extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default
- <--Block site--> - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
- DownloadHelper - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
- FEBE - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
- FireShot - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
- ColorfulTabs - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
- Pocket - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\extensions\isreaditlater@ideashower.com
- Anti-Aliasing Tuner - C:\Users\Marcus 2\AppData\Roaming\Mozilla\Firefox\Profiles\xfil7t6l.default\extensions\aatuner@hotmint.com
- Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
- Anti-Aliasing Tuner - %ProfilePath%\extensions\aatuner@hotmint.com
- Pocket - %ProfilePath%\extensions\isreaditlater@ideashower.com
- ColorfulTabs - %ProfilePath%\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
- FireShot - %ProfilePath%\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
- FEBE - %ProfilePath%\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
- DownloadHelper - %ProfilePath%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
- <--Block site--> - %ProfilePath%\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
- about:addons-memory - %ProfilePath%\extensions\about-addons-memory@tn123.org.xpi
- Undetermined - %ProfilePath%\extensions\cam@sdrocking.com.xpi
- Facebook Disconnect - %ProfilePath%\extensions\facebook@disconnect.me.xpi
- F.B. Purity - Cleans Up Facebook - %ProfilePath%\extensions\fbp@fbpurity.com.xpi
- Bookmax - %ProfilePath%\extensions\jid0-fV7XvaHKKf7Fjf3aBynVQBq7bhY@jetpack.xpi
- Google Translator - %ProfilePath%\extensions\jid1-dgnIBwQga0SIBw@jetpack.xpi
- Lightbeam - %ProfilePath%\extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi
- Double-click Image Downloader - %ProfilePath%\extensions\jid1-xgtdawe3yyUeBQ@jetpack.xpi
- list.it - %ProfilePath%\extensions\listit@csail.mit.edu.xpi
- NoSquint - %ProfilePath%\extensions\nosquint@urandom.ca.xpi
- Previous Folders - %ProfilePath%\extensions\previousfolders@sapa.mine.nu.xpi
- RescueTime for Firefox - %ProfilePath%\extensions\rescuetime_firefox@rescuetime.com.xpi
- Restart - %ProfilePath%\extensions\Restart@schuzak.jp.xpi
- Simple Timer - %ProfilePath%\extensions\simpletimer@grbradt.org.xpi
- Status-4-Evar - %ProfilePath%\extensions\status4evar@caligonstudios.com.xpi
- TinEye Reverse Image Search - %ProfilePath%\extensions\tineye@ideeinc.com.xpi
- YesScript - %ProfilePath%\extensions\yesscript@userstyles.org.xpi
- LeechBlock - %ProfilePath%\extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi
- Saved From URL - %ProfilePath%\extensions\{be102f2d-bf47-49db-8dcc-a2ccd1c8d376}.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
- DownThemAll - %ProfilePath%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
- QuickJava - %ProfilePath%\extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi
- ProfileSwitcher - %ProfilePath%\extensions\{fa8476cf-a98c-4e08-99b4-65a69cb4b7d4}.xpi

ProfilePath: C:\Users\MARCUS~2\AppData\Roaming\Zotero\Zotero\Profiles\qv2wl8a7.default
- Zotero LibreOffice Integration - C:\Program Files (x86)\Zotero Standalone\extensions\zoteroOpenOfficeIntegration@zotero.org
- Zotero Word for Windows Integration - C:\Program Files (x86)\Zotero Standalone\extensions\zoteroWinWordIntegration@zotero.org

AppDir: C:\Program Files\Mozilla Firefox
- Undetermined - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

==== Firefox Plugins ======================


==== Chromium Look ======================

Google Chrome Version: 46.0.2490.86

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
daanglpcpkjjlkhcbladppjphglbigam - No path found[]
fheoggkfdfchfphceeifdbepaooicaho - No path found[]
pnlccmojcmeohlpggmfnbbiapkmbliob - C:\Program Files (x86)\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx[17/06/2016 20:15]

