| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um HilfeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
27.07.2013, 23:07
| #1 |
 |  Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe Hallo, ich habe mir den aktuellen Facebooktrojaner gefangen und würde mich sehr freuen, wenn mir jemand helfen kann. habe die Farbar-recovery laufen lassen und hänge die beiden Dateien an. vielen Dank schonmal lg Anhang 58323 Anhang 58324 |
|
28.07.2013, 05:24
| #2 |
| /// the machine /// TB-Ausbilder    | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe hi,
__________________ So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
28.07.2013, 05:28
| #3 |
| | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um HilfeFRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-07-2013 04
Ran by schleppi (administrator) on 27-07-2013 23:42:59
Running from C:\Users\schleppi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(IObit) C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Dropbox, Inc.) C:\Users\schleppi\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2817872 2012-04-25] (ELAN Microelectronics Corp.)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKU\Default\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
HKU\Default User\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
Startup: C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\schleppi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-search.com/?affID=119776&babsrc=HP_ss&mntrId=5e40bfb7000000000000002454f86287
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.delta-search.com/?affID=119776&babsrc=HP_ss&mntrId=5e40bfb7000000000000002454f86287
URLSearchHook: (No Name) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - No File
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
SearchScopes: HKCU - DefaultScope {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL =
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=5e40bfb7000000000000002454f86287
SearchScopes: HKCU - {E6301F15-5FB1-4DC7-ABE8-BA2EE22FACEF} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll No File
BHO-x32: RewardsArcade - {597A9974-8CB0-4f41-B61F-ED065738A397} - C:\Program Files (x86)\RewardsArcade\RewardsArcade.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Samsung BHO Class - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll No File
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default
FF user.js: detected! => C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\user.js
FF Homepage: https://login.yahoo.com/config/login_verify2?.intl=de&.src=ym
FF Keyword.URL: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p14_serp_ff_de_display?ie=UTF8&tagbase=bds-p14&tag=bds-p14-serp-de-ff-21&tbrId=v1_abb-channel-14_b53f9463d52d4b7a94bf69e8d387c953_16_37_20130720_DE_ff_ab_&query=
FF NetworkProxy: "autoconfig_url", "hxxp://proxy.charite.de/"
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=10.15.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\searchplugins\amazon.xml
FF SearchPlugin: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\searchplugins\delta.xml
FF SearchPlugin: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\searchplugins\sweetim.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF Extension: No Name - C:\Users\schleppi\AppData\Roaming\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
FF Extension: Ghostery - C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\Extensions\firefox@ghostery.com
FF Extension: No Name - C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF Extension: movie2kdownloader - C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\Extensions\movie2kdownloader@movie2kdownloader.com.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [blaofbhgbmeikidhlkmjhbkbfohpgekf] - C:\Program Files (x86)\Movie2KDownloader.com\Movie2KDownloader10.crx
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx
==================== Services (Whitelisted) =================
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
==================== Drivers (Whitelisted) ====================
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-27] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-27] (Windows (R) 2003 DDK 3790 provider)
S3 clwvd; system32\DRIVERS\clwvd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-27 23:42 - 2013-07-27 23:42 - 01780815 _____ (Farbar) C:\Users\schleppi\Desktop\FRST64.exe
2013-07-27 23:42 - 2013-07-27 23:42 - 00000000 ____D C:\FRST
2013-07-20 09:51 - 2013-07-20 10:22 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-07-19 22:43 - 2013-04-10 11:09 - 00849992 _____ (Realtek ) C:\windows\system32\Drivers\Rt64win7.sys
2013-07-19 22:43 - 2013-04-10 11:09 - 00073800 _____ (Realtek Semiconductor Corporation) C:\windows\system32\RtNicProp64.dll
2013-07-19 22:40 - 2013-07-19 22:44 - 00052398 _____ C:\windows\DPINST.LOG
2013-07-19 22:39 - 2013-06-21 05:06 - 27781920 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 25256224 _____ (NVIDIA Corporation) C:\windows\system32\nvcompiler.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 21102368 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 17560352 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcompiler.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 15144928 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 11235104 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2013-07-19 22:39 - 2013-06-21 05:06 - 09239344 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 07687592 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 07641832 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 06324360 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02953504 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02777888 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02363680 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvenc.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02002720 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvenc.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 01832224 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6432049.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 01511712 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6432049.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00572704 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00570656 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00467232 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00465184 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2013-07-19 22:39 - 2013-02-24 22:27 - 00194848 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvhda64v.sys
2013-07-19 22:39 - 2013-02-24 22:27 - 00031520 _____ (NVIDIA Corporation) C:\windows\system32\nvhdap64.dll
2013-07-19 22:39 - 2013-01-29 01:35 - 01510176 _____ (NVIDIA Corporation) C:\windows\system32\nvhdagenco6420103.dll
2013-07-19 22:36 - 2013-07-22 22:46 - 00000302 _____ C:\windows\Tasks\Driver Booster Startup.job
2013-07-19 22:36 - 2013-07-19 22:36 - 00003222 _____ C:\windows\System32\Tasks\Driver Booster Scan
2013-07-19 22:36 - 2013-07-19 22:36 - 00003220 _____ C:\windows\System32\Tasks\Driver Booster Update
2013-07-19 22:36 - 2013-07-19 22:36 - 00002582 _____ C:\windows\System32\Tasks\Driver Booster Startup
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\ProgramData\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Program Files (x86)\IObit
2013-07-14 13:38 - 2013-07-24 18:05 - 00000663 _____ C:\windows\setupact.log
2013-07-14 13:38 - 2013-07-14 13:38 - 00000000 _____ C:\windows\setuperr.log
2013-07-11 07:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-07-11 07:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-07-11 07:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 07:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-07-11 07:05 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-07-11 07:05 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-07-11 07:04 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-07-11 07:04 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-07-11 07:04 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-07-10 15:26 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-07-10 15:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2013-07-10 15:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2013-07-10 15:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-07-10 15:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-07-10 15:26 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2013-07-10 15:26 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2013-06-28 20:13 - 2013-06-28 20:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-06-28 20:13 - 2013-06-28 20:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
==================== One Month Modified Files and Folders =======
2013-07-27 23:42 - 2013-07-27 23:42 - 01780815 _____ (Farbar) C:\Users\schleppi\Desktop\FRST64.exe
2013-07-27 23:42 - 2013-07-27 23:42 - 00000000 ____D C:\FRST
2013-07-27 23:32 - 2012-08-26 13:12 - 00001114 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-27 23:26 - 2012-08-30 19:27 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-07-27 18:53 - 2012-12-12 23:07 - 01191942 _____ C:\windows\WindowsUpdate.log
2013-07-27 18:41 - 2011-10-20 16:03 - 00000000 ____D C:\ProgramData\MFAData
2013-07-27 17:24 - 2012-08-26 13:12 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-27 08:53 - 2013-06-16 16:56 - 00003954 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{1534DA73-4149-4D86-BC64-A5F303CCEF9E}
2013-07-24 18:05 - 2013-07-14 13:38 - 00000663 _____ C:\windows\setupact.log
2013-07-22 22:46 - 2013-07-19 22:36 - 00000302 _____ C:\windows\Tasks\Driver Booster Startup.job
2013-07-22 18:40 - 2013-02-28 19:41 - 00000472 _____ C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job
2013-07-22 17:35 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-22 17:35 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-20 10:22 - 2013-07-20 09:51 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-07-20 10:22 - 2011-10-20 15:49 - 00000000 ___RD C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-19 22:48 - 2012-02-10 17:13 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Dropbox
2013-07-19 22:47 - 2012-02-10 19:05 - 00000000 ___RD C:\Users\schleppi\Dropbox
2013-07-19 22:46 - 2012-12-12 22:35 - 00000428 _____ C:\windows\Tasks\Wise Care 365.job
2013-07-19 22:46 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-07-19 22:45 - 2012-02-10 17:09 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Azureus
2013-07-19 22:44 - 2013-07-19 22:40 - 00052398 _____ C:\windows\DPINST.LOG
2013-07-19 22:43 - 2011-07-28 06:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-19 22:41 - 2011-07-28 05:36 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-07-19 22:36 - 2013-07-19 22:36 - 00003222 _____ C:\windows\System32\Tasks\Driver Booster Scan
2013-07-19 22:36 - 2013-07-19 22:36 - 00003220 _____ C:\windows\System32\Tasks\Driver Booster Update
2013-07-19 22:36 - 2013-07-19 22:36 - 00002582 _____ C:\windows\System32\Tasks\Driver Booster Startup
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\ProgramData\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Program Files (x86)\IObit
2013-07-15 22:06 - 2012-07-14 20:30 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\vlc
2013-07-14 13:38 - 2013-07-14 13:38 - 00000000 _____ C:\windows\setuperr.log
2013-07-13 16:27 - 2012-08-26 13:12 - 00004110 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 16:27 - 2012-08-26 13:12 - 00003858 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 23:17 - 2011-02-11 21:57 - 00000000 ____D C:\windows\Panther
2013-07-11 19:40 - 2012-08-30 19:27 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-07-11 19:39 - 2012-08-30 19:22 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 19:39 - 2012-08-30 19:22 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 19:35 - 2009-07-14 06:45 - 00462168 _____ C:\windows\system32\FNTCACHE.DAT
2013-07-11 07:23 - 2011-07-28 20:57 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 07:23 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 07:23 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 07:07 - 2012-02-21 13:31 - 78185248 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-07-08 18:43 - 2011-07-28 21:05 - 00643866 _____ C:\windows\system32\perfh007.dat
2013-07-08 18:43 - 2011-07-28 21:05 - 00126394 _____ C:\windows\system32\perfc007.dat
2013-07-08 18:43 - 2009-07-14 07:13 - 01472002 _____ C:\windows\system32\PerfStringBackup.INI
2013-07-03 10:12 - 2013-04-12 00:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-28 20:13 - 2013-06-28 20:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-06-28 20:13 - 2013-06-28 20:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-15 15:07
==================== End Of Log ============================
FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-07-2013 04
Ran by schleppi at 2013-07-27 23:44:29
Running from C:\Users\schleppi\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
„Windows Live Essentials“ (x32 Version: 15.4.3502.0922)
„Windows Live Mail“ (x32 Version: 15.4.3502.0922)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Atheros Client Installation Program (x32 Version: 9.0)
AVG 2013 (Version: 13.0.3209)
AVG 2013 (Version: 13.0.3349)
AVG 2013 (Version: 2013.0.3349)
AVG PC Tuneup 2011 (x32)
BatteryLifeExtender (x32 Version: 1.0.11)
Broadcom 802.11 Network Adapter (Version: 5.60.48.55)
Brother MFL-Pro Suite MFC-255CW (x32 Version: 1.0.1.0)
CCleaner (Version: 3.21)
D3DX10 (x32 Version: 15.4.2368.0902)
DBView Element 2005 (x32 Version: 4.0)
dows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (Version: 05/31/2012 7.1.2.0)
Driver Booster (x32 Version: Beta 2.0)
Dropbox (HKCU Version: 1.6.18)
Easy Content Share (x32 Version: 1.0)
Easy Display Manager (x32 Version: 3.2)
Easy Migration (x32 Version: 1.0)
Easy Network Manager (x32 Version: 4.4.7)
Easy SpeedUp Manager (x32 Version: 2.1.1.1)
EasyBatteryManager (x32 Version: 4.0.0.4)
EasyFileShare (x32 Version: 1.0.12)
ETDWare PS/2-X64 10.7.14.12_WHQL (Version: 10.7.14.12)
Fast Start (x32 Version: 2.2.0.1)
Fishdom 2 Deluxe (x32)
Free Studio version 5.3.3 (x32)
Free YouTube to MP3 Converter version 3.11.35.1031 (x32 Version: 3.11.35.1031)
FreeMind (x32 Version: 0.9.0_RC_10)
Google Update Helper (x32 Version: 1.3.21.153)
Intel PROSet Wireless (x32)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) PROSet/Wireless WiFi Software (Version: 14.01.1000)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.5.1001)
Java Auto Updater (x32 Version: 2.1.9.0)
Java(TM) 6 Update 33 (x32 Version: 6.0.330)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1)
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1)
Movie Color Enhancer (x32 Version: 1.0)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Multimedia POP (x32 Version: 1.0)
Nokia Connectivity Cable Driver (x32 Version: 7.1.172.0)
Nokia Suite (x32 Version: 3.8.30.0)
NVIDIA Install Application (Version: 2.1002.124.810)
NVIDIA Systemsteuerung 320.49 (Version: 320.49)
OpenOffice.org 3.4 (x32 Version: 3.4.9590)
PC Connectivity Solution (x32 Version: 12.0.109.0)
PDF24 Creator 5.2.0 (x32)
PDF-Viewer (Version: 2.5.210.0)
PhoneShare (x32 Version: 9.1.4)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
Realtek Ethernet Controller Driver (x32 Version: 7.40.126.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6400)
Samsung AnyWeb Print (x32 Version: 2.0.67.1)
Samsung Printer Live Update (x32)
Samsung Recovery Solution 5 (x32 Version: 5.0.1.0)
Samsung Support Center (x32 Version: 1.1.24)
Samsung Universal Print Driver (x32 Version: 2.02.05.00:27)
Samsung Universal Scan Driver (x32 Version: 1.2.5.0)
Samsung Update Plus (x32 Version: 3.0.0.17)
Skype™ 4.2 (x32 Version: 4.2.169)
Synchredible (x32 Version: 4.0.0.5)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.0.82.0)
User Guide (x32 Version: 1.6)
Visual Studio 2008 x64 Redistributables (x32 Version: 10.0.0.2)
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1)
VLC media player 2.0.2 (x32 Version: 2.0.2)
Vuze (x32 Version: 5.0.0.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Pošta (x32 Version: 15.4.3502.0922)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Live 메일 (x32 Version: 15.4.3502.0922)
Windows Live 필수 패키지 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3508.1109)
Windows Live 软件包 (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
WinRAR 4.00 (64-Bit) (Version: 4.00.0)
Wise Registry Cleaner 7.73 (x32 Version: 7.73)
WordCaptureX Pro (x32 Version: 4.0.0)
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)
Почта Windows Live (x32 Version: 15.4.3502.0922)
بريد Windows Live (x32 Version: 15.4.3502.0922)
==================== Restore Points =========================
16-06-2013 13:20:04 Removed Adobe Reader X (10.1.6) - Deutsch.
16-06-2013 14:33:44 Windows-Sicherung
28-06-2013 10:44:54 Geplanter Prüfpunkt
08-07-2013 20:37:17 Geplanter Prüfpunkt
11-07-2013 04:43:02 Windows Update
12-07-2013 05:15:25 Windows Update
12-07-2013 20:36:16 Removed Versandhelfer
19-07-2013 20:38:57 Driver Booster : NVIDIA GeForce GT 520M
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {025A0E68-F036-467F-9553-F2C8F9FD91BA} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2011-02-14] (SEC)
Task: {062A5F82-BAFF-4AE1-AEA8-9EBB819E6561} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: {07B13C30-5A10-4756-B40E-D04632AF8EC3} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)
Task: {07EF1EEC-8A79-4303-864E-7520287E8FDB} - System32\Tasks\Driver Booster Update => C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe [2013-07-17] (IObit)
Task: {0A91FBA5-96FE-4196-972D-E44CCC71A768} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {0AA78EFD-EA4E-4C03-9691-5855AE596C69} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2010-08-27] (Samsung Electronics)
Task: {0FADA576-25F9-40F3-A9FD-5F00088303AA} - System32\Tasks\Driver Booster Startup => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2013-07-17] (IObit)
Task: {11D935D9-676C-44E4-BB96-FAA163882110} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {250B4C9C-B47D-4B0D-A4D5-F7DF6A12DA90} - System32\Tasks\Synchredible-schleppi => C:\Program Files (x86)\ASCOMP Software\Synchredible\synchredible.exe [2013-01-31] (ASCOMP Software GmbH)
Task: {3BE0B2FB-3DB8-4B06-A799-77B71757DBAF} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2010-02-10] (Samsung Electronics Co., Ltd.)
Task: {4C13C545-CC5D-4E5D-9C50-969215675D1D} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {5F956975-F718-4BD1-95FF-0D56C37E7119} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {703E4EC8-B7F6-4A0D-AB25-6269B4059E61} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {763A2B7B-6FFC-4568-8D0E-4F14CD53584A} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {810BAD61-35F0-4982-BD9A-A584CA4AAA15} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2027592733-4161651481-1790285415-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe No File
Task: {8B62AF8A-B95D-44FB-839A-8CF14A37C123} - System32\Tasks\EasyPartitionManager => C:\Windows\MSetup\BA46-12225A02\EPM.exe No File
Task: {8C79300E-DF30-476A-8E90-4CEDB652CFCA} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {9793C63F-5F0D-4260-B559-D716A571374F} - System32\Tasks\Driver Booster Scan => C:\Program Files (x86)\IObit\Driver Booster\Scheduler.exe [2013-07-17] (IObit)
Task: {A3F6C7FA-96A2-4883-8C52-480173AA0073} - System32\Tasks\Wise Care 365 => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe No File
Task: {BEF11CF5-B7C0-4BA1-B39D-E97B6EA2D365} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.)
Task: {C0B7810F-C442-42FF-B400-70ABDCC556BF} - System32\Tasks\User_Feed_Synchronization-{1534DA73-4149-4D86-BC64-A5F303CCEF9E} => C:\windows\system32\msfeedssync.exe [2013-02-27] (Microsoft Corporation)
Task: {C0D579B1-FCAF-4EEC-8B15-6A547768DEB6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: {C7FE6C5C-69FF-4865-8F05-375B1515BEA9} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-02-07] (SAMSUNG Electronics)
Task: {D35BCFE9-91F2-4A27-B486-85CE4E3265F0} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2027592733-4161651481-1790285415-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe No File
Task: {E32F14BE-2FCE-44F8-96AA-DA303EDDA635} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2013-06-17] (WiseCleaner.com)
Task: {E3E3A0CC-B5BC-447F-8972-573EDDA928B9} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-11] (Adobe Systems Incorporated)
Task: {F008F492-3511-42B3-AB07-6FC0437EF6E7} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] ()
Task: {F090C633-431A-4005-B2B7-EBDE3566F57B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Driver Booster Startup.job => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe
Task: C:\windows\Tasks\Wise Care 365.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
Task: C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/27/2013 00:08:36 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b
Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00173668
ID des fehlerhaften Prozesses: 0x102c
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (07/19/2013 10:47:56 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/11/2013 07:39:44 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b
Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00173668
ID des fehlerhaften Prozesses: 0x1294
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (07/11/2013 07:35:49 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/09/2013 08:33:45 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b
Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00173668
ID des fehlerhaften Prozesses: 0xf0c
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (07/09/2013 08:25:31 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b
Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00173668
ID des fehlerhaften Prozesses: 0x1334
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (07/08/2013 06:37:28 PM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (07/08/2013 06:37:28 PM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.
Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (07/08/2013 06:37:28 PM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (07/08/2013 06:37:28 PM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
System errors:
=============
Error: (07/20/2013 03:24:43 PM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
Error: (07/19/2013 10:45:16 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (07/17/2013 10:23:20 AM) (Source: Server) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{D3F2B640-155A-470C-8C53-28570737A067} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (07/15/2013 10:13:31 AM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
Error: (07/15/2013 10:13:01 AM) (Source: Service Control Manager) (User: )
Description: Dienst "Google Update-Dienst (gupdate)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/14/2013 11:47:50 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%109
Error: (07/14/2013 11:47:50 PM) (Source: DCOM) (User: )
Description: 109gupdate/comsvc{4EB61BAC-A3B6-4760-9581-655041EF4D69}
Error: (07/11/2013 07:23:32 AM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (07/11/2013 07:23:12 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800f0902 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 und Windows Server 2008 R2 SP1 für x64-basierte Systeme (KB2840631)
Error: (07/11/2013 07:03:51 AM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
Microsoft Office Sessions:
=========================
Error: (07/27/2013 00:08:36 AM) (Source: Application Error)(User: )
Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc000000500173668102c01ce8a4bcabd6b70C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dlleabc3673-f63f-11e2-850a-e81132cd5764
Error: (07/19/2013 10:47:56 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/11/2013 07:39:44 PM) (Source: Application Error)(User: )
Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc000000500173668129401ce7e5d4cd89507C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dlldf1ea10e-ea50-11e2-ae53-e81132cd5764
Error: (07/11/2013 07:35:49 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/09/2013 08:33:45 PM) (Source: Application Error)(User: )
Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc000000500173668f0c01ce7cd256e77854C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll15c54122-e8c6-11e2-a2aa-e81132cd5764
Error: (07/09/2013 08:25:31 PM) (Source: Application Error)(User: )
Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc000000500173668133401ce7cc8e174f90aC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dllef680229-e8c4-11e2-a2aa-e81132cd5764
Error: (07/08/2013 06:37:28 PM) (Source: Windows Search Service)(User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (07/08/2013 06:37:28 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (07/08/2013 06:37:28 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (07/08/2013 06:37:28 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer
==================== Memory info ===========================
Percentage of memory in use: 23%
Total physical RAM: 8171.55 MB
Available physical RAM: 6280.87 MB
Total Pagefile: 16341.28 MB
Available Pagefile: 12696.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:230 GB) (Free:135.56 GB) NTFS (Disk=0 Partition=2)
Drive d: () (Fixed) (Total:342.28 GB) (Free:157.2 GB) NTFS (Disk=0 Partition=4)
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 596 GB) (Disk ID: 23C4F13B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=230 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=342 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=24 GB) - (Type=27)
==================== End Of Log ============================
|
|
28.07.2013, 07:24
| #4 | |
| /// the machine /// TB-Ausbilder | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um HilfeCombofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.07.2013, 09:23
| #5 |
| | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe Combofix Logfile: Code:
ATTFilter ComboFix 13-07-27.01 - schleppi 28.07.2013 9:48.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8172.6564 [GMT 2:00]
ausgeführt von:: c:\users\schleppi\AppData\Local\Temp\setup.exe
AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-06-28 bis 2013-07-28 ))))))))))))))))))))))))))))))
.
.
