| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Claro-Search von Firefox entfernenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
21.11.2012, 10:56
| #1 |
| |  Claro-Search von Firefox entfernen Hallo! So wie Benutzer "Siro", Registriert seit: 28.10.2012, von Euch empfohlen wurde, habe ich die Schritte zum Aufspüren + schließlich zum Löschen von Claro-Search (Firefox-Toolbar) durchgeführt. - Vielen Dank für die sehr gut verständliche Anleitung! Die von euch benötigten Dateien, zum endgültigen Löschen von Claro-Search, füge ich dieser Nachricht. Ich bin Euch äußerst dankbar für Eure Hilfe! Liebe Grüße, Jaki |
|
21.11.2012, 20:23
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Claro-Search von Firefox entfernen Hallo und
__________________ Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
Note: Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread. Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards. Schon irgendwelche Scans mit anderen Tools gemacht? Logs mit Funden vorhanden? Siehe => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!
__________________ |
|
22.11.2012, 07:03
| #3 |
| | Claro-Search von Firefox entfernen Hallo cosinus,
__________________vielen Dank für Deine Unterstützung, die ich sehr zu schätzen weis! Da Du hier jemandem zum selben Thema "Claro-Search löschen aus Firefox Toolbar" geholfen hast, habe ich mir Deine Anleitungen durchgelesen und Scanns durchgeführt, die nun aber wieder gelöscht habe. - Du willst ja etwas "frisches"... ;-) Am Sonntag, 18.11. habe ich mit TuneUp Utilities 2013 die Festplatte auf Fehler überprüft. Ohne Erfolg. Claro wird weiterhin angezeigt. Soll ich jetzt noch ´mal scannen? Liebe Grüße, Jaki Cosinus,... ich habe eben noch festgestellt, beim Öffnen der Firefox Toolbar, dass neue Taps mit "My Start by Incredi Bar" angezeigt werden. Also das noch zusätzlich zu Claro... Lieber Gruß, Jaki |
|
22.11.2012, 13:01
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Claro-Search von Firefox entfernenZitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
23.11.2012, 10:48
| #5 |
| | Claro-Search von Firefox entfernen Hallo Cosinus, es tut mir Leid, dass mit meiner Antwort auf mich warten lasse! - Jetzt ist es mittlerweile so, dass die Internet-Einwahl nur noch selten funktioniert!?... Nur über Internet Explorer-Browser (mit Anzeige "MyStart by IncrediBar"), nicht über Firefox (Fehlermeldung - Screenshot dazu gespeichert) möglich! Entsprechend Deiner Hilfestellung an SIRO, habe ich die Zip-Dateien mit: aswMBR & TDSSKiller erstellt, in meiner Nachricht hier (21.11.2012) gepostet und später gelöscht, weil Du schriebst, dass Du "frisches" brauchst... Ebenso habe ich Dateien zu: OTL Logfile by Oldtimer & (erinnere mich nicht mehr an den Programmnamen, siehe SIRO) erstellt und später gelöscht... Hilft Dir das ein bißchen? Lieber Gruß, Jaki |
|
23.11.2012, 14:16
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Claro-Search von Firefox entfernen adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren Downloade Dir bitte AdwCleaner auf deinen Desktop. Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
__________________ --> Claro-Search von Firefox entfernen |
|
23.11.2012, 14:38
| #7 |
| | Claro-Search von Firefox entfernen gewünschtes nachfolgend... # AdwCleaner v2.008 - Datei am 23/11/2012 um 14:32:27 erstellt # Aktualisiert am 17/11/2012 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzer : Jenny - KIRSTEN # Bootmodus : Normal # Ausgeführt unter : C:\Users\Jenny\Downloads\adwcleaner.exe # Option [Suche] **** [Dienste] **** Gefunden : IBUpdaterService Gefunden : PC Performer Manager ***** [Dateien / Ordner] ***** Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\defaults\pref\all-iminent.js Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\searchplugins\SearchTheWeb.xml Datei Gefunden : C:\user.js Datei Gefunden : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\extensions\ocr@babylon.com.xpi Datei Gefunden : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\searchplugins\Askcom.xml Datei Gefunden : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\searchplugins\Conduit.xml Datei Gefunden : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\searchplugins\MyStart Search.xml Datei Gefunden : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\searchplugins\SearchTheWeb.xml Datei Gefunden : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\searchplugins\web-search.xml Ordner Gefunden : C:\Program Files (x86)\Iminent Ordner Gefunden : C:\Program Files\Babylon Ordner Gefunden : C:\Program Files\IB Updater Ordner Gefunden : C:\ProgramData\Ask Ordner Gefunden : C:\ProgramData\Babylon Ordner Gefunden : C:\ProgramData\IBUpdaterService Ordner Gefunden : C:\ProgramData\Iminent Ordner Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent Ordner Gefunden : C:\ProgramData\pc performer manager Ordner Gefunden : C:\Users\Jenny\AppData\Local\Temp\BabylonToolbar Ordner Gefunden : C:\Users\Jenny\AppData\Local\Temp\Iminent Ordner Gefunden : C:\Users\Jenny\AppData\LocalLow\Bandoo Ordner Gefunden : C:\Users\Jenny\AppData\LocalLow\Toolbar4 Ordner Gefunden : C:\Users\Jenny\AppData\Roaming\Babylon Ordner Gefunden : C:\Users\Jenny\AppData\Roaming\Iminent Ordner Gefunden : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\ConduitCommon Ordner Gefunden : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444} Ordner Gefunden : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\extensions\ffxtlbr@incredibar.com Ordner Gefunden : C:\Windows\SysWOW64\WNLT ***** [Registrierungsdatenbank] ***** Daten Gefunden : HKLM\..