| |
| |||||||
Log-Analyse und Auswertung: GVU Trojaner eingefangenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
08.12.2012, 17:31
| #1 |
| |  GVU Trojaner eingefangen Hallo zusammen, Meine Freundin hat sich auf ihrem Rechner den GVU Trojaner eingefangen. Falls dazu noch Bilder nötig seien sollten, damit man sieht welcher das genau ist, dann reiche ich die selbstverständlich nach. Ich habe dann nachgelesen, das der Trojaner nicht so einfach zu entfernen ist, deswegen wende ich mich an euch. Das System ist Win7 Ultimate 64 Bit Was ich bereits getan habe: - Windows im abgesicherten Modus hochgefahren mit Netzwerkunterstützung - Malwarebytes installiert, geupdated und durchlaufen lassen - Defogger ausgeführt und adapter deaktiviert - OTL scannen lassen - adwcleaner scannen lassen gelöscht habe ich noch nichts, denn so wie ich das gelesen habe in anderen Threads kann es ja das lösen des Problems behindern. Hier die Logs: Malwarebyte: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.12.08.04 Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 8.0.7600.16385 Jen :: JEN-PC [Administrator] Schutz: Deaktiviert 08.12.2012 15:47:33 mbam-log-2012-12-08 (17-07-43).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 435539 Laufzeit: 52 Minute(n), 56 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCU\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 5 C:\Users\Jen\Downloads\SoftonicDownloader_fuer_knuffel.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt. C:\Users\Jen\Downloads\video_downloader.exe (PUP.BundleInstaller.VG) -> Keine Aktion durchgeführt. C:\Users\Jen\AppData\Local\Temp\wpbt0.dll (Exploit.Drop.GS) -> Keine Aktion durchgeführt. C:\Users\Jen\wgsdgsdgdsgsd.exe (Exploit.Drop.GS) -> Keine Aktion durchgeführt. C:\Users\Jen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk (Trojan.Ransom.SUGen) -> Keine Aktion durchgeführt. (Ende) Dann OTL Code:
ATTFilter OTL logfile created on: 08.12.2012 16:24:47 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jen\Desktop 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 63,83% Memory free 7,99 Gb Paging File | 6,67 Gb Available in Paging File | 83,47% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 79,18 Gb Total Space | 5,01 Gb Free Space | 6,32% Space Free | Partition Type: NTFS Drive D: | 307,72 Gb Total Space | 173,54 Gb Free Space | 56,40% Space Free | Partition Type: NTFS Drive E: | 78,86 Gb Total Space | 54,45 Gb Free Space | 69,05% Space Free | Partition Type: NTFS Unable to calculate disk information. Drive G: | 3,75 Gb Total Space | 3,73 Gb Free Space | 99,49% Space Free | Partition Type: FAT32 Computer Name: JEN-PC | User Name: Jen | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.12.08 16:23:39 | 000,050,477 | ---- | M] () -- C:\Users\Jen\Downloads\Defogger.exe PRC - [2012.12.08 15:48:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jen\Desktop\OTL.exe PRC - [2012.12.05 22:36:03 | 000,916,960 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.09.29 19:54:26 | 000,981,656 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe PRC - [2012.08.27 06:14:43 | 001,191,768 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe PRC - [2012.05.24 21:10:00 | 002,152,720 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe PRC - [2011.12.23 07:12:10 | 001,101,960 | ---- | M] () -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe ========== Modules (No Company Name) ========== MOD - [2012.12.08 16:23:39 | 000,050,477 | ---- | M] () -- C:\Users\Jen\Downloads\Defogger.exe MOD - [2012.12.05 22:36:02 | 002,397,152 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ========== Services (SafeList) ========== SRV:64bit: - [2011.01.26 23:55:36 | 000,203,776 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.12.05 22:36:02 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.05.24 21:10:00 | 002,152,720 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service) SRV - [2012.05.08 20:46:53 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.08 20:46:53 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.08.06 21:46:22 | 000,069,120 | ---- | M] (BOONTY) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\BOONTY Shared\Service\Boonty.exe -- (Boonty Games) SRV - [2011.02.26 01:30:11 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- d:\Spiele\SteamApps\common\dragon age origins\bin_ship\daupdatersvc.service.exe -- (DAUpdaterSvc) SRV - [2010.04.16 15:10:58 | 000,036,864 | ---- | M] (Realtek) [Auto | Stopped] -- C:\Program Files (x86)\Hama\Wireless LAN RTL8192SU\RtlService.exe -- (Realtek11nSU) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.09.29 19:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.05.08 20:46:53 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.05.08 20:46:53 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.12.23 07:12:12 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd) DRV:64bit: - [2011.12.15 15:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.01.27 00:37:20 | 009,085,952 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2011.01.26 23:13:32 | 000,299,520 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2010.11.17 13:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2010.07.07 13:55:20 | 000,692,768 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192su.sys -- (RTL8192su) DRV:64bit: - [2010.06.14 08:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk) DRV:64bit: - [2010.04.27 03:25:16 | 000,161,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdm.sys -- (ss_bmdm) DRV:64bit: - [2010.04.27 03:25:16 | 000,127,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bbus.sys -- (ss_bbus) DRV:64bit: - [2010.04.27 03:25:16 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ss_bmdfl.sys -- (ss_bmdfl) DRV:64bit: - [2009.07.14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2009.07.14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 02:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:35:38 | 000,707,072 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netr7364.sys -- (netr7364) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.03.01 23:05:32 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV - [2012.01.30 14:08:34 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys -- (Lavasoft Kernexplorer) DRV - [2010.06.14 08:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2001.09.22 09:16:42 | 000,004,016 | ---- | M] (SpecoSoft) [Kernel | On_Demand | Stopped] -- D:\UltraStar\zlportio.sys -- (zlportio) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 33 16 4B D6 C1 D6 CB 01 [binary data] IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7Bcc05a3e3-64c3-4af2-bfc1-af0d66b69065%7D:3.16.0.3 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.8 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.12.05 22:36:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.12.05 22:33:41 | 000,000,000 | ---D | M] [2011.02.25 21:37:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jen\AppData\Roaming\mozilla\Extensions [2012.12.07 18:15:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jen\AppData\Roaming\mozilla\Firefox\Profiles\r2ztbt0a.default\extensions [2012.11.07 23:00:55 | 000,000,000 | ---D | M] (ST-de3 Community Toolbar) -- C:\Users\Jen\AppData\Roaming\mozilla\Firefox\Profiles\r2ztbt0a.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2011.07.10 10:01:31 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Jen\AppData\Roaming\mozilla\Firefox\Profiles\r2ztbt0a.default\extensions\engine@conduit.com [2012.12.07 18:15:06 | 000,035,624 | ---- | M] () (No name found) -- C:\Users\Jen\AppData\Roaming\mozilla\firefox\profiles\r2ztbt0a.