2013-07-28 07:56 . 2013-07-28 07:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-28 07:43 . 2013-07-28 07:49 -------- d-----w- c:\users\schleppi\AppData\Local\VisualBeeExe
2013-07-28 07:43 . 2013-07-28 07:43 -------- d-----w- c:\program files (x86)\Plus-HD-2.5
2013-07-28 07:42 . 2013-07-28 07:43 -------- d-----w- c:\programdata\VisualBee
2013-07-28 07:42 . 2013-07-28 07:42 -------- d-----w- c:\users\schleppi\AppData\Local\emaze
2013-07-28 07:42 . 2013-07-28 07:42 -------- d-----w- c:\program files (x86)\BrowseForTheCause
2013-07-27 21:42 . 2013-07-27 21:42 -------- d-----w- C:\FRST
2013-07-20 07:51 . 2013-07-28 07:44 -------- d-----w- c:\program files (x86)\MyPC Backup
2013-07-19 20:43 . 2013-04-10 09:09 849992 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2013-07-19 20:43 . 2013-04-10 09:09 73800 ----a-w- c:\windows\system32\RtNicProp64.dll
2013-07-19 20:36 . 2013-07-19 20:36 -------- d-----w- c:\programdata\IObit
2013-07-19 20:36 . 2013-07-19 20:36 -------- d-----w- c:\users\schleppi\AppData\Roaming\IObit
2013-07-19 20:36 . 2013-07-19 20:36 -------- d-----w- c:\program files (x86)\IObit
2013-07-11 05:04 . 2013-06-11 23:25 15404032 ----a-w- c:\windows\system32\ieframe.dll
2013-07-11 05:04 . 2013-06-11 23:25 19238912 ----a-w- c:\windows\system32\mshtml.dll
2013-06-28 18:13 . 2013-06-28 18:13 -------- d-----w- c:\program files\Microsoft Silverlight
2013-06-28 18:13 . 2013-06-28 18:13 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-11 17:39 . 2012-08-30 17:22 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-11 17:39 . 2012-08-30 17:22 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-11 05:07 . 2012-02-21 11:31 78185248 ----a-w- c:\windows\system32\MRT.exe
2013-06-21 10:23 . 2011-02-09 07:15 6496544 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 10:23 . 2011-02-09 07:15 3514656 ----a-w- c:\windows\system32\nvsvc64.dll
2013-06-21 10:23 . 2011-02-09 07:15 884512 ----a-w- c:\windows\system32\nvvsvc.exe
2013-06-21 10:23 . 2011-02-09 07:15 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 10:23 . 2011-02-09 07:15 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-06-21 10:23 . 2011-02-09 07:15 2555680 ----a-w- c:\windows\system32\nvsvcr.dll
2013-06-21 03:06 . 2011-07-28 03:36 15920536 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-06-21 03:06 . 2011-07-28 03:36 13411896 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-06-21 03:06 . 2011-07-28 03:36 12427240 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-06-21 03:06 . 2011-07-28 03:36 2936208 ----a-w- c:\windows\system32\nvapi64.dll
2013-06-21 03:06 . 2011-07-28 03:36 2597856 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-05-16 17:21 . 2010-06-24 02:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-13 05:51 . 2013-06-12 19:00 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 19:00 1464320 ----a-w- c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 19:00 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 19:00 52224 ----a-w- c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 19:00 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 19:00 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 19:00 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-05-13 03:43 . 2013-06-12 19:00 1192448 ----a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 19:00 903168 ----a-w- c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 19:00 43008 ----a-w- c:\windows\SysWow64\certenc.dll
2013-05-08 06:39 . 2013-06-12 19:01 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-01-19 11:34 . 2011-01-19 11:34 3003392 ----a-w- c:\program files (x86)\openofficeorg33.msi
2004-03-09 21:00 . 2011-01-19 11:33 142848 ----a-w- c:\program files (x86)\setup.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110311341138}]
2013-07-28 07:43 750952 ----a-w- c:\program files (x86)\Plus-HD-2.5\Plus-HD-2.5-bho.dll
.
c:\users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\schleppi\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-3-12 29106336]
MyPC Backup.lnk - c:\program files (x86)\MyPC Backup\MyPC Backup.exe [2013-7-1 1945128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
"DisableStartupSound"= 1 (0x1)
"DisableStatusMessages"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)
"ForceActiveDesktopOn"= 0 (0x0)
.
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
R3 Samsung UPD Service;Samsung UPD Service;c:\windows\System32\SUPDSvc.exe;c:\windows\SYSNATIVE\SUPDSvc.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [x]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-30 17:39]
.
2013-07-22 c:\windows\Tasks\Driver Booster Startup.job
- c:\program files (x86)\IObit\Driver Booster\DriverBooster.exe [2013-07-19 16:11]
.
2013-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 11:12]
.
2013-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26 11:12]
.
2013-07-28 c:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job
- c:\program files (x86)\Plus-HD-2.5\Plus-HD-2.5-chromeinstaller.exe [2013-07-28 07:43]
.
2013-07-28 c:\windows\Tasks\Plus-HD-2.5-codedownloader.job
- c:\program files (x86)\Plus-HD-2.5\Plus-HD-2.5-codedownloader.exe [2013-07-28 07:43]
.
2013-07-28 c:\windows\Tasks\Plus-HD-2.5-enabler.job
- c:\program files (x86)\Plus-HD-2.5\Plus-HD-2.5-enabler.exe [2013-07-28 07:43]
.
2013-07-28 c:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job
- c:\program files (x86)\Plus-HD-2.5\Plus-HD-2.5-firefoxinstaller.exe [2013-07-28 07:43]
.
2013-07-28 c:\windows\Tasks\Plus-HD-2.5-updater.job
- c:\program files (x86)\Plus-HD-2.5\Plus-HD-2.5-updater.exe [2013-07-28 07:43]
.
2013-02-02 c:\windows\Tasks\ROC_REG_JAN_DELETE.job
- c:\programdata\AVG January 2013 Campaign\ROC.exe [2013-01-22 21:16]
.
2013-07-22 c:\windows\Tasks\Wise Registry Cleaner Schedule Task.job
- c:\program files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2012-11-25 12:37]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\schleppi\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\schleppi\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\schleppi\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\schleppi\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-06-25 11895400]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.delta-search.com/?affID=119776&babsrc=HP_ss&mntrId=5e40bfb7000000000000002454f86287
uDefault_Page_URL = hxxp://samsung.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube Download - c:\users\schleppi\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\schleppi\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: Interfaces\{37A550B1-E653-433A-9A90-446D9FB3494F}: NameServer = 76.73.7.75,107.6.133.7
TCP: Interfaces\{71DEE413-63EB-4D97-B36C-806F379CE74F}: NameServer = 76.73.7.75,107.6.133.7
TCP: Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: NameServer = 76.73.7.75,107.6.133.7
TCP: Interfaces\{930E9C9E-AC09-4B4F-9693-F1464DE35CAB}: NameServer = 76.73.7.75,107.6.133.7
TCP: Interfaces\{D3F2B640-155A-470C-8C53-28570737A067}: NameServer = 76.73.7.75,107.6.133.7
TCP: Interfaces\{D5A08749-06D0-48B1-8A37-6931611456A4}: NameServer = 76.73.7.75,107.6.133.7
FF - ProfilePath - c:\users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\
FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?.intl=de&.src=ym
FF - prefs.js: keyword.URL - hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p14_serp_ff_de_display?ie=UTF8&tagbase=bds-p14&tag=bds-p14-serp-de-ff-21&tbrId=v1_abb-channel-14_b53f9463d52d4b7a94bf69e8d387c953_16_37_20130720_DE_ff_ab_&query=
FF - prefs.js: network.proxy.type - 4
FF - user.js: extensions.Softonic.rvrtMsg - Click Yes to keep current home page and default search settings, Click No to restore original settings
FF - user.js: extensions.Softonic.autoRvrt - false
FF - user.js: extensions.Softonic_i.newTab - false
FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=
FF - user.js: extensions.Softonic.id - 5e40bfb700000000000000ffb1255e15
FF - user.js: extensions.Softonic.instlDay - 15432
FF - user.js: extensions.Softonic.vrsn - 1.5.21.0
FF - user.js: extensions.Softonic.vrsni - 1.5.21.0
FF - user.js: extensions.Softonic_i.vrsnTs - 1.5.21.018:36
FF - user.js: extensions.Softonic.prtnrId - softonic
FF - user.js: extensions.Softonic.prdct - Softonic
FF - user.js: extensions.Softonic.aflt - SD
FF - user.js: extensions.Softonic_i.smplGrp - none
FF - user.js: extensions.Softonic.tlbrId - base
FF - user.js: extensions.Softonic.instlRef - MON00015
FF - user.js: extensions.Softonic.dfltLng - de
FF - user.js: extensions.Softonic.excTlbr - false
FF - user.js: extensions.Softonic.admin - false
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 5e40bfb7000000000000002454f86287
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15756
FF - user.js: extensions.delta.vrsn - 1.8.10.0
FF - user.js: extensions.delta.vrsni - 1.8.10.0
FF - user.js: extensions.delta.vrsnTs - 1.8.10.020:37
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
.
------- Dateityp-Verknüpfung -------
.
regedit=regedit.exe "%1"
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)
BHO-{597A9974-8CB0-4f41-B61F-ED065738A397} - c:\program files (x86)\RewardsArcade\RewardsArcade.dll
Toolbar-Locked - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - c:\users\schleppi\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - c:\users\schleppi\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - c:\users\schleppi\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NETFramework]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\1394ohci]
"ImagePath"="\SystemRoot\system32\drivers\1394ohci.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ACPI]
"ImagePath"="system32\drivers\ACPI.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AcpiPmi]
"ImagePath"="\SystemRoot\system32\drivers\acpipmi.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc]
"ImagePath"="c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adp94xx]
"ImagePath"="\SystemRoot\system32\drivers\adp94xx.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adpahci]
"ImagePath"="\SystemRoot\system32\drivers\adpahci.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adpu320]
"ImagePath"="\SystemRoot\system32\drivers\adpu320.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adsi]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc]
"ServiceDll"="%SystemRoot%\System32\aelupsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AFD]
"ImagePath"="\SystemRoot\system32\drivers\afd.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\agp440]
"ImagePath"="\SystemRoot\system32\drivers\agp440.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ALG]
"ImagePath"="%SystemRoot%\System32\alg.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\aliide]
"ImagePath"="\SystemRoot\system32\drivers\aliide.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdide]
"ImagePath"="\SystemRoot\system32\drivers\amdide.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AmdK8]
"ImagePath"="\SystemRoot\system32\drivers\amdk8.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AmdPPM]
"ImagePath"="\SystemRoot\system32\drivers\amdppm.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdsata]
"ImagePath"="\SystemRoot\system32\drivers\amdsata.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdsbs]
"ImagePath"="\SystemRoot\system32\drivers\amdsbs.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdxata]
"ImagePath"="system32\drivers\amdxata.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppID]
"ImagePath"="\SystemRoot\system32\drivers\appid.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc]
"ServiceDll"="%SystemRoot%\System32\appidsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Appinfo]
"ServiceDll"="%SystemRoot%\System32\appinfo.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppMgmt]
"ServiceDll"="%SystemRoot%\System32\appmgmts.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\arc]
"ImagePath"="\SystemRoot\system32\drivers\arc.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\arcsas]
"ImagePath"="\SystemRoot\system32\drivers\arcsas.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AsyncMac]
"ImagePath"="system32\DRIVERS\asyncmac.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\atapi]
"ImagePath"="system32\drivers\atapi.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\athr]
"ImagePath"="system32\DRIVERS\athrx.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder]
"ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv]
"ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avg]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSAgent]
"ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgidsagent.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver]
"ImagePath"="system32\DRIVERS\avgidsdrivera.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA]
"ImagePath"="system32\DRIVERS\avgidsha.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgldx64]
"ImagePath"="system32\DRIVERS\avgldx64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga]
"ImagePath"="system32\DRIVERS\avgloga.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64]
"ImagePath"="system32\DRIVERS\avgmfx64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgrkx64]
"ImagePath"="system32\DRIVERS\avgrkx64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgtdia]
"ImagePath"="system32\DRIVERS\avgtdia.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgwd]
"ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AxInstSV]
"ServiceDll"="%SystemRoot%\System32\AxInstSV.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\b06bdrv]
"ImagePath"="\SystemRoot\system32\drivers\bxvbda.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\b57nd60a]
"ImagePath"="system32\DRIVERS\b57nd60a.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BackupStack]
"ImagePath"="c:\program files (x86)\MyPC Backup\BackupStack.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BattC]
"MofImagePath"="system32\drivers\battc.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BDESVC]
"ServiceDll"="%SystemRoot%\System32\bdesvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Beep]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE]
"ServiceDll"="%SystemRoot%\System32\bfe.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS]
"ServiceDll"="%SystemRoot%\System32\qmgr.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\blbdrive]
"ImagePath"="system32\DRIVERS\blbdrive.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bowser]
"ImagePath"="system32\DRIVERS\bowser.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrFiltLo]
"ImagePath"="\SystemRoot\system32\drivers\BrFiltLo.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrFiltUp]
"ImagePath"="\SystemRoot\system32\drivers\BrFiltUp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BridgeMP]
"ImagePath"="system32\DRIVERS\bridge.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Browser]
"ServiceDll"="%SystemRoot%\System32\browser.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Brserid]
"ImagePath"="\SystemRoot\System32\Drivers\Brserid.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrSerWdm]
"ImagePath"="\SystemRoot\System32\Drivers\BrSerWdm.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrUsbMdm]
"ImagePath"="\SystemRoot\System32\Drivers\BrUsbMdm.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrUsbSer]
"ImagePath"="\SystemRoot\System32\Drivers\BrUsbSer.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BtFilter]
"ImagePath"="system32\DRIVERS\btfilter.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BthEnum]
"ImagePath"="\SystemRoot\system32\drivers\BthEnum.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHMODEM]
"ImagePath"="\SystemRoot\system32\drivers\bthmodem.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BthPan]
"ImagePath"="system32\DRIVERS\bthpan.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHPORT]
"ImagePath"="\SystemRoot\System32\Drivers\BTHport.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bthserv]
"ServiceDll"="%SystemRoot%\system32\bthserv.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHUSB]
"ImagePath"="\SystemRoot\System32\Drivers\BTHUSB.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\catchme]
"ImagePath"="\??\c:\setup\catchme.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cdfs]
"ImagePath"="system32\DRIVERS\cdfs.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cdrom]
"ImagePath"="system32\DRIVERS\cdrom.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CertPropSvc]
"ServiceDll"="%SystemRoot%\System32\certprop.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\circlass]
"ImagePath"="\SystemRoot\system32\drivers\circlass.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CLFS]
"ImagePath"="System32\CLFS.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v2.0.50727_32]
"ImagePath"="%systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v2.0.50727_64]
"ImagePath"="%systemroot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clwvd]
"ImagePath"="system32\DRIVERS\clwvd.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CmBatt]
"ImagePath"="system32\DRIVERS\CmBatt.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cmdide]
"ImagePath"="\SystemRoot\system32\drivers\cmdide.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CNG]
"ImagePath"="System32\Drivers\cng.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Compbatt]
"ImagePath"="system32\DRIVERS\compbatt.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CompositeBus]
"ImagePath"="system32\DRIVERS\CompositeBus.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\COMSysApp]
"ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crcdisk]
"ImagePath"="\SystemRoot\system32\drivers\crcdisk.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc]
"ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DCLocator]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch]
"ServiceDll"="%SystemRoot%\system32\rpcss.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\defragsvc]
"ServiceDll"="%Systemroot%\System32\defragsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DfsC]
"ImagePath"="System32\Drivers\dfsc.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dhcp]
"ServiceDll"="%SystemRoot%\system32\dhcpcore.dll"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\discache]
"ImagePath"="System32\drivers\discache.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk]
"ImagePath"="system32\drivers\disk.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dnscache]
"ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot3svc]
"ServiceDll"="%SystemRoot%\System32\dot3svc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DPS]
"ServiceDll"="%SystemRoot%\system32\dps.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\drmkaud]
"ImagePath"="system32\drivers\drmkaud.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DXGKrnl]
"ImagePath"="\SystemRoot\System32\drivers\dxgkrnl.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EapHost]
"ServiceDll"="%SystemRoot%\System32\eapsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ebdrv]
"ImagePath"="\SystemRoot\system32\drivers\evbda.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EFS]
"ImagePath"="%SystemRoot%\System32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ehRecvr]
"ImagePath"="%systemroot%\ehome\ehRecvr.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ehSched]
"ImagePath"="%systemroot%\ehome\ehsched.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Elantech]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\elxstor]
"ImagePath"="\SystemRoot\system32\drivers\elxstor.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ErrDev]
"ImagePath"="\SystemRoot\system32\drivers\errdev.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ESENT]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ETD]
"ImagePath"="system32\DRIVERS\ETD.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog]
"ServiceDll"="%SystemRoot%\System32\wevtsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem]
"ServiceDll"="%systemroot%\system32\es.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\exfat]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fastfat]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fax]
"ImagePath"="%systemroot%\system32\fxssvc.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdc]
"ImagePath"="\SystemRoot\system32\drivers\fdc.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdPHost]
"ServiceDll"="%SystemRoot%\system32\fdPHost.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub]
"ServiceDll"="%SystemRoot%\system32\fdrespub.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FileInfo]
"ImagePath"="system32\drivers\fileinfo.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Filetrace]
"ImagePath"="system32\drivers\filetrace.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\flpydisk]
"ImagePath"="\SystemRoot\system32\drivers\flpydisk.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FltMgr]
"ImagePath"="system32\drivers\fltmgr.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache]
"ServiceDll"="%SystemRoot%\system32\FntCache.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache3.0.0.0]
"ImagePath"="%systemroot%\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FsDepends]
"ImagePath"="System32\drivers\FsDepends.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fs_Rec]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fvevol]
"ImagePath"="System32\DRIVERS\fvevol.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gagp30kx]
"ImagePath"="\SystemRoot\system32\drivers\gagp30kx.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc]
"ServiceDll"="%SystemRoot%\System32\gpsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate]
"ImagePath"="\"c:\program files (x86)\Google\Update\GoogleUpdate.exe\" /svc"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem]
"ImagePath"="\"c:\program files (x86)\Google\Update\GoogleUpdate.exe\" /medsvc"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hcw85cir]
"ImagePath"="\SystemRoot\system32\drivers\hcw85cir.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HdAudAddService]
"ImagePath"="system32\drivers\HdAudio.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HDAudBus]
"ImagePath"="system32\DRIVERS\HDAudBus.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidBatt]
"ImagePath"="\SystemRoot\system32\drivers\HidBatt.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidBth]
"ImagePath"="\SystemRoot\system32\drivers\hidbth.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidIr]
"ImagePath"="\SystemRoot\system32\drivers\hidir.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hidserv]
"ServiceDll"="%SystemRoot%\System32\hidserv.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidUsb]
"ImagePath"="system32\DRIVERS\hidusb.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hkmsvc]
"ServiceDLL"="%SystemRoot%\system32\kmsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupListener]
"ServiceDll"="%SystemRoot%\system32\ListSvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupProvider]
"ServiceDll"="%SystemRoot%\system32\provsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HpSAMD]
"ImagePath"="\SystemRoot\system32\drivers\HpSAMD.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HTTP]
"ImagePath"="system32\drivers\HTTP.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hwpolicy]
"ImagePath"="System32\drivers\hwpolicy.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\i8042prt]
"ImagePath"="system32\DRIVERS\i8042prt.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iaStor]
"ImagePath"="system32\DRIVERS\iaStor.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iaStorV]
"ImagePath"="\SystemRoot\system32\drivers\iaStorV.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\idsvc]
"ImagePath"="\"%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\igfx]
"ImagePath"="system32\DRIVERS\igdkmd64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iirsp]
"ImagePath"="\SystemRoot\system32\drivers\iirsp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IKEEXT]
"ServiceDll"="%SystemRoot%\System32\ikeext.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\inetaccs]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IntcAzAudAddService]
"ImagePath"="system32\drivers\RTKVHD64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelide]
"ImagePath"="\SystemRoot\system32\drivers\intelide.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelppm]
"ImagePath"="system32\DRIVERS\intelppm.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPBusEnum]
"ServiceDll"="%SystemRoot%\system32\ipbusenum.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IpFilterDriver]
"ImagePath"="system32\DRIVERS\ipfltdrv.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc]
"ServiceDll"="%SystemRoot%\System32\iphlpsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPMIDRV]
"ImagePath"="\SystemRoot\system32\drivers\IPMIDrv.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPNAT]
"ImagePath"="System32\drivers\ipnat.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IRENUM]
"ImagePath"="system32\drivers\irenum.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\isapnp]
"ImagePath"="\SystemRoot\system32\drivers\isapnp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iScsiPrt]
"ImagePath"="\SystemRoot\system32\drivers\msiscsi.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\kbdclass]
"ImagePath"="system32\DRIVERS\kbdclass.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\kbdhid]
"ImagePath"="system32\DRIVERS\kbdhid.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso]
"ImagePath"="%SystemRoot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KSecDD]
"ImagePath"="System32\Drivers\ksecdd.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KSecPkg]
"ImagePath"="System32\Drivers\ksecpkg.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ksthunk]
"ImagePath"="\SystemRoot\system32\drivers\ksthunk.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KtmRm]
"ServiceDll"="%systemroot%\system32\msdtckrm.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer]
"ServiceDll"="%SystemRoot%\System32\srvsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation]
"ServiceDll"="%SystemRoot%\System32\wkssvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ldap]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio]
"ImagePath"="system32\DRIVERS\lltdio.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdsvc]
"ServiceDll"="%SystemRoot%\System32\lltdsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lmhosts]
"ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LMS]
"ImagePath"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Lsa]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_FC]
"ImagePath"="\SystemRoot\system32\drivers\lsi_fc.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SAS]
"ImagePath"="\SystemRoot\system32\drivers\lsi_sas.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SAS2]
"ImagePath"="\SystemRoot\system32\drivers\lsi_sas2.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SCSI]
"ImagePath"="\SystemRoot\system32\drivers\lsi_scsi.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\luafv]
"ImagePath"="\SystemRoot\system32\drivers\luafv.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc]
"ServiceDll"="%SystemRoot%\system32\Mcx2Svc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\megasas]
"ImagePath"="\SystemRoot\system32\drivers\megasas.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MegaSR]
"ImagePath"="\SystemRoot\system32\drivers\MegaSR.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MEIx64]
"ImagePath"="system32\DRIVERS\HECIx64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MMCSS]
"ServiceDll"="%SystemRoot%\system32\mmcss.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Modem]
"ImagePath"="system32\drivers\modem.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\monitor]
"ImagePath"="system32\DRIVERS\monitor.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mouclass]
"ImagePath"="system32\DRIVERS\mouclass.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mouhid]
"ImagePath"="system32\DRIVERS\mouhid.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mountmgr]
"ImagePath"="System32\drivers\mountmgr.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mpio]
"ImagePath"="\SystemRoot\system32\drivers\mpio.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mpsdrv]
"ImagePath"="System32\drivers\mpsdrv.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc]
"ServiceDll"="%SystemRoot%\system32\mpssvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MRxDAV]
"ImagePath"="\SystemRoot\system32\drivers\mrxdav.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb]
"ImagePath"="system32\DRIVERS\mrxsmb.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb10]
"ImagePath"="system32\DRIVERS\mrxsmb10.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb20]
"ImagePath"="system32\DRIVERS\mrxsmb20.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msahci]
"ImagePath"="system32\drivers\msahci.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msdsm]
"ImagePath"="\SystemRoot\system32\drivers\msdsm.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC]
"ImagePath"="%SystemRoot%\System32\msdtc.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Msfs]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mshidkmdf]
"ImagePath"="\SystemRoot\System32\drivers\mshidkmdf.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msisadrv]
"ImagePath"="system32\drivers\msisadrv.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSiSCSI]
"ServiceDll"="%systemroot%\system32\iscsiexe.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msiserver]
"ImagePath"="%systemroot%\system32\msiexec.exe /V"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSKSSRV]
"ImagePath"="system32\drivers\MSKSSRV.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSPCLOCK]
"ImagePath"="system32\drivers\MSPCLOCK.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSPQM]
"ImagePath"="system32\drivers\MSPQM.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsRPC]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSSCNTRS]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mssmbios]
"ImagePath"="system32\DRIVERS\mssmbios.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSTEE]
"ImagePath"="system32\drivers\MSTEE.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MTConfig]
"ImagePath"="\SystemRoot\system32\drivers\MTConfig.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mup]
"ImagePath"="System32\Drivers\mup.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent]
"ServiceDLL"="%SystemRoot%\system32\qagentRT.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NativeWifiP]
"ImagePath"="system32\DRIVERS\nwifi.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDIS]
"ImagePath"="system32\drivers\ndis.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisCap]
"ImagePath"="system32\DRIVERS\ndiscap.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisTapi]
"ImagePath"="system32\DRIVERS\ndistapi.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio]
"ImagePath"="system32\DRIVERS\ndisuio.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisWan]