Avast Online Security (BETA) - Marcus 1\AppData\Local\Google\Chrome\User Data\Default\Extensions\daanglpcpkjjlkhcbladppjphglbigam
Avast SafePrice - Marcus 1\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck
SiteAdvisor - Marcus 1\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho
Avast Online Security - Marcus 1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
RoboForm - Marcus 1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnlccmojcmeohlpggmfnbbiapkmbliob
Lockify - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiigoloogeminempipceaikpnaimbekd
1Password - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aomjjhallfgjeglblehebfpbcfeobpgk
Rapport - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjllphbppobebmjpjcijfbakobcheof
Google Tips - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnhacgcmhcgppboemgoobibkhlpglejb
Spotify - Music for every moment - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnkjkdjlofllcpbemipjbcpfnglbgieh
Fraction Calculator - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\daknohebamnokicgmpigepchllkhkdah
MaskMe - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpkiidbpeijnaaacjlfnijncdlkicejg
Torrent Turbo Search App - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\eegbffmjdkflkcfncpfjjbggbdlnbdif
Fair Ads (by STANDS) - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\gagfkmknmijppikpcikmbbkdkhggcmge
LastPass - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd
Unlimited Full Movies - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\himnkobpbjfgkpdklgmjbhhkllkonfcd
Mogicons.com - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkdlcejbjnnmjgajjjfenejacioiimpp
Writer - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlddiopdeghmcmdjjmpdegemnojihpib
Amazon Storywriter - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmcnhpcghhifadgblhkonelnmbenkeep
Facebook unseen - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\iicapmagmhahddefgokbabbgieiogjop
Unlimeted VPN Browsec - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\jccmoegogckfgbnllaapbhbpcohhknmc
Word Search - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\jigekglfaceoiilbabcffhhakffifpci
Webflow - Website Builder - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\kabncpcembkecekibfmamlbogjefdnae
How Many Calories - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\klcnombbhgdapimghbinkjjolmadnnhe
StayFocusd - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\laankejkbhbdhmipfmgcngdelahlfoji
Marauders Map - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\mliofombcghaamgjkmmmmlepkiacdhkh
IOS 7 Home - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmapjnboohofgcploolgjojhcdedckha
Play Books - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmimngoggfoobjdlefbcabngfnmieonb
Recipe Cookbook - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nekpdjbfkadaebgjbhailkaodcdlnadi
Save to Pocket - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj
imo free video calls and text - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocaebkdojpikfmhmnekiflipcicedobi
Pre-Algebra - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\okbpppjneapanomfkhjlkkpffmbkkfbl
myHomework - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pembccdigcahnckbjcbehhcacplbbomj
Crossword Fun - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmfgofhllajilkgpgocondlicpbcoaad
RoboForm - Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnlccmojcmeohlpggmfnbbiapkmbliob

==== Chromium Fix ======================

C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_wordfinder.yourdictionary.com_0.localstorage deleted successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_wordfinder.yourdictionary.com_0.localstorage-journal deleted successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.wordfind.com_0.localstorage deleted successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.wordfind.com_0.localstorage-journal deleted successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage deleted successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage-journal deleted successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage deleted successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage-journal deleted successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_sdw1.lightspeedgmiservices.com_0.localstorage deleted successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_sdw1.lightspeedgmiservices.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{921825F4-418D-4C0E-B7B7-E05CB3E6D1EE}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - No_Url_Value
HKLM\SearchScopes\{921825F4-418D-4C0E-B7B7-E05CB3E6D1EE} - http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ACJB
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{921825F4-418D-4C0E-B7B7-E05CB3E6D1EE}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - No_Url_Value
HKLM\Wow6432Node\SearchScopes\{921825F4-418D-4C0E-B7B7-E05CB3E6D1EE} - http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ACJB
HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

==== Reset Google Chrome ======================

C:\Users\Marcus 1\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Marcus 1\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Marcus 1\AppData\Local\Private Internet Access\User Data\Default\Preferences was reset successfully
C:\Users\Marcus 1\AppData\Local\Private Internet Access\User Data\Default\Secure Preferences was reset successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Marcus 1\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Marcus 1\AppData\Local\Private Internet Access\User Data\Default\Web Data was reset successfully
C:\Users\Marcus 1\AppData\Local\Private Internet Access\User Data\Default\Web Data-journal was reset successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Marcus 2\AppData\Local\Google\Chrome\User Data\Default\Web Data.tmp was reset successfully