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012.11.23 20:50:53 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Jen\AppData\Roaming\mozilla\firefox\profiles\r2ztbt0a.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.12.05 22:33:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.12.05 22:36:03 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.02.25 21:49:26 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2012.10.14 10:16:57 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.10.14 10:16:57 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.10.14 10:16:57 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.10.14 10:16:57 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.10.14 10:16:57 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.10.14 10:16:57 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (ST-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (ST-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (ST-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files (x86)\softonic-de3\prxtbsof0.dll (Conduit Ltd.) O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [NPSStartup] File not found O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [AutoStartNPSAgent] D:\NPSAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKCU..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found O4 - HKCU..\Run: [Steam] D:\Spiele\Steam.exe (Valve Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Users\Jen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jen\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jen\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{032EE64D-4F13-4C00-9BE4-F32A1991055B}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{03F87B00-0A86-4DA4-A9F6-631F52F457B9}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5EF5E84E-5831-4065-8038-CCB7DCC82E05}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{88C55484-E456-487F-A0BF-84E123445B3E}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{98B8903B-AF38-4924-A05F-B4DA431F905E}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A048057F-D505-4154-B9A9-2E1C4AE333D6}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A5612F1C-4978-4BEA-86E2-93CEB24FBE52}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.08.17 14:55:34 | 000,000,000 | ---D | M] - E:\Autobackups -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.12.08 16:15:23 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Jen\Desktop\OTL.exe [2012.12.08 15:49:15 | 000,000,000 | ---D | C] -- C:\Users\Jen\Desktop\Desktop [2012.12.08 15:36:13 | 000,000,000 | ---D | C] -- C:\Users\Jen\AppData\Roaming\Malwarebytes [2012.12.08 15:36:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.12.08 15:36:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.12.08 15:36:03 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.12.08 15:36:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.12.08 13:53:07 | 000,254,976 | ---- | C] (Microsoft Corporation) -- C:\Users\Jen\wgsdgsdgdsgsd.exe [2012.12.05 22:33:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.11.24 21:01:43 | 000,000,000 | ---D | C] -- C:\Users\Jen\Documents\OneNote-Notizbücher [2012.11.24 17:10:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER [2012.11.24 17:10:06 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2012.11.24 17:04:55 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office [2012.11.24 17:04:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services [2012.11.24 17:04:10 | 000,000,000 | ---D | C] -- C:\Users\Jen\AppData\Local\Microsoft Help [2012.11.24 17:04:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office [2012.11.24 17:04:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2012.11.24 17:03:48 | 000,000,000 | RH-D | C] -- C:\MSOCache [2012.11.18 22:58:50 | 000,000,000 | ---D | C] -- C:\Users\Jen\AppData\Local\Monotype Imaging Inc [2012.11.18 22:55:44 | 000,000,000 | R--D | C] -- C:\Users\Jen\Documents\Scanned Documents [2012.11.18 22:55:44 | 000,000,000 | ---D | C] -- C:\Users\Jen\Documents\Fax [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.12.08 16:23:53 | 000,000,000 | ---- | M] () -- C:\Users\Jen\defogger_reenable [2012.12.08 16:16:59 | 001,494,684 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.12.08 16:16:59 | 000,651,976 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.12.08 16:16:59 | 000,614,038 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.12.08 16:16:59 | 000,129,734 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.12.08 16:16:59 | 000,106,158 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.12.08 15:48:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jen\Desktop\OTL.exe [2012.12.08 15:48:32 | 000,540,743 | ---- | M] () -- C:\Users\Jen\Desktop\adwcleaner (1).exe [2012.12.08 15:46:37 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job [2012.12.08 15:46:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.08 15:46:19 | 3217,678,336 | -HS- | M] () -- C:\hiberfil.sys [2012.12.08 15:36:05 | 000,001,120 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.08 14:52:53 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.12.08 14:52:46 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.12.08 14:03:32 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.08 14:03:32 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.08 13:53:12 | 000,001,052 | ---- | M] () -- C:\Users\Jen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2012.12.08 13:53:07 | 000,254,976 | ---- | M] (Microsoft Corporation) -- C:\Users\Jen\wgsdgsdgdsgsd.exe [2012.12.08 13:50:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.12.07 17:39:42 | 000,001,351 | ---- | M] () -- C:\Users\Jen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2012.12.06 15:29:18 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat [2012.12.06 15:29:18 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat [2012.11.25 20:08:49 | 000,360,448 | ---- | M] () -- C:\Users\Jen\Documents\Database1.accdb [2012.11.25 10:06:34 | 000,433,568 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.11.24 21:06:01 | 001,513,638 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.11.18 23:05:24 | 000,026,829 | ---- | M] () -- C:\Users\Jen\Documents\Veggie Rezepte.odt [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.12.08 16:23:53 | 000,000,000 | ---- | C] () -- C:\Users\Jen\defogger_reenable [2012.12.08 16:15:26 | 000,540,743 | ---- | C] () -- C:\Users\Jen\Desktop\adwcleaner (1).exe [2012.12.08 15:36:05 | 000,001,120 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.08 14:54:12 | 000,000,408 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job [2012.12.08 13:53:12 | 000,001,052 | ---- | C] () -- C:\Users\Jen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2012.12.08 13:53:10 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.11.24 21:06:01 | 001,513,638 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.11.24 21:01:45 | 000,001,351 | ---- | C] () -- C:\Users\Jen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2012.11.24 21:00:19 | 000,360,448 | ---- | C] () -- C:\Users\Jen\Documents\Database1.accdb [2012.11.18 23:05:22 | 000,026,829 | ---- | C] () -- C:\Users\Jen\Documents\Veggie Rezepte.odt [2012.09.19 14:58:43 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe [2011.09.18 10:37:51 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini [2011.06.07 07:06:35 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat [2011.06.07 07:06:35 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat [2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011.02.25 21:37:48 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2011.02.25 21:28:11 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010.12.21 03:27:20 | 000,003,113 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2010.07.27 15:59:11 | 014,162,944 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2010.07.27 15:03:24 | 012,867,584 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] < End of report > Code:
ATTFilter OTL Extras logfile created on: 08.12.2012 16:24:47 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jen\Desktop
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 63,83% Memory free
7,99 Gb Paging File | 6,67 Gb Available in Paging File | 83,47% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 79,18 Gb Total Space | 5,01 Gb Free Space | 6,32% Space Free | Partition Type: NTFS
Drive D: | 307,72 Gb Total Space | 173,54 Gb Free Space | 56,40% Space Free | Partition Type: NTFS
Drive E: | 78,86 Gb Total Space | 54,45 Gb Free Space | 69,05% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Drive G: | 3,75 Gb Total Space | 3,73 Gb Free Space | 99,49% Space Free | Partition Type: FAT32
Computer Name: JEN-PC | User Name: Jen | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{030746C0-DDA5-4DCF-AEE5-04CF55B68FFC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0B645C0D-07AA-41EF-A3B3-85D90D7394A4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{0BB0665E-ACCE-45A4-8375-96FE0ED7DDC0}" = rport=10243 | protocol=6 | dir=out | app=system |
"{0CBEADCB-7C74-464B-A25B-E7256B58BAE7}" = lport=138 | protocol=17 | dir=in | app=system |
"{0D7C6042-2A39-4548-B899-0AFEA18FF73D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1094B7BA-4167-441D-A19C-711AFBD28B18}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{13774D4C-4CDB-4DD1-B738-DC6953A3EA00}" = lport=10243 | protocol=6 | dir=in | app=system |
"{2AB7F927-1723-462D-A5EA-DFB0DBA32FAB}" = rport=137 | protocol=17 | dir=out | app=system |
"{2EDF8A99-7106-4BC7-AE0A-28325669C142}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{42198A5C-AE08-4EE3-80CC-C247495BB129}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{46D69361-ACDD-4D2D-8846-91AE57B3BD30}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{48161CBA-BF39-4E81-9F06-3F5B5AF105F6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4A7EA1A7-7686-4D08-B9E0-B5921CB8A477}" = lport=139 | protocol=6 | dir=in | app=system |
"{4F00D3E9-F379-4122-B21E-6E635E602882}" = rport=445 | protocol=6 | dir=out | app=system |
"{5A05A2C2-B755-4A09-9C40-97778C06E0BA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{70640630-AA05-4E7C-ADB0-DE5663039F56}" = rport=138 | protocol=17 | dir=out | app=system |
"{88624C56-F448-4FE3-97E8-9482CB88C6B3}" = lport=1542 | protocol=17 | dir=in | name=realtek wps udp prot |
"{891145EE-F13B-4A0B-9E67-4C4597ED6257}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A6DA9890-6AC4-441F-8CE0-3B8478D10022}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B61DE60F-8CA0-45DF-820B-74DF2DE1DE42}" = lport=53 | protocol=17 | dir=in | name=realtek ap udp prot |
"{DD43D63A-FF2F-4987-A85F-FE367FFC16B9}" = lport=1542 | protocol=6 | dir=in | name=realtek wps tcp prot |
"{E9455AB1-2BA0-4D2E-9316-CF3B30C9CEC7}" = rport=139 | protocol=6 | dir=out | app=system |
"{E95473EF-1726-44DC-9BBF-7E5EC3EA2AE4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EF0EF61F-3EF1-4E2B-98B4-B760CED18E9C}" = lport=445 | protocol=6 | dir=in | app=system |
"{F2375CBC-FDAC-40E9-BCAB-C908FF7BB0E3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F68E46C9-3D72-4E3C-B189-DBA4E3152AB3}" = lport=137 | protocol=17 | dir=in | app=system |
"{FE263CE4-8E2C-4008-93E0-1F148D029354}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01634DCC-BDAA-454B-8BA3-9CCD90F63E51}" = protocol=6 | dir=out | app=system |
"{02D031AE-C5E3-4218-B373-B9F125D83E8F}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{02F4B401-3FCB-4530-9A48-AFDD920B0466}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{03A5A7B1-2F9B-4102-A23F-1430B5F3FE80}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe |
"{0CDADB75-EDE8-4B76-AEC7-3B629C28661A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{0D3A34F2-CDC4-4C15-959E-620C3ACAA040}" = protocol=6 | dir=in | app=d:\spiele\steamapps\common\dragon age origins\docs\ea help\electronic_arts_technical_support.htm |
"{0D4E3A2C-CDC5-4AD6-9C0E-44CB16A90D38}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe |
"{0F563BB4-7D00-4B33-8058-AF97EC15143D}" = protocol=6 | dir=in | app=d:\spiele\steamapps\common\dragon age origins\bin_ship\daorigins.exe |
"{18FA5B5F-63F1-4DD0-BFE8-A565BF43EDA1}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{1D470226-341F-439E-9B6A-2BD7089993A8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1D67C69E-7C77-4E52-82BE-C370CBFDD2E0}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{2041C103-DFCF-4949-A182-38B21DA6073D}" = protocol=17 | dir=in | app=d:\npsvsvr.exe |
"{22D4D298-5E0D-4BCF-A3C3-4FFBE3D067EB}" = protocol=17 | dir=in | app=d:\spiele\steamapps\common\dragon age origins\docs\ea help\electronic_arts_technical_support.htm |
"{25D4AFD6-BE7F-44C5-BB9D-9691DB1D5EE8}" = protocol=6 | dir=in | app=d:\spiele\diablo iii\diablo iii.exe |
"{2F4E274B-6577-4585-935A-255A44297249}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2FAC4081-D17C-415F-BB87-817DCB13AB73}" = protocol=6 | dir=in | app=d:\spiele\steam.exe |
"{300774FB-7B5A-4B1E-9B59-11CECDCD6193}" = protocol=17 | dir=in | app=d:\spiele\diablo iii\diablo iii.exe |
"{3CB33C23-CBF4-43A1-8BF7-8428F8C58520}" = protocol=6 | dir=in | app=d:\npsasvr.exe |
"{4679E6BB-3A8A-454C-AEDE-9146F7D87104}" = protocol=17 | dir=in | app=d:\npsasvr.exe |
"{4C102591-3B12-4449-91F5-174E0578A98C}" = protocol=17 | dir=in | app=d:\spiele\steamapps\common\skyrim\skyrimlauncher.exe |
"{54784ED1-9826-4278-B1A5-C8A565B90128}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{55D6A6FE-C19D-4698-8DD1-901E68876EDA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{584CA13D-15B8-455D-8F19-75D154C17E58}" = protocol=17 | dir=in | app=d:\spiele\steamapps\common\portal 2\portal2.exe |
"{58A930EF-2B53-47E5-BEFF-443C5A945EC7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{5B80D337-C4E0-48A9-AEAC-D76667401CA5}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{5F4044FD-A245-4073-BB0B-1EB373C556D1}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{61675BC8-CB6F-4D42-B700-3B6BF72BD5F8}" = protocol=17 | dir=in | app=d:\spiele\steam.exe |
"{64B840FC-A543-4D53-9106-70755EB3C14A}" = protocol=6 | dir=in | app=d:\spiele\steamapps\common\dragon age origins\bin_ship\daupdatersvc.service.exe |
"{64FCF79A-D820-492F-9A01-19CFA4A94AF4}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{67A935D6-EA54-436F-88D8-00D8AB4ECFB1}" = protocol=17 | dir=in | app=c:\program files (x86)\hama\wireless lan rtl8192su\rtwlan.exe |
"{6F0AF4CB-A76D-4632-8B9F-D97E9F28B2DE}" = protocol=6 | dir=in | app=d:\spiele\steamapps\common\portal 2\portal2.exe |
"{71438F7A-ECC8-4AAD-90E9-1EAED1717B7A}" = protocol=17 | dir=in | app=d:\spiele\steamapps\common\dragon age origins\bin_ship\daupdatersvc.service.exe |
"{76207CCB-A185-4690-842D-C3DC52D47237}" = protocol=6 | dir=in | app=c:\program files (x86)\dragon age 2\bin_ship\dragonage2.exe |
"{772BB611-B4CF-4C43-B5CD-B89CAE9D835C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{7FA1D827-949D-4688-B609-47D72D2AA520}" = protocol=6 | dir=in | app=d:\npsvsvr.exe |
"{7FCDC633-3035-41D0-BCF7-57F686CB081D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{843088C8-04D1-4BFF-9C5F-5893A3AEDFB8}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{8589E8CB-7FA9-4B19-9C7C-F1B1B9BE0AEE}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{88AFA4D5-EA3D-4092-84B0-9C41E09A7A10}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{91E31B28-E2A9-4FAF-907A-0ED2744E5C1D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{984D31BA-A3ED-4B46-B74A-2001F8DD08CF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9E4BE212-60A0-4DC6-A3E8-4C6958EE1E82}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{A3F4967A-D999-4FF5-AD66-F8E8A039C276}" = protocol=17 | dir=in | app=d:\spiele\steamapps\common\dragon age origins\daoriginslauncher.exe |