"ImagePath"="system32\DRIVERS\ndiswan.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDProxy]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS]
"ImagePath"="system32\DRIVERS\netbios.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT]
"ImagePath"="System32\DRIVERS\netbt.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netlogon]
"ImagePath"="%systemroot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netman]
"ServiceDll"="%SystemRoot%\System32\netman.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\netprofm]
"ServiceDll"="%SystemRoot%\System32\netprofm.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpPortSharing]
"ImagePath"="\"%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nfrd960]
"ImagePath"="\SystemRoot\system32\drivers\nfrd960.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NlaSvc]
"ServiceDll"="%SystemRoot%\System32\nlasvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nmwcd]
"ImagePath"="system32\drivers\ccdcmbx64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nmwcdc]
"ImagePath"="system32\drivers\ccdcmbox64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Npfs]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nsi]
"ServiceDll"="%systemroot%\system32\nsisvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nsiproxy]
"ImagePath"="system32\drivers\nsiproxy.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NTDS]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ntfs]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Null]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NVHDA]
"ImagePath"="system32\drivers\nvhda64v.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvlddmkm]
"ImagePath"="system32\DRIVERS\nvlddmkm.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvraid]
"ImagePath"="\SystemRoot\system32\drivers\nvraid.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvstor]
"ImagePath"="\SystemRoot\system32\drivers\nvstor.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NVSvc]
"ImagePath"="\"c:\windows\system32\nvvsvc.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nv_agp]
"ImagePath"="\SystemRoot\system32\drivers\nv_agp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ohci1394]
"ImagePath"="\SystemRoot\system32\drivers\ohci1394.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc]
"ServiceDll"="%SystemRoot%\system32\pnrpsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2psvc]
"ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Parport]
"ImagePath"="\SystemRoot\system32\drivers\parport.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr]
"ImagePath"="System32\drivers\partmgr.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PcaSvc]
"ServiceDll"="%SystemRoot%\System32\pcasvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pccsmcfd]
"ImagePath"="system32\DRIVERS\pccsmcfdx64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pci]
"ImagePath"="system32\drivers\pci.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pciide]
"ImagePath"="\SystemRoot\system32\drivers\pciide.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pcmcia]
"ImagePath"="\SystemRoot\system32\drivers\pcmcia.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pcw]
"ImagePath"="System32\drivers\pcw.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PEAUTH]
"ImagePath"="system32\drivers\peauth.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfDisk]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfHost]
"ImagePath"="%SystemRoot%\SysWow64\perfhost.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfNet]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfOS]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfProc]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pla]
"ServiceDll"="%systemroot%\system32\pla.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PlugPlay]
"ServiceDll"="%SystemRoot%\system32\umpnpmgr.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPAutoReg]
"ServiceDll"="%SystemRoot%\system32\pnrpauto.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPsvc]
"ServiceDll"="%SystemRoot%\system32\pnrpsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent]
"ServiceDll"="%SystemRoot%\System32\ipsecsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PortProxy]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Power]
"ServiceDll"="%SystemRoot%\system32\umpo.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PptpMiniport]
"ImagePath"="system32\DRIVERS\raspptp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Processor]
"ImagePath"="\SystemRoot\system32\drivers\processr.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProfSvc]
"ServiceDll"="%systemroot%\system32\profsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProtectedStorage]
"ImagePath"="%SystemRoot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Psched]
"ImagePath"="system32\DRIVERS\pacer.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ql2300]
"ImagePath"="\SystemRoot\system32\drivers\ql2300.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ql40xx]
"ImagePath"="\SystemRoot\system32\drivers\ql40xx.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE]
"ServiceDll"="%windir%\system32\qwave.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVEdrv]
"ImagePath"="\SystemRoot\system32\drivers\qwavedrv.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAcd]
"ImagePath"="System32\DRIVERS\rasacd.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAgileVpn]
"ImagePath"="system32\DRIVERS\AgileVpn.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAuto]
"ServiceDll"="%SystemRoot%\System32\rasauto.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Rasl2tp]
"ImagePath"="system32\DRIVERS\rasl2tp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasMan]
"ServiceDll"="%SystemRoot%\System32\rasmans.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe]
"ImagePath"="system32\DRIVERS\raspppoe.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasSstp]
"ImagePath"="system32\DRIVERS\rassstp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdbss]
"ImagePath"="system32\DRIVERS\rdbss.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdpbus]
"ImagePath"="\SystemRoot\system32\drivers\rdpbus.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPCDD]
"ImagePath"="System32\DRIVERS\RDPCDD.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPDD]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPENCDD]
"ImagePath"="system32\drivers\rdpencdd.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPREFMP]
"ImagePath"="system32\drivers\rdprefmp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPWD]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdyboost]
"ImagePath"="System32\drivers\rdyboost.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess]
"ServiceDLL"="%SystemRoot%\System32\mprdim.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteRegistry]
"ServiceDll"="%SystemRoot%\system32\regsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RFCOMM]
"ImagePath"="system32\DRIVERS\rfcomm.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper]
"ServiceDll"="%SystemRoot%\System32\RpcEpMap.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcLocator]
"ImagePath"="%SystemRoot%\system32\locator.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs]
"ServiceDll"="%SystemRoot%\system32\rpcss.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr]
"ImagePath"="system32\DRIVERS\rspndr.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RTL8167]
"ImagePath"="system32\DRIVERS\Rt64win7.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rtport]
"ImagePath"="\??\c:\windows\SysWOW64\drivers\rtport.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SABI]
"ImagePath"="\??\c:\windows\system32\Drivers\SABI.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SamSs]
"ImagePath"="%SystemRoot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Samsung UPD Service]
"ImagePath"="\"c:\windows\System32\SUPDSvc.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sbp2port]
"ImagePath"="\SystemRoot\system32\drivers\sbp2port.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr]
"ServiceDll"="%SystemRoot%\System32\SCardSvr.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\scfilter]
"ImagePath"="System32\DRIVERS\scfilter.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Schedule]
"ServiceDll"="%systemroot%\system32\schedsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCPolicySvc]
"ServiceDll"="%SystemRoot%\System32\certprop.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SDRSVC]
"ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\secdrv]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\seclogon]
"ServiceDll"="%windir%\system32\seclogon.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SENS]
"ServiceDll"="%SystemRoot%\System32\sens.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc]
"ServiceDll"="%SystemRoot%\system32\sensrsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Serenum]
"ImagePath"="\SystemRoot\system32\drivers\serenum.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Serial]
"ImagePath"="\SystemRoot\system32\drivers\serial.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sermouse]
"ImagePath"="\SystemRoot\system32\drivers\sermouse.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceLayer]
"ImagePath"="\"c:\program files (x86)\PC Connectivity Solution\ServiceLayer.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SessionEnv]
"ServiceDLL"="%SystemRoot%\system32\sessenv.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffdisk]
"ImagePath"="\SystemRoot\system32\drivers\sffdisk.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffp_mmc]
"ImagePath"="\SystemRoot\system32\drivers\sffp_mmc.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffp_sd]
"ImagePath"="\SystemRoot\system32\drivers\sffp_sd.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sfloppy]
"ImagePath"="\SystemRoot\system32\drivers\sfloppy.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess]
"ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ShellHWDetection]
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SiSRaid2]
"ImagePath"="\SystemRoot\system32\drivers\SiSRaid2.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SiSRaid4]
"ImagePath"="\SystemRoot\system32\drivers\sisraid4.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb]
"ImagePath"="system32\DRIVERS\smb.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SNMPTRAP]
"ImagePath"="%SystemRoot%\System32\snmptrap.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\spldr]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Spooler]
"ImagePath"="%SystemRoot%\System32\spoolsv.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppsvc]
"ImagePath"="%SystemRoot%\system32\sppsvc.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppuinotify]
"ServiceDll"="%SystemRoot%\system32\sppuinotify.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv]
"ImagePath"="System32\DRIVERS\srv.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv2]
"ImagePath"="System32\DRIVERS\srv2.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srvnet]
"ImagePath"="System32\DRIVERS\srvnet.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV]
"ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SstpSvc]
"ServiceDll"="%SystemRoot%\system32\sstpsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\stexstor]
"ImagePath"="\SystemRoot\system32\drivers\stexstor.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\StillCam]
"ImagePath"="system32\DRIVERS\serscan.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\stisvc]
"ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swenum]
"ImagePath"="system32\DRIVERS\swenum.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swprv]
"ServiceDll"="%Systemroot%\System32\swprv.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SysMain]
"ServiceDll"="%systemroot%\system32\sysmain.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TabletInputService]
"ServiceDll"="%SystemRoot%\System32\TabSvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tap0901]
"ImagePath"="system32\DRIVERS\tap0901.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TapiSrv]
"ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS]
"ServiceDll"="%SystemRoot%\System32\tbssvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip]
"ImagePath"="System32\drivers\tcpip.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6]
"ImagePath"="system32\DRIVERS\tcpip.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6TUNNEL]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tcpipreg]
"ImagePath"="System32\drivers\tcpipreg.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIPTUNNEL]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TDPIPE]
"ImagePath"="system32\drivers\tdpipe.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TDTCP]
"ImagePath"="system32\drivers\tdtcp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tdx]
"ImagePath"="system32\DRIVERS\tdx.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermDD]
"ImagePath"="system32\DRIVERS\termdd.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService]
"ServiceDll"="%SystemRoot%\System32\termsrv.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Themes]
"ServiceDll"="%SystemRoot%\system32\themeservice.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\THREADORDER]
"ServiceDll"="%SystemRoot%\system32\mmcss.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrkWks]
"ServiceDll"="%SystemRoot%\System32\trkwks.dll"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrustedInstaller]
"ImagePath"="%SystemRoot%\servicing\TrustedInstaller.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TSDDD]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tssecsrv]
"ImagePath"="System32\DRIVERS\tssecsrv.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TsUsbFlt]
"ImagePath"="system32\drivers\tsusbflt.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TsUsbGD]
"ImagePath"="\SystemRoot\system32\drivers\TsUsbGD.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tunnel]
"ImagePath"="system32\DRIVERS\tunnel.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TurboB]
"ImagePath"="system32\DRIVERS\TurboB.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TurboBoost]
"ImagePath"="\"c:\program files\Intel\TurboBoost\TurboBoost.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\uagp35]
"ImagePath"="\SystemRoot\system32\drivers\uagp35.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\udfs]
"ImagePath"="system32\DRIVERS\udfs.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UGatherer]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UGTHRSVC]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UI0Detect]
"ImagePath"="%SystemRoot%\system32\UI0Detect.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\uliagpkx]
"ImagePath"="\SystemRoot\system32\drivers\uliagpkx.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\umbus]
"ImagePath"="system32\DRIVERS\umbus.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmPass]
"ImagePath"="\SystemRoot\system32\drivers\umpass.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UNS]
"ImagePath"="\"c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost]
"ServiceDll"="%SystemRoot%\System32\upnphost.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upperdev]
"ImagePath"="system32\DRIVERS\usbser_lowerfltx64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbccgp]
"ImagePath"="system32\DRIVERS\usbccgp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbcir]
"ImagePath"="\SystemRoot\system32\drivers\usbcir.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbehci]
"ImagePath"="\SystemRoot\system32\drivers\usbehci.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbhub]
"ImagePath"="system32\DRIVERS\usbhub.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbohci]
"ImagePath"="\SystemRoot\system32\drivers\usbohci.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbprint]
"ImagePath"="\SystemRoot\system32\drivers\usbprint.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbser]
"ImagePath"="system32\drivers\usbser.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UsbserFilt]
"ImagePath"="system32\DRIVERS\usbser_lowerfltjx64.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\USBSTOR]
"ImagePath"="system32\DRIVERS\USBSTOR.SYS"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbuhci]
"ImagePath"="\SystemRoot\system32\drivers\usbuhci.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbvideo]
"ImagePath"="System32\Drivers\usbvideo.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UxSms]
"ServiceDll"="%SystemRoot%\System32\uxsms.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc]
"ImagePath"="%SystemRoot%\system32\lsass.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vdrvroot]
"ImagePath"="system32\drivers\vdrvroot.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vds]
"ImagePath"="%SystemRoot%\System32\vds.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vga]
"ImagePath"="system32\DRIVERS\vgapnp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VgaSave]
"ImagePath"="\SystemRoot\System32\drivers\vga.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vhdmp]
"ImagePath"="\SystemRoot\system32\drivers\vhdmp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\viaide]
"ImagePath"="\SystemRoot\system32\drivers\viaide.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volmgr]
"ImagePath"="system32\drivers\volmgr.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volmgrx]
"ImagePath"="System32\drivers\volmgrx.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volsnap]
"ImagePath"="system32\drivers\volsnap.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vsmraid]
"ImagePath"="\SystemRoot\system32\drivers\vsmraid.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS]
"ImagePath"="%systemroot%\system32\vssvc.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vwifibus]
"ImagePath"="system32\DRIVERS\vwifibus.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vwififlt]
"ImagePath"="system32\DRIVERS\vwififlt.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W32Time]
"ServiceDll"="%systemroot%\system32\w32time.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W3SVC]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WacomPen]
"ImagePath"="\SystemRoot\system32\drivers\wacompen.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WANARP]
"ImagePath"="system32\DRIVERS\wanarp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wanarpv6]
"ImagePath"="system32\DRIVERS\wanarp.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wbengine]
"ImagePath"="\"%systemroot%\system32\wbengine.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WbioSrvc]
"ServiceDll"="%SystemRoot%\System32\wbiosrvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc]
"ServiceDll"="%SystemRoot%\System32\wcncsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WcsPlugInService]
"ServiceDll"="%SystemRoot%\System32\WcsPlugInService.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wd]
"ImagePath"="\SystemRoot\system32\drivers\wd.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wdf01000]
"ImagePath"="system32\drivers\Wdf01000.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WdiServiceHost]
"ServiceDll"="%SystemRoot%\system32\wdi.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WdiSystemHost]
"ServiceDll"="%SystemRoot%\system32\wdi.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient]
"ServiceDll"="%SystemRoot%\System32\webclnt.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wecsvc]
"ServiceDll"="%SystemRoot%\system32\wecsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wercplsupport]
"ServiceDll"="%SystemRoot%\System32\wercplsupport.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc]
"ServiceDll"="%SystemRoot%\System32\WerSvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WfpLwf]
"ImagePath"="system32\DRIVERS\wfplwf.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WIMMount]
"ImagePath"="system32\drivers\wimmount.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend]
"ServiceDll"="%ProgramFiles%\Windows Defender\mpsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinHttpAutoProxySvc]
"ServiceDll"="winhttp.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt]
"ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRM]
"ServiceDll"="%SystemRoot%\system32\WsmSvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinUsb]
"ImagePath"="system32\DRIVERS\WinUsb.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wlansvc]
"ServiceDll"="%SystemRoot%\System32\wlansvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wlidsvc]
"ImagePath"="\"c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WmiAcpi]
"ImagePath"="\SystemRoot\system32\drivers\wmiacpi.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WmiApRpl]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wmiApSrv]
"ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WMPNetworkSvc]
"ImagePath"="\"%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPCSvc]
"ServiceDll"="%SystemRoot%\System32\wpcsvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPDBusEnum]
"ServiceDll"="%SystemRoot%\system32\wpdbusenum.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ws2ifsl]
"ImagePath"="\SystemRoot\system32\drivers\ws2ifsl.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WSearch]
"ImagePath"="%systemroot%\system32\SearchIndexer.exe /Embedding"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WSearchIdxPi]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv]
"ServiceDll"="%systemroot%\system32\wuaueng.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WudfPf]
"ImagePath"="system32\drivers\WudfPf.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WUDFRd]
"ImagePath"="system32\DRIVERS\WUDFRd.sys"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wudfsvc]
"ServiceDll"="%SystemRoot%\System32\WUDFSvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WwanSvc]
"ServiceDll"="%SystemRoot%\System32\wwansvc.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\xmlprov]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{37A550B1-E653-433A-9A90-446D9FB3494F}]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{71DEE413-63EB-4D97-B36C-806F379CE74F}]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{930E9C9E-AC09-4B4F-9693-F1464DE35CAB}]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{D3F2B640-155A-470C-8C53-28570737A067}]
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{D5A08749-06D0-48B1-8A37-6931611456A4}]
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\02\05\0a\0f\09\1aF"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-28 10:16:21
ComboFix-quarantined-files.txt 2013-07-28 08:16
.
Vor Suchlauf: 8 Verzeichnis(se), 149.896.978.432 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 149.518.360.576 Bytes frei
.
- - End Of File - - 8E344FB25D4E09CFE19614F6A8C69EE1
D41D8CD98F00B204E9800998ECF8427E |
|
28.07.2013, 16:20
| #6 |
| /// the machine /// TB-Ausbilder | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe |
|
28.07.2013, 18:22
| #7 |
| | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe vielen Dank schonmal schrauber! malware ist schon fertig: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.07.28.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16635 schleppi :: SCHLEPPI-PC [Administrator] 28.07.2013 17:05:59 MBAM-log-2013-07-28 (18-16-26).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 417516 Laufzeit: 1 Stunde(n), 7 Minute(n), 15 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKCR\CLSID\{597A9974-8CB0-4f41-B61F-ED065738A397} (PUP.RewardsArcade) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\schleppi\Desktop\setup.exe (PUP.Optional.IBryte) -> Keine Aktion durchgeführt. (Ende) Code:
ATTFilter # AdwCleaner v2.306 - Datei am 28/07/2013 um 18:24:13 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : schleppi - SCHLEPPI-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\schleppi\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\user.js
Datei Gelöscht : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\bprotector_prefs.js
Datei Gelöscht : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\extensions\movie2kdownloader@movie2kdownloader.com.xpi
Datei Gelöscht : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\searchplugins\delta.xml
Datei Gelöscht : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\searchplugins\SweetIm.xml
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\IMinent toolbar
Ordner Gelöscht : C:\Program Files (x86)\SweetIM
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BrowserProtect
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\visualbee
Ordner Gelöscht : C:\Users\schleppi\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\schleppi\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\schleppi\AppData\Local\visualbeeexe
Ordner Gelöscht : C:\Users\schleppi\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\schleppi\AppData\LocalLow\delta
Ordner Gelöscht : C:\Users\schleppi\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\schleppi\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Movie2KDownloader.com
Ordner Gelöscht : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\ConduitCommon
Ordner Gelöscht : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
Ordner Gelöscht : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\jetpack
Ordner Gelöscht : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\SweetPacksToolbarData
Ordner Gelöscht : C:\Users\schleppi\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\schleppi\AppData\Roaming\pdfforge
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\delta LTD
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\5e53dad9e66abe46
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\Software\AVG Secure Search
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033438.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033438.Sandbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033438.Sandbox.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Movie2KDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RewardsArcade.FBApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RewardsArcade.FBApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311341138}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\5e53dad9e66abe46
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110311341138}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220322342238}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{25514C64-8321-494E-BD3E-3DBAB3F8CEBA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{55555555-5555-5555-5555-550355345538}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660366346638}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311341138}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355345538}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366346638}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.delta-search.com/?affID=119776&babsrc=HP_ss&mntrId=5e40bfb7000000000000002454f86287 --> hxxp://www.google.com
-\\ Mozilla Firefox v22.0 (de)
Datei : C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\prefs.js
C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\user.js ... Gelöscht !
Gelöscht : user_pref("CT2504091..clientLogIsEnabled", true);
Gelöscht : user_pref("CT2504091..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Gelöscht : user_pref("CT2504091..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Gelöscht : user_pref("CT2504091.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Gelöscht : user_pref("CT2504091.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gelöscht : user_pref("CT2504091.BrowserCompStateIsOpen_129707804829376918", true);
Gelöscht : user_pref("CT2504091.CTID", "CT2504091");
Gelöscht : user_pref("CT2504091.CurrentServerDate", "10-2-2012");
Gelöscht : user_pref("CT2504091.DSInstall", false);
Gelöscht : user_pref("CT2504091.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT2504091.DialogsGetterLastCheckTime", "Fri Feb 10 2012 16:12:01 GMT+0100");
Gelöscht : user_pref("CT2504091.DownloadReferralCookieData", "");
Gelöscht : user_pref("CT2504091.EMailNotifierPollDate", "Fri Feb 10 2012 17:17:57 GMT+0100");
Gelöscht : user_pref("CT2504091.FeedLastCount129079840422964131", 0);
Gelöscht : user_pref("CT2504091.FeedPollDate128891351169457140", "Fri Feb 10 2012 17:17:58 GMT+0100");
Gelöscht : user_pref("CT2504091.FeedPollDate129079840422964131", "Fri Feb 10 2012 16:12:01 GMT+0100");
Gelöscht : user_pref("CT2504091.FeedTTL128891351169457140", 40);
Gelöscht : user_pref("CT2504091.FirstServerDate", "10-2-2012");
Gelöscht : user_pref("CT2504091.FirstTime", true);
Gelöscht : user_pref("CT2504091.FirstTimeFF3", true);
Gelöscht : user_pref("CT2504091.FixPageNotFoundErrors", true);
Gelöscht : user_pref("CT2504091.GroupingServerCheckInterval", 1440);
Gelöscht : user_pref("CT2504091.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gelöscht : user_pref("CT2504091.HPInstall", false);
Gelöscht : user_pref("CT2504091.HasUserGlobalKeys", true);
Gelöscht : user_pref("CT2504091.HomePageProtectorEnabled", false);
Gelöscht : user_pref("CT2504091.HomepageBeforeUnload", "hxxps://login.yahoo.com/config/login_verify2?.intl=de&.[...]
Gelöscht : user_pref("CT2504091.Initialize", true);
Gelöscht : user_pref("CT2504091.InitializeCommonPrefs", true);
Gelöscht : user_pref("CT2504091.InstallationAndCookieDataSentCount", 1);
Gelöscht : user_pref("CT2504091.InstallationId", "ConduitNSISIntegration");
Gelöscht : user_pref("CT2504091.InstallationType", "ConduitXPEIntegration");
Gelöscht : user_pref("CT2504091.InstalledDate", "Fri Feb 10 2012 16:12:01 GMT+0100");
Gelöscht : user_pref("CT2504091.IsAlertDBUpdated", true);
Gelöscht : user_pref("CT2504091.IsGrouping", false);
Gelöscht : user_pref("CT2504091.IsInitSetupIni", true);
Gelöscht : user_pref("CT2504091.IsMulticommunity", false);
Gelöscht : user_pref("CT2504091.IsOpenThankYouPage", false);
Gelöscht : user_pref("CT2504091.IsOpenUninstallPage", false);
Gelöscht : user_pref("CT2504091.LanguagePackLastCheckTime", "Fri Feb 10 2012 16:12:02 GMT+0100");
Gelöscht : user_pref("CT2504091.LanguagePackReloadIntervalMM", 1440);
Gelöscht : user_pref("CT2504091.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gelöscht : user_pref("CT2504091.LastLogin_3.9.0.3", "Fri Feb 10 2012 16:12:02 GMT+0100");
Gelöscht : user_pref("CT2504091.LatestVersion", "3.9.0.3");
Gelöscht : user_pref("CT2504091.Locale", "en-us");
Gelöscht : user_pref("CT2504091.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT2504091.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT2504091.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT2504091.MyStuffEnabledAtInstallation", true);
Gelöscht : user_pref("CT2504091.OriginalFirstVersion", "3.9.0.3");
Gelöscht : user_pref("CT2504091.SearchCaption", "Web Search");
Gelöscht : user_pref("CT2504091.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
Gelöscht : user_pref("CT2504091.SearchFromAddressBarIsInit", true);
Gelöscht : user_pref("CT2504091.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT250[...]