\Windows [AppInit_DLLs] = c:\progra~3\pcperf~1\24897~1.175\{61d8b~1\pcpmngr.dll Schlüssel Gefunden : HKCU\Software\DataMngr Schlüssel Gefunden : HKCU\Software\DataMngr_Toolbar Schlüssel Gefunden : HKCU\Software\IM Schlüssel Gefunden : HKCU\Software\Iminent Schlüssel Gefunden : HKCU\Software\ImInstaller Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EB5CEE80-030A-4ED8-8E20-454E9C68380F} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} Schlüssel Gefunden : HKCU\Software\Softonic Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} Schlüssel Gefunden : HKLM\Software\Babylon Schlüssel Gefunden : HKLM\Software\Bandoo Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\Extension.DLL Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\Iminent.WebBooster.InternetExplorer.DLL Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BandooCore.BandooCore Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr Schlüssel Gefunden : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.DownloadArgs Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.LinkToPromoteArgs Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.RawDataArgs Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.TinyUrlArgs Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.ViralLinkArgs Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ClientCallback Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ContractBase Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.AddToUserContentCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CheckLoginStatusCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CleanCacheCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GameOverCallback Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetCreditCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetInstallationContextCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusResult Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableResult Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.InstallationContextResult Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommandResult Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginStatusChangedCallback Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LogoutCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MergeIdentityCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MyAccountCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PlayContentCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PostContentCallback Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.RecycleViewsCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.SetVariableCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowBrowserWindowCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowControlCenterCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowPluginWindowCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.UserContentChangedCallback Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.VariableChangedCallback Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WarmUpCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WelcomeCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerCommand Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerResult Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightContent Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightUri Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Iminent.Mediator.MediatorServiceProxy Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandle.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandler Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler Schlüssel Gefunden : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler.1 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF} Schlüssel Gefunden : HKLM\Software\DataMngr Schlüssel Gefunden : HKLM\Software\IB Updater Schlüssel Gefunden : HKLM\Software\Iminent Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{01A602A0-D0B9-445B-8081-719E4177C4A7} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02C9C7B0-C7C8-4AAC-A9E4-55295BF60F8F} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0398B101-6DA7-473F-A290-17D2FBC88CC0} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0CC36196-8589-4B80-A771-D659411D7F90} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{143D96F9-EB64-48B3-B192-91C2C41A1F43} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{14F7D91F-F669-45C9-9F42-BACBFDB86EAD} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{187A6488-6E71-4A2A-B118-7BEFBFE58257} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2D065204-A024-4C39-8A38-EE7078EC7ACF} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{30F5476C-677B-4DB0-B397-51F5BFD86840} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{351798B1-C1D2-45AB-92B4-4D6C2D6AB5AF} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3AEA1BEF-6195-46F4-ACA2-0ED14F7EFA1B} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3D7F9AC3-BAC3-4E51-81D7-D121D79E550A} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4498C5E9-93C6-4142-B6BE-F0C6DC48B77A} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{479BF2D6-E362-4A99-B1AB-BC764D7B97AE} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{492A108F-51D0-4BD8-899D-AD4AB2893064} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4B6D6E60-FBD2-4E79-BF4B-886BC98F1797} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{60893E02-2E5B-43F9-A93A-BAD60C2DF6EF} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6D39931F-451E-4BDD-BAF4-37FB96DBBA5D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{76C684D2-C35D-4284-976A-D862F53ADB81} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{796D822A-C3F9-4A97-BAAB-42FE7628EA63} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{79EF3691-EC1A-4705-A01A-D2E36EC11758} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{82F41418-8E64-47EB-A7F1-4702A974D289} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{85D920CE-63A7-46DC-8992-41D1D2E07FAD} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{895ED5E8-ABB4-40C3-A0CA-2571964268E2} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{8AAC123A-1959-4A45-BFC5-E2D50783098A} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A07956CD-81F8-4A03-B524-5D87E690DC83} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B5E3B26B-6E5C-4865-A63D-58D04B10E245} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B84D