"{A5E52CB5-C31D-4345-8221-DC589B9A086F}" = protocol=6 | dir=in | app=d:\spiele\steamapps\common\dragon age origins\daoriginslauncher.exe |
"{A89AA7E9-6507-4B70-ADF1-7C554CAEEE9B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AD84F564-27C3-4601-A55A-80F6116E3548}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{B343E27F-F7E7-4A0C-9EA7-0781AEAC7BDD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B6DA6B99-C25A-476C-928B-913088A99ED2}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{BC8739D2-5B16-4F04-96CA-F8666A61C733}" = protocol=17 | dir=in | app=d:\spiele\steamapps\common\dragon age origins\bin_ship\daorigins.exe |
"{BDF963A7-BB46-4DE8-8093-A8D48B564A48}" = protocol=6 | dir=in | app=c:\program files (x86)\dragon age 2\dragonage2launcher.exe |
"{C37CE0F1-03D8-4F84-8BB6-1013EAF31B09}" = protocol=6 | dir=in | app=d:\spiele\steamapps\common\skyrim\skyrimlauncher.exe |
"{CA3DE4CC-AB39-4FA8-97B8-FA49F7F4D029}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{D0E50B15-9A3B-4F1E-8020-6953776BE206}" = protocol=17 | dir=in | app=c:\program files (x86)\dragon age 2\bin_ship\dragonage2.exe |
"{D3FFC88D-7E83-49CD-A960-F1050BC094E4}" = protocol=17 | dir=in | app=c:\program files (x86)\dragon age 2\dragonage2launcher.exe |
"{D5477EBE-5150-4EE9-B498-A3029976E1F8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D9758F9A-AF75-4CDE-8B23-A38FE1A2A7E5}" = protocol=6 | dir=in | app=c:\program files (x86)\hama\wireless lan rtl8192su\rtwlan.exe |
"{E4909B7E-0B2C-4903-A8B7-E15703D61E6B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{3A3AE40F-0E05-47B7-A58A-DA0FC200032B}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"TCP Query User{61148B62-06E9-404F-97A2-55F9297DB626}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |
"TCP Query User{7AFEC876-7523-47D8-BE52-A374344DB210}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
"TCP Query User{D585881F-09E9-4E7F-AF7D-99EC71A53C8E}D:\titan quest setup\titan quest\titan quest.exe" = protocol=6 | dir=in | app=d:\titan quest setup\titan quest\titan quest.exe |
"TCP Query User{DDAAF993-8548-499F-B825-F1E10602A81C}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"UDP Query User{04F3CF7C-B6AF-4163-AA04-5E2517E8AD61}D:\titan quest setup\titan quest\titan quest.exe" = protocol=17 | dir=in | app=d:\titan quest setup\titan quest\titan quest.exe |
"UDP Query User{3202BBCB-F16A-49E6-B67B-F8769CCD4D29}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe |
"UDP Query User{55D1F433-C36B-4952-8A2B-3DE1BC73AC72}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{62005D12-C64F-43FA-A791-F1D68EE79B8E}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |
"UDP Query User{B45BD95F-C107-41E8-A2EE-FA8835FF4E86}C:\program files (x86)\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\client\googleearth.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{22441735-5983-AD2A-5CC5-FA2CCD7EF732}" = ATI Stream SDK v2 Developer
"{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}" = Paint.NET v3.5.10
"{5E2BDF97-E0C7-75AE-29E1-5EA9DA262F2F}" = WMV9/VC-1 Video Playback
"{6A9B5F9E-CAF3-2264-9DA0-E374F9A34279}" = AMD Drag and Drop Transcoding
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{AE57C044-8912-A181-A0E4-BC2DAB3A092A}" = ATI Catalyst Install Manager
"{B2C5B378-546F-75A7-7757-C1EAAFAF9E33}" = ccc-utility64
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Logitech Unifying" = Logitech Unifying-Software 2.00
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0D0EB043-73A9-B71E-BA0B-1F6126BD2524}" = Napster 5.0 Beta
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{141B8BA9-BFFD-4635-AF64-078E31010EC3}_is1" = FINAL FANTASY VII
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{2C9EE786-1DDB-4C98-8FA4-B1B9B5A66B77}" = Microsoft Games for Windows - LIVE
"{2D37F6AE-D201-4580-B91A-6BF9BB93ED2D}" = Die Sims™ 2 Super Deluxe
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{434D0831-A4CC-401A-9E74-621000018401}" = F1 2010
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5FD89EA1-99C2-40EE-BBF5-20F8991ED756}" = Catalyst Control Center - Branding
"{664D6E1D-2A6C-D54D-31A5-B6BC30CEB0C6}" = CCC Help English
"{6CB35178-9E25-48fb-9F86-E40ADC7043B6}" = Die Sims™ 2 Best of Business Collection
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7AD24EE1-1982-4B80-BA00-EC260C88AB5A}_is1" = Die große Kartenspiele-Box
"{7B9F5775-8C8C-2A4E-0CAB-74EA7AF5CB09}" = ccc-core-static
"{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}" = Die Sims™ 2 Freizeit-Spaß
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8E9976D2-E563-43DE-A51F-5AEBC38D1F08}" = Ad-Aware
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90981870-9BB7-4A25-9676-1FEF875B9117}_is1" = World's Best Board Games 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C049499-055C-4a0c-A916-1D8CA1FF45EB}" = Hama Wireless LAN Adapter
"{A0673604-C7C6-4E23-A59C-1073CB8D7D58}" = Napster Player Sync
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA945C94-285E-DE48-A30F-70105C6580DE}" = Catalyst Control Center Graphics Previews Common
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{B6F5B704-06D3-4687-90F3-6195304AD755}" = Die Sims™ 2 Apartment-Leben
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die*Sims™*3
"{CC29B835-95A5-3CD9-087B-F94D7B9ECC9B}" = Catalyst Control Center InstallProxy
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.4.4 Game
"{D7E7EC5E-4349-4E40-B37C-4342188B86EC}" = Monopoly
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F248ADFA-64E0-4b03-8A83-059078BED6A0}" = Die Sims™ 2 Gute Reise
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F2E23139-3404-4E3C-9855-7724415D62A5}" = Dragon Age II
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F41C11EC-7C13-47A7-A07C-251D96EC3879}" = Baphomets Fluch - Der Engel des Todes
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Art of Murder 2/DE-German_is1" = Die Kunst des Mordens: Der Marionettenspieler
"Art of Murder 3/DE-German_is1" = Die Kunst des Mordens: Karten des Schicksals
"Art of Murder/DE-German_is1" = Die Kunst des Mordens: Geheimakte FBI
"Avira AntiVir Desktop" = Avira Free Antivirus
"CEP - Colour Enable Packages_is1" = CEP - Color Enable Package
"com.Rhapsody.Napster5" = Napster 5.0 Beta
"Diablo III" = Diablo III
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.35.1031
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Nicht ärgern! inkl. Hutfangen + Gesperrt" = Nicht ärgern! inkl. Hutfangen + Gesperrt 1.0
"Office14.SingleImage" = Microsoft Office Professional 2010
"OpenAL" = OpenAL
"Origin" = Origin
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"ST5UNST #1" = Knuffel
"Steam App 17450" = Dragon Age: Origins
"Steam App 47730" = Dragon Age: Origins - Awakening
"Steam App 72850" = The Elder Scrolls V: Skyrim
"UltraStar" = UltraStar 0.7.0
"WinRAR archiver" = WinRAR
"yWriter5_is1" = yWriter5
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dragon Age Awakening Redesigned" = Dragon Age Awakening Redesigned
"Dragon Age Awakening Velanna Redesigned©" = Dragon Age Awakening Velanna Redesigned©
"Dragon Age Redesigned © Morrigan" = Dragon Age Redesigned © Morrigan
"Dragon Age Redesigned Oghren©" = Dragon Age Redesigned Oghren©
"Dragon Age Redesigned©" = Dragon Age Redesigned©
"Dragon Age Redesigned© Zevran" = Dragon Age Redesigned© Zevran
"Dragon Age Redesigned© Sten" = Dragon Age Redesigned© Sten