Gelöscht : user_pref("CT2504091.SearchInNewTabEnabled", true);
Gelöscht : user_pref("CT2504091.SearchInNewTabIntervalMM", 1440);
Gelöscht : user_pref("CT2504091.SearchInNewTabLastCheckTime", "Fri Feb 10 2012 16:12:02 GMT+0100");
Gelöscht : user_pref("CT2504091.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gelöscht : user_pref("CT2504091.SearchProtectorEnabled", false);
Gelöscht : user_pref("CT2504091.SearchProtectorToolbarDisabled", false);
Gelöscht : user_pref("CT2504091.SendProtectorDataViaLogin", true);
Gelöscht : user_pref("CT2504091.ServiceMapLastCheckTime", "Fri Feb 10 2012 16:12:01 GMT+0100");
Gelöscht : user_pref("CT2504091.SettingsLastCheckTime", "Fri Feb 10 2012 16:12:01 GMT+0100");
Gelöscht : user_pref("CT2504091.SettingsLastUpdate", "1327080125");
Gelöscht : user_pref("CT2504091.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2504091&SearchSource=13");
Gelöscht : user_pref("CT2504091.ThirdPartyComponentsInterval", 504);
Gelöscht : user_pref("CT2504091.ThirdPartyComponentsLastCheck", "Fri Feb 10 2012 16:12:01 GMT+0100");
Gelöscht : user_pref("CT2504091.ThirdPartyComponentsLastUpdate", "1312887586");
Gelöscht : user_pref("CT2504091.ToolbarShrinkedFromSetup", false);
Gelöscht : user_pref("CT2504091.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2504091");
Gelöscht : user_pref("CT2504091.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Gelöscht : user_pref("CT2504091.UserID", "UN29761373843906413");
Gelöscht : user_pref("CT2504091.alertChannelId", "897164");
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B4D4[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e.:2z527", "247E707571777278333228702A7B797B7B7E30273224262[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e06cg5el8:", "6E6D6F6A6B6C6F6E7272");
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A74737570717275747878242F4B4947[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347474[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934215[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b-0?3g>d", "3B6C716F6F7470447A4773764920794A7C7A25797A7E542A24[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b-0?3g@6:5;", "");
Gelöscht : user_pref("CT2504091.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F297B7E7D21202F26313E424[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576");
Gelöscht : user_pref("CT2504091.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484776213F3E484F4E4D464[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b5ba==9cjag", "3C6D69406E7042447A777747497B7478774C222221");
Gelöscht : user_pref("CT2504091.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6F6A6B6C6F6F7575747172");
Gelöscht : user_pref("CT2504091.backendstorage./9b9643g3/9e", "6A");
Gelöscht : user_pref("CT2504091.backendstorage./9b<:222h64<", "393F352F3E");
Gelöscht : user_pref("CT2504091.backendstorage./9b=+03eh8h8j?:", "4443");
Gelöscht : user_pref("CT2504091.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...]
Gelöscht : user_pref("CT2504091.backendstorage./9b?b0d:8aj62<h", "6D");
Gelöscht : user_pref("CT2504091.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B");
Gelöscht : user_pref("CT2504091.backendstorage.shoppingapp.gk.exipres", "5765642046656220313520323031322031363A[...]
Gelöscht : user_pref("CT2504091.backendstorage.shoppingapp.gk.geolocation", "6765726D616E79");
Gelöscht : user_pref("CT2504091.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Gelöscht : user_pref("CT2504091.globalFirstTimeInfoLastCheckTime", "Fri Feb 10 2012 16:12:01 GMT+0100");
Gelöscht : user_pref("CT2504091.homepageProtectorEnableByLogin", true);
Gelöscht : user_pref("CT2504091.initDone", true);
Gelöscht : user_pref("CT2504091.isAppTrackingManagerOn", true);
Gelöscht : user_pref("CT2504091.myStuffEnabled", true);
Gelöscht : user_pref("CT2504091.myStuffPublihserMinWidth", 400);
Gelöscht : user_pref("CT2504091.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gelöscht : user_pref("CT2504091.myStuffServiceIntervalMM", 1440);
Gelöscht : user_pref("CT2504091.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gelöscht : user_pref("CT2504091.revertSettingsEnabled", true);
Gelöscht : user_pref("CT2504091.searchProtectorDialogDelayInSec", 10);
Gelöscht : user_pref("CT2504091.searchProtectorEnableByLogin", true);
Gelöscht : user_pref("CT2504091.testingCtid", "");
Gelöscht : user_pref("CT2504091.toolbarAppMetaDataLastCheckTime", "Fri Feb 10 2012 16:12:01 GMT+0100");
Gelöscht : user_pref("CT2504091.toolbarContextMenuLastCheckTime", "Fri Feb 10 2012 16:12:01 GMT+0100");
Gelöscht : user_pref("CT2504091.usagesFlag", 1);
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2504091/CT2504091[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/897164/892962/DE", "\"0\"")[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2504091", [...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2504091",[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...]
Gelöscht : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\schleppi\\AppData\\Roaming\\Mozilla[...]
Gelöscht : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.9.0.3");
Gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2504091");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2504091");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList4", "CT2504091");
Gelöscht : user_pref("CommunityToolbar.globalUserId", "93ebc798-4cb1-42e9-82c8-11cb97a426df");
Gelöscht : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2504091");
Gelöscht : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Fri Feb 10 2012 16:12:0[...]
Gelöscht : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Gelöscht : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Fri Feb 10 2012 17:18:05 GMT+010[...]
Gelöscht : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Gelöscht : user_pref("CommunityToolbar.notifications.locale", "en");
Gelöscht : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Gelöscht : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Fri Feb 10 2012 16:12:00 GMT+0100");
Gelöscht : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Gelöscht : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Gelöscht : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Gelöscht : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Gelöscht : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Gelöscht : user_pref("CommunityToolbar.notifications.userId", "d6de240a-f0cf-45de-b406-cbe4c34dc195");
Gelöscht : user_pref("CommunityToolbar.originalHomepage", "hxxps://login.yahoo.com/config/login_verify2?.intl=d[...]
Gelöscht : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://www.delta-search.com/?affID=119776&babsrc[...]
Gelöscht : user_pref("extensions.Softonic.admin", false);
Gelöscht : user_pref("extensions.Softonic.aflt", "SD");
Gelöscht : user_pref("extensions.Softonic.autoRvrt", "false");
Gelöscht : user_pref("extensions.Softonic.dfltLng", "de");
Gelöscht : user_pref("extensions.Softonic.excTlbr", false);
Gelöscht : user_pref("extensions.Softonic.id", "5e40bfb700000000000000ffb1255e15");
Gelöscht : user_pref("extensions.Softonic.instlDay", "15432");
Gelöscht : user_pref("extensions.Softonic.instlRef", "MON00015");
Gelöscht : user_pref("extensions.Softonic.prdct", "Softonic");
Gelöscht : user_pref("extensions.Softonic.prtnrId", "softonic");
Gelöscht : user_pref("extensions.Softonic.rvrtMsg", "Click Yes to keep current home page and default search set[...]
Gelöscht : user_pref("extensions.Softonic.tlbrId", "base");
Gelöscht : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MON00015/tb_v1?SearchSource[...]
Gelöscht : user_pref("extensions.Softonic.vrsn", "1.5.21.0");
Gelöscht : user_pref("extensions.Softonic.vrsni", "1.5.21.0");
Gelöscht : user_pref("extensions.Softonic_i.newTab", false);
Gelöscht : user_pref("extensions.Softonic_i.smplGrp", "none");
Gelöscht : user_pref("extensions.Softonic_i.vrsnTs", "1.5.21.018:36:24");
Gelöscht : user_pref("extensions.crossriderapp498.498.InstallationThankYouPage", true);
Gelöscht : user_pref("extensions.crossriderapp498.498.active", true);
Gelöscht : user_pref("extensions.crossriderapp498.498.affid", "0");
Gelöscht : user_pref("extensions.crossriderapp498.498.backgroundjs", "\n\n/************************************[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.backgroundver", 4);
Gelöscht : user_pref("extensions.crossriderapp498.498.certdomaininstaller", "");
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie.InstallationTime.value", "1328886588");
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:0[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie.InstallerParams.value", "%7B%22sub_id%22%3A%22defa[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie._GPL_geo.expiration", "Fri Feb 24 2012 20:10:45 GM[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie._GPL_geo.value", "%7B%22geoplugin_city%22%3A%22Ber[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 20[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie._GPL_hotfix20111102645.value", "%221%22");
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030 0[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie._GPL_parent_zoneid.value", "%2210619%22");
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:00[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.cookie._GPL_zoneid.value", "%2218932%22");
Gelöscht : user_pref("extensions.crossriderapp498.498.description", "RewardsArcade is a platform that allows us[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.domain", "www.rewardsarcade.com");
Gelöscht : user_pref("extensions.crossriderapp498.498.emailsig", "");
Gelöscht : user_pref("extensions.crossriderapp498.498.exposesites", "");
Gelöscht : user_pref("extensions.crossriderapp498.498.fbremoteurl", "");
Gelöscht : user_pref("extensions.crossriderapp498.498.group", 0);
Gelöscht : user_pref("extensions.crossriderapp498.498.homepage", "");
Gelöscht : user_pref("extensions.crossriderapp498.498.iframe", false);
Gelöscht : user_pref("extensions.crossriderapp498.498.js", "\n\nvar _GPL_PID = 18;\n\n(function($) { \n\n $.[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.name", "RewardsArcade");
Gelöscht : user_pref("extensions.crossriderapp498.498.premium", true);
Gelöscht : user_pref("extensions.crossriderapp498.498.publisher", "215 Apps");
Gelöscht : user_pref("extensions.crossriderapp498.498.settingsurl", "");
Gelöscht : user_pref("extensions.crossriderapp498.498.thankyou", "hxxp://www.rewardsarcade.com/r.php?app_id=498[...]
Gelöscht : user_pref("extensions.crossriderapp498.498.ver", 71);
Gelöscht : user_pref("extensions.crossriderapp498.apps", "498");
Gelöscht : user_pref("extensions.crossriderapp498.bic", "13567d232f8850b1689aebd780681e90");
Gelöscht : user_pref("extensions.crossriderapp498.cid", 498);
Gelöscht : user_pref("extensions.crossriderapp498.firstrun", false);
Gelöscht : user_pref("extensions.crossriderapp498.hadappinstalled", true);
Gelöscht : user_pref("extensions.crossriderapp498.installationdate", 1328886723);
Gelöscht : user_pref("extensions.crossriderapp498.jsver", 3);
Gelöscht : user_pref("extensions.crossriderapp498.lastcheck", 22166489);
Gelöscht : user_pref("extensions.crossriderapp498.lastcheckitem", 22166586);
Gelöscht : user_pref("extensions.crossriderapp498.misc.lastBgWorkerTimer", "1329995125830");
Gelöscht : user_pref("extensions.crossriderapp498.misc.lastDomWorkerTimer", "1329995125828");
Gelöscht : user_pref("extensions.delta.admin", false);
Gelöscht : user_pref("extensions.delta.aflt", "babsst");
Gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Gelöscht : user_pref("extensions.delta.bbDpng", "27");
Gelöscht : user_pref("extensions.delta.cntry", "DE");
Gelöscht : user_pref("extensions.delta.dfltLng", "en");
Gelöscht : user_pref("extensions.delta.excTlbr", false);
Gelöscht : user_pref("extensions.delta.hdrMd5", "FD19677BF82646E4DB66A909C7736B13");
Gelöscht : user_pref("extensions.delta.id", "5e40bfb7000000000000002454f86287");
Gelöscht : user_pref("extensions.delta.instlDay", "15756");
Gelöscht : user_pref("extensions.delta.instlRef", "sst");
Gelöscht : user_pref("extensions.delta.lastVrsnTs", "1.8.10.020:37:11");
Gelöscht : user_pref("extensions.delta.newTab", false);
Gelöscht : user_pref("extensions.delta.prdct", "delta");
Gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Gelöscht : user_pref("extensions.delta.rvrt", "false");
Gelöscht : user_pref("extensions.delta.sg", "azb");
Gelöscht : user_pref("extensions.delta.smplGrp", "none");
Gelöscht : user_pref("extensions.delta.tlbrId", "base");
Gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Gelöscht : user_pref("extensions.delta.vrsn", "1.8.10.0");
Gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.10.020:37:11");
Gelöscht : user_pref("extensions.delta.vrsni", "1.8.10.0");
Gelöscht : user_pref("sweetim.toolbar.Visibility.VisibilityGuardLastUnHide", "1354573562280");
Gelöscht : user_pref("sweetim.toolbar.Visibility.enable", "true");
Gelöscht : user_pref("sweetim.toolbar.Visibility.intervaldays", "7");
Gelöscht : user_pref("sweetim.toolbar.cargo", "3.26010003");
Gelöscht : user_pref("sweetim.toolbar.cda.DisableOveride.enable", "true");
Gelöscht : user_pref("sweetim.toolbar.cda.HideOveride.enable", "true");
Gelöscht : user_pref("sweetim.toolbar.cda.RemoveOveride.enable", "true");
Gelöscht : user_pref("sweetim.toolbar.cda.returnValue", "disable");
Gelöscht : user_pref("sweetim.toolbar.dialogs.0.enable", "true");
Gelöscht : user_pref("sweetim.toolbar.dialogs.0.handler", "chrome://sim_toolbar_package/content/optionsdialog-h[...]
Gelöscht : user_pref("sweetim.toolbar.dialogs.0.height", "335");
Gelöscht : user_pref("sweetim.toolbar.dialogs.0.id", "id_options_dialog");
Gelöscht : user_pref("sweetim.toolbar.dialogs.0.title", "$string.config.label;");
Gelöscht : user_pref("sweetim.toolbar.dialogs.0.url", "hxxp://www.sweetim.com/simffbar/options_remote_ff_1_6.ht[...]
Gelöscht : user_pref("sweetim.toolbar.dialogs.0.width", "761");
Gelöscht : user_pref("sweetim.toolbar.dialogs.1.enable", "true");
Gelöscht : user_pref("sweetim.toolbar.dialogs.1.handler", "chrome://sim_toolbar_package/content/exampledialog-h[...]
Gelöscht : user_pref("sweetim.toolbar.dialogs.1.height", "300");
Gelöscht : user_pref("sweetim.toolbar.dialogs.1.id", "id_example_dialog");
Gelöscht : user_pref("sweetim.toolbar.dialogs.1.title", "Example (unit-test) dialog");
Gelöscht : user_pref("sweetim.toolbar.dialogs.1.url", "chrome://sim_toolbar_package/content/exampledialog.html"[...]
Gelöscht : user_pref("sweetim.toolbar.dialogs.1.width", "500");
Gelöscht : user_pref("sweetim.toolbar.dialogs.2.enable", "true");
Gelöscht : user_pref("sweetim.toolbar.dialogs.2.handler", "chrome://sim_toolbar_package/content/cdadialog-handl[...]
Gelöscht : user_pref("sweetim.toolbar.dialogs.2.height", "150");
Gelöscht : user_pref("sweetim.toolbar.dialogs.2.id", "id_dialog_hide_disable_remove");
Gelöscht : user_pref("sweetim.toolbar.dialogs.2.title", "Option Dialog");
Gelöscht : user_pref("sweetim.toolbar.dialogs.2.url", "hxxp://www.sweetim.com/simffbar/simcdadialog.asp");
Gelöscht : user_pref("sweetim.toolbar.dialogs.2.width", "530");
Gelöscht : user_pref("sweetim.toolbar.dnscatch.domain-blacklist", ".*.sweetim.com/.*|.*.facebook.com/.*|.*.goog[...]
Gelöscht : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
Gelöscht : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
Gelöscht : user_pref("sweetim.toolbar.mode.debug", "false");
Gelöscht : user_pref("sweetim.toolbar.scripts.0.addcontextdiv", "true");
Gelöscht : user_pref("sweetim.toolbar.scripts.0.callback", "simVerification");
Gelöscht : user_pref("sweetim.toolbar.scripts.0.domain-blacklist", "");
Gelöscht : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");
Gelöscht : user_pref("sweetim.toolbar.scripts.0.elementid", "id_script_sim_fb");
Gelöscht : user_pref("sweetim.toolbar.scripts.0.enable", "true");
Gelöscht : user_pref("sweetim.toolbar.scripts.0.id", "id_script_fb");
Gelöscht : user_pref("sweetim.toolbar.scripts.0.url", "hxxp://sc.sweetim.com/apps/in/fb/infb.js");
Gelöscht : user_pref("sweetim.toolbar.scripts.1.addcontextdiv", "true");
Gelöscht : user_pref("sweetim.toolbar.scripts.1.callback", "simVerification");
Gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");
Gelöscht : user_pref("sweetim.toolbar.scripts.1.elementid", "id_script_sim_fb");
Gelöscht : user_pref("sweetim.toolbar.scripts.1.enable", "false");
Gelöscht : user_pref("sweetim.toolbar.scripts.1.id", "id_script_fb_hxxpS");
Gelöscht : user_pref("sweetim.toolbar.scripts.1.url", "hxxps://sc.sweetim.com/apps/in/fb/infb.js");
Gelöscht : user_pref("sweetim.toolbar.scripts.2.addcontextdiv", "false");
Gelöscht : user_pref("sweetim.toolbar.scripts.2.callback", "");
Gelöscht : user_pref("sweetim.toolbar.scripts.2.domain-blacklist", ".*.google..*|.*.bing..*|.*.live..*|.*.msn..[...]
Gelöscht : user_pref("sweetim.toolbar.scripts.2.domain-whitelist", "");
Gelöscht : user_pref("sweetim.toolbar.scripts.2.elementid", "id_predict_include_script");
Gelöscht : user_pref("sweetim.toolbar.scripts.2.enable", "false");
Gelöscht : user_pref("sweetim.toolbar.scripts.2.id", "id_script_prad");
Gelöscht : user_pref("sweetim.toolbar.scripts.2.url", "hxxp://cdn1.certified-apps.com/scripts/shared/enable.js?[...]
Gelöscht : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]
Gelöscht : user_pref("sweetim.toolbar.search.history.capacity", "10");
Gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "false");
Gelöscht : user_pref("sweetim.toolbar.searchguard.initialized_by_rc", "true");
Gelöscht : user_pref("sweetim.toolbar.simapp_id", "{5F0C0C64-EAED-11E1-A087-E81132CD5764}");
Gelöscht : user_pref("sweetim.toolbar.version", "1.6.0.3");
*************************
AdwCleaner[S1].txt - [46352 octets] - [28/07/2013 18:24:13]
########## EOF - C:\AdwCleaner[S1].txt - [46413 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.2.5 (07.26.2013:2)
OS: Windows 7 Home Premium x64
Ran by schleppi on 28.07.2013 at 18:30:27,69
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\distromatic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\visualbee
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\visualbee
~~~ Files
Successfully deleted: [File] C:\eula.1031.txt
Successfully deleted: [File] C:\install.res.1031.dll
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files (x86)\mypc backup"
~~~ FireFox
Successfully deleted the following from C:\Users\schleppi\AppData\Roaming\mozilla\firefox\profiles\ibh5e4as.default\prefs.js
user_pref("extensions.crossrider.bic", "13567d232f8850b1689aebd780681e90");
Emptied folder: C:\Users\schleppi\AppData\Roaming\mozilla\firefox\profiles\ibh5e4as.default\minidumps [574 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.07.2013 at 18:42:28,16
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-07-2013
Ran by schleppi (administrator) on 28-07-2013 19:16:57
Running from C:\Users\schleppi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6NVY4E2
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(Microsoft Corporation) C:\Windows\system32\PrintIsolationHost.exe
(IObit) C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
() C:\Program Files (x86)\BrowseForTheCause\BrowseForTheCause.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
(Dropbox, Inc.) C:\Users\schleppi\AppData\Roaming\Dropbox\bin\Dropbox.exe
(WiseCleaner.com) C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
(WiseCleaner.com) C:\Program Files (x86)\Wise\Wise Care 365\WiseMemoryOptimzer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2817872 2012-04-25] (ELAN Microelectronics Corp.)
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [BrowseForTheCause] - C:\Program Files (x86)\BrowseForTheCause\BrowseForTheCause.exe [3744104 2013-07-28] ()
Startup: C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\schleppi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Samsung BHO Class - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll No File
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{37A550B1-E653-433A-9A90-446D9FB3494F}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{71DEE413-63EB-4D97-B36C-806F379CE74F}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{930E9C9E-AC09-4B4F-9693-F1464DE35CAB}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{D3F2B640-155A-470C-8C53-28570737A067}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{D5A08749-06D0-48B1-8A37-6931611456A4}: [NameServer]76.73.7.75,107.6.133.7
FireFox:
========
FF ProfilePath: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default
FF Homepage: https://login.yahoo.com/config/login_verify2?.intl=de&.src=ym
FF Keyword.URL: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p14_serp_ff_de_display?ie=UTF8&tagbase=bds-p14&tag=bds-p14-serp-de-ff-21&tbrId=v1_abb-channel-14_b53f9463d52d4b7a94bf69e8d387c953_16_37_20130720_DE_ff_ab_&query=
FF NetworkProxy: "autoconfig_url", "hxxp://proxy.charite.de/"
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=10.15.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\searchplugins\amazon.xml
FF Extension: No Name - C:\Users\schleppi\AppData\Roaming\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
FF Extension: No Name - C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\Extensions\75c9b989-a6e6-4455-971f-45304161eb23@02648b91-49b2-4d7f-99ef-7e959a8e6505.com
FF Extension: Ghostery - C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\Extensions\firefox@ghostery.com
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Plus-HD-2.5) - C:\Users\schleppi\AppData\Local\Google\Chrome\User Data\Default\Extensions\iefogiieekeeeeaiklglonbockmhmkgd\1.23.8_0
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx
==================== Services (Whitelisted) =================
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580232 2013-04-25] (WiseCleaner.com)
==================== Drivers (Whitelisted) ====================
R4 AFD; C:\Windows\system32\drivers\afd.sys [79672 2013-07-28] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-27] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-27] (Windows (R) 2003 DDK 3790 provider)
R4 ws2ifsl; C:\Windows\system32\drivers\ws2ifsl.sys [79672 2013-07-28] (AVG Technologies CZ, s.r.o.)