==== shortcuts on Users Desktops ======================

C:\Users\Marcus 1\Desktop\AllMyNotes Organizer.lnk - E:\Program Files (x86)\AllMyNotes Organizer\AllMyNotes.exe
C:\Users\Marcus 1\Desktop\Anki.lnk - C:\Program Files (x86)\Anki\anki.exe
C:\Users\Marcus 1\Desktop\AnyTime Organizer.lnk - E:\Program Files (x86)\AnyTime Organizer Deluxe\Atw.exe
C:\Users\Marcus 1\Desktop\Customize Fences.lnk - C:\Program Files (x86)\Stardock\Fences\Fences.exe /FromDesktop
C:\Users\Marcus 1\Desktop\FileHippo App Manager.lnk - C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
C:\Users\Marcus 1\Desktop\My Blood Pressure.lnk - E:\Program Files (x86)\My-BP\My-BP.exe
C:\Users\Marcus 1\Desktop\My Weight Software.lnk - C:\Program Files (x86)\My-Weight\My-Weight.exe
C:\Users\Marcus 1\Desktop\PerformanceTest.lnk - E:\Programs\PerformanceTest\PerformanceTest64.exe
C:\Users\Marcus 1\Desktop\Stayfocused.lnk - C:\Program Files (x86)\Bytesignals\Stayfocused\stayfocused.exe
C:\Users\Marcus 1\Desktop\VisioTask.lnk - C:\Users\Marcus 1\Documents\VisioTask\VisioTask.exe
C:\Users\Marcus 1\Desktop\XMind 6.lnk - E:\Program Files (x86)\XMind\XMind.exe
C:\Users\Marcus 2\Desktop\AllMyNotes - Shortcut.lnk - E:\Program Files (x86)\AllMyNotes Organizer\AllMyNotes.exe
C:\Users\Marcus 2\Desktop\Amazon Cloud Drive.lnk - C:\Users\Marcus 2\AppData\Local\Amazon Cloud Drive\AmazonCloudDrive.exe --source-desktop
C:\Users\Marcus 2\Desktop\Anki.lnk - C:\Program Files (x86)\Anki\anki.exe
C:\Users\Marcus 2\Desktop\AnyTime Organizer.lnk - E:\Program Files (x86)\AnyTime Organizer Deluxe\Atw.exe
C:\Users\Marcus 2\Desktop\Chrome App Launcher.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --show-app-list
C:\Users\Marcus 2\Desktop\Customize Fences.lnk - C:\Program Files (x86)\Stardock\Fences\Fences.exe /FromDesktop
C:\Users\Marcus 2\Desktop\Diffractor.lnk - C:\Users\Marcus 2\AppData\Local\Diffractor\Diffractor.exe
C:\Users\Marcus 2\Desktop\Dropbox.lnk - C:\Program Files (x86)\Dropbox\Client\Dropbox.exe /home
C:\Users\Marcus 2\Desktop\FileHippo.AppManager.lnk - C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
C:\Users\Marcus 2\Desktop\FileLocator Pro.lnk - C:\Program Files (x86)\Mythicsoft\FileLocator Pro\FileLocatorPro.exe
C:\Users\Marcus 2\Desktop\Huawei router - Shortcut.lnk -  
C:\Users\Marcus 2\Desktop\Kindle.lnk - C:\Users\Marcus 2\AppData\Local\Amazon\Kindle\application\Kindle.exe
C:\Users\Marcus 2\Desktop\Kindlian.lnk - C:\Users\Marcus 2\AppData\Roaming\Microsoft\Installer\{6BC15173-1A04-4400-BAF2-4674B6DD36DE}\_8B3350F8C6A0FE52B690D1.exe
C:\Users\Marcus 2\Desktop\Microsoft Office Excel 2007.lnk - C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
C:\Users\Marcus 2\Desktop\Microsoft Office Word 2007.lnk - C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
C:\Users\Marcus 2\Desktop\Mind Collected.lnk - C:\Users\Marcus 2\Documents\Mind Collected\Mind Collected.exe
C:\Users\Marcus 2\Desktop\Private Internet Access.lnk - C:\Program Files (x86)\pia_manager\pia_manager.exe
C:\Users\Marcus 2\Desktop\RoboForm Activation.LNK - C:\Users\Marcus 2\Documents\My RoboForm Data\Default Profile\RoboForm Activation.rfp -l
C:\Users\Marcus 2\Desktop\Smartflix.lnk - C:\Users\Marcus 2\AppData\Local\smartflix\Update.exe --processStart Smartflix.exe
C:\Users\Marcus 2\Desktop\Swift To-Do List.lnk - C:\Users\Marcus 2\AppData\Local\Swift To-Do List\Swift To-Do List.exe
C:\Users\Marcus 2\Desktop\Wunderlist.lnk - C:\Users\Marcus 2\AppData\Local\Wunderlist\Wunderlist.exe
C:\Users\UpdatusUser\Desktop\Anki.lnk - C:\Program Files (x86)\Anki\anki.exe
C:\Users\UpdatusUser\Desktop\AnyTime Organizer.lnk - E:\Program Files (x86)\AnyTime Organizer Deluxe\Atw.exe