"Dragon Age Redesigned© Wynne" = Dragon Age Redesigned© Wynne
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 24.10.2012 16:29:19 | Computer Name = Jen-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: freac.exe, Version: 1.0.20.788, Zeitstempel:
0x4f70bd69 Name des fehlerhaften Moduls: smooth.dll, Version: 0.8.70.10, Zeitstempel:
0x4dc6cc5c Ausnahmecode: 0xc0000005 Fehleroffset: 0x00029478 ID des fehlerhaften Prozesses:
0xa68 Startzeit der fehlerhaften Anwendung: 0x01cdb201a110ff99 Pfad der fehlerhaften
Anwendung: D:\freac.exe Pfad des fehlerhaften Moduls: D:\smooth.dll Berichtskennung:
7c2c60bd-1e19-11e2-84e1-6cf049734fcd
Error - 26.10.2012 10:23:09 | Computer Name = Jen-PC | Source = Microsoft-Windows-Defrag | ID = 257
Description =
Error - 31.10.2012 11:22:26 | Computer Name = Jen-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 31.10.2012 14:38:34 | Computer Name = Jen-PC | Source = Microsoft-Windows-Defrag | ID = 257
Description =
Error - 01.11.2012 09:11:34 | Computer Name = Jen-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 05.11.2012 02:08:15 | Computer Name = Jen-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 05.11.2012 11:19:16 | Computer Name = Jen-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7600.16450,
Zeitstempel: 0x4aebab8d Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16695,
Zeitstempel: 0x4cc7b325 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000004c8f4
ID
des fehlerhaften Prozesses: 0x558 Startzeit der fehlerhaften Anwendung: 0x01cdbb68c556b8b7
Pfad
der fehlerhaften Anwendung: C:\Windows\Explorer.EXE Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 2927ee07-275c-11e2-b4ea-6cf049734fcd
Error - 09.11.2012 02:48:02 | Computer Name = Jen-PC | Source = Microsoft-Windows-Defrag | ID = 257
Description =
Error - 11.11.2012 16:06:50 | Computer Name = Jen-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 14.11.2012 08:26:45 | Computer Name = Jen-PC | Source = Microsoft-Windows-Defrag | ID = 257
Description =
Error - 18.11.2012 05:40:39 | Computer Name = Jen-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Steam.exe, Version: 1.0.1446.623,
Zeitstempel: 0x5004ae1a Name des fehlerhaften Moduls: steamservice.dll_unloaded,
Version: 0.0.0.0, Zeitstempel: 0x5085e919 Ausnahmecode: 0xc0000005 Fehleroffset:
0x6f3c1031 ID des fehlerhaften Prozesses: 0x9c0 Startzeit der fehlerhaften Anwendung:
0x01cdc5709ee38588 Pfad der fehlerhaften Anwendung: D:\Spiele\Steam.exe Pfad des
fehlerhaften Moduls: steamservice.dll Berichtskennung: 02e8bbf4-3164-11e2-9e30-6cf049734fcd
Error - 26.11.2012 12:18:33 | Computer Name = Jen-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Steam.exe, Version: 1.0.1446.623,
Zeitstempel: 0x5004ae1a Name des fehlerhaften Moduls: steamservice.dll_unloaded,
Version: 0.0.0.0, Zeitstempel: 0x5085e919 Ausnahmecode: 0xc0000005 Fehleroffset:
0x6e6e1031 ID des fehlerhaften Prozesses: 0x9b8 Startzeit der fehlerhaften Anwendung:
0x01cdcbf17db89e2c Pfad der fehlerhaften Anwendung: D:\Spiele\Steam.exe Pfad des
fehlerhaften Moduls: steamservice.dll Berichtskennung: ebe74e18-37e4-11e2-bf7b-6cf049734fcd
Error - 28.11.2012 01:31:26 | Computer Name = Jen-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Steam.exe, Version: 1.0.1446.623,
Zeitstempel: 0x5004ae1a Name des fehlerhaften Moduls: steamservice.dll_unloaded,
Version: 0.0.0.0, Zeitstempel: 0x5085e919 Ausnahmecode: 0xc0000005 Fehleroffset:
0x6d561031 ID des fehlerhaften Prozesses: 0x8c8 Startzeit der fehlerhaften Anwendung:
0x01cdcd2975f38965 Pfad der fehlerhaften Anwendung: D:\Spiele\Steam.exe Pfad des
fehlerhaften Moduls: steamservice.dll Berichtskennung: d9e269bb-391c-11e2-9ae4-6cf049734fcd
[ System Events ]
Error - 08.12.2012 11:20:15 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 08.12.2012 11:20:15 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 08.12.2012 11:20:15 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 08.12.2012 11:20:15 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 08.12.2012 11:20:15 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 08.12.2012 11:20:15 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 08.12.2012 11:20:16 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 08.12.2012 11:20:16 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 08.12.2012 11:20:16 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 08.12.2012 11:20:16 | Computer Name = Jen-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
< End of report >
Code:
ATTFilter # AdwCleaner v2.011 - Datei am 08/12/2012 um 16:25:14 erstellt
# Aktualisiert am 02/12/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate (64 bits)
# Benutzer : Jen - JEN-PC
# Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Jen\Desktop\adwcleaner (1).exe
# Option [Suche]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gefunden : C:\Program Files (x86)\Conduit
Ordner Gefunden : C:\Program Files (x86)\softonic-de3
Ordner Gefunden : C:\Users\Jen\AppData\Local\Conduit
Ordner Gefunden : C:\Users\Jen\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Jen\AppData\LocalLow\PriceGong
Ordner Gefunden : C:\Users\Jen\AppData\LocalLow\softonic-de3
Ordner Gefunden : C:\Users\Jen\AppData\Roaming\Mozilla\Firefox\Profiles\r2ztbt0a.default\ConduitCommon
Ordner Gefunden : C:\Users\Jen\AppData\Roaming\Mozilla\Firefox\Profiles\r2ztbt0a.default\CT2431245
Ordner Gefunden : C:\Users\Jen\AppData\Roaming\Mozilla\Firefox\Profiles\r2ztbt0a.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
Ordner Gefunden : C:\Users\Jen\AppData\Roaming\Mozilla\Firefox\Profiles\r2ztbt0a.default\extensions\engine@conduit.com
***** [Registrierungsdatenbank] *****
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\softonic-de3
Schlüssel Gefunden : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2431245
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E6EF52C3-9DEC-4A32-9AA3-09F66E48A11B}
Schlüssel Gefunden : HKLM\Software\softonic-de3
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E6EF52C3-9DEC-4A32-9AA3-09F66E48A11B}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{257307C3-74DB-47B4-B51B-A402B60A491F}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4AE6C614-6CB7-4DD6-8596-57F6BE27D9D7}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\softonic-de3 Toolbar
Schlüssel Gefunden : HKU\S-1-5-21-2515361826-3028058715-4187408877-1001\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7600.16722
[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245
-\\ Mozilla Firefox v17.0.1 (de)
Profilname : default
Datei : C:\Users\Jen\AppData\Roaming\Mozilla\Firefox\Profiles\r2ztbt0a.default\prefs.js
Gefunden : user_pref("CT2431245..clientLogIsEnabled", false);
Gefunden : user_pref("CT2431245..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Gefunden : user_pref("CT2431245..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Gefunden : user_pref("CT2431245.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Gefunden : user_pref("CT2431245.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gefunden : user_pref("CT2431245.AppTrackingLastCheckTime", "Sat Nov 24 2012 09:43:25 GMT+0100");
Gefunden : user_pref("CT2431245.BrowserCompStateIsOpen_129453394044193841", true);
Gefunden : user_pref("CT2431245.BrowserCompStateIsOpen_129633225487491098", true);
Gefunden : user_pref("CT2431245.BrowserCompStateIsOpen_129659302539581540", true);
Gefunden : user_pref("CT2431245.BrowserCompStateIsOpen_129682601309982614", true);
Gefunden : user_pref("CT2431245.BrowserCompStateIsOpen_129780209672379590", true);
Gefunden : user_pref("CT2431245.BrowserCompStateIsOpen_129790544018252482", true);
Gefunden : user_pref("CT2431245.CT2431245", "CT2431245");