S3 clwvd; system32\DRIVERS\clwvd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-28 19:11 - 2013-07-28 19:11 - 00002860 _____ C:\windows\System32\Tasks\Wise Care 365
2013-07-28 19:11 - 2013-07-28 19:11 - 00000428 _____ C:\windows\Tasks\Wise Care 365.job
2013-07-28 19:11 - 2013-07-28 19:11 - 00000408 _____ C:\windows\Tasks\Wise Turbo Checker.job
2013-07-28 18:58 - 2013-07-28 19:09 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Wise Care 365
2013-07-28 18:57 - 2013-07-28 18:57 - 00001120 _____ C:\Users\Public\Desktop\Wise Care 365.lnk
2013-07-28 18:43 - 2013-07-28 18:43 - 00001474 _____ C:\Users\schleppi\Desktop\junkware.txt
2013-07-28 18:30 - 2013-07-28 18:30 - 00000000 ____D C:\windows\ERUNT
2013-07-28 18:29 - 2013-07-28 18:29 - 00046379 _____ C:\Users\schleppi\Desktop\AdwCleaner[S1].txt
2013-07-28 18:24 - 2013-07-28 18:24 - 00046379 _____ C:\AdwCleaner[S1].txt
2013-07-28 18:21 - 2013-07-28 18:21 - 00561198 _____ (Oleg N. Scherbakov) C:\Users\schleppi\Desktop\JRT.exe
2013-07-28 18:19 - 2013-07-28 18:19 - 00666633 _____ C:\Users\schleppi\Desktop\adwcleaner.exe
2013-07-28 17:03 - 2013-07-28 17:03 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-28 17:03 - 2013-07-28 17:03 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-28 10:16 - 2013-07-28 10:16 - 00072575 _____ C:\ComboFix.txt
2013-07-28 09:45 - 2013-07-28 10:16 - 00000000 ____D C:\Qoobox
2013-07-28 09:45 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-07-28 09:45 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-07-28 09:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-07-28 09:44 - 2013-07-28 09:57 - 00000000 ____D C:\windows\erdnt
2013-07-28 09:43 - 2013-07-28 18:27 - 00001910 _____ C:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job
2013-07-28 09:43 - 2013-07-28 18:27 - 00001836 _____ C:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job
2013-07-28 09:43 - 2013-07-28 18:27 - 00001204 _____ C:\windows\Tasks\Plus-HD-2.5-codedownloader.job
2013-07-28 09:43 - 2013-07-28 18:27 - 00001200 _____ C:\windows\Tasks\Plus-HD-2.5-updater.job
2013-07-28 09:43 - 2013-07-28 18:27 - 00001104 _____ C:\windows\Tasks\Plus-HD-2.5-enabler.job
2013-07-28 09:43 - 2013-07-28 09:43 - 00004234 _____ C:\windows\System32\Tasks\Plus-HD-2.5-codedownloader
2013-07-28 09:43 - 2013-07-28 09:43 - 00004230 _____ C:\windows\System32\Tasks\Plus-HD-2.5-updater
2013-07-28 09:43 - 2013-07-28 09:43 - 00004134 _____ C:\windows\System32\Tasks\Plus-HD-2.5-enabler
2013-07-28 09:43 - 2013-07-28 09:43 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.5
2013-07-28 09:42 - 2013-07-28 18:29 - 00003398 _____ C:\windows\System32\Tasks\BrowseForTheCauseUpdate
2013-07-28 09:42 - 2013-07-28 09:42 - 00001236 _____ C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Users\schleppi\AppData\Local\emaze
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Program Files (x86)\BrowseForTheCause
2013-07-27 23:52 - 2013-07-27 23:52 - 00000000 ____D C:\Users\schleppi\Desktop\Desctop
2013-07-27 23:45 - 2013-07-27 23:45 - 00027184 _____ C:\Users\schleppi\Desktop\FRST.txt
2013-07-27 23:44 - 2013-07-27 23:45 - 00022476 _____ C:\Users\schleppi\Desktop\Addition.txt
2013-07-27 23:42 - 2013-07-27 23:42 - 01780815 _____ (Farbar) C:\Users\schleppi\Desktop\FRST64.exe
2013-07-27 23:42 - 2013-07-27 23:42 - 00000000 ____D C:\FRST
2013-07-19 22:43 - 2013-04-10 11:09 - 00849992 _____ (Realtek ) C:\windows\system32\Drivers\Rt64win7.sys
2013-07-19 22:43 - 2013-04-10 11:09 - 00073800 _____ (Realtek Semiconductor Corporation) C:\windows\system32\RtNicProp64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 27781920 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 25256224 _____ (NVIDIA Corporation) C:\windows\system32\nvcompiler.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 21102368 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 17560352 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcompiler.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 15144928 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 11235104 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2013-07-19 22:39 - 2013-06-21 05:06 - 09239344 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 07687592 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 07641832 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 06324360 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02953504 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02777888 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02363680 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvenc.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02002720 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvenc.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 01832224 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6432049.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 01511712 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6432049.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00572704 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00570656 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00467232 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00465184 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2013-07-19 22:39 - 2013-02-24 22:27 - 00194848 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvhda64v.sys
2013-07-19 22:39 - 2013-02-24 22:27 - 00031520 _____ (NVIDIA Corporation) C:\windows\system32\nvhdap64.dll
2013-07-19 22:39 - 2013-01-29 01:35 - 01510176 _____ (NVIDIA Corporation) C:\windows\system32\nvhdagenco6420103.dll
2013-07-19 22:36 - 2013-07-28 18:27 - 00000302 _____ C:\windows\Tasks\Driver Booster Startup.job
2013-07-19 22:36 - 2013-07-19 22:36 - 00003222 _____ C:\windows\System32\Tasks\Driver Booster Scan
2013-07-19 22:36 - 2013-07-19 22:36 - 00003220 _____ C:\windows\System32\Tasks\Driver Booster Update
2013-07-19 22:36 - 2013-07-19 22:36 - 00002582 _____ C:\windows\System32\Tasks\Driver Booster Startup
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\ProgramData\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Program Files (x86)\IObit
2013-07-11 07:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-07-11 07:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-07-11 07:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 07:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-07-11 07:05 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-07-11 07:05 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-07-11 07:04 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-07-11 07:04 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-07-11 07:04 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-07-10 15:26 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-07-10 15:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2013-07-10 15:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2013-07-10 15:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-07-10 15:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-07-10 15:26 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2013-07-10 15:26 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2013-06-28 20:13 - 2013-06-28 20:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-06-28 20:13 - 2013-06-28 20:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
126
==================== One Month Modified Files and Folders =======
2013-07-28 19:11 - 2013-07-28 19:11 - 00003224 _____ C:\windows\System32\Tasks\Wise Turbo Checker
2013-07-28 19:11 - 2013-07-28 19:11 - 00002860 _____ C:\windows\System32\Tasks\Wise Care 365
2013-07-28 19:11 - 2013-07-28 19:11 - 00000428 _____ C:\windows\Tasks\Wise Care 365.job
2013-07-28 19:11 - 2013-07-28 19:11 - 00000408 _____ C:\windows\Tasks\Wise Turbo Checker.job
2013-07-28 19:11 - 2012-02-10 17:09 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Azureus
2013-07-28 19:09 - 2013-07-28 18:58 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Wise Care 365
2013-07-28 19:01 - 2012-11-25 11:14 - 00000000 ____D C:\Program Files (x86)\Wise
2013-07-28 19:00 - 2012-02-10 18:59 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-07-28 18:57 - 2013-07-28 18:57 - 00001120 _____ C:\Users\Public\Desktop\Wise Care 365.lnk
2013-07-28 18:43 - 2013-07-28 18:43 - 00001474 _____ C:\Users\schleppi\Desktop\junkware.txt
2013-07-28 18:34 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-28 18:34 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-28 18:33 - 2012-12-12 23:07 - 01232841 ____N C:\windows\WindowsUpdate.log
2013-07-28 18:33 - 2012-02-10 19:05 - 00000000 ___RD C:\Users\schleppi\Dropbox
2013-07-28 18:33 - 2012-02-10 17:13 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Dropbox
2013-07-28 18:33 - 2011-10-20 15:49 - 00000000 ___RD C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-28 18:32 - 2012-08-26 13:12 - 00001114 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-28 18:30 - 2013-07-28 18:30 - 00000000 ____D C:\windows\ERUNT
2013-07-28 18:30 - 2011-10-20 16:03 - 00000000 ____D C:\ProgramData\MFAData
2013-07-28 18:29 - 2013-07-28 18:29 - 00046379 _____ C:\Users\schleppi\Desktop\AdwCleaner[S1].txt
2013-07-28 18:29 - 2013-07-28 09:42 - 00003398 _____ C:\windows\System32\Tasks\BrowseForTheCauseUpdate
2013-07-28 18:27 - 2013-07-28 09:43 - 00001910 _____ C:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job
2013-07-28 18:27 - 2013-07-28 09:43 - 00001836 _____ C:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job
2013-07-28 18:27 - 2013-07-28 09:43 - 00001204 _____ C:\windows\Tasks\Plus-HD-2.5-codedownloader.job
2013-07-28 18:27 - 2013-07-28 09:43 - 00001200 _____ C:\windows\Tasks\Plus-HD-2.5-updater.job
2013-07-28 18:27 - 2013-07-28 09:43 - 00001104 _____ C:\windows\Tasks\Plus-HD-2.5-enabler.job
2013-07-28 18:27 - 2013-07-19 22:36 - 00000302 _____ C:\windows\Tasks\Driver Booster Startup.job
2013-07-28 18:27 - 2012-08-26 13:12 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-28 18:26 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-07-28 18:25 - 2012-02-15 09:09 - 00079672 _____ (AVG Technologies CZ, s.r.o.) C:\windows\system32\Drivers\AFD.SYS
2013-07-28 18:25 - 2009-07-14 02:10 - 00079672 _____ (AVG Technologies CZ, s.r.o.) C:\windows\system32\Drivers\WS2IFSL.SYS
2013-07-28 18:24 - 2013-07-28 18:24 - 00046379 _____ C:\AdwCleaner[S1].txt
2013-07-28 18:24 - 2012-08-30 19:27 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-07-28 18:21 - 2013-07-28 18:21 - 00561198 _____ (Oleg N. Scherbakov) C:\Users\schleppi\Desktop\JRT.exe
2013-07-28 18:19 - 2013-07-28 18:19 - 00666633 _____ C:\Users\schleppi\Desktop\adwcleaner.exe
2013-07-28 17:03 - 2013-07-28 17:03 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-28 17:03 - 2013-07-28 17:03 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-28 11:13 - 2013-06-16 16:56 - 00003954 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{1534DA73-4149-4D86-BC64-A5F303CCEF9E}
2013-07-28 10:16 - 2013-07-28 10:16 - 00072575 _____ C:\ComboFix.txt
2013-07-28 10:16 - 2013-07-28 09:45 - 00000000 ____D C:\Qoobox
2013-07-28 10:16 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-28 10:16 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-28 09:57 - 2013-07-28 09:44 - 00000000 ____D C:\windows\erdnt
2013-07-28 09:56 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-07-28 09:43 - 2013-07-28 09:43 - 00004234 _____ C:\windows\System32\Tasks\Plus-HD-2.5-codedownloader
2013-07-28 09:43 - 2013-07-28 09:43 - 00004230 _____ C:\windows\System32\Tasks\Plus-HD-2.5-updater
2013-07-28 09:43 - 2013-07-28 09:43 - 00004134 _____ C:\windows\System32\Tasks\Plus-HD-2.5-enabler
2013-07-28 09:43 - 2013-07-28 09:43 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.5
2013-07-28 09:42 - 2013-07-28 09:42 - 00001236 _____ C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Users\schleppi\AppData\Local\emaze
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Program Files (x86)\BrowseForTheCause
2013-07-27 23:52 - 2013-07-27 23:52 - 00000000 ____D C:\Users\schleppi\Desktop\Desctop
2013-07-27 23:45 - 2013-07-27 23:45 - 00027184 _____ C:\Users\schleppi\Desktop\FRST.txt
2013-07-27 23:45 - 2013-07-27 23:44 - 00022476 _____ C:\Users\schleppi\Desktop\Addition.txt
2013-07-27 23:42 - 2013-07-27 23:42 - 01780815 _____ (Farbar) C:\Users\schleppi\Desktop\FRST64.exe
2013-07-27 23:42 - 2013-07-27 23:42 - 00000000 ____D C:\FRST
2013-07-22 18:40 - 2013-02-28 19:41 - 00000472 _____ C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job
2013-07-19 22:43 - 2011-07-28 06:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-19 22:41 - 2011-07-28 05:36 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-07-19 22:36 - 2013-07-19 22:36 - 00003222 _____ C:\windows\System32\Tasks\Driver Booster Scan
2013-07-19 22:36 - 2013-07-19 22:36 - 00003220 _____ C:\windows\System32\Tasks\Driver Booster Update
2013-07-19 22:36 - 2013-07-19 22:36 - 00002582 _____ C:\windows\System32\Tasks\Driver Booster Startup
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\ProgramData\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Program Files (x86)\IObit
2013-07-15 22:06 - 2012-07-14 20:30 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\vlc
2013-07-13 16:27 - 2012-08-26 13:12 - 00004110 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 16:27 - 2012-08-26 13:12 - 00003858 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 23:17 - 2011-02-11 21:57 - 00000000 ____D C:\windows\Panther
2013-07-11 19:40 - 2012-08-30 19:27 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-07-11 19:39 - 2012-08-30 19:22 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 19:39 - 2012-08-30 19:22 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 19:35 - 2009-07-14 06:45 - 00462168 _____ C:\windows\system32\FNTCACHE.DAT
2013-07-11 07:23 - 2011-07-28 20:57 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 07:23 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 07:07 - 2012-02-21 13:31 - 78185248 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-07-08 18:43 - 2011-07-28 21:05 - 00643866 _____ C:\windows\system32\perfh007.dat
2013-07-08 18:43 - 2011-07-28 21:05 - 00126394 _____ C:\windows\system32\perfc007.dat
2013-07-08 18:43 - 2009-07-14 07:13 - 01472002 _____ C:\windows\system32\PerfStringBackup.INI
2013-07-03 10:12 - 2013-04-12 00:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-06-28 20:13 - 2013-06-28 20:13 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-06-28 20:13 - 2013-06-28 20:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-15 15:07
==================== End Of Log ============================
--- --- --- --- --- --- FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-07-2013 Ran by schleppi at 2013-07-28 19:22:05 Running from C:\Users\schleppi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6NVY4E2 Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= „Windows Live Essentials“ (x32 Version: 15.4.3502.0922) „Windows Live Mail“ (x32 Version: 15.4.3502.0922) Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Atheros Client Installation Program (x32 Version: 9.0) AVG 2013 (Version: 13.0.3209) AVG 2013 (Version: 13.0.3349) AVG 2013 (Version: 2013.0.3349) AVG PC Tuneup 2011 (x32) BatteryLifeExtender (x32 Version: 1.0.11) Broadcom 802.11 Network Adapter (Version: 5.60.48.55) Brother MFL-Pro Suite MFC-255CW (x32 Version: 1.0.1.0) Browse for the Cause (x32) CCleaner (Version: 3.21) D3DX10 (x32 Version: 15.4.2368.0902) DBView Element 2005 (x32 Version: 4.0) dows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (Version: 05/31/2012 7.1.2.0) Driver Booster (x32 Version: Beta 2.0) Dropbox (HKCU Version: 2.0.22) Easy Content Share (x32 Version: 1.0) Easy Display Manager (x32 Version: 3.2) Easy Migration (x32 Version: 1.0) Easy Network Manager (x32 Version: 4.4.7) Easy SpeedUp Manager (x32 Version: 2.1.1.1) EasyBatteryManager (x32 Version: 4.0.0.4) EasyFileShare (x32 Version: 1.0.12) ETDWare PS/2-X64 10.7.14.12_WHQL (Version: 10.7.14.12) Fast Start (x32 Version: 2.2.0.1) Fishdom 2 Deluxe (x32) Free Studio version 5.3.3 (x32) Free YouTube to MP3 Converter version 3.11.35.1031 (x32 Version: 3.11.35.1031) FreeMind (x32 Version: 0.9.0_RC_10) Google Update Helper (x32 Version: 1.3.21.153) Intel PROSet Wireless (x32) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) PROSet/Wireless WiFi Software (Version: 14.01.1000) Intel(R) Rapid Storage Technology (x32 Version: 10.1.5.1001) Java Auto Updater (x32 Version: 2.1.9.0) Java(TM) 6 Update 33 (x32 Version: 6.0.330) Junk Mail filter update (x32 Version: 15.4.3502.0922) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Silverlight (Version: 5.1.20125.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1) Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1) Movie Color Enhancer (x32 Version: 1.0) Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0) MSVC80_x64_v2 (Version: 1.0.3.0) MSVC80_x86_v2 (x32 Version: 1.0.3.0) MSVC90_x64 (Version: 1.0.1.2) MSVC90_x86 (x32 Version: 1.0.1.2) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) Multimedia POP (x32 Version: 1.0) Nokia Connectivity Cable Driver (x32 Version: 7.1.172.0) Nokia Suite (x32 Version: 3.8.30.0) NVIDIA Install Application (Version: 2.1002.124.810) NVIDIA Systemsteuerung 320.49 (Version: 320.49) OpenOffice.org 3.4 (x32 Version: 3.4.9590) PC Connectivity Solution (x32 Version: 12.0.109.0) PDF24 Creator 5.2.0 (x32) PDF-Viewer (Version: 2.5.210.0) PhoneShare (x32 Version: 9.1.4) Plus-HD-2.5 (x32 Version: 1.27.153.5) Poczta usługi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) Pošta Windows Live (x32 Version: 15.4.3502.0922) Realtek Ethernet Controller Driver (x32 Version: 7.40.126.2011) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6400) Samsung AnyWeb Print (x32 Version: 2.0.67.1) Samsung Printer Live Update (x32) Samsung Recovery Solution 5 (x32 Version: 5.0.1.0) Samsung Support Center (x32 Version: 1.1.24) Samsung Universal Print Driver (x32 Version: 2.02.05.00:27) Samsung Universal Scan Driver (x32 Version: 1.2.5.0) Samsung Update Plus (x32 Version: 3.0.0.17) Skype™ 4.2 (x32 Version: 4.2.169) Synchredible (x32 Version: 4.0.0.5) Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.0.82.0) User Guide (x32 Version: 1.6) Visual Studio 2008 x64 Redistributables (x32 Version: 10.0.0.2) Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1) VLC media player 2.0.2 (x32 Version: 2.0.2) Vuze (x32 Version: 5.0.0.0) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3508.1109) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Pošta (x32 Version: 15.4.3502.0922) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Windows Live 메일 (x32 Version: 15.4.3502.0922) Windows Live 필수 패키지 (x32 Version: 15.4.3502.0922) Windows Live 程式集 (x32 Version: 15.4.3502.0922) Windows Live 程式集 (x32 Version: 15.4.3508.1109) Windows Live 软件包 (x32 Version: 15.4.3502.0922) Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922) Windows Liven sähköposti (x32 Version: 15.4.3502.0922) WinRAR 4.00 (64-Bit) (Version: 4.00.0) Wise Care 365 version 2.66 (x32 Version: 2.66) WordCaptureX Pro (x32 Version: 4.0.0) Основные компоненты Windows Live (x32 Version: 15.4.3502.0922) Почта Windows Live (x32 Version: 15.4.3502.0922) بريد Windows Live (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= 28-06-2013 10:44:54 Geplanter Prüfpunkt 08-07-2013 20:37:17 Geplanter Prüfpunkt 11-07-2013 04:43:02 Windows Update 12-07-2013 05:15:25 Windows Update 12-07-2013 20:36:16 Removed Versandhelfer 19-07-2013 20:38:57 Driver Booster : NVIDIA GeForce GT 520M 28-07-2013 07:45:18 ComboFix created restore point ==================== Hosts content: ========================== 2009-07-14 04:34 - 2013-07-28 09:56 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {025A0E68-F036-467F-9553-F2C8F9FD91BA} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2011-02-14] (SEC) Task: {062A5F82-BAFF-4AE1-AEA8-9EBB819E6561} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.) Task: {07B13C30-5A10-4756-B40E-D04632AF8EC3} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.) Task: {07EF1EEC-8A79-4303-864E-7520287E8FDB} - System32\Tasks\Driver Booster Update => C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe [2013-07-17] (IObit) Task: {0A91FBA5-96FE-4196-972D-E44CCC71A768} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation) Task: {0AA78EFD-EA4E-4C03-9691-5855AE596C69} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2010-08-27] (Samsung Electronics) Task: {0FADA576-25F9-40F3-A9FD-5F00088303AA} - System32\Tasks\Driver Booster Startup => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2013-07-17] (IObit) Task: {11D935D9-676C-44E4-BB96-FAA163882110} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.) Task: {250B4C9C-B47D-4B0D-A4D5-F7DF6A12DA90} - System32\Tasks\Synchredible-schleppi => C:\Program Files (x86)\ASCOMP Software\Synchredible\synchredible.exe [2013-01-31] (ASCOMP Software GmbH) Task: {3BE0B2FB-3DB8-4B06-A799-77B71757DBAF} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2010-02-10] (Samsung Electronics Co., Ltd.) Task: {4A0789F8-DADB-4675-83DE-5319E88315E9} - System32\Tasks\Plus-HD-2.5-codedownloader => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-codedownloader.exe [2013-07-28] (Plus HD) Task: {4C13C545-CC5D-4E5D-9C50-969215675D1D} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.) Task: {5A6CCA2E-0505-4408-AC4C-D30F0CD55D4C} - System32\Tasks\Wise Care 365 => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe [2013-04-26] (WiseCleaner.com) Task: {5F956975-F718-4BD1-95FF-0D56C37E7119} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.) Task: {703E4EC8-B7F6-4A0D-AB25-6269B4059E61} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {763A2B7B-6FFC-4568-8D0E-4F14CD53584A} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation) Task: {7BD3816D-8E54-4926-9F66-7AD5BD0F11F8} - System32\Tasks\Plus-HD-2.5-firefoxinstaller => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-firefoxinstaller.exe [2013-07-28] (Plus HD) Task: {810BAD61-35F0-4982-BD9A-A584CA4AAA15} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2027592733-4161651481-1790285415-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe No File Task: {838FBF08-95EB-45D6-AD62-0CD3E5ADC9C9} - System32\Tasks\Plus-HD-2.5-enabler => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-enabler.exe [2013-07-28] (Plus HD) Task: {8B62AF8A-B95D-44FB-839A-8CF14A37C123} - System32\Tasks\EasyPartitionManager => C:\Windows\MSetup\BA46-12225A02\EPM.exe No File Task: {8C79300E-DF30-476A-8E90-4CEDB652CFCA} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.) Task: {8EB1AA34-6AE2-4BA9-83B5-9923484245A8} - System32\Tasks\Wise Turbo Checker => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe [2013-05-23] (WiseCleaner.COM) Task: {9793C63F-5F0D-4260-B559-D716A571374F} - System32\Tasks\Driver Booster Scan => C:\Program Files (x86)\IObit\Driver Booster\Scheduler.exe [2013-07-17] (IObit) Task: {A2B37064-CE1B-46E8-B4D6-E597FE822F9F} - System32\Tasks\Plus-HD-2.5-updater => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-updater.exe [2013-07-28] (Plus HD) Task: {AC8B457C-8C99-4BD3-8674-C65D84069CAB} - System32\Tasks\BrowseForTheCauseUpdate => C:\Program Files (x86)\BrowseForTheCause\BrowseForTheCause.exe [2013-07-28] () Task: {BEF11CF5-B7C0-4BA1-B39D-E97B6EA2D365} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.) Task: {C00E7702-3342-4E08-877B-66882DB067B6} - System32\Tasks\Plus-HD-2.5-chromeinstaller => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-chromeinstaller.exe [2013-07-28] (Plus HD) Task: {C0B7810F-C442-42FF-B400-70ABDCC556BF} - System32\Tasks\User_Feed_Synchronization-{1534DA73-4149-4D86-BC64-A5F303CCEF9E} => C:\windows\system32\msfeedssync.exe [2013-02-27] (Microsoft Corporation) Task: {C0D579B1-FCAF-4EEC-8B15-6A547768DEB6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.) Task: {C7FE6C5C-69FF-4865-8F05-375B1515BEA9} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-02-07] (SAMSUNG Electronics) Task: {D35BCFE9-91F2-4A27-B486-85CE4E3265F0} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2027592733-4161651481-1790285415-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe No File Task: {E32F14BE-2FCE-44F8-96AA-DA303EDDA635} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe No File Task: {E3E3A0CC-B5BC-447F-8972-573EDDA928B9} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-11] (Adobe Systems Incorporated) Task: {F008F492-3511-42B3-AB07-6FC0437EF6E7} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] () Task: {F090C633-431A-4005-B2B7-EBDE3566F57B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\windows\Tasks\Driver Booster Startup.job => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-chromeinstaller.exe Task: C:\windows\Tasks\Plus-HD-2.5-codedownloader.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-codedownloader.exe Task: C:\windows\Tasks\Plus-HD-2.5-enabler.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-enabler.exe Task: C:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-firefoxinstaller.exe Task: C:\windows\Tasks\Plus-HD-2.5-updater.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-updater.exe Task: C:\windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe Task: C:\windows\Tasks\Wise Care 365.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe Task: C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe Task: C:\windows\Tasks\Wise Turbo Checker.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/28/2013 06:59:59 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00173668 ID des fehlerhaften Prozesses: 0x167c Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 System errors: ============= Error: (07/28/2013 06:57:47 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Wise Boot Assistant" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Microsoft Office Sessions: ========================= Error: (07/28/2013 06:59:59 PM) (Source: Application Error)(User: ) Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc000000500173668167c01ce8bb1b1e6a431C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll22be8bec-f7a7-11e2-a2fc-e81132cd5764 CodeIntegrity Errors: =================================== Date: 2013-07-28 09:55:14.706 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\setup\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-07-28 09:55:14.579 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\setup\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. ==================== Memory info =========================== Percentage of memory in use: 24% Total physical RAM: 8171.55 MB Available physical RAM: 6173.02 MB Total Pagefile: 16341.28 MB Available Pagefile: 13962.32 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:230 GB) (Free:139.15 GB) NTFS (Disk=0 Partition=2) Drive d: () (Fixed) (Total:342.28 GB) (Free:157.2 GB) NTFS (Disk=0 Partition=4) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 596 GB) (Disk ID: 23C4F13B) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=230 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=342 GB) - (Type=OF Extended) Partition 4: (Not Active) - (Size=24 GB) - (Type=27) ==================== End Of Log ============================ |
|
29.07.2013, 07:25
| #8 |
| /// the machine /// TB-Ausbilder | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe Malwarebytes nochmal laufen lassen, Du sollst die Funde löschen lassen  ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.07.2013, 07:39
| #9 |
| | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe hallo schrauber, jetzt habe ich zusätzlich ein konnektivitätsproblem. -ich komme nicht mehr ins internet "Die Proxyeinstellungen des Netzwerks konnten nicht automatisch ermittelt werden" (schreibe hier vom Rechner meines Mitbewohners). rooter neu starten habe ich probiert, erfolglos. - die verbindung zu meinem drucker findet er auch nicht mehr. was mache ich jetzt?? vielen dank troja12 Ergänzung: Nach nochmaligem Hochfahren zeigt er unter Geräte+Drucker auch außer Dem Laptop und der Tastaur nichts mehr an. Wenn ich versuche, den Drucker wieder hinzuzufügen kommt die Fehlermeldung "Der lokale Druckerspooler wird nicht ausgeführt." Geändert von troja12 (29.07.2013 um 08:18 Uhr) |
|
29.07.2013, 08:47
| #10 |
| /// the machine /// TB-Ausbilder | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe Poste mal ein frisches FRST log bitte. Downloade dir bitte  Farbar Service Scanner
Poste bitte den Inhalt hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.07.2013, 08:58
| #11 |
| | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe Kurze Zwischenfrage: Da ich die Down- und Uploads über den Laptop meines Mitbewohners machen muss .. gefährde ich sein System damit? |
|
29.07.2013, 10:54
| #12 |
| /// the machine /// TB-Ausbilder | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe Nee eigentlich nicht. Beim Anstecken des Sticks Großschreibtaste drücken und gedrückt halten, das sperrt den Autostart. Für alle Fälle
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.07.2013, 12:17
| #13 |
| | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um HilfeCode:
ATTFilter Results of screen317's Security Check version 0.99.71
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
AVG AntiVirus Free Edition 2013
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
AVG PC Tuneup 2011
Java(TM) 6 Update 33
Java version out of Date!