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\1Password 4.lnk - E:\Program Files (x86)\1Password 4\1Password.exe
C:\Users\Public\Desktop\Acer Docs.lnk - C:\Program Files (x86)\Acer\AcerCloud Docs\AcerCloud Docs.exe
C:\Users\Public\Desktop\Acer Portal.lnk - C:\Program Files (x86)\Acer\Acer Portal\acpanel_win.exe
C:\Users\Public\Desktop\Acer Remote Files.lnk - C:\Program Files (x86)\Acer\Remote Files\RemoteFilesService.exe --open-shell --check-update
C:\Users\Public\Desktop\Acronis True Image 2015.lnk - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageLauncher.exe
C:\Users\Public\Desktop\All My Movies .lnk - C:\Program Files (x86)\AllMyMovies\allmymovies.exe
C:\Users\Public\Desktop\AntiBrowserSpy.lnk - C:\Program Files (x86)\AntiBrowserSpy\AntiBrowserSpy.exe
C:\Users\Public\Desktop\Avast Premier.lnk - C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Users\Public\Desktop\Avast SafeZone Browser.lnk - C:\Program Files\AVAST Software\SZBrowser\launcher.exe
C:\Users\Public\Desktop\Book Collector.lnk - C:\Program Files (x86)\Collectorz.com\Book Collector\BookCollector.exe
C:\Users\Public\Desktop\Boxcryptor.lnk - C:\Program Files (x86)\Boxcryptor\Boxcryptor.exe
C:\Users\Public\Desktop\Buy Online.lnk - C:\Program Files (x86)\Accessory Store\StartUrl.exe http://go.acer.com/?id=13397&model=Aspire V3-772G
C:\Users\Public\Desktop\calibre - E-book management.lnk - C:\Program Files (x86)\Calibre2\calibre.exe
C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk - C:\Program Files (x86)\Calibre2\calibre.exe
C:\Users\Public\Desktop\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner64.exe
C:\Users\Public\Desktop\CPUID CPU-Z.lnk - C:\Program Files\CPUID\CPU-Z\cpuz.exe
C:\Users\Public\Desktop\CyberLink PowerDVD 14.lnk - C:\Program Files (x86)\CyberLink\PowerDVD14\PDVDLP.exe
C:\Users\Public\Desktop\EasyUEFI.lnk - C:\Program Files\EasyUEFI\bin\EasyUEFI.exe
C:\Users\Public\Desktop\Epubor Ultimate.lnk - C:\Program Files (x86)\ultimate\ultimate.exe
C:\Users\Public\Desktop\EssentialPIM Pro.lnk - C:\Program Files (x86)\EssentialPIM Pro\EssentialPIM.exe
C:\Users\Public\Desktop\Folder Lock.lnk - C:\Program Files (x86)\NewSoftware's\Folder Lock\Folder Lock.exe
C:\Users\Public\Desktop\Foxit PhantomPDF.lnk - C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\FoxitPhantomPDF.exe
C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Public\Desktop\Help and Support.lnk -  
C:\Users\Public\Desktop\HitmanPro.lnk - C:\Program Files (x86)\HitmanPro\HitmanPro.exe
C:\Users\Public\Desktop\HP ENVY 4520 series.lnk - C:\Program Files (x86)\HP\HP ENVY 4520 series\Bin\HP ENVY 4520 series.exe -Start UDCDevicePage
C:\Users\Public\Desktop\HP Photo Creations.lnk - C:\Program Files (x86)\HP Photo Creations\PhotoProduct.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\KDeasy.lnk - C:\Program Files (x86)\KDeasy\kindleManager.exe
C:\Users\Public\Desktop\Mailbird.lnk - C:\Program Files (x86)\Mailbird\Mailbird.exe
C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Users\Public\Desktop\Maple.lnk - C:\Program Files (x86)\Maple\maple.exe
C:\Users\Public\Desktop\Mozilla Firefox.lnk - C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Public\Desktop\MyKeyFinder.lnk - C:\Program Files (x86)\MyKeyFinder\AbLauncher.exe
C:\Users\Public\Desktop\Norton Online Backup.lnk - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe OPEN
C:\Users\Public\Desktop\Pale Moon.lnk - C:\Program Files\Pale Moon\palemoon.exe
C:\Users\Public\Desktop\PRIVATE WiFi.lnk - C:\Program Files (x86)\PRIVATE WiFi\StartUrl.exe http://www.privatewifi.com/partner/clicks.php?pid=928649&bid=76&campaign=default
C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\Users\Public\Desktop\Seagate Dashboard.lnk - C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Dashboard.exe
C:\Users\Public\Desktop\SeaTools for Windows.lnk - C:\Program Files (x86)\Seagate\SeaTools for Windows\SeaToolsforWindows.exe C:\Program Files (x86)\Seagate\SeaTools for Windows\Seagate_Logo.ico
C:\Users\Public\Desktop\Shop for Supplies - HP ENVY 4520 series.lnk - C:\Program Files (x86)\HP\HP ENVY 4520 series\Bin\hpqDTSS.exe
C:\Users\Public\Desktop\Steam.lnk - C:\Program Files (x86)\Steam\Steam.exe
C:\Users\Public\Desktop\Video Download Capture.lnk - C:\Program Files (x86)\Apowersoft\Video Download Capture\Video Download Capture.exe
C:\Users\Public\Desktop\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
C:\Users\Public\Desktop\Waterfox.lnk - C:\Program Files\Waterfox\waterfox.exe
C:\Users\Public\Desktop\WhizFolders.lnk - E:\Program Files (x86)\WhizFolders Organizer\whizfolders.exe
C:\Users\Public\Desktop\Yahoo Messenger.lnk -  
C:\Users\Public\Desktop\Zotero Standalone.lnk - C:\Program Files (x86)\Zotero Standalone\zotero.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diffractor.lnk - C:\Users\Marcus 2\AppData\Local\Diffractor\Diffractor.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wunderlist.lnk - C:\Users\Marcus 2\AppData\Local\Wunderlist\Wunderlist.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon\Amazon Kindle\Kindle.lnk - C:\Users\Marcus 2\AppData\Local\Amazon\Kindle\application\Kindle.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon\Amazon Kindle\Uninstall Kindle.lnk - C:\Users\Marcus 2\AppData\Local\Amazon\Kindle\application\uninstall.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FireShot\FireShot Homepage.lnk -  