2DC5-42B2-4E5E-BF61-7B48152FF8EF} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B89D5309-0367-4494-A92F-3D4C94F88307} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C014EBF8-8854-448B-B5A4-557C4090EDCE} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C31191DB-2F64-464C-B97C-6AC81ACB7AAC} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C342C7A7-F622-4EF3-8B7F-ABB9FBE73F14} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C4765B07-BC2F-477B-925C-B2BF24887823} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C875C0A1-09E3-48D5-9F8E-BD337796FD14} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CD126DA6-FF5B-4181-AC13-54A62240D2FA} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D8F01233-2DE6-4EE7-8988-37263F00651B} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DD438708-AAB4-422D-A322-B619589F5680} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E812AE43-7799-4E67-8CF8-4104297A2D16} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F0BAAEC7-9AE0-49FF-9C4B-86E774FF397F} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F92193FD-2243-4401-9ACC-49FF30885898} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD21B8A2-910B-45AC-9C10-45E6A8B84984} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0AF350D9-3916-454B-AC53-0B0B65F41301} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F7CF0E9A-D48B-4942-9537-259ED0568DF4} Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32} Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1 Schlüssel Gefunden : HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gefunden : HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} Schlüssel Gefunden : HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{977AE9CC-AF83-45E8-9E03-E2798216E2D5}] Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{84FF7BD6-B47F-46F8-9130-01B2696B36CB}] Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{9E131A93-EED7-4BEB-B015-A0ADB30B5646}] Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D0F4A166-B8D4-48b8-9D63-80849FE137CB}] ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16421 [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://mystart.incredibar.com/mb165?a=6OyUAjXE74&i=26 [HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page] = hxxp://www.claro-search.com/?affID=114506&tt=4512_8&babsrc=HP_clro&mntrId=e687865700000000000088252c1470a6 -\\ Mozilla Firefox v17.0 (de) Profilname : default Datei : C:\Users\Jenny\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\prefs.js Gefunden : user_pref("avg.install.userHPSettings", "hxxp://www.claro-search.com/?affID=114506&tt=4512_8&babsrc=[...] Gefunden : user_pref("avg.install.userSPSettings", "Claro Search"); Gefunden : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com"); Gefunden : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb165?a=6OyUAjXE74&i=26"); Gefunden : user_pref("browser.search.defaultengine", "Ask.com"); Gefunden : user_pref("browser.search.defaultenginename", "MyStart Search"); Gefunden : user_pref("browser.search.defaultthis.engineName", "Partnerprogramme Customized Web Search"); Gefunden : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT336090&Sear[...] Gefunden : user_pref("browser.search.selectedEngine", "MyStart Search"); Gefunden : user_pref("browser.startup.homepage", "hxxp://www.claro-search.com/?affID=114506&tt=4512_8&babsrc=HP[...] Gefunden : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT336090&SearchS[...] Gefunden : user_pref("CommunityToolbar.ConduitSearchList", "Partnerprogramme Customized Web Search"); Gefunden : user_pref("extensions.BabylonToolbar_i.aflt", "babclient"); Gefunden : user_pref("extensions.BabylonToolbar_i.babExt", ""); Gefunden : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=7775&tl=ykn015083"); Gefunden : user_pref("extensions.BabylonToolbar_i.hardId", "e6878657000000000000001e101f1ed9"); Gefunden : user_pref("extensions.BabylonToolbar_i.id", "e6878657000000000000001e101f1ed9"); Gefunden : user_pref("extensions.BabylonToolbar_i.instlDay", "15418"); Gefunden : user_pref("extensions.BabylonToolbar_i.instlRef", "std"); Gefunden : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar"); Gefunden : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon"); Gefunden : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Gefunden : user_pref("extensions.BabylonToolbar_i.srcExt", "def"); Gefunden : user_pref("extensions.BabylonToolbar_i.tlbrId", "base"); Gefunden : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17"); Gefunden : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17"); Gefunden : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1720:30:08"); Gefunden : user_pref("extensions.claro.admin", false); Gefunden : user_pref("extensions.claro.aflt", "babsst"); Gefunden : user_pref("extensions.claro.appId", "{C3110516-8EFC-49D6-8B72-69354F332062}"); Gefunden : user_pref("extensions.claro.dfltLng", "en"); Gefunden : user_pref("extensions.claro.excTlbr", false); Gefunden : user_pref("extensions.claro.id", "e687865700000000000088252c1470a6"); Gefunden : user_pref("extensions.claro.instlDay", "15655"); Gefunden : user_pref("extensions.claro.instlRef", "sst"); Gefunden : user_pref("extensions.claro.prdct", "claro"); Gefunden : user_pref("extensions.claro.prtnrId", "claro"); Gefunden : user_pref("extensions.claro.tlbrId", "claro"); Gefunden : user_pref("extensions.claro.tlbrSrchUrl", ""); Gefunden : user_pref("extensions.claro.vrsn", "1.8.3.10"); Gefunden : user_pref("extensions.claro.vrsni", "1.8.3.10"); Gefunden : user_pref("extensions.claro_i.smplGrp", "none"); Gefunden : user_pref("extensions.claro_i.vrsnTs", "1.8.3.1013:11:57"); Gefunden : user_pref("extensions.enabledAddons", "amznUWL2@amazon.com:1.10,ocr@babylon.com:1.1,{0b457cAA-602d-4[...] Gefunden : user_pref("keyword.URL", "hxxp://mystart.incredibar.com/mb165/?loc=IB_DS&a=6OyUAjXE74&&i=26&search="[...] ************************* AdwCleaner[R1].txt - [35473 octets] - [23/11/2012 14:32:27] ########## EOF - C:\AdwCleaner[R1].txt - [35534 octets] ########## |