Gefunden : user_pref("CT2431245.CommunitiesChangesLastCheckTime", "0");
Gefunden : user_pref("CT2431245.CurrentServerDate", "8-12-2012");
Gefunden : user_pref("CT2431245.DialogsAlignMode", "LTR");
Gefunden : user_pref("CT2431245.DialogsGetterLastCheckTime", "Wed Dec 05 2012 16:41:57 GMT+0100");
Gefunden : user_pref("CT2431245.DownloadReferralCookieData", "");
Gefunden : user_pref("CT2431245.EMailNotifierPollDate", "Sun Jul 10 2011 17:31:31 GMT+0200");
Gefunden : user_pref("CT2431245.EnableClickToSearchBox", false);
Gefunden : user_pref("CT2431245.EnableSearchHistory", false);
Gefunden : user_pref("CT2431245.EnableSearchSuggest", false);
Gefunden : user_pref("CT2431245.FeedLastCount129009402595187825", 562);
Gefunden : user_pref("CT2431245.FeedPollDate7470634014180506963", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634014269327586", "Sun Jul 10 2011 17:31:31 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634014329599698", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634014537505092", "Sun Jul 10 2011 17:31:31 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634014970726540", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015410831318", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015483395460", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015636754705", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015768347545", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634015855543602", "Sun Jul 10 2011 17:31:31 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016030710453", "Sun Jul 10 2011 17:31:31 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016114705611", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016129205152", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016143724791", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016271239162", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016568520719", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634016726993788", "Sun Jul 10 2011 17:31:31 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017109031809", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017132743740", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017299547668", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017302327846", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017344111490", "Sun Jul 10 2011 17:31:32 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017478360748", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017732797593", "Sun Jul 10 2011 17:31:31 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634017821686064", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedPollDate7470634018090228721", "Sun Jul 10 2011 17:31:33 GMT+0200");
Gefunden : user_pref("CT2431245.FeedTTL7470634014269327586", 5);
Gefunden : user_pref("CT2431245.FeedTTL7470634014537505092", 5);
Gefunden : user_pref("CT2431245.FeedTTL7470634014970726540", 2);
Gefunden : user_pref("CT2431245.FeedTTL7470634015636754705", 5);
Gefunden : user_pref("CT2431245.FeedTTL7470634016568520719", 30);
Gefunden : user_pref("CT2431245.FeedTTL7470634017109031809", 30);
Gefunden : user_pref("CT2431245.FeedTTL7470634017299547668", 2);
Gefunden : user_pref("CT2431245.FirstServerDate", "10-7-2011");
Gefunden : user_pref("CT2431245.FirstTime", true);
Gefunden : user_pref("CT2431245.FirstTimeFF3", true);
Gefunden : user_pref("CT2431245.FixPageNotFoundErrors", false);
Gefunden : user_pref("CT2431245.GroupingInvalidateCache", false);
Gefunden : user_pref("CT2431245.GroupingLastCheckTime", "0");
Gefunden : user_pref("CT2431245.GroupingLastServerUpdateTime", "0");
Gefunden : user_pref("CT2431245.GroupingServerCheckInterval", 1440);
Gefunden : user_pref("CT2431245.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gefunden : user_pref("CT2431245.HasUserGlobalKeys", true);
Gefunden : user_pref("CT2431245.HomePageProtectorEnabled", false);
Gefunden : user_pref("CT2431245.Initialize", true);
Gefunden : user_pref("CT2431245.InitializeCommonPrefs", true);
Gefunden : user_pref("CT2431245.InstallationAndCookieDataSentCount", 3);
Gefunden : user_pref("CT2431245.InstalledDate", "Sun Jul 10 2011 17:31:46 GMT+0200");
Gefunden : user_pref("CT2431245.InvalidateCache", false);
Gefunden : user_pref("CT2431245.IsAlertDBUpdated", true);
Gefunden : user_pref("CT2431245.IsGrouping", false);
Gefunden : user_pref("CT2431245.IsInitSetupIni", true);
Gefunden : user_pref("CT2431245.IsMulticommunity", false);
Gefunden : user_pref("CT2431245.IsOpenThankYouPage", true);
Gefunden : user_pref("CT2431245.IsOpenUninstallPage", true);
Gefunden : user_pref("CT2431245.IsProtectorsInit", true);
Gefunden : user_pref("CT2431245.LanguagePackLastCheckTime", "Fri Dec 07 2012 17:07:07 GMT+0100");
Gefunden : user_pref("CT2431245.LanguagePackReloadIntervalMM", 1440);
Gefunden : user_pref("CT2431245.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gefunden : user_pref("CT2431245.LastLogin_3.11.0.3", "Sun May 06 2012 16:21:41 GMT+0200");
Gefunden : user_pref("CT2431245.LastLogin_3.12.2.3", "Sun May 20 2012 14:56:30 GMT+0200");
Gefunden : user_pref("CT2431245.LastLogin_3.13.0.6", "Mon Jul 16 2012 16:14:30 GMT+0200");
Gefunden : user_pref("CT2431245.LastLogin_3.14.1.0", "Tue Aug 21 2012 21:16:31 GMT+0200");
Gefunden : user_pref("CT2431245.LastLogin_3.15.1.0", "Wed Nov 07 2012 19:44:38 GMT+0100");
Gefunden : user_pref("CT2431245.LastLogin_3.16.0.3", "Sat Dec 08 2012 12:30:40 GMT+0100");
Gefunden : user_pref("CT2431245.LastLogin_3.5.0.12", "Mon Aug 01 2011 08:12:25 GMT+0200");
Gefunden : user_pref("CT2431245.LastLogin_3.6.0.10", "Sun Oct 02 2011 14:51:11 GMT+0200");
Gefunden : user_pref("CT2431245.LastLogin_3.7.0.6", "Tue Oct 11 2011 13:19:40 GMT+0200");
Gefunden : user_pref("CT2431245.LastLogin_3.8.0.8", "Wed Nov 30 2011 11:35:32 GMT+0100");
Gefunden : user_pref("CT2431245.LastLogin_3.8.1.0", "Mon Jan 09 2012 08:26:31 GMT+0100");
Gefunden : user_pref("CT2431245.LastLogin_3.9.0.3", "Mon Feb 06 2012 15:36:22 GMT+0100");
Gefunden : user_pref("CT2431245.LatestVersion", "3.16.0.3");
Gefunden : user_pref("CT2431245.Locale", "de-de");
Gefunden : user_pref("CT2431245.MCDetectTooltipHeight", "83");
Gefunden : user_pref("CT2431245.MCDetectTooltipShow", false);
Gefunden : user_pref("CT2431245.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gefunden : user_pref("CT2431245.MCDetectTooltipWidth", "295");
Gefunden : user_pref("CT2431245.MyStuffEnabledAtInstallation", true);
Gefunden : user_pref("CT2431245.OriginalFirstVersion", "3.5.0.12");
Gefunden : user_pref("CT2431245.RadioIsPodcast", false);
Gefunden : user_pref("CT2431245.RadioLastCheckTime", "0");
Gefunden : user_pref("CT2431245.RadioLastUpdateIPServer", "0");
Gefunden : user_pref("CT2431245.RadioLastUpdateServer", "0");
Gefunden : user_pref("CT2431245.RadioMediaID", "20503672");
Gefunden : user_pref("CT2431245.RadioMediaType", "Media Player");
Gefunden : user_pref("CT2431245.RadioMenuSelectedID", "EBRadioMenu_CT243124520503672");
Gefunden : user_pref("CT2431245.RadioShrinked", "shrinked");
Gefunden : user_pref("CT2431245.RadioShrinkedFromSetup", true);
Gefunden : user_pref("CT2431245.RadioStationName", "Team%20Radio%20Deutschland");
Gefunden : user_pref("CT2431245.RadioStationURL", "hxxp://trd.stream.w-u-s.org:6666/dsl.m3u");
Gefunden : user_pref("CT2431245.SHRINK_TOOLBAR", 0);
Gefunden : user_pref("CT2431245.SearchBackToDefaultEngine", false);
Gefunden : user_pref("CT2431245.SearchBoxWidth", 1748);
Gefunden : user_pref("CT2431245.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
Gefunden : user_pref("CT2431245.SearchFromAddressBarIsInit", true);
Gefunden : user_pref("CT2431245.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT243[...]