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FireShot\Uninstall FireShot.lnk - C:\Users\Marcus 2\AppData\Roaming\FireShot\uninstall.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Swift To-Do List\Swift To-Do List Homepage.lnk - C:\Users\Marcus 2\AppData\Local\Swift To-Do List\Swift To-Do List Homepage.url
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Swift To-Do List\Swift To-Do List Support.lnk - C:\Users\Marcus 2\AppData\Local\Swift To-Do List\Swift To-Do List Support.url
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Swift To-Do List\Swift To-Do List.lnk - C:\Users\Marcus 2\AppData\Local\Swift To-Do List\Swift To-Do List.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wunderlist\Wunderlist.lnk - C:\Users\Marcus 2\AppData\Local\Wunderlist\Wunderlist.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk - C:\Program Files\AVAST Software\SZBrowser\launcher.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zotero Standalone.lnk - C:\Program Files (x86)\Zotero Standalone\zotero.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk - C:\Program Files (x86)\7-Zip\7zFM.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk - C:\Program Files (x86)\7-Zip\7-zip.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Andy\HandyAndy.lnk - C:\Program Files\Andy\HandyAndy.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Andy\Start Andy.lnk - C:\Program Files\Andy\HandyAndy.exe startandy
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiBrowserSpy\AntiBrowserSpy.lnk - C:\Program Files (x86)\AntiBrowserSpy\AntiBrowserSpy.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software\Avast Premier.lnk - C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bolide Software\ Bolide Software on the Web.lnk - C:\Program Files (x86)\AllMyMovies\bolide.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bolide Software\All My Movies .lnk - C:\Program Files (x86)\AllMyMovies\allmymovies.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bolide Software\All My Movies License.lnk - C:\Program Files (x86)\AllMyMovies\license.rtf
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bolide Software\Order All My Movies.lnk - C:\Program Files (x86)\AllMyMovies\order.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bolide Software\Uninstall  All My Movies.lnk - C:\Program Files (x86)\AllMyMovies\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boxcryptor\Boxcryptor Help.lnk -  
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Boxcryptor\Boxcryptor.lnk - C:\Program Files (x86)\Boxcryptor\Boxcryptor.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\calibre - E-book management.lnk - C:\Program Files (x86)\Calibre2\calibre.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\E-book viewer.lnk - C:\Program Files (x86)\Calibre2\ebook-viewer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\Edit E-book.lnk - C:\Program Files (x86)\Calibre2\ebook-edit.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management\LRF viewer.lnk - C:\Program Files (x86)\Calibre2\lrfviewer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\calibre 64bit - E-book management.lnk - C:\Program Files (x86)\Calibre2\calibre.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\E-book viewer 64bit.lnk - C:\Program Files (x86)\Calibre2\ebook-viewer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\Edit E-book 64bit.lnk - C:\Program Files (x86)\Calibre2\ebook-edit.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management\LRF viewer 64bit.lnk - C:\Program Files (x86)\Calibre2\lrfviewer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner64.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Collectorz.com\Book Collector\Book Collector.lnk - C:\Program Files (x86)\Collectorz.com\Book Collector\BookCollector.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Collectorz.com\Book Collector\Uninstall Book Collector.lnk - C:\Program Files (x86)\Collectorz.com\Book Collector\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID\CPU-Z\CPU-Z.lnk - C:\Program Files\CPUID\CPU-Z\cpuz.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID\CPU-Z\Edit CPU-Z Config File.lnk - C:\Program Files\CPUID\CPU-Z\cpuz.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID\CPU-Z\Uninstall CPU-Z.lnk - C:\Program Files (x86)\CPUID\CPU-Z\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk - C:\Program Files (x86)\Dropbox\Client\Dropbox.exe /home
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasyUEFI\EasyUEFI.lnk - C:\Program Files\EasyUEFI\bin\EasyUEFI.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasyUEFI\Uninstall EasyUEFI.lnk - C:\Program Files (x86)\EasyUEFI\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileLocator Pro\FileLocator Pro Help.lnk - C:\Program Files (x86)\Mythicsoft\FileLocator Pro\help\en\index.html