|
23.11.2012, 14:55
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Claro-Search von Firefox entfernen Die Logs bitte in CODE-Tags!  Versuch bitte alle im adwCleaner-Log erwähnten Einträge (wie zB BabylonToolbar oder Ask) über die Systemsteuerung zu deinstallieren, danach ein neues Suchlog mit dem adwCleaner machen. Reste und was sich nicht deinstallieren lassen will machen wir mit dem adwCleaner weg.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.11.2012, 15:26
| #9 |
| | Claro-Search von Firefox entfernen Hallo Claro, bitte entschuldige mich... die Seite hier, die die CODE-Tags-Eingabe darstellt habe ich mir angeschaut, aber nicht verstanden!? Mit Copy+Paste war da nix!?... Ein neues Suchlog mit dem adwCleaner muss ich nicht machen, weil sich die Einträge: Ask, Babylon Toolbar und Claro nicht in der Systemsteuerung finden- und somit auch nicht deinstallieren lassen. Der Eintrag "Iminent" findet sich in der Systemsteuerung, ist aber nicht zu Deinstallieren (mehrfache Versuche, stets Verbindungsfehleranzeige). Ich bitte Dich, dass wir mit adwCleaner selbst aktiv werden ;-) |
|
23.11.2012, 16:44
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Claro-Search von Firefox entfernen adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
Danach eine Kontrolle mit OTL bitte:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.11.2012, 10:19
| #11 |
| | Claro-Search von Firefox entfernen # AdwCleaner v2.008 - Datei am 23/11/2012 um 19:08:44 erstellt # Aktualisiert am 17/11/2012 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzer : xxxx # Bootmodus : Normal # Ausgeführt unter : C:\Users\xxxx\Desktop\adwcleaner.exe # Option [Löschen] **** [Dienste] **** ***** [Dateien / Ordner] ***** Gelöscht mit Neustart : C:\Program Files\IB Updater Gelöscht mit Neustart : C:\ProgramData\pc performer manager ***** [Registrierungsdatenbank] ***** ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Die Registrierungsdatenbank ist sauber. -\\ Mozilla Firefox v17.0 (de) Profilname : default Datei : C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\prefs.js [OK] Die Datei ist sauber. ************************* AdwCleaner[R1].txt - [972 octets] - [23/11/2012 19:07:44] AdwCleaner[S1].txt - [918 octets] - [23/11/2012 19:08:44] ########## EOF - C:\AdwCleaner[S1].txt - [977 octets] ########## Code:
ATTFilter # AdwCleaner v2.008 - Datei am 23/11/2012 um 19:08:44 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : xxxx
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\xxxx\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Gelöscht mit Neustart : C:\Program Files\IB Updater
Gelöscht mit Neustart : C:\ProgramData\pc performer manager
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v17.0 (de)
Profilname : default
Datei : C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\39h0g7kx.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [972 octets] - [23/11/2012 19:07:44]
AdwCleaner[S1].txt - [918 octets] - [23/11/2012 19:08:44]
########## EOF - C:\AdwCleaner[S1].txt - [977 octets] ##########
Code:
ATTFilter OTL logfile created on: 24.11.2012 08:26:16 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\xxxx\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,72 Gb Available Physical Memory | 68,01% Memory free 7,99 Gb Paging File | 6,64 Gb Available in Paging File | 83,10% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 80,00 Gb Total Space | 41,44 Gb Free Space | 51,80% Space Free | Partition Type: NTFS Drive D: | 375,75 Gb Total Space | 330,15 Gb Free Space | 87,87% Space Free | Partition Type: NTFS Drive H: | 1,92 Gb Total Space | 1,28 Gb Free Space | 66,84% Space Free | Partition Type: FAT Computer Name: xxxx | User Name: xxxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\xxxx\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files\IB Updater\ExtensionUpdaterService.exe () PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe (TeamViewer GmbH) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\ASUS\Eee Manager\EeeManager.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\ASUS\Eee Manager\EMOSDControl\EMOSDControl.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\ASUS\Eee Manager\EMMessageParser.exe (ASUSTeK Computer Inc.) PRC - C:\Program Files (x86)\ASUS\Message Controller\AsMessageController.exe (ASUSTeK Computer Inc.) ========== Modules (No Company Name) ========== MOD - c:\ProgramData\PC Performer Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\pcpmngr.dll () MOD - C:\Program Files (x86)\ASUS\Message Controller\AsKeyboardHooker.dll () MOD - C:\Program Files (x86)\ASUS\Message Controller\AsRemoteControlHooker.dll () MOD - C:\Program Files (x86)\ASUS\Eee Manager\ImageMgr.dll () MOD - C:\Program Files (x86)\ASUS\Eee Manager\MessageParser\AsMultiLang.dll () MOD - C:\Program Files (x86)\ASUS\Eee Manager\EMOSDControl\MultiLang\AsMultiLang.dll () MOD - C:\Program Files (x86)\ASUS\Eee Manager\AsMultiLang.dll () ========== Services (SafeList) ========== SRV:64bit: - (IB Updater Updater) -- C:\Program Files\IB Updater\ExtensionUpdaterService.exe () SRV:64bit: - (SfCtlCom) -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe (Trend Micro Inc.) SRV:64bit: - (TMBMServer) -- C:\Program Files\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.) SRV:64bit: - (TmProxy) -- C:\Program Files\Trend Micro\Internet Security\TmProxy.exe (Trend Micro Inc.) SRV:64bit: - (TmPfw) -- C:\Program Files\Trend Micro\Internet Security\TmPfw.exe (Trend Micro Inc.) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (IAANTMON) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation) DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation) DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation) DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation) DRV:64bit: - (tmxpflt) -- C:\Windows\SysNative\drivers\tmxpflt.sys (Trend Micro Inc.) DRV:64bit: - (tmpreflt) -- C:\Windows\SysNative\drivers\tmpreflt.sys (Trend Micro Inc.) DRV:64bit: - (vsapint) -- C:\Windows\SysNative\drivers\vsapint.sys (Trend Micro Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation) DRV:64bit: - (tmwfp) -- C:\Windows\SysNative\drivers\tmwfp.sys (Trend Micro Inc.) DRV:64bit: - (tmlwf) -- C:\Windows\SysNative\drivers\tmlwf.sys (Trend Micro Inc.) DRV:64bit: - (tmtdi) -- C:\Windows\SysNative\drivers\tmtdi.sys (Trend Micro Inc.) DRV:64bit: - (JME) -- C:\Windows\SysNative\drivers\JME.sys (JMicron Technology Corp.) DRV:64bit: - (hidkmdf) -- C:\Windows\SysNative\drivers\hidkmdf.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (NW1950) -- C:\Windows\SysNative\drivers\NW1950.sys () DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation) DRV:64bit: - (rtl8192se) -- C:\Windows\SysNative\drivers\rtl8192se.sys (Realtek Semiconductor Corporation ) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys () DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (enecir) -- C:\Windows\SysNative\drivers\enecir.sys (ENE TECHNOLOGY INC.) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation ) DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (ASInsHelp) -- C:\Windows\SysWOW64\drivers\AsInsHelp64.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com/ IE - HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\..\SearchScopes\{B2262AB1-DDE7-4AF8-A79C-7948290B9508}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=76BB761C-6FA7-4EFC-8898-42658F47F664&apn_sauid=8086B6D0-9EFF-414F-A1B3-B8E48DB26A51 IE - HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-3855440590-2406734051-3325578704-1003\..\SearchScopes,DefaultScope = ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.bing.com/?pc=MOZO" FF - prefs.js..extensions.enabledAddons: amznUWL2%40amazon.com:1.10 FF - prefs.js..extensions.enabledAddons: %7B0b457cAA-602d-484a-8fe7-c1d894a011ba%7D:0.98.24 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\IB UPDATER\FIREFOX FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\e-webprint@epson.com: C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on [2012.07.13 15:52:02 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.28 08:32:23 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{dfefbe51-ca52-484b-adf0-6b158b05262d}: C:\ProgramData\PC Performer Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\FirefoxExtension [2011.02.17 12:17:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jenny\AppData\Roaming\mozilla\Extensions [2011.02.17 12:17:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jenny\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com [2012.11.23 15:41:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jenny\AppData\Roaming\mozilla\Firefox\Profiles\39h0g7kx.default\extensions [2012.11.23 08:33:36 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Jenny\AppData\Roaming\mozilla\Firefox\Profiles\39h0g7kx.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba} [2012.11.23 08:33:35 | 000,000,000 | ---D | M] (Webutation.org) -- C:\Users\Jenny\AppData\Roaming\mozilla\Firefox\Profiles\39h0g7kx.default\extensions\{15fe27f3-e5ab-2d59-4c5c-dadc7945bdbd} [2012.10.11 08:51:38 | 000,243,287 | ---- | M] () (No name found) -- C:\Users\Jenny\AppData\Roaming\mozilla\firefox\profiles\39h0g7kx.default\extensions\amznUWL2@amazon.com.xpi [2012.11.21 10:18:59 | 000,035,923 | ---- | M] () (No name found) -- C:\Users\Jenny\AppData\Roaming\mozilla\firefox\profiles\39h0g7kx.default\extensions\{15fe27f3-e5ab-2d59-4c5c-dadc7945bdbd}.xpi O1 HOSTS File: ([2012.11.23 16:02:53 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation) O2 - BHO: (E-Web Print) - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll (SEIKO EPSON CORPORATION) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (E-Web Print) - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll (SEIKO EPSON CORPORATION) O3 - HKLM\..\Toolbar: (no name) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-3855440590-2406734051-3325578704-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [UfSeAgnt.exe] C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3855440590-2406734051-3325578704-1000..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (Trend Micro Inc.) O4 - HKU\S-1-5-21-3855440590-2406734051-3325578704-1003..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-3855440590-2406734051-3325578704-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{34824582-4EAF-42FF-9F02-2C3105C6691D}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - AppInit_DLLs: (c:\progra~3\pcperf~1\24897~1.175\{61d8b~1\pcpmngr.dll) - c:\ProgramData\PC Performer Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\pcpmngr.dll () O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O27:64bit: - HKLM IFEO\shell.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\shell.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe (TuneUp Software) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{0bdb606e-3d05-11e0-9e60-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{0bdb606e-3d05-11e0-9e60-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{2eab3b88-89f7-11e0-a3ef-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{2eab3b88-89f7-11e0-a3ef-705ab6e5c8e1}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{2eab3b96-89f7-11e0-a3ef-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{2eab3b96-89f7-11e0-a3ef-705ab6e5c8e1}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{2fdfa05c-3a86-11e0-80f6-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{2fdfa05c-3a86-11e0-80f6-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{2fdfa063-3a86-11e0-80f6-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{2fdfa063-3a86-11e0-80f6-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{36e2c1ef-975a-11e0-9139-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{36e2c1ef-975a-11e0-9139-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{37f1cfd3-166c-11e0-92d6-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{37f1cfd3-166c-11e0-92d6-