Gefunden : user_pref("CT2431245.SearchInNewTabEnabled", true);
Gefunden : user_pref("CT2431245.SearchInNewTabIntervalMM", 1440);
Gefunden : user_pref("CT2431245.SearchInNewTabLastCheckTime", "Fri Dec 07 2012 17:07:06 GMT+0100");
Gefunden : user_pref("CT2431245.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gefunden : user_pref("CT2431245.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Gefunden : user_pref("CT2431245.SearchInNewTabUserEnabled", false);
Gefunden : user_pref("CT2431245.SearchProtectorEnabled", false);
Gefunden : user_pref("CT2431245.SearchProtectorToolbarDisabled", false);
Gefunden : user_pref("CT2431245.ServiceMapLastCheckTime", "Fri Dec 07 2012 17:07:07 GMT+0100");
Gefunden : user_pref("CT2431245.SettingsLastCheckTime", "Sat Dec 08 2012 16:16:18 GMT+0100");
Gefunden : user_pref("CT2431245.SettingsLastUpdate", "1354704977");
Gefunden : user_pref("CT2431245.ThirdPartyComponentsInterval", 504);
Gefunden : user_pref("CT2431245.ThirdPartyComponentsLastCheck", "Tue Nov 27 2012 07:01:50 GMT+0100");
Gefunden : user_pref("CT2431245.ThirdPartyComponentsLastUpdate", "1331806000");
Gefunden : user_pref("CT2431245.ToolbarShrinkedFromSetup", true);
Gefunden : user_pref("CT2431245.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2431245");
Gefunden : user_pref("CT2431245.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Gefunden : user_pref("CT2431245.UserID", "UN55622863168332227");
Gefunden : user_pref("CT2431245.ValidationData_Search", 2);
Gefunden : user_pref("CT2431245.ValidationData_Toolbar", 1);
Gefunden : user_pref("CT2431245.alertChannelId", "825452");
Gefunden : user_pref("CT2431245.approveUntrustedApps", true);
Gefunden : user_pref("CT2431245.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B474[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e.:2z527", "2423");
Gefunden : user_pref("CT2431245.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e06cg5el8:", "6E6D6C6E6A6C75767671");
Gefunden : user_pref("CT2431245.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A7473727470727B7C7C77242F4B4947[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cj0<==b:=$nn", "247E61393F236B25727374772A212C6E414F444[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cj3<=ibfel%oo", "247E61393F236B2575777172752B222D6F4250[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cj7fk;kg#ncep@mc+vkn", "247E61393F236B25737471712A212C6[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cj:?7:!habkgo(shk", "247E61393F236B257671717A742B222D6F[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cj:f==bj<?mn'rg*cn", "247E61393F236B256F72727A2A212C6E4[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cj<j<::j>$nn", "247E61393F236B25717079792A212C6E414F444[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cj=2 j<jcl%oo", "247E61393F236B2576737571752B222D6F4250[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cja88>kd@ic?e(shk", "247E61393F236B25717371772A212C6E41[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjb<99i:>bbn'qq", "247E61393F236B2576727375732B222D6F42[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjc9gh@ndh>:'qq", "247E61393F236B2576727476732B222D6F42[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjc<=fbj#mm", "247E61393F236B257576737A2A212C6E414F444D[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjc<=fbj#ncf", "247E61393F236B25757677712A212C6E414F444[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjd?cjc=#ncf", "247E61393F236B2575787672752B222D6F42504[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjdj9ee@b|%oo", "247E61393F236B25767277727B2B222D6F4250[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cje794!lad", "247E61393F236B25766F75732A212C6E414F444D3[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjeik4!kk", "247E61393F236B25767177722A212C6E414F444D32[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjff~ei<=cq??c)til", "247E61393F236B257171797A2A212C6E4[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjff~im8ocnr'rgj", "247E61393F236B257172777A2A212C6E414[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cji5=jmka>>dbp)ss", "247E61393F236B256F76707A2A212C6E41[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cji9?hjnbjmga(rr", "247E61393F236B25717377752A212C6E414[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cji>k3?a#mm", "247E61393F236B257377287E2A6C3F4D424B3078[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e31;cjs7:h@k=$nn", "247E61393F236B25767377757A2B222D6F42504[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347513[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...]
Gefunden : user_pref("CT2431245.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934235[...]
Gefunden : user_pref("CT2431245.backendstorage./9b-0?3g>d", "3D3E706C6E3F41427A77754475207A4C767E254D517E262A23[...]
Gefunden : user_pref("CT2431245.backendstorage./9b-0?3g@6:5;", "");
Gefunden : user_pref("CT2431245.backendstorage./9b-0?3gfa7ef", "2B2E2C3D");
Gefunden : user_pref("CT2431245.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F292A212C393D44307832332[...]
Gefunden : user_pref("CT2431245.backendstorage./9b/556,bi5a>g", "6E6D7069736F6C707577727675");
Gefunden : user_pref("CT2431245.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576");
Gefunden : user_pref("CT2431245.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484775213F3E484F4E4D464[...]
Gefunden : user_pref("CT2431245.backendstorage./9b5ba==9cjag", "6E6B686B416B73437A4371737973754C764A222021");
Gefunden : user_pref("CT2431245.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6C6E6A6C75767576757577");
Gefunden : user_pref("CT2431245.backendstorage./9b9643g3/9e", "6A");
Gefunden : user_pref("CT2431245.backendstorage./9b;45>:bi9i7ie", "2B2E2C3D");
Gefunden : user_pref("CT2431245.backendstorage./9b<:222h64<", "393F352F3E");
Gefunden : user_pref("CT2431245.backendstorage./9b=+03eh8h8j?:", "4443");
Gefunden : user_pref("CT2431245.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...]