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileLocator Pro\FileLocator Pro.lnk - C:\Program Files (x86)\Mythicsoft\FileLocator Pro\FileLocatorPro.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileLocator Pro\Uninstall FileLocator Pro.lnk - C:\Windows\System32\msiexec.exe /x {01EE62F7-4B8E-4E80-9DD1-5B03C6F492A3}
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\HitmanPro.lnk - C:\Program Files (x86)\HitmanPro\HitmanPro.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\Remove HitmanPro 3.7.lnk - C:\Program Files (x86)\HitmanPro\HitmanPro.exe /uninstall
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Calendar.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudWeb.exe calendar
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Contacts.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudWeb.exe contacts
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Find My iPhone.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudWeb.exe find
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\iCloud Photos.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\ShellStreamsShortcut.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\iCloud.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Keynote.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudWeb.exe keynote
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Mail.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudWeb.exe mail
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Notes.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudWeb.exe notes
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Numbers.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudWeb.exe numbers
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Pages.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudWeb.exe pages
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud\Reminders.lnk - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudWeb.exe reminders
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\About iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.Resources\en_GB.lproj\About iTunes.rtf
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk - C:\Program Files (x86)\Java\jre1.8.0_101\bin\javacpl.exe -tab about
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk - C:\Program Files (x86)\Java\jre1.8.0_101\bin\javacpl.exe -tab update
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk - C:\Program Files (x86)\Java\jre1.8.0_101\bin\javacpl.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mailbird\Check for updates.lnk - C:\Program Files (x86)\Mailbird\MailbirdUpdater.exe /checknow
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mailbird\Mailbird.lnk - C:\Program Files (x86)\Mailbird\Mailbird.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mailbird\Uninstall.lnk - C:\Windows\SysWOW64\msiexec.exe /x {5B1785F8-7578-446A-B380-E9810BF74712}
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit\Malwarebytes Anti-Exploit.lnk - C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit\Uninstall Malwarebytes Anti-Exploit.lnk - C:\Program Files (x86)\Malwarebytes Anti-Exploit\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk - C:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\Silverlight.Configuration.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm\RoboForm.lnk - C:\Program Files (x86)\Siber Systems\AI RoboForm\identities.exe -startpage
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate\SeaTools for Windows\SeaTools for Windows.lnk - C:\Program Files (x86)\Seagate\SeaTools for Windows\SeaToolsforWindows.exe C:\Program Files (x86)\Seagate\SeaTools for Windows\Seagate_Logo.ico
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate\SeaTools for Windows\Uninstall.lnk - C:\Program Files (x86)\Seagate\SeaTools for Windows\uninst.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate Dashboard\Seagate Dashboard.lnk - C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Dashboard.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stardock\Fences.lnk - C:\Program Files (x86)\Stardock\Fences\Fences.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk - C:\Program Files (x86)\VideoLAN\VLC\Documentation.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk - C:\Program Files (x86)\VideoLAN\VLC\NEWS.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk - C:\Program Files (x86)\VideoLAN\VLC\VideoLAN Website.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player - reset preferences and cache files.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe --reset-config --reset-plugins-cache vlc://quit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe -Iskins
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Song Downloader\YouTubeSongDownloader.lnk - C:\Program Files (x86)\YouTube Song Downloader\AbLauncher.exe