Adobe Flash Player 11.8.800.94
Mozilla Firefox (22.0)
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Code:
ATTFilter Farbar Service Scanner Version: 26-07-2013
Ran by schleppi (administrator) on 29-07-2013 at 13:00:53
Running from "C:\Users\schleppi\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.
afd Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open afd registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open afd registry key. The service key does not exist.
Checking LEGACY_afd: ATTENTION!=====> Unable to open LEGACY_afd\0000 registry key. The key does not exist.
Connection Status:
==============
Localhost is accessible.
There is no connection to network.
Attempt to access Google IP returned error.
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo.com returned error: Other errors
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.
BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.
Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys
[2012-02-15 09:09] - [2013-07-28 18:25] - 0079672 ____A (AVG Technologies CZ, s.r.o.) 044333531FF88AE5C80C981A33649396
ATTENTION!=====> C:\Windows\System32\drivers\afd.sys IS INFECTED.
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-07-2013 04
Ran by schleppi (administrator) on 29-07-2013 13:08:07
Running from C:\Users\schleppi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Dropbox, Inc.) C:\Users\schleppi\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
() C:\Program Files (x86)\BrowseForTheCause\BrowseForTheCause.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(ASCOMP Software GmbH) C:\Program Files (x86)\ASCOMP Software\Synchredible\synchredible.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2817872 2012-04-25] (ELAN Microelectronics Corp.)
HKLM-x32\...\Runonce: [Del13959952] - cmd.exe /Q /D /c del "C:\Users\schleppi\AppData\Local\Temp\0.del" [x]
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKCU\...\Runonce: [Del13959952] - cmd.exe /Q /D /c del "C:\Users\schleppi\AppData\Local\Temp\0.del" [x]
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [BrowseForTheCause] - C:\Program Files (x86)\BrowseForTheCause\BrowseForTheCause.exe [3744104 2013-07-28] ()
HKU\Default\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
HKU\Default User\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
Startup: C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\schleppi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Samsung BHO Class - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll No File
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{37A550B1-E653-433A-9A90-446D9FB3494F}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{71DEE413-63EB-4D97-B36C-806F379CE74F}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{930E9C9E-AC09-4B4F-9693-F1464DE35CAB}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{D3F2B640-155A-470C-8C53-28570737A067}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{D5A08749-06D0-48B1-8A37-6931611456A4}: [NameServer]76.73.7.75,107.6.133.7
FireFox:
========
FF ProfilePath: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default
FF Homepage: https://login.yahoo.com/config/login_verify2?.intl=de&.src=ym
FF Keyword.URL: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p14_serp_ff_de_display?ie=UTF8&tagbase=bds-p14&tag=bds-p14-serp-de-ff-21&tbrId=v1_abb-channel-14_b53f9463d52d4b7a94bf69e8d387c953_16_37_20130720_DE_ff_ab_&query=
FF NetworkProxy: "autoconfig_url", "hxxp://proxy.charite.de/"
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=10.15.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\searchplugins\amazon.xml
FF Extension: No Name - C:\Users\schleppi\AppData\Roaming\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
FF Extension: No Name - C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\Extensions\75c9b989-a6e6-4455-971f-45304161eb23@02648b91-49b2-4d7f-99ef-7e959a8e6505.com
FF Extension: Ghostery - C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\Extensions\firefox@ghostery.com
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Plus-HD-2.5) - C:\Users\schleppi\AppData\Local\Google\Chrome\User Data\Default\Extensions\iefogiieekeeeeaiklglonbockmhmkgd\1.23.8_0
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx
==================== Services (Whitelisted) =================
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580232 2013-04-25] (WiseCleaner.com)
==================== Drivers (Whitelisted) ====================
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-27] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-27] (Windows (R) 2003 DDK 3790 provider)
S3 clwvd; system32\DRIVERS\clwvd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-29 13:02 - 2013-07-29 13:02 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-29 13:00 - 2013-07-29 13:01 - 00003743 _____ C:\Users\schleppi\Desktop\FSS.txt
2013-07-29 13:00 - 2013-07-29 12:57 - 02347384 _____ (ESET) C:\Users\schleppi\Desktop\esetsmartinstaller_enu.exe
2013-07-29 13:00 - 2013-07-29 12:57 - 00891098 _____ C:\Users\schleppi\Desktop\SecurityCheck.exe
2013-07-29 13:00 - 2013-07-29 12:56 - 00357145 _____ (Farbar) C:\Users\schleppi\Desktop\FSS.exe
2013-07-29 12:50 - 2013-07-29 12:50 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\DigitalSite
2013-07-29 08:07 - 2013-07-29 09:00 - 00002494 _____ C:\windows\WindowsUpdate.log
2013-07-29 08:05 - 2013-07-29 08:58 - 00000112 _____ C:\windows\setupact.log
2013-07-29 08:05 - 2013-07-29 08:05 - 00000574 _____ C:\windows\PFRO.log
2013-07-29 08:05 - 2013-07-29 08:05 - 00000000 _____ C:\windows\setuperr.log
2013-07-28 19:11 - 2013-07-29 08:05 - 00000428 _____ C:\windows\Tasks\Wise Care 365.job
2013-07-28 19:11 - 2013-07-29 08:05 - 00000408 _____ C:\windows\Tasks\Wise Turbo Checker.job
2013-07-28 19:11 - 2013-07-28 19:11 - 00003224 _____ C:\windows\System32\Tasks\Wise Turbo Checker
2013-07-28 19:11 - 2013-07-28 19:11 - 00002860 _____ C:\windows\System32\Tasks\Wise Care 365
2013-07-28 18:58 - 2013-07-29 08:59 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Wise Care 365
2013-07-28 18:57 - 2013-07-28 18:57 - 00001120 _____ C:\Users\Public\Desktop\Wise Care 365.lnk
2013-07-28 18:30 - 2013-07-28 18:30 - 00000000 ____D C:\windows\ERUNT
2013-07-28 18:24 - 2013-07-28 18:24 - 00046379 _____ C:\AdwCleaner[S1].txt
2013-07-28 18:21 - 2013-07-28 18:21 - 00561198 _____ (Oleg N. Scherbakov) C:\Users\schleppi\Desktop\JRT.exe
2013-07-28 18:19 - 2013-07-28 18:19 - 00666633 _____ C:\Users\schleppi\Desktop\adwcleaner.exe
2013-07-28 17:03 - 2013-07-29 09:00 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-28 10:16 - 2013-07-28 10:16 - 00072575 _____ C:\ComboFix.txt
2013-07-28 09:45 - 2013-07-28 10:16 - 00000000 ____D C:\Qoobox
2013-07-28 09:45 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-07-28 09:45 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-07-28 09:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-07-28 09:44 - 2013-07-28 09:57 - 00000000 ____D C:\windows\erdnt
2013-07-28 09:43 - 2013-07-29 07:40 - 00001836 _____ C:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job
2013-07-28 09:43 - 2013-07-29 07:35 - 00001910 _____ C:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job
2013-07-28 09:43 - 2013-07-29 07:35 - 00001204 _____ C:\windows\Tasks\Plus-HD-2.5-codedownloader.job
2013-07-28 09:43 - 2013-07-29 07:35 - 00001200 _____ C:\windows\Tasks\Plus-HD-2.5-updater.job
2013-07-28 09:43 - 2013-07-29 07:35 - 00001104 _____ C:\windows\Tasks\Plus-HD-2.5-enabler.job
2013-07-28 09:43 - 2013-07-28 09:43 - 00004234 _____ C:\windows\System32\Tasks\Plus-HD-2.5-codedownloader
2013-07-28 09:43 - 2013-07-28 09:43 - 00004230 _____ C:\windows\System32\Tasks\Plus-HD-2.5-updater
2013-07-28 09:43 - 2013-07-28 09:43 - 00004134 _____ C:\windows\System32\Tasks\Plus-HD-2.5-enabler
2013-07-28 09:43 - 2013-07-28 09:43 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.5
2013-07-28 09:42 - 2013-07-28 18:29 - 00003398 _____ C:\windows\System32\Tasks\BrowseForTheCauseUpdate
2013-07-28 09:42 - 2013-07-28 09:42 - 00001236 _____ C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Users\schleppi\AppData\Local\emaze
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Program Files (x86)\BrowseForTheCause
2013-07-27 23:52 - 2013-07-28 20:17 - 00000000 ____D C:\Users\schleppi\Desktop\Desctop
2013-07-27 23:42 - 2013-07-27 23:42 - 01780815 _____ (Farbar) C:\Users\schleppi\Desktop\FRST64.exe
2013-07-27 23:42 - 2013-07-27 23:42 - 00000000 ____D C:\FRST
2013-07-19 22:43 - 2013-04-10 11:09 - 00849992 _____ (Realtek ) C:\windows\system32\Drivers\Rt64win7.sys
2013-07-19 22:43 - 2013-04-10 11:09 - 00073800 _____ (Realtek Semiconductor Corporation) C:\windows\system32\RtNicProp64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 27781920 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 25256224 _____ (NVIDIA Corporation) C:\windows\system32\nvcompiler.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 21102368 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 17560352 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcompiler.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 15144928 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 11235104 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2013-07-19 22:39 - 2013-06-21 05:06 - 09239344 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 07687592 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 07641832 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 06324360 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02953504 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02777888 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02363680 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvenc.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02002720 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvenc.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 01832224 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6432049.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 01511712 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6432049.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00572704 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00570656 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00467232 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00465184 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2013-07-19 22:39 - 2013-02-24 22:27 - 00194848 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvhda64v.sys
2013-07-19 22:39 - 2013-02-24 22:27 - 00031520 _____ (NVIDIA Corporation) C:\windows\system32\nvhdap64.dll
2013-07-19 22:39 - 2013-01-29 01:35 - 01510176 _____ (NVIDIA Corporation) C:\windows\system32\nvhdagenco6420103.dll
2013-07-19 22:36 - 2013-07-29 08:04 - 00000302 _____ C:\windows\Tasks\Driver Booster Startup.job
2013-07-19 22:36 - 2013-07-19 22:36 - 00003222 _____ C:\windows\System32\Tasks\Driver Booster Scan
2013-07-19 22:36 - 2013-07-19 22:36 - 00003220 _____ C:\windows\System32\Tasks\Driver Booster Update
2013-07-19 22:36 - 2013-07-19 22:36 - 00002582 _____ C:\windows\System32\Tasks\Driver Booster Startup
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\ProgramData\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Program Files (x86)\IObit
2013-07-11 07:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-07-11 07:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-07-11 07:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 07:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-07-11 07:05 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-07-11 07:05 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-07-11 07:04 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-07-11 07:04 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-07-11 07:04 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-07-10 15:26 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-07-10 15:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2013-07-10 15:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2013-07-10 15:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-07-10 15:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-07-10 15:26 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2013-07-10 15:26 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
==================== One Month Modified Files and Folders =======
2013-07-29 13:02 - 2013-07-29 13:02 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-29 13:01 - 2013-07-29 13:00 - 00003743 _____ C:\Users\schleppi\Desktop\FSS.txt
2013-07-29 12:57 - 2013-07-29 13:00 - 02347384 _____ (ESET) C:\Users\schleppi\Desktop\esetsmartinstaller_enu.exe
2013-07-29 12:57 - 2013-07-29 13:00 - 00891098 _____ C:\Users\schleppi\Desktop\SecurityCheck.exe
2013-07-29 12:56 - 2013-07-29 13:00 - 00357145 _____ (Farbar) C:\Users\schleppi\Desktop\FSS.exe
2013-07-29 12:55 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF
2013-07-29 12:50 - 2013-07-29 12:50 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\DigitalSite
2013-07-29 12:50 - 2011-07-28 21:05 - 00643866 _____ C:\windows\system32\perfh007.dat
2013-07-29 12:50 - 2011-07-28 21:05 - 00126394 _____ C:\windows\system32\perfc007.dat
2013-07-29 12:50 - 2009-07-14 07:13 - 01472002 _____ C:\windows\system32\PerfStringBackup.INI
2013-07-29 09:05 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-29 09:05 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-29 09:00 - 2013-07-29 08:07 - 00002494 _____ C:\windows\WindowsUpdate.log
2013-07-29 09:00 - 2013-07-28 17:03 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-29 08:59 - 2013-07-28 18:58 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Wise Care 365
2013-07-29 08:59 - 2012-02-10 17:13 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Dropbox
2013-07-29 08:58 - 2013-07-29 08:05 - 00000112 _____ C:\windows\setupact.log
2013-07-29 08:58 - 2009-07-14 07:08 - 00032596 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-07-29 08:58 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-07-29 08:39 - 2011-10-20 16:03 - 00000000 ____D C:\ProgramData\MFAData
2013-07-29 08:05 - 2013-07-29 08:05 - 00000574 _____ C:\windows\PFRO.log
2013-07-29 08:05 - 2013-07-29 08:05 - 00000000 _____ C:\windows\setuperr.log
2013-07-29 08:05 - 2013-07-28 19:11 - 00000428 _____ C:\windows\Tasks\Wise Care 365.job
2013-07-29 08:05 - 2013-07-28 19:11 - 00000408 _____ C:\windows\Tasks\Wise Turbo Checker.job
2013-07-29 08:04 - 2013-07-19 22:36 - 00000302 _____ C:\windows\Tasks\Driver Booster Startup.job
2013-07-29 07:40 - 2013-07-28 09:43 - 00001836 _____ C:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job
2013-07-29 07:35 - 2013-07-28 09:43 - 00001910 _____ C:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job
2013-07-29 07:35 - 2013-07-28 09:43 - 00001204 _____ C:\windows\Tasks\Plus-HD-2.5-codedownloader.job
2013-07-29 07:35 - 2013-07-28 09:43 - 00001200 _____ C:\windows\Tasks\Plus-HD-2.5-updater.job
2013-07-29 07:35 - 2013-07-28 09:43 - 00001104 _____ C:\windows\Tasks\Plus-HD-2.5-enabler.job
2013-07-29 07:35 - 2012-08-30 19:27 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-07-29 07:35 - 2012-08-26 13:12 - 00001114 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-28 20:17 - 2013-07-27 23:52 - 00000000 ____D C:\Users\schleppi\Desktop\Desctop
2013-07-28 20:08 - 2012-04-02 18:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Sunbird
2013-07-28 19:11 - 2013-07-28 19:11 - 00003224 _____ C:\windows\System32\Tasks\Wise Turbo Checker
2013-07-28 19:11 - 2013-07-28 19:11 - 00002860 _____ C:\windows\System32\Tasks\Wise Care 365
2013-07-28 19:11 - 2012-02-10 17:09 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Azureus
2013-07-28 19:01 - 2012-11-25 11:14 - 00000000 ____D C:\Program Files (x86)\Wise
2013-07-28 19:00 - 2012-02-10 18:59 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-07-28 18:57 - 2013-07-28 18:57 - 00001120 _____ C:\Users\Public\Desktop\Wise Care 365.lnk
2013-07-28 18:33 - 2012-02-10 19:05 - 00000000 ___RD C:\Users\schleppi\Dropbox
2013-07-28 18:33 - 2011-10-20 15:49 - 00000000 ___RD C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-28 18:30 - 2013-07-28 18:30 - 00000000 ____D C:\windows\ERUNT
2013-07-28 18:29 - 2013-07-28 09:42 - 00003398 _____ C:\windows\System32\Tasks\BrowseForTheCauseUpdate
2013-07-28 18:27 - 2012-08-26 13:12 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-28 18:25 - 2012-02-15 09:09 - 00079672 _____ (AVG Technologies CZ, s.r.o.) C:\windows\system32\Drivers\AFD.SYS
2013-07-28 18:25 - 2009-07-14 02:10 - 00079672 _____ (AVG Technologies CZ, s.r.o.) C:\windows\system32\Drivers\WS2IFSL.SYS
2013-07-28 18:24 - 2013-07-28 18:24 - 00046379 _____ C:\AdwCleaner[S1].txt
2013-07-28 18:21 - 2013-07-28 18:21 - 00561198 _____ (Oleg N. Scherbakov) C:\Users\schleppi\Desktop\JRT.exe
2013-07-28 18:19 - 2013-07-28 18:19 - 00666633 _____ C:\Users\schleppi\Desktop\adwcleaner.exe
2013-07-28 11:13 - 2013-06-16 16:56 - 00003954 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{1534DA73-4149-4D86-BC64-A5F303CCEF9E}
2013-07-28 10:16 - 2013-07-28 10:16 - 00072575 _____ C:\ComboFix.txt
2013-07-28 10:16 - 2013-07-28 09:45 - 00000000 ____D C:\Qoobox
2013-07-28 10:16 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-28 10:16 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-28 09:57 - 2013-07-28 09:44 - 00000000 ____D C:\windows\erdnt
2013-07-28 09:56 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-07-28 09:43 - 2013-07-28 09:43 - 00004234 _____ C:\windows\System32\Tasks\Plus-HD-2.5-codedownloader
2013-07-28 09:43 - 2013-07-28 09:43 - 00004230 _____ C:\windows\System32\Tasks\Plus-HD-2.5-updater
2013-07-28 09:43 - 2013-07-28 09:43 - 00004134 _____ C:\windows\System32\Tasks\Plus-HD-2.5-enabler
2013-07-28 09:43 - 2013-07-28 09:43 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.5
2013-07-28 09:42 - 2013-07-28 09:42 - 00001236 _____ C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Users\schleppi\AppData\Local\emaze
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Program Files (x86)\BrowseForTheCause
2013-07-27 23:42 - 2013-07-27 23:42 - 01780815 _____ (Farbar) C:\Users\schleppi\Desktop\FRST64.exe
2013-07-27 23:42 - 2013-07-27 23:42 - 00000000 ____D C:\FRST
2013-07-22 18:40 - 2013-02-28 19:41 - 00000472 _____ C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job
2013-07-19 22:43 - 2011-07-28 06:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-19 22:41 - 2011-07-28 05:36 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-07-19 22:36 - 2013-07-19 22:36 - 00003222 _____ C:\windows\System32\Tasks\Driver Booster Scan
2013-07-19 22:36 - 2013-07-19 22:36 - 00003220 _____ C:\windows\System32\Tasks\Driver Booster Update
2013-07-19 22:36 - 2013-07-19 22:36 - 00002582 _____ C:\windows\System32\Tasks\Driver Booster Startup
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\ProgramData\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Program Files (x86)\IObit
2013-07-15 22:06 - 2012-07-14 20:30 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\vlc
2013-07-13 16:27 - 2012-08-26 13:12 - 00004110 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 16:27 - 2012-08-26 13:12 - 00003858 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 23:17 - 2011-02-11 21:57 - 00000000 ____D C:\windows\Panther
2013-07-11 19:40 - 2012-08-30 19:27 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-07-11 19:39 - 2012-08-30 19:22 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 19:39 - 2012-08-30 19:22 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 19:35 - 2009-07-14 06:45 - 00462168 _____ C:\windows\system32\FNTCACHE.DAT
2013-07-11 07:23 - 2011-07-28 20:57 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 07:23 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 07:07 - 2012-02-21 13:31 - 78185248 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-07-03 10:12 - 2013-04-12 00:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-28 20:37
==================== End Of Log ============================
--- --- --- FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-07-2013 04
Ran by schleppi at 2013-07-29 13:09:07
Running from C:\Users\schleppi\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
„Windows Live Essentials“ (x32 Version: 15.4.3502.0922)
„Windows Live Mail“ (x32 Version: 15.4.3502.0922)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Atheros Client Installation Program (x32 Version: 9.0)
AVG 2013 (Version: 13.0.3209)
AVG 2013 (Version: 13.0.3349)
AVG 2013 (Version: 2013.0.3349)
AVG PC Tuneup 2011 (x32)
BatteryLifeExtender (x32 Version: 1.0.11)
Broadcom 802.11 Network Adapter (Version: 5.60.48.55)
Brother MFL-Pro Suite MFC-255CW (x32 Version: 1.0.1.0)
Browse for the Cause (x32)
CCleaner (Version: 3.21)
D3DX10 (x32 Version: 15.4.2368.0902)
DBView Element 2005 (x32 Version: 4.0)
dows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (Version: 05/31/2012 7.1.2.0)
Driver Booster (x32 Version: Beta 2.0)
Dropbox (HKCU Version: 2.0.22)
Easy Content Share (x32 Version: 1.0)
Easy Display Manager (x32 Version: 3.2)
Easy Migration (x32 Version: 1.0)
Easy Network Manager (x32 Version: 4.4.7)
Easy SpeedUp Manager (x32 Version: 2.1.1.1)
EasyBatteryManager (x32 Version: 4.0.0.4)
EasyFileShare (x32 Version: 1.0.12)
ETDWare PS/2-X64 10.7.14.12_WHQL (Version: 10.7.14.12)
Fast Start (x32 Version: 2.2.0.1)
Fishdom 2 Deluxe (x32)
Free Studio version 5.3.3 (x32)
Free YouTube to MP3 Converter version 3.11.35.1031 (x32 Version: 3.11.35.1031)
FreeMind (x32 Version: 0.9.0_RC_10)
Google Update Helper (x32 Version: 1.3.21.153)
Intel PROSet Wireless (x32)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) PROSet/Wireless WiFi Software (Version: 14.01.1000)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.5.1001)
Java Auto Updater (x32 Version: 2.1.9.0)
Java(TM) 6 Update 33 (x32 Version: 6.0.330)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1)
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1)
Movie Color Enhancer (x32 Version: 1.0)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Multimedia POP (x32 Version: 1.0)
Nokia Connectivity Cable Driver (x32 Version: 7.1.172.0)
Nokia Suite (x32 Version: 3.8.30.0)
NVIDIA Install Application (Version: 2.1002.124.810)
NVIDIA Systemsteuerung 320.49 (Version: 320.49)
OpenOffice.org 3.4 (x32 Version: 3.4.9590)
PC Connectivity Solution (x32 Version: 12.0.109.0)
PDF24 Creator 5.2.0 (x32)
PDF-Viewer (Version: 2.5.210.0)
PhoneShare (x32 Version: 9.1.4)
Plus-HD-2.5 (x32 Version: 1.27.153.5)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
Realtek Ethernet Controller Driver (x32 Version: 7.40.126.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6400)
Samsung AnyWeb Print (x32 Version: 2.0.67.1)
Samsung Printer Live Update (x32)
Samsung Recovery Solution 5 (x32 Version: 5.0.1.0)
Samsung Support Center (x32 Version: 1.1.24)
Samsung Universal Print Driver (x32 Version: 2.02.05.00:27)
Samsung Universal Scan Driver (x32 Version: 1.2.5.0)
Samsung Update Plus (x32 Version: 3.0.0.17)
Skype™ 4.2 (x32 Version: 4.2.169)
Synchredible (x32 Version: 4.0.0.5)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.0.82.0)
Update for Zip Opener (HKCU)
User Guide (x32 Version: 1.6)
Visual Studio 2008 x64 Redistributables (x32 Version: 10.0.0.2)
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1)
VLC media player 2.0.2 (x32 Version: 2.0.2)
Vuze (x32 Version: 5.0.0.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Pošta (x32 Version: 15.4.3502.0922)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Live 메일 (x32 Version: 15.4.3502.0922)
Windows Live 필수 패키지 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3508.1109)
Windows Live 软件包 (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
WinRAR 4.00 (64-Bit) (Version: 4.00.0)
Wise Care 365 version 2.66 (x32 Version: 2.66)
WordCaptureX Pro (x32 Version: 4.0.0)
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)
Почта Windows Live (x32 Version: 15.4.3502.0922)
بريد Windows Live (x32 Version: 15.4.3502.0922)
==================== Restore Points =========================
28-06-2013 10:44:54 Geplanter Prüfpunkt
08-07-2013 20:37:17 Geplanter Prüfpunkt
11-07-2013 04:43:02 Windows Update
12-07-2013 05:15:25 Windows Update
12-07-2013 20:36:16 Removed Versandhelfer
19-07-2013 20:38:57 Driver Booster : NVIDIA GeForce GT 520M
28-07-2013 07:45:18 ComboFix created restore point
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-07-28 09:56 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {025A0E68-F036-467F-9553-F2C8F9FD91BA} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2011-02-14] (SEC)
Task: {062A5F82-BAFF-4AE1-AEA8-9EBB819E6561} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: {07B13C30-5A10-4756-B40E-D04632AF8EC3} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)
Task: {07EF1EEC-8A79-4303-864E-7520287E8FDB} - System32\Tasks\Driver Booster Update => C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe [2013-07-17] (IObit)
Task: {0A91FBA5-96FE-4196-972D-E44CCC71A768} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {0AA78EFD-EA4E-4C03-9691-5855AE596C69} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2010-08-27] (Samsung Electronics)
Task: {0FADA576-25F9-40F3-A9FD-5F00088303AA} - System32\Tasks\Driver Booster Startup => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2013-07-17] (IObit)
Task: {11D935D9-676C-44E4-BB96-FAA163882110} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {250B4C9C-B47D-4B0D-A4D5-F7DF6A12DA90} - System32\Tasks\Synchredible-schleppi => C:\Program Files (x86)\ASCOMP Software\Synchredible\synchredible.exe [2013-01-31] (ASCOMP Software GmbH)
Task: {3BE0B2FB-3DB8-4B06-A799-77B71757DBAF} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2010-02-10] (Samsung Electronics Co., Ltd.)