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{37f1cfe1-166c-11e0-92d6-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{37f1cfe1-166c-11e0-92d6-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{39b6f4f0-d609-11e0-ad4a-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{39b6f4f0-d609-11e0-ad4a-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{39b6f4fd-d609-11e0-ad4a-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{39b6f4fd-d609-11e0-ad4a-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{43ba33d4-d931-11e0-8a58-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{43ba33d4-d931-11e0-8a58-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{43ba33da-d931-11e0-8a58-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{43ba33da-d931-11e0-8a58-705ab6e5c8e1}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{44ae1771-39f7-11e0-b5e8-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{44ae1771-39f7-11e0-b5e8-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{69ee6856-4b56-11e1-91dd-001e101f50a4}\Shell - "" = AutoRun O33 - MountPoints2\{69ee6856-4b56-11e1-91dd-001e101f50a4}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{6a8915e6-9dd3-11e0-8b21-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{6a8915e6-9dd3-11e0-8b21-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{6a891617-9dd3-11e0-8b21-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{6a891617-9dd3-11e0-8b21-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{79c7e947-cc2a-11e0-bf23-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{79c7e947-cc2a-11e0-bf23-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{79c7e955-cc2a-11e0-bf23-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{79c7e955-cc2a-11e0-bf23-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{79f96f27-7cce-11e0-8e0e-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{79f96f27-7cce-11e0-8e0e-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{837f960b-3b97-11e0-b8b6-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{837f960b-3b97-11e0-b8b6-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{837f9631-3b97-11e0-b8b6-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{837f9631-3b97-11e0-b8b6-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{837f9636-3b97-11e0-b8b6-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{837f9636-3b97-11e0-b8b6-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{897e6c3b-b9ac-11e0-a65e-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{897e6c3b-b9ac-11e0-a65e-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{897e6c3e-b9ac-11e0-a65e-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{897e6c3e-b9ac-11e0-a65e-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{90b3c7fc-3ae0-11e1-92fd-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{90b3c7fc-3ae0-11e1-92fd-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{90b3c829-3ae0-11e1-92fd-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{90b3c829-3ae0-11e1-92fd-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{90b3c837-3ae0-11e1-92fd-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{90b3c837-3ae0-11e1-92fd-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{99f6928b-7ccd-11e0-baf5-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{99f6928b-7ccd-11e0-baf5-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{9c11bc8a-3d0d-11e0-93ec-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{9c11bc8a-3d0d-11e0-93ec-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{9c11bc90-3d0d-11e0-93ec-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{9c11bc90-3d0d-11e0-93ec-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{9dd52c63-8005-11e0-a012-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{9dd52c63-8005-11e0-a012-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{9dd52c71-8005-11e0-a012-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{9dd52c71-8005-11e0-a012-705ab6e5c8e1}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{a328deb9-cafd-11e0-8c9c-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{a328deb9-cafd-11e0-8c9c-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{ac0b4dbd-39fa-11e0-9114-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{ac0b4dbd-39fa-11e0-9114-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{b455e492-9b11-11e0-a099-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{b455e492-9b11-11e0-a099-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{b455e499-9b11-11e0-a099-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{b455e499-9b11-11e0-a099-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{bb95e815-98ab-11e0-bf28-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{bb95e815-98ab-11e0-bf28-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{bb95e83b-98ab-11e0-bf28-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{bb95e83b-98ab-11e0-bf28-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{c5dbffb3-a63d-11e0-8fa6-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{c5dbffb3-a63d-11e0-8fa6-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{c5dbffc2-a63d-11e0-8fa6-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{c5dbffc2-a63d-11e0-8fa6-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{d46400e6-ad3e-11e0-848a-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{d46400e6-ad3e-11e0-848a-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{d4640109-ad3e-11e0-848a-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{d4640109-ad3e-11e0-848a-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{e217bf07-ffa0-11e0-97dc-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{e217bf07-ffa0-11e0-97dc-705ab6e5c8e1}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{e217bf25-ffa0-11e0-97dc-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{e217bf25-ffa0-11e0-97dc-705ab6e5c8e1}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{ed2374cb-3d07-11e0-94ab-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{ed2374cb-3d07-11e0-94ab-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{ed2374d7-3d07-11e0-94ab-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{ed2374d7-3d07-11e0-94ab-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f0b7bfde-718d-11e0-ad9d-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{f0b7bfde-718d-11e0-ad9d-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f0b7bfe1-718d-11e0-ad9d-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{f0b7bfe1-718d-11e0-ad9d-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f578b063-7cd0-11e0-a7ae-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{f578b063-7cd0-11e0-a7ae-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f578b0bf-7cd0-11e0-a7ae-705ab6e5c8e1}\Shell - "" = AutoRun O33 - MountPoints2\{f578b0bf-7cd0-11e0-a7ae-705ab6e5c8e1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.11.23 19:15:04 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\xxxx\Desktop\OTL.exe [2012.11.23 15:58:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs [2012.11.18 17:03:53 | 000,829,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcr100.dll [2012.11.18 17:03:53 | 000,608,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcp100.dll [2012.11.18 17:03:53 | 000,035,328 | ---- | C] (IncrediMail, Ltd.) -- C:\Windows\SysNative\ImHttpComm.dll [2012.11.18 17:03:53 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ARFC [2012.11.18 17:03:47 | 000,000,000 | ---D | C] -- C:\Program Files\IB Updater [2012.11.18 11:12:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012.11.18 10:10:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2012.11.18 10:10:20 | 006,200,680 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcpl.dll [2012.11.18 10:10:20 | 003,293,544 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvc64.dll [2012.11.18 10:10:20 | 002,557,800 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvcr.dll [2012.11.18 10:10:20 | 000,118,120 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvmctray.dll [2012.11.18 10:10:20 | 000,063,336 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvshext.dll [2012.11.17 17:31:34 | 000,000,000 | ---D | C] -- C:\Users\Jenny\Desktop\Fernunterricht [2012.11.17 12:23:34 | 000,000,000 | R--D | C] -- C:\Users\Jenny\Documents\Scanned Documents [2012.11.17 12:23:34 | 000,000,000 | ---D | C] -- C:\Users\Jenny\Documents\Fax [2012.11.15 08:03:52 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys [2012.11.15 08:03:52 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll [2012.11.15 07:52:42 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.11.15 07:52:41 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.11.15 07:52:39 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.11.15 07:52:39 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.11.15 07:52:38 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.11.15 07:52:38 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.11.15 07:52:38 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.11.15 07:52:38 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.11.15 07:52:37 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.11.15 07:52:37 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.11.15 07:52:37 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.11.15 07:52:36 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2012.11.15 07:52:33 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.11.15 07:52:33 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.11.15 07:52:33 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2012.11.15 07:51:39 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll [2012.11.15 07:51:38 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll [2012.11.15 07:51:38 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe [2012.11.15 07:51:38 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll [2012.11.15 06:24:56 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll [2012.11.15 06:24:56 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll [2012.11.15 06:24:56 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll [2012.11.15 06:24:30 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll [2012.11.15 06:24:30 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll [2012.11.15 06:24:29 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll [2012.11.15 06:24:29 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll [2012.11.15 06:24:29 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll [2012.11.15 06:24:29 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll [2012.11.15 06:23:42 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll [2012.11.15 06:23:42 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll [2012.11.11 13:11:37 | 000,000,000 | ---D | C] -- C:\Users\Jenny\AppData\Roaming\PerformerSoft [2012.11.11 13:11:21 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Performer Manager [2012.10.28 08:32:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox ========== Files - Modified Within 30 Days ========== [2012.11.24 08:38:01 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfud.bin [2012.11.24 08:37:49 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\tmvsthfss.bin [2012.11.24 08:31:15 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.11.24 08:31:15 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.11.24 08:28:54 | 006,864,036 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.11.24 08:28:54 | 002,432,088 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.11.24 08:28:54 | 002,059,402 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.11.24 08:28:54 | 001,840,226 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.11.24 08:28:54 | 000,005,438 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.11.24 08:23:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.11.23 19:58:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.11.23 19:15:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jenny\Desktop\OTL.exe [2012.11.23 19:07:23 | 000,543,531 | ---- | M] () -- C:\Users\Jenny\Desktop\adwcleaner.exe [2012.11.23 16:02:53 | 000,000,824 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2012.11.21 12:03:15 | 000,000,000 | ---- | M] () -- C:\Users\Jenny\defogger_reenable [2012.11.17 17:20:24 | 000,001,101 | ---- | M] () -- C:\Users\Jenny\Desktop\RevenueWire Keyword Manager.lnk [2012.11.17 15:26:57 | 000,081,778 | ---- | M] () -- C:\Users\Jenny\Desktop\Hartz IV und die Wohnkostenabrechnung.pdf [2012.11.16 08:01:00 | 000,275,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.11.02 09:53:02 | 000,000,959 | ---- | M] () -- C:\Users\Public\Desktop\Acrobat_com.lnk ========== Files Created - No Company Name ========== [2012.11.23 19:07:15 | 000,543,531 | ---- | C] () -- C:\Users\Jenny\Desktop\adwcleaner.exe [2012.11.21 12:03:15 | 000,000,000 | ---- | C] () -- C:\Users\Jenny\defogger_reenable [2012.11.18 17:03:53 | 001,261,936 | ---- | C] () -- C:\Windows\SysNative\dmwu.exe [2012.11.17 17:20:24 | 000,001,101 | ---- | C] () -- C:\Users\Jenny\Desktop\RevenueWire Keyword Manager.lnk [2012.11.17 15:26:57 | 000,081,778 | ---- | C] () -- C:\Users\Jenny\Desktop\Hartz IV und die Wohnkostenabrechnung.pdf [2012.11.15 08:03:56 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2012.11.15 07:51:38 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2012.11.02 09:53:02 | 000,000,971 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat_com.lnk [2012.11.02 09:53:02 | 000,000,959 | ---- | C] () -- C:\Users\Public\Desktop\Acrobat_com.lnk [2012.07.15 13:48:23 | 000,000,082 | ---- | C] () -- C:\Windows\odbc_merge.INI [2012.06.20 13:40:47 | 000,000,089 | ---- | C] () -- C:\Users\Jenny\govello20.properties [2012.06.19 21:18:16 | 000,002,719 | ---- | C] () -- C:\Users\Jenny\AppData\Local\recently-used.xbel [2012.04.23 17:20:18 | 000,033,134 | ---- | C] () -- C:\Users\Jenny\AppData\Roaming\UserTile.png [2012.03.28 09:56:47 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.03.14 13:43:34 | 001,526,976 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.01.02 13:19:13 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe [2010.05.04 01:20:18 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2011.08.11 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\Bytemobile [2011.08.11 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\Bytemobile [2012.05.08 13:44:29 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Amazon [2011.01.02 13:45:17 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Asus [2011.01.02 14:39:27 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Asus WebStorage [2011.02.16 19:31:37 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Bytemobile [2011.06.26 21:32:30 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2012.02.22 17:03:47 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\com.vilango.birkenbihlsprachen.standalone.demo.cd.4098D6077932D7E96A46C8B37530CA6753B141F8.1 [2011.03.18 13:05:36 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\EeeStorageUploader [2012.11.16 09:58:14 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\FireShot [2012.07.25 15:08:19 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Five9 [2012.01.09 13:26:28 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\HCM Updater [2012.11.11 13:15:36 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\PerformerSoft [2011.02.17 12:20:38 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Philips [2011.02.17 12:17:54 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Philips-Songbird [2012.11.23 15:41:10 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\SoftGrid Client [2012.04.04 22:54:02 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\Systweak [2011.03.14 13:44:47 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\TP [2012.10.23 11:37:04 | 000,000,000 | ---D | M] -- C:\Users\Jenny\AppData\Roaming\TuneUp Software [2011.08.11 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\UpdatusUser\AppData\Roaming\Bytemobile ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:1A60DE96 < End of report > |
|
26.11.2012, 15:17
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Claro-Search von Firefox entfernen Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes - denk bitte vorher daran, Malwarebytes über den Updatebutton zu aktualisieren Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.11.2012, 10:32
| #13 |
| | Claro-Search von Firefox entfernen gewünschtes anbei... danke, Cosinus! Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.11.28.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Jenny :: KIRSTEN [Administrator] Schutz: Aktiviert 28.11.2012 09:00:48 mbam-log-2012-11-28 (09-00-48).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|H:\|Q:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 346660 Laufzeit: 1 Stunde(n), 25 Minute(n), 9 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=cd51b7a942c2de4785af81af5c429ec9
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-11-28 09:39:17
# local_time=2012-11-28 10:39:17 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=513 16777085 100 97 8343 87177573 0 0
# compatibility_mode=5893 16776574 66 85 51825383 105725407 0 0
# compatibility_mode=8192 67108863 100 0 3900 3900 0 0
# scanned=0
# found=0
# cleaned=0
# scan_time=0
|
|
28.11.2012, 10:47
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Claro-Search von Firefox entfernen Sieht soweit ok aus Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
09.12.2012, 10:10
| #15 |
| | Incredibar "eingebettet" in Firefox Browser Hallo cosinus, vielen Dank dafür, dass Du mir bei CLARO so gut geholfen hast! Leider habe ich das Problem Incredibar "eingebettet" in Firefox Browser, das ich bisher nicht beheben konnte... Schönen zweiten Advent! Liebe Grüße, jaki |
|
| Themen zu Claro-Search von Firefox entfernen |
| anleitung, benutzer, benötigte, claro-search, dankbar, dateien, empfohlen, endgültigen, entferne, entfernen, firefox, hilfe!, leitung, löschen, registriert, schritte, verständliche |
Linear-Darstellung