Gefunden : user_pref("CT2431245.backendstorage./9b?b0d:8aj62<h", "6D");
Gefunden : user_pref("CT2431245.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B");
Gefunden : user_pref("CT2431245.backendstorage.autocompletepro_enable", "31");
Gefunden : user_pref("CT2431245.backendstorage.autocompletepro_enable_auto", "30");
Gefunden : user_pref("CT2431245.backendstorage.cb", "31");
Gefunden : user_pref("CT2431245.backendstorage.cb_experience_000", "313732");
Gefunden : user_pref("CT2431245.backendstorage.cb_firstuse0100", "31");
Gefunden : user_pref("CT2431245.backendstorage.cb_user_id_000", "434236393232303933373734335F46697265666F78");
Gefunden : user_pref("CT2431245.backendstorage.cbcountry_001", "4445");
Gefunden : user_pref("CT2431245.backendstorage.cbfirsttime", "547565204F637420313620323031322030363A34313A33302[...]
Gefunden : user_pref("CT2431245.backendstorage.cbopenmamsettings", "30");
Gefunden : user_pref("CT2431245.backendstorage.ct2431245ads1", "25374225323261647325323225334125354225374225323[...]
Gefunden : user_pref("CT2431245.backendstorage.ct2431245current_term", "");
Gefunden : user_pref("CT2431245.backendstorage.ct2431245isadsdisabled", "66616C7365");
Gefunden : user_pref("CT2431245.backendstorage.ct2431245sdate", "38");
Gefunden : user_pref("CT2431245.backendstorage.printitgreenstatus", "74727565");
Gefunden : user_pref("CT2431245.backendstorage.shoppingapp.gk.exipres", "546875204F637420313820323031322031343A[...]
Gefunden : user_pref("CT2431245.backendstorage.shoppingapp.gk.geolocation", "6765726D616E79");
Gefunden : user_pref("CT2431245.backendstorage.url_history0001", "687474703A2F2F7777772E7370696E6E7261642E64652[...]
Gefunden : user_pref("CT2431245.componentAlertEnabled", false);
Gefunden : user_pref("CT2431245.components.1000034", false);
Gefunden : user_pref("CT2431245.components.1000082", false);
Gefunden : user_pref("CT2431245.components.1000234", false);
Gefunden : user_pref("CT2431245.components.1000515", false);
Gefunden : user_pref("CT2431245.components.129009402593156547", false);
Gefunden : user_pref("CT2431245.components.129009402595187825", false);
Gefunden : user_pref("CT2431245.components.129009402595656583", false);
Gefunden : user_pref("CT2431245.components.129453393919975934", false);
Gefunden : user_pref("CT2431245.components.129453393922944692", false);
Gefunden : user_pref("CT2431245.components.129453393923725944", false);
Gefunden : user_pref("CT2431245.components.129453394044193841", false);
Gefunden : user_pref("CT2431245.components.129460318377631679", false);
Gefunden : user_pref("CT2431245.components.129502739333844312", false);
Gefunden : user_pref("CT2431245.components.129514202712524870", false);
Gefunden : user_pref("CT2431245.components.129530497903908208", false);
Gefunden : user_pref("CT2431245.components.129530498480786171", false);
Gefunden : user_pref("CT2431245.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Gefunden : user_pref("CT2431245.globalFirstTimeInfoLastCheckTime", "Thu Dec 06 2012 22:41:27 GMT+0100");
Gefunden : user_pref("CT2431245.homepageProtectorEnableByLogin", true);
Gefunden : user_pref("CT2431245.initDone", true);
Gefunden : user_pref("CT2431245.isAppTrackingManagerOn", false);
Gefunden : user_pref("CT2431245.isFirstRadioInstallation", false);
Gefunden : user_pref("CT2431245.myStuffEnabled", true);
Gefunden : user_pref("CT2431245.myStuffPublihserMinWidth", 400);
Gefunden : user_pref("CT2431245.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gefunden : user_pref("CT2431245.myStuffServiceIntervalMM", 1440);
Gefunden : user_pref("CT2431245.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gefunden : user_pref("CT2431245.oldAppsList", "129009402577063104,129009402577844366,111,129790544018252482,129[...]
Gefunden : user_pref("CT2431245.revertSettingsEnabled", true);
Gefunden : user_pref("CT2431245.searchProtectorDialogDelayInSec", 10);
Gefunden : user_pref("CT2431245.searchProtectorEnableByLogin", true);
Gefunden : user_pref("CT2431245.testingCtid", "");
Gefunden : user_pref("CT2431245.toolbarAppMetaDataLastCheckTime", "Fri Dec 07 2012 17:07:07 GMT+0100");
Gefunden : user_pref("CT2431245.toolbarContextMenuLastCheckTime", "Mon Nov 26 2012 21:13:21 GMT+0100");
Gefunden : user_pref("CT2431245.usageEnabled", false);
Gefunden : user_pref("CT2431245.usagesFlag", 2);
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2431245/CT2431245[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/825452/821260/DE", "\"0\"")[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2431245", [...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.11[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.15[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.16[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.6.[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2431245",[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2431245&octid=[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2431245/CT2431245[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=EB_LOCALE",[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de-de", "\"[...]
Gefunden : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Jen\\AppData\\Roaming\\Mozilla\\Fir[...]
Gefunden : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.16.0.3");
Gefunden : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/agreement/agree.html#pg_e[...]
Gefunden : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");
Gefunden : user_pref("CommunityToolbar.ToolbarsList", "CT2431245");
Gefunden : user_pref("CommunityToolbar.ToolbarsList2", "CT2431245");
Gefunden : user_pref("CommunityToolbar.ToolbarsList4", "CT2431245");
Gefunden : user_pref("CommunityToolbar.globalUserId", "148aecd1-0ea8-419c-9fa3-ed05d93484c7");
Gefunden : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Gefunden : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Gefunden : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Dec 05 2012 21:24:3[...]
Gefunden : user_pref("CommunityToolbar.notifications.alertEnabled", false);
Gefunden : user_pref("CommunityToolbar.notifications.alertInfoInterval", 60);
Gefunden : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sun Jul 10 2011 17:31:42 GMT+020[...]
Gefunden : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Gefunden : user_pref("CommunityToolbar.notifications.locale", "en");
Gefunden : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Gefunden : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Fri Dec 07 2012 17:07:07 GMT+0100");
Gefunden : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Gefunden : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Gefunden : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Gefunden : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Gefunden : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Gefunden : user_pref("CommunityToolbar.notifications.userId", "e0bcc5d6-ee1b-4598-b3f9-b4f2a8c2f034");
*************************
AdwCleaner[R1].txt - [33358 octets] - [08/12/2012 16:25:14]
########## EOF - C:\AdwCleaner[R1].txt - [33419 octets] ##########
Vielen Dank schon einmal im Vorraus Andreas |
| Themen zu GVU Trojaner eingefangen |
| ad-aware, antivir, appdatalow, autorun, avira, battle.net, bho, converter, entfernen, error, firefox, flash player, gvu trojaner, install.exe, internet browser, karte, logfile, mozilla, mp3, ntdll.dll, plug-in, realtek, registrierungsdatenbank, registry, runctf.lnk, scan, security, senden, software, super, svchost.exe, system, trojaner, trymedia, usb, wgsdgsdgdsgsd.exe, win7 64 bit, windows |
Baum-Darstellung