Task: {4A0789F8-DADB-4675-83DE-5319E88315E9} - System32\Tasks\Plus-HD-2.5-codedownloader => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-codedownloader.exe [2013-07-28] (Plus HD)
Task: {4C13C545-CC5D-4E5D-9C50-969215675D1D} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {5A6CCA2E-0505-4408-AC4C-D30F0CD55D4C} - System32\Tasks\Wise Care 365 => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe [2013-04-26] (WiseCleaner.com)
Task: {5F956975-F718-4BD1-95FF-0D56C37E7119} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {703E4EC8-B7F6-4A0D-AB25-6269B4059E61} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {763A2B7B-6FFC-4568-8D0E-4F14CD53584A} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {7BD3816D-8E54-4926-9F66-7AD5BD0F11F8} - System32\Tasks\Plus-HD-2.5-firefoxinstaller => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-firefoxinstaller.exe [2013-07-28] (Plus HD)
Task: {810BAD61-35F0-4982-BD9A-A584CA4AAA15} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2027592733-4161651481-1790285415-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe No File
Task: {838FBF08-95EB-45D6-AD62-0CD3E5ADC9C9} - System32\Tasks\Plus-HD-2.5-enabler => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-enabler.exe [2013-07-28] (Plus HD)
Task: {8B62AF8A-B95D-44FB-839A-8CF14A37C123} - System32\Tasks\EasyPartitionManager => C:\Windows\MSetup\BA46-12225A02\EPM.exe No File
Task: {8C79300E-DF30-476A-8E90-4CEDB652CFCA} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {8EB1AA34-6AE2-4BA9-83B5-9923484245A8} - System32\Tasks\Wise Turbo Checker => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe [2013-05-23] (WiseCleaner.COM)
Task: {9793C63F-5F0D-4260-B559-D716A571374F} - System32\Tasks\Driver Booster Scan => C:\Program Files (x86)\IObit\Driver Booster\Scheduler.exe [2013-07-17] (IObit)
Task: {A2B37064-CE1B-46E8-B4D6-E597FE822F9F} - System32\Tasks\Plus-HD-2.5-updater => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-updater.exe [2013-07-28] (Plus HD)
Task: {AC8B457C-8C99-4BD3-8674-C65D84069CAB} - System32\Tasks\BrowseForTheCauseUpdate => C:\Program Files (x86)\BrowseForTheCause\BrowseForTheCause.exe [2013-07-28] ()
Task: {BEF11CF5-B7C0-4BA1-B39D-E97B6EA2D365} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.)
Task: {C00E7702-3342-4E08-877B-66882DB067B6} - System32\Tasks\Plus-HD-2.5-chromeinstaller => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-chromeinstaller.exe [2013-07-28] (Plus HD)
Task: {C0B7810F-C442-42FF-B400-70ABDCC556BF} - System32\Tasks\User_Feed_Synchronization-{1534DA73-4149-4D86-BC64-A5F303CCEF9E} => C:\windows\system32\msfeedssync.exe [2013-02-27] (Microsoft Corporation)
Task: {C0D579B1-FCAF-4EEC-8B15-6A547768DEB6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: {C7FE6C5C-69FF-4865-8F05-375B1515BEA9} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-02-07] (SAMSUNG Electronics)
Task: {D35BCFE9-91F2-4A27-B486-85CE4E3265F0} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2027592733-4161651481-1790285415-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe No File
Task: {E32F14BE-2FCE-44F8-96AA-DA303EDDA635} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe No File
Task: {E3E3A0CC-B5BC-447F-8972-573EDDA928B9} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-11] (Adobe Systems Incorporated)
Task: {F008F492-3511-42B3-AB07-6FC0437EF6E7} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] ()
Task: {F090C633-431A-4005-B2B7-EBDE3566F57B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Driver Booster Startup.job => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-chromeinstaller.exe
Task: C:\windows\Tasks\Plus-HD-2.5-codedownloader.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-codedownloader.exe
Task: C:\windows\Tasks\Plus-HD-2.5-enabler.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-enabler.exe
Task: C:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-firefoxinstaller.exe
Task: C:\windows\Tasks\Plus-HD-2.5-updater.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-updater.exe
Task: C:\windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe
Task: C:\windows\Tasks\Wise Care 365.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
Task: C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe
Task: C:\windows\Tasks\Wise Turbo Checker.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe
==================== Faulty Device Manager Devices =============
Name: HTTP
Description: HTTP
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: HTTP
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/29/2013 01:02:18 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (07/29/2013 01:02:14 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (07/29/2013 01:00:22 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (07/29/2013 00:59:50 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (07/29/2013 09:00:11 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2013 08:58:39 AM) (Source: Schedule) (User: )
Description: Schedule error: 10050Initialize call failed, bailing out
Error: (07/29/2013 08:52:38 AM) (Source: Schedule) (User: )
Description: Schedule error: 10050Initialize call failed, bailing out
Error: (07/29/2013 08:08:55 AM) (Source: Brother BrLog) (User: )
Description: CTLCN BrtCTLCN: [2013/07/29 08:08:55.504]: [00001160]: brccMCtl.exe: ErrorMessage.cpp (0241) : -------- error code is [0x03031f04].
Error: (07/29/2013 08:08:55 AM) (Source: Brother BrLog) (User: )
Description: CTLCN BrtCTLCN: [2013/07/29 08:08:55.485]: [00001160]: brccFCtl.dll: ### ERROR ### Scanning-Image Failed! lErrCode = 0x3031F04
Error: (07/29/2013 08:08:55 AM) (Source: Brother BrLog) (User: )
Description: TWN BrtTWN: [2013/07/29 08:08:55.467]: [00001160]:
##### Device Open ERROR! #####
System errors:
=============
Error: (07/29/2013 01:03:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HTTP" wurde aufgrund folgenden Fehlers nicht gestartet:
%%22
Error: (07/29/2013 01:01:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147014846.
Error: (07/29/2013 01:01:02 PM) (Source: Microsoft-Windows-Bits-Client) (User: NT-AUTORITÄT)
Description: Fehler beim Starten des BITS-Dienstes. Fehler: 2147952450.
Error: (07/29/2013 00:51:43 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" ist vom Dienst "DHCP-Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1075
Error: (07/29/2013 00:51:43 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DHCP-Client" ist von folgendem Dienst abhängig: Afd. Dieser Dienst ist eventuell nicht installiert.
Error: (07/29/2013 00:51:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%10050
Error: (07/29/2013 00:51:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Server" ist vom Dienst "Server-SMB-Treiber 1.xxx" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (07/29/2013 00:51:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Arbeitsstationsdienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (07/29/2013 00:51:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Server-SMB-Treiber 1.xxx" ist vom Dienst "Server-SMB-Treiber 2.xxx" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (07/29/2013 00:51:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Arbeitsstationsdienst" ist vom Dienst "SMB 2.0-Miniredirector" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Microsoft Office Sessions:
=========================
Error: (07/29/2013 01:02:18 PM) (Source: SideBySide)(User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\schleppi\Desktop\esetsmartinstaller_enu.exe
Error: (07/29/2013 01:02:14 PM) (Source: SideBySide)(User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\schleppi\Desktop\esetsmartinstaller_enu.exe
Error: (07/29/2013 01:00:22 PM) (Source: SideBySide)(User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\schleppi\Desktop\esetsmartinstaller_enu.exe
Error: (07/29/2013 00:59:50 PM) (Source: SideBySide)(User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestF:\esetsmartinstaller_enu.exe
Error: (07/29/2013 09:00:11 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2013 08:58:39 AM) (Source: Schedule)(User: )
Description: Schedule error: 10050Initialize call failed, bailing out
Error: (07/29/2013 08:52:38 AM) (Source: Schedule)(User: )
Description: Schedule error: 10050Initialize call failed, bailing out
Error: (07/29/2013 08:08:55 AM) (Source: Brother BrLog)(User: )
Description: CTLCNBrtCTLCN: [2013/07/29 08:08:55.504]: [00001160]: brccMCtl.exe: ErrorMessage.cpp (0241) : -------- error code is [0x03031f04].
Error: (07/29/2013 08:08:55 AM) (Source: Brother BrLog)(User: )
Description: CTLCNBrtCTLCN: [2013/07/29 08:08:55.485]: [00001160]: brccFCtl.dll: ### ERROR ### Scanning-Image Failed! lErrCode = 0x3031F04
Error: (07/29/2013 08:08:55 AM) (Source: Brother BrLog)(User: )
Description: TWNBrtTWN: [2013/07/29 08:08:55.467]: [00001160]:
##### Device Open ERROR! #####
CodeIntegrity Errors:
===================================
Date: 2013-07-28 09:55:14.706
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\setup\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-28 09:55:14.579
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\setup\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 28%
Total physical RAM: 8171.55 MB
Available physical RAM: 5866.34 MB
Total Pagefile: 16341.28 MB
Available Pagefile: 14276.83 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:230 GB) (Free:138.48 GB) NTFS (Disk=0 Partition=2)
Drive d: () (Fixed) (Total:342.28 GB) (Free:157.2 GB) NTFS (Disk=0 Partition=4)
Drive f: (DATEN!) (Removable) (Total:3.73 GB) (Free:3.49 GB) FAT32 (Disk=1 Partition=1)
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 596 GB) (Disk ID: 23C4F13B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=230 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=342 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=24 GB) - (Type=27)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 4 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=4 GB) - (Type=0C)
==================== End Of Log ============================
Den Esetsmart konnte ich noch nicht machen, der möchte zum arbeiten gern ins Internet. Wenn da jetzt so viele Probleme auftauchen, macht es da sinn den Rechner zurück zu setzten? oder ist der Trojaner dann trotzdem noch da/Probleme irreversibel? danke dir für die viele Mühe. Geändert von troja12 (29.07.2013 um 12:24 Uhr) |
|
29.07.2013, 15:19
| #14 |
| /// the machine /// TB-Ausbilder | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe Der ist dann immer noch da Downloade dir bitte Windows Repair (All In One) von hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.07.2013, 18:41
| #15 |
| | Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe Hi Schrauber, leider noch keine Veränderung.  Kein Internet und kein Drucker installierbar/vorhanden. die aktuelle Frst doku lege ich dir bei. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-07-2013 04
Ran by schleppi (administrator) on 29-07-2013 18:00:33
Running from C:\Users\schleppi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVG Technologies CZ, s.r.o.) C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Dropbox, Inc.) C:\Users\schleppi\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
() C:\Program Files (x86)\BrowseForTheCause\BrowseForTheCause.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2817872 2012-04-25] (ELAN Microelectronics Corp.)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [BrowseForTheCause] - C:\Program Files (x86)\BrowseForTheCause\BrowseForTheCause.exe [3744104 2013-07-28] ()
HKU\Default\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
HKU\Default User\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-21] (Microsoft Corporation)
Startup: C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\schleppi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Samsung BHO Class - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll No File
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{37A550B1-E653-433A-9A90-446D9FB3494F}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{71DEE413-63EB-4D97-B36C-806F379CE74F}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{930E9C9E-AC09-4B4F-9693-F1464DE35CAB}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{D3F2B640-155A-470C-8C53-28570737A067}: [NameServer]76.73.7.75,107.6.133.7
Tcpip\..\Interfaces\{D5A08749-06D0-48B1-8A37-6931611456A4}: [NameServer]76.73.7.75,107.6.133.7
FireFox:
========
FF ProfilePath: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default
FF Homepage: https://login.yahoo.com/config/login_verify2?.intl=de&.src=ym
FF Keyword.URL: hxxp://www.amazon.de/gp/bit/amazonserp/ref=bit_bds-p14_serp_ff_de_display?ie=UTF8&tagbase=bds-p14&tag=bds-p14-serp-de-ff-21&tbrId=v1_abb-channel-14_b53f9463d52d4b7a94bf69e8d387c953_16_37_20130720_DE_ff_ab_&query=
FF NetworkProxy: "autoconfig_url", "hxxp://proxy.charite.de/"
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=10.15.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\searchplugins\amazon.xml
FF Extension: No Name - C:\Users\schleppi\AppData\Roaming\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
FF Extension: No Name - C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\Extensions\75c9b989-a6e6-4455-971f-45304161eb23@02648b91-49b2-4d7f-99ef-7e959a8e6505.com
FF Extension: Ghostery - C:\Users\schleppi\AppData\Roaming\Mozilla\Firefox\Profiles\ibh5e4as.default\Extensions\firefox@ghostery.com
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Plus-HD-2.5) - C:\Users\schleppi\AppData\Local\Google\Chrome\User Data\Default\Extensions\iefogiieekeeeeaiklglonbockmhmkgd\1.23.8_0
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx
==================== Services (Whitelisted) =================
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
==================== Drivers (Whitelisted) ====================
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-27] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-09-27] (Windows (R) 2003 DDK 3790 provider)
S3 clwvd; system32\DRIVERS\clwvd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-29 17:11 - 2013-07-29 17:11 - 00000207 _____ C:\windows\tweaking.com-regbackup-SCHLEPPI-PC-Microsoft-Windows-7-Home-Premium-(64-Bit).dat
2013-07-29 17:10 - 2013-07-29 17:10 - 00000000 ____D C:\RegBackup
2013-07-29 16:38 - 2013-07-29 16:38 - 00003288 ____N C:\bootsqm.dat
2013-07-29 16:31 - 2013-07-29 17:45 - 00181064 _____ (Sysinternals) C:\windows\PSEXESVC.EXE
2013-07-29 16:31 - 2013-07-29 16:31 - 00000000 ____D C:\Users\schleppi\Desktop\Tweaking.com - Windows Repair
2013-07-29 13:02 - 2013-07-29 13:02 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-29 13:00 - 2013-07-29 12:57 - 02347384 _____ (ESET) C:\Users\schleppi\Desktop\esetsmartinstaller_enu.exe
2013-07-29 13:00 - 2013-07-29 12:57 - 00891098 _____ C:\Users\schleppi\Desktop\SecurityCheck.exe
2013-07-29 13:00 - 2013-07-29 12:56 - 00357145 _____ (Farbar) C:\Users\schleppi\Desktop\FSS.exe
2013-07-29 12:50 - 2013-07-29 12:50 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\DigitalSite
2013-07-29 08:07 - 2013-07-29 17:50 - 00006265 _____ C:\windows\WindowsUpdate.log
2013-07-29 08:05 - 2013-07-29 17:46 - 00000924 _____ C:\windows\PFRO.log
2013-07-29 08:05 - 2013-07-29 17:46 - 00000280 _____ C:\windows\setupact.log
2013-07-29 08:05 - 2013-07-29 08:05 - 00000000 _____ C:\windows\setuperr.log
2013-07-28 19:11 - 2013-07-29 08:05 - 00000428 _____ C:\windows\Tasks\Wise Care 365.job
2013-07-28 19:11 - 2013-07-29 08:05 - 00000408 _____ C:\windows\Tasks\Wise Turbo Checker.job
2013-07-28 19:11 - 2013-07-28 19:11 - 00003224 _____ C:\windows\System32\Tasks\Wise Turbo Checker
2013-07-28 19:11 - 2013-07-28 19:11 - 00002860 _____ C:\windows\System32\Tasks\Wise Care 365
2013-07-28 18:30 - 2013-07-28 18:30 - 00000000 ____D C:\windows\ERUNT
2013-07-28 18:24 - 2013-07-28 18:24 - 00046379 _____ C:\AdwCleaner[S1].txt
2013-07-28 18:21 - 2013-07-28 18:21 - 00561198 _____ (Oleg N. Scherbakov) C:\Users\schleppi\Desktop\JRT.exe
2013-07-28 18:19 - 2013-07-28 18:19 - 00666633 _____ C:\Users\schleppi\Desktop\adwcleaner.exe
2013-07-28 10:16 - 2013-07-28 10:16 - 00072575 _____ C:\ComboFix.txt
2013-07-28 09:45 - 2013-07-28 10:16 - 00000000 ____D C:\Qoobox
2013-07-28 09:45 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-07-28 09:45 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-07-28 09:45 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-07-28 09:45 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-07-28 09:44 - 2013-07-28 09:57 - 00000000 ____D C:\windows\erdnt
2013-07-28 09:43 - 2013-07-29 07:40 - 00001836 _____ C:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job
2013-07-28 09:43 - 2013-07-29 07:35 - 00001910 _____ C:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job
2013-07-28 09:43 - 2013-07-29 07:35 - 00001204 _____ C:\windows\Tasks\Plus-HD-2.5-codedownloader.job
2013-07-28 09:43 - 2013-07-29 07:35 - 00001200 _____ C:\windows\Tasks\Plus-HD-2.5-updater.job
2013-07-28 09:43 - 2013-07-29 07:35 - 00001104 _____ C:\windows\Tasks\Plus-HD-2.5-enabler.job
2013-07-28 09:43 - 2013-07-28 09:43 - 00004234 _____ C:\windows\System32\Tasks\Plus-HD-2.5-codedownloader
2013-07-28 09:43 - 2013-07-28 09:43 - 00004230 _____ C:\windows\System32\Tasks\Plus-HD-2.5-updater
2013-07-28 09:43 - 2013-07-28 09:43 - 00004134 _____ C:\windows\System32\Tasks\Plus-HD-2.5-enabler
2013-07-28 09:43 - 2013-07-28 09:43 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.5
2013-07-28 09:42 - 2013-07-28 18:29 - 00003398 _____ C:\windows\System32\Tasks\BrowseForTheCauseUpdate
2013-07-28 09:42 - 2013-07-28 09:42 - 00001236 _____ C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Users\schleppi\AppData\Local\emaze
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Program Files (x86)\BrowseForTheCause
2013-07-27 23:52 - 2013-07-28 20:17 - 00000000 ____D C:\Users\schleppi\Desktop\Desctop
2013-07-27 23:42 - 2013-07-27 23:42 - 01780815 _____ (Farbar) C:\Users\schleppi\Desktop\FRST64.exe
2013-07-27 23:42 - 2013-07-27 23:42 - 00000000 ____D C:\FRST
2013-07-19 22:43 - 2013-04-10 11:09 - 00849992 _____ (Realtek ) C:\windows\system32\Drivers\Rt64win7.sys
2013-07-19 22:43 - 2013-04-10 11:09 - 00073800 _____ (Realtek Semiconductor Corporation) C:\windows\system32\RtNicProp64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 27781920 _____ (NVIDIA Corporation) C:\windows\system32\nvoglv64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 25256224 _____ (NVIDIA Corporation) C:\windows\system32\nvcompiler.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 21102368 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvoglv32.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 17560352 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcompiler.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 15144928 _____ (NVIDIA Corporation) C:\windows\system32\nvd3dumx.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 11235104 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvlddmkm.sys
2013-07-19 22:39 - 2013-06-21 05:06 - 09239344 _____ (NVIDIA Corporation) C:\windows\system32\nvcuda.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 07687592 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuda.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 07641832 _____ (NVIDIA Corporation) C:\windows\system32\nvopencl.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 06324360 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvopencl.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02953504 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvid.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02777888 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvid.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02363680 _____ (NVIDIA Corporation) C:\windows\system32\nvcuvenc.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 02002720 _____ (NVIDIA Corporation) C:\windows\SysWOW64\nvcuvenc.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 01832224 _____ (NVIDIA Corporation) C:\windows\system32\nvdispco6432049.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 01511712 _____ (NVIDIA Corporation) C:\windows\system32\nvdispgenco6432049.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00572704 _____ (NVIDIA Corporation) C:\windows\system32\NvFBC64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00570656 _____ (NVIDIA Corporation) C:\windows\system32\NvIFR64.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00467232 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvIFR.dll
2013-07-19 22:39 - 2013-06-21 05:06 - 00465184 _____ (NVIDIA Corporation) C:\windows\SysWOW64\NvFBC.dll
2013-07-19 22:39 - 2013-02-24 22:27 - 00194848 _____ (NVIDIA Corporation) C:\windows\system32\Drivers\nvhda64v.sys
2013-07-19 22:39 - 2013-02-24 22:27 - 00031520 _____ (NVIDIA Corporation) C:\windows\system32\nvhdap64.dll
2013-07-19 22:39 - 2013-01-29 01:35 - 01510176 _____ (NVIDIA Corporation) C:\windows\system32\nvhdagenco6420103.dll
2013-07-19 22:36 - 2013-07-29 08:04 - 00000302 _____ C:\windows\Tasks\Driver Booster Startup.job
2013-07-19 22:36 - 2013-07-19 22:36 - 00003222 _____ C:\windows\System32\Tasks\Driver Booster Scan
2013-07-19 22:36 - 2013-07-19 22:36 - 00003220 _____ C:\windows\System32\Tasks\Driver Booster Update
2013-07-19 22:36 - 2013-07-19 22:36 - 00002582 _____ C:\windows\System32\Tasks\Driver Booster Startup
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\ProgramData\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Program Files (x86)\IObit
2013-07-11 07:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-07-11 07:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-07-11 07:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-07-11 07:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-07-11 07:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-07-11 07:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-07-11 07:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 07:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-07-11 07:05 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-07-11 07:05 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-07-11 07:04 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-07-11 07:04 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-07-11 07:04 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-07-10 15:26 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-07-10 15:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2013-07-10 15:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2013-07-10 15:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-07-10 15:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-07-10 15:26 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2013-07-10 15:26 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
==================== One Month Modified Files and Folders =======
2013-07-29 18:00 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF
2013-07-29 17:56 - 2012-02-10 17:13 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Dropbox