==== shortcuts in Quick Launch ======================

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\EssentialPIM Pro.lnk - C:\Program Files (x86)\EssentialPIM Pro\EssentialPIM.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Yahoo Messenger.lnk -  
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Acer Media.lnk - C:\Program Files (x86)\Acer\Acer Media\AcerMedia.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Acer Photo.lnk - C:\Program Files (x86)\Acer\Acer Photo\AcerPhoto.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Acer Quick Access.lnk - C:\Program Files (x86)\Acer\Acer Quick Access\QAStart.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\BlueStacks.lnk - C:\ProgramData\BlueStacksGameManager\BlueStacks.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk -  
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\LOVEFiLM.lnk - C:\Program Files (x86)\LoveFilm\StartURL.exe http://Lovefilm.com/acer
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mailbird.lnk - C:\Program Files (x86)\Mailbird\Mailbird.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\EssentialPIM Pro.lnk - C:\Program Files (x86)\EssentialPIM Pro\EssentialPIM.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mind Collected.lnk - C:\Users\Marcus 2\Documents\Mind Collected\Mind Collected.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Swift To-Do List.lnk - C:\Users\Marcus 2\AppData\Local\Swift To-Do List\Swift To-Do List.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Yahoo Messenger.lnk -  
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Acer Media.lnk - C:\Program Files (x86)\Acer\Acer Media\AcerMedia.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Acer Photo.lnk - C:\Program Files (x86)\Acer\Acer Photo\AcerPhoto.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Acer Quick Access.lnk - C:\Program Files (x86)\Acer\Acer Quick Access\QAStart.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome App Launcher.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --show-app-list
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk -  
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\LOVEFiLM.lnk - C:\Program Files (x86)\LoveFilm\StartURL.exe http://Lovefilm.com/acer
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Moneydance.lnk - C:\Program Files (x86)\Moneydance\Moneydance.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox (2).lnk - C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Stayfocused.lnk - C:\Program Files (x86)\Bytesignals\Stayfocused\stayfocused.exe
C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\EssentialPIM Pro.lnk - C:\Program Files (x86)\EssentialPIM Pro\EssentialPIM.exe
C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Yahoo Messenger.lnk -  

==== shortcuts After Repair ======================

C:\Users\Public\Desktop\Buy Online.lnk - C:\Program Files (x86)\Accessory Store\StartUrl.exe
C:\Users\Public\Desktop\PRIVATE WiFi.lnk - C:\Program Files (x86)\PRIVATE WiFi\StartUrl.exe
C:\Users\Marcus 1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\LOVEFiLM.lnk - C:\Program Files (x86)\LoveFilm\StartURL.exe
C:\Users\Marcus 2\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\LOVEFiLM.lnk - C:\Program Files (x86)\LoveFilm\StartURL.exe
 



#15 nasdaq

nasdaq

  • Malware Response Team
  • 39,214 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:05 AM

Posted 01 August 2016 - 12:21 PM

Looking better.

What is/are the remaining issue(s)?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users