2013-07-29 17:53 - 2011-07-28 21:05 - 00643866 _____ C:\windows\system32\perfh007.dat
2013-07-29 17:53 - 2011-07-28 21:05 - 00126394 _____ C:\windows\system32\perfc007.dat
2013-07-29 17:53 - 2009-07-14 07:13 - 01472002 _____ C:\windows\system32\PerfStringBackup.INI
2013-07-29 17:52 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-29 17:52 - 2009-07-14 06:45 - 00020992 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-29 17:50 - 2013-07-29 08:07 - 00006265 _____ C:\windows\WindowsUpdate.log
2013-07-29 17:50 - 2011-10-20 16:03 - 00000000 ____D C:\ProgramData\MFAData
2013-07-29 17:47 - 2009-07-14 06:45 - 00462168 _____ C:\windows\system32\FNTCACHE.DAT
2013-07-29 17:46 - 2013-07-29 08:05 - 00000924 _____ C:\windows\PFRO.log
2013-07-29 17:46 - 2013-07-29 08:05 - 00000280 _____ C:\windows\setupact.log
2013-07-29 17:46 - 2009-07-14 07:08 - 00032596 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-07-29 17:46 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-07-29 17:45 - 2013-07-29 16:31 - 00181064 _____ (Sysinternals) C:\windows\PSEXESVC.EXE
2013-07-29 17:44 - 2009-07-14 04:34 - 00000423 _____ C:\windows\win.ini
2013-07-29 17:11 - 2013-07-29 17:11 - 00000207 _____ C:\windows\tweaking.com-regbackup-SCHLEPPI-PC-Microsoft-Windows-7-Home-Premium-(64-Bit).dat
2013-07-29 17:10 - 2013-07-29 17:10 - 00000000 ____D C:\RegBackup
2013-07-29 16:38 - 2013-07-29 16:38 - 00003288 ____N C:\bootsqm.dat
2013-07-29 16:31 - 2013-07-29 16:31 - 00000000 ____D C:\Users\schleppi\Desktop\Tweaking.com - Windows Repair
2013-07-29 14:07 - 2012-11-25 11:14 - 00000000 ____D C:\Program Files (x86)\Wise
2013-07-29 13:02 - 2013-07-29 13:02 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-29 12:57 - 2013-07-29 13:00 - 02347384 _____ (ESET) C:\Users\schleppi\Desktop\esetsmartinstaller_enu.exe
2013-07-29 12:57 - 2013-07-29 13:00 - 00891098 _____ C:\Users\schleppi\Desktop\SecurityCheck.exe
2013-07-29 12:56 - 2013-07-29 13:00 - 00357145 _____ (Farbar) C:\Users\schleppi\Desktop\FSS.exe
2013-07-29 12:50 - 2013-07-29 12:50 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\DigitalSite
2013-07-29 08:05 - 2013-07-29 08:05 - 00000000 _____ C:\windows\setuperr.log
2013-07-29 08:05 - 2013-07-28 19:11 - 00000428 _____ C:\windows\Tasks\Wise Care 365.job
2013-07-29 08:05 - 2013-07-28 19:11 - 00000408 _____ C:\windows\Tasks\Wise Turbo Checker.job
2013-07-29 08:04 - 2013-07-19 22:36 - 00000302 _____ C:\windows\Tasks\Driver Booster Startup.job
2013-07-29 07:40 - 2013-07-28 09:43 - 00001836 _____ C:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job
2013-07-29 07:35 - 2013-07-28 09:43 - 00001910 _____ C:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job
2013-07-29 07:35 - 2013-07-28 09:43 - 00001204 _____ C:\windows\Tasks\Plus-HD-2.5-codedownloader.job
2013-07-29 07:35 - 2013-07-28 09:43 - 00001200 _____ C:\windows\Tasks\Plus-HD-2.5-updater.job
2013-07-29 07:35 - 2013-07-28 09:43 - 00001104 _____ C:\windows\Tasks\Plus-HD-2.5-enabler.job
2013-07-29 07:35 - 2012-08-30 19:27 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-07-29 07:35 - 2012-08-26 13:12 - 00001114 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-28 20:17 - 2013-07-27 23:52 - 00000000 ____D C:\Users\schleppi\Desktop\Desctop
2013-07-28 20:08 - 2012-04-02 18:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Sunbird
2013-07-28 19:11 - 2013-07-28 19:11 - 00003224 _____ C:\windows\System32\Tasks\Wise Turbo Checker
2013-07-28 19:11 - 2013-07-28 19:11 - 00002860 _____ C:\windows\System32\Tasks\Wise Care 365
2013-07-28 19:11 - 2012-02-10 17:09 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Azureus
2013-07-28 19:00 - 2012-02-10 18:59 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-07-28 18:33 - 2012-02-10 19:05 - 00000000 ___RD C:\Users\schleppi\Dropbox
2013-07-28 18:33 - 2011-10-20 15:49 - 00000000 ___RD C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-28 18:30 - 2013-07-28 18:30 - 00000000 ____D C:\windows\ERUNT
2013-07-28 18:29 - 2013-07-28 09:42 - 00003398 _____ C:\windows\System32\Tasks\BrowseForTheCauseUpdate
2013-07-28 18:27 - 2012-08-26 13:12 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-28 18:24 - 2013-07-28 18:24 - 00046379 _____ C:\AdwCleaner[S1].txt
2013-07-28 18:21 - 2013-07-28 18:21 - 00561198 _____ (Oleg N. Scherbakov) C:\Users\schleppi\Desktop\JRT.exe
2013-07-28 18:19 - 2013-07-28 18:19 - 00666633 _____ C:\Users\schleppi\Desktop\adwcleaner.exe
2013-07-28 11:13 - 2013-06-16 16:56 - 00003954 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{1534DA73-4149-4D86-BC64-A5F303CCEF9E}
2013-07-28 10:16 - 2013-07-28 10:16 - 00072575 _____ C:\ComboFix.txt
2013-07-28 10:16 - 2013-07-28 09:45 - 00000000 ____D C:\Qoobox
2013-07-28 10:16 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-28 10:16 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-28 09:57 - 2013-07-28 09:44 - 00000000 ____D C:\windows\erdnt
2013-07-28 09:56 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-07-28 09:43 - 2013-07-28 09:43 - 00004234 _____ C:\windows\System32\Tasks\Plus-HD-2.5-codedownloader
2013-07-28 09:43 - 2013-07-28 09:43 - 00004230 _____ C:\windows\System32\Tasks\Plus-HD-2.5-updater
2013-07-28 09:43 - 2013-07-28 09:43 - 00004134 _____ C:\windows\System32\Tasks\Plus-HD-2.5-enabler
2013-07-28 09:43 - 2013-07-28 09:43 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.5
2013-07-28 09:42 - 2013-07-28 09:42 - 00001236 _____ C:\Users\schleppi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Create Amazing Presentations.lnk
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Users\schleppi\AppData\Local\emaze
2013-07-28 09:42 - 2013-07-28 09:42 - 00000000 ____D C:\Program Files (x86)\BrowseForTheCause
2013-07-27 23:42 - 2013-07-27 23:42 - 01780815 _____ (Farbar) C:\Users\schleppi\Desktop\FRST64.exe
2013-07-27 23:42 - 2013-07-27 23:42 - 00000000 ____D C:\FRST
2013-07-22 18:40 - 2013-02-28 19:41 - 00000472 _____ C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job
2013-07-19 22:43 - 2011-07-28 06:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-19 22:41 - 2011-07-28 05:36 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-07-19 22:36 - 2013-07-19 22:36 - 00003222 _____ C:\windows\System32\Tasks\Driver Booster Scan
2013-07-19 22:36 - 2013-07-19 22:36 - 00003220 _____ C:\windows\System32\Tasks\Driver Booster Update
2013-07-19 22:36 - 2013-07-19 22:36 - 00002582 _____ C:\windows\System32\Tasks\Driver Booster Startup
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\ProgramData\IObit
2013-07-19 22:36 - 2013-07-19 22:36 - 00000000 ____D C:\Program Files (x86)\IObit
2013-07-15 22:06 - 2012-07-14 20:30 - 00000000 ____D C:\Users\schleppi\AppData\Roaming\vlc
2013-07-13 16:27 - 2012-08-26 13:12 - 00004110 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 16:27 - 2012-08-26 13:12 - 00003858 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 23:17 - 2011-02-11 21:57 - 00000000 ____D C:\windows\Panther
2013-07-11 19:40 - 2012-08-30 19:27 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-07-11 19:39 - 2012-08-30 19:22 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-07-11 19:39 - 2012-08-30 19:22 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-11 07:23 - 2011-07-28 20:57 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 07:23 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 07:07 - 2012-02-21 13:31 - 78185248 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-07-03 10:12 - 2013-04-12 00:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-28 20:37
==================== End Of Log ============================
--- --- --- FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-07-2013 04
Ran by schleppi at 2013-07-29 18:01:41
Running from C:\Users\schleppi\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
„Windows Live Essentials“ (x32 Version: 15.4.3502.0922)
„Windows Live Mail“ (x32 Version: 15.4.3502.0922)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Atheros Client Installation Program (x32 Version: 9.0)
AVG 2013 (Version: 13.0.3209)
AVG 2013 (Version: 13.0.3349)
AVG 2013 (Version: 2013.0.3349)
AVG PC Tuneup 2011 (x32)
BatteryLifeExtender (x32 Version: 1.0.11)
Broadcom 802.11 Network Adapter (Version: 5.60.48.55)
Brother MFL-Pro Suite MFC-255CW (x32 Version: 1.0.1.0)
Browse for the Cause (x32)
CCleaner (Version: 3.21)
D3DX10 (x32 Version: 15.4.2368.0902)
DBView Element 2005 (x32 Version: 4.0)
dows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (Version: 05/31/2012 7.1.2.0)
Driver Booster (x32 Version: Beta 2.0)
Dropbox (HKCU Version: 2.0.22)
Easy Content Share (x32 Version: 1.0)
Easy Display Manager (x32 Version: 3.2)
Easy Migration (x32 Version: 1.0)
Easy Network Manager (x32 Version: 4.4.7)
Easy SpeedUp Manager (x32 Version: 2.1.1.1)
EasyBatteryManager (x32 Version: 4.0.0.4)
EasyFileShare (x32 Version: 1.0.12)
ETDWare PS/2-X64 10.7.14.12_WHQL (Version: 10.7.14.12)
Fast Start (x32 Version: 2.2.0.1)
Fishdom 2 Deluxe (x32)
Free Studio version 5.3.3 (x32)
Free YouTube to MP3 Converter version 3.11.35.1031 (x32 Version: 3.11.35.1031)
FreeMind (x32 Version: 0.9.0_RC_10)
Google Update Helper (x32 Version: 1.3.21.153)
Intel PROSet Wireless (x32)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) PROSet/Wireless WiFi Software (Version: 14.01.1000)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.5.1001)
Java Auto Updater (x32 Version: 2.1.9.0)
Java(TM) 6 Update 33 (x32 Version: 6.0.330)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1)
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1)
Movie Color Enhancer (x32 Version: 1.0)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Multimedia POP (x32 Version: 1.0)
Nokia Connectivity Cable Driver (x32 Version: 7.1.172.0)
Nokia Suite (x32 Version: 3.8.30.0)
NVIDIA Install Application (Version: 2.1002.124.810)
NVIDIA Systemsteuerung 320.49 (Version: 320.49)
OpenOffice.org 3.4 (x32 Version: 3.4.9590)
PC Connectivity Solution (x32 Version: 12.0.109.0)
PDF24 Creator 5.2.0 (x32)
PDF-Viewer (Version: 2.5.210.0)
PhoneShare (x32 Version: 9.1.4)
Plus-HD-2.5 (x32 Version: 1.27.153.5)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
Realtek Ethernet Controller Driver (x32 Version: 7.40.126.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6400)
Samsung AnyWeb Print (x32 Version: 2.0.67.1)
Samsung Printer Live Update (x32)
Samsung Recovery Solution 5 (x32 Version: 5.0.1.0)
Samsung Support Center (x32 Version: 1.1.24)
Samsung Universal Print Driver (x32 Version: 2.02.05.00:27)
Samsung Universal Scan Driver (x32 Version: 1.2.5.0)
Samsung Update Plus (x32 Version: 3.0.0.17)
Skype™ 4.2 (x32 Version: 4.2.169)
Synchredible (x32 Version: 4.0.0.5)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.0.82.0)
User Guide (x32 Version: 1.6)
Visual Studio 2008 x64 Redistributables (x32 Version: 10.0.0.2)
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1)
VLC media player 2.0.2 (x32 Version: 2.0.2)
Vuze (x32 Version: 5.0.0.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Pošta (x32 Version: 15.4.3502.0922)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Live 메일 (x32 Version: 15.4.3502.0922)
Windows Live 필수 패키지 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3508.1109)
Windows Live 软件包 (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
WinRAR 4.00 (64-Bit) (Version: 4.00.0)
WordCaptureX Pro (x32 Version: 4.0.0)
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)
Почта Windows Live (x32 Version: 15.4.3502.0922)
بريد Windows Live (x32 Version: 15.4.3502.0922)
==================== Restore Points =========================
28-06-2013 10:44:54 Geplanter Prüfpunkt
08-07-2013 20:37:17 Geplanter Prüfpunkt
11-07-2013 04:43:02 Windows Update
12-07-2013 05:15:25 Windows Update
12-07-2013 20:36:16 Removed Versandhelfer
19-07-2013 20:38:57 Driver Booster : NVIDIA GeForce GT 520M
28-07-2013 07:45:18 ComboFix created restore point
29-07-2013 15:10:25 Tweaking.com - Windows Repair
==================== Hosts content: ==========================
2009-07-14 04:34 - 2013-07-28 09:56 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {025A0E68-F036-467F-9553-F2C8F9FD91BA} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2011-02-14] (SEC)
Task: {062A5F82-BAFF-4AE1-AEA8-9EBB819E6561} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: {07B13C30-5A10-4756-B40E-D04632AF8EC3} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)
Task: {07EF1EEC-8A79-4303-864E-7520287E8FDB} - System32\Tasks\Driver Booster Update => C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe [2013-07-17] (IObit)
Task: {0A91FBA5-96FE-4196-972D-E44CCC71A768} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {0AA78EFD-EA4E-4C03-9691-5855AE596C69} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2010-08-27] (Samsung Electronics)
Task: {0FADA576-25F9-40F3-A9FD-5F00088303AA} - System32\Tasks\Driver Booster Startup => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe [2013-07-17] (IObit)
Task: {11D935D9-676C-44E4-BB96-FAA163882110} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {250B4C9C-B47D-4B0D-A4D5-F7DF6A12DA90} - System32\Tasks\Synchredible-schleppi => C:\Program Files (x86)\ASCOMP Software\Synchredible\synchredible.exe [2013-01-31] (ASCOMP Software GmbH)
Task: {3BE0B2FB-3DB8-4B06-A799-77B71757DBAF} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2010-02-10] (Samsung Electronics Co., Ltd.)
Task: {4A0789F8-DADB-4675-83DE-5319E88315E9} - System32\Tasks\Plus-HD-2.5-codedownloader => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-codedownloader.exe [2013-07-28] (Plus HD)
Task: {4C13C545-CC5D-4E5D-9C50-969215675D1D} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {5A6CCA2E-0505-4408-AC4C-D30F0CD55D4C} - System32\Tasks\Wise Care 365 => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe No File
Task: {5F956975-F718-4BD1-95FF-0D56C37E7119} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {703E4EC8-B7F6-4A0D-AB25-6269B4059E61} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {763A2B7B-6FFC-4568-8D0E-4F14CD53584A} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {7BD3816D-8E54-4926-9F66-7AD5BD0F11F8} - System32\Tasks\Plus-HD-2.5-firefoxinstaller => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-firefoxinstaller.exe [2013-07-28] (Plus HD)
Task: {810BAD61-35F0-4982-BD9A-A584CA4AAA15} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2027592733-4161651481-1790285415-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe No File
Task: {838FBF08-95EB-45D6-AD62-0CD3E5ADC9C9} - System32\Tasks\Plus-HD-2.5-enabler => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-enabler.exe [2013-07-28] (Plus HD)
Task: {8B62AF8A-B95D-44FB-839A-8CF14A37C123} - System32\Tasks\EasyPartitionManager => C:\Windows\MSetup\BA46-12225A02\EPM.exe No File
Task: {8C79300E-DF30-476A-8E90-4CEDB652CFCA} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {8EB1AA34-6AE2-4BA9-83B5-9923484245A8} - System32\Tasks\Wise Turbo Checker => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe No File
Task: {9793C63F-5F0D-4260-B559-D716A571374F} - System32\Tasks\Driver Booster Scan => C:\Program Files (x86)\IObit\Driver Booster\Scheduler.exe [2013-07-17] (IObit)
Task: {A2B37064-CE1B-46E8-B4D6-E597FE822F9F} - System32\Tasks\Plus-HD-2.5-updater => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-updater.exe [2013-07-28] (Plus HD)
Task: {AC8B457C-8C99-4BD3-8674-C65D84069CAB} - System32\Tasks\BrowseForTheCauseUpdate => C:\Program Files (x86)\BrowseForTheCause\BrowseForTheCause.exe [2013-07-28] ()
Task: {BEF11CF5-B7C0-4BA1-B39D-E97B6EA2D365} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.)
Task: {C00E7702-3342-4E08-877B-66882DB067B6} - System32\Tasks\Plus-HD-2.5-chromeinstaller => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-chromeinstaller.exe [2013-07-28] (Plus HD)
Task: {C0B7810F-C442-42FF-B400-70ABDCC556BF} - System32\Tasks\User_Feed_Synchronization-{1534DA73-4149-4D86-BC64-A5F303CCEF9E} => C:\windows\system32\msfeedssync.exe [2013-02-27] (Microsoft Corporation)
Task: {C0D579B1-FCAF-4EEC-8B15-6A547768DEB6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: {C7FE6C5C-69FF-4865-8F05-375B1515BEA9} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-02-07] (SAMSUNG Electronics)
Task: {D35BCFE9-91F2-4A27-B486-85CE4E3265F0} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2027592733-4161651481-1790285415-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe No File
Task: {E32F14BE-2FCE-44F8-96AA-DA303EDDA635} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe No File
Task: {E3E3A0CC-B5BC-447F-8972-573EDDA928B9} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-11] (Adobe Systems Incorporated)
Task: {F008F492-3511-42B3-AB07-6FC0437EF6E7} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] ()
Task: {F090C633-431A-4005-B2B7-EBDE3566F57B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Driver Booster Startup.job => C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Plus-HD-2.5-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-chromeinstaller.exe
Task: C:\windows\Tasks\Plus-HD-2.5-codedownloader.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-codedownloader.exe
Task: C:\windows\Tasks\Plus-HD-2.5-enabler.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-enabler.exe
Task: C:\windows\Tasks\Plus-HD-2.5-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-firefoxinstaller.exe
Task: C:\windows\Tasks\Plus-HD-2.5-updater.job => C:\Program Files (x86)\Plus-HD-2.5\Plus-HD-2.5-updater.exe
Task: C:\windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe
Task: C:\windows\Tasks\Wise Care 365.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
Task: C:\windows\Tasks\Wise Registry Cleaner Schedule Task.job => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe
Task: C:\windows\Tasks\Wise Turbo Checker.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe
==================== Faulty Device Manager Devices =============
Name: HTTP
Description: HTTP
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: HTTP
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/29/2013 05:46:48 PM) (Source: Schedule) (User: )
Description: Schedule error: 10050Initialize call failed, bailing out
Error: (07/29/2013 05:42:48 PM) (Source: WinMgmt) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\FR-FR\MSFEEDS.MFL
Error: (07/29/2013 05:42:48 PM) (Source: WinMgmt) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\MSFEEDSBS.MFL
Error: (07/29/2013 05:42:48 PM) (Source: WinMgmt) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\MSFEEDS.MFL
Error: (07/29/2013 05:41:47 PM) (Source: WinMgmt) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\FR-FR\MSFEEDS.MFL
Error: (07/29/2013 05:41:47 PM) (Source: WinMgmt) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\MSFEEDSBS.MFL
Error: (07/29/2013 05:41:47 PM) (Source: WinMgmt) (User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\MSFEEDS.MFL
Error: (07/29/2013 05:20:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2013 05:18:52 PM) (Source: Schedule) (User: )
Description: Schedule error: 10050Initialize call failed, bailing out
Error: (07/29/2013 05:16:36 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
System errors:
=============
Error: (07/29/2013 06:01:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" ist vom Dienst "DHCP-Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1075
Error: (07/29/2013 06:01:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DHCP-Client" ist von folgendem Dienst abhängig: Afd. Dieser Dienst ist eventuell nicht installiert.
Error: (07/29/2013 06:01:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" ist vom Dienst "DHCP-Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1075
Error: (07/29/2013 06:01:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DHCP-Client" ist von folgendem Dienst abhängig: Afd. Dieser Dienst ist eventuell nicht installiert.
Error: (07/29/2013 06:01:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" ist vom Dienst "DHCP-Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1075
Error: (07/29/2013 06:01:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DHCP-Client" ist von folgendem Dienst abhängig: Afd. Dieser Dienst ist eventuell nicht installiert.
Error: (07/29/2013 06:01:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" ist vom Dienst "DHCP-Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1075
Error: (07/29/2013 06:01:15 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DHCP-Client" ist von folgendem Dienst abhängig: Afd. Dieser Dienst ist eventuell nicht installiert.
Error: (07/29/2013 05:59:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%10050
Error: (07/29/2013 05:59:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%10050
Microsoft Office Sessions:
=========================
Error: (07/29/2013 05:46:48 PM) (Source: Schedule)(User: )
Description: Schedule error: 10050Initialize call failed, bailing out
Error: (07/29/2013 05:42:48 PM) (Source: WinMgmt)(User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\FR-FR\MSFEEDS.MFL
Error: (07/29/2013 05:42:48 PM) (Source: WinMgmt)(User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\MSFEEDSBS.MFL
Error: (07/29/2013 05:42:48 PM) (Source: WinMgmt)(User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\MSFEEDS.MFL
Error: (07/29/2013 05:41:47 PM) (Source: WinMgmt)(User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\FR-FR\MSFEEDS.MFL
Error: (07/29/2013 05:41:47 PM) (Source: WinMgmt)(User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\MSFEEDSBS.MFL
Error: (07/29/2013 05:41:47 PM) (Source: WinMgmt)(User: )
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\IT-IT\MSFEEDS.MFL
Error: (07/29/2013 05:20:02 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/29/2013 05:18:52 PM) (Source: Schedule)(User: )
Description: Schedule error: 10050Initialize call failed, bailing out
Error: (07/29/2013 05:16:36 PM) (Source: SideBySide)(User: )
Description: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestF:\esetsmartinstaller_enu.exe
CodeIntegrity Errors:
===================================
Date: 2013-07-28 09:55:14.706
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\setup\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-28 09:55:14.579
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\setup\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 21%
Total physical RAM: 8171.55 MB
Available physical RAM: 6425.94 MB
Total Pagefile: 16341.28 MB
Available Pagefile: 14506.76 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:230 GB) (Free:137.87 GB) NTFS (Disk=0 Partition=2)
Drive d: () (Fixed) (Total:342.28 GB) (Free:157.2 GB) NTFS (Disk=0 Partition=4)
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 596 GB) (Disk ID: 23C4F13B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=230 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=342 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=24 GB) - (Type=27)
==================== End Of Log ============================
PS: wenn ich den DHCP_Client starten will sagt er mir "Fehler 1075: Abhängigkeitsdienst nicht vorhanden oder zum löschen markiert" |
|
| Themen zu Trojaner bei Facebook gefangen (Trojan.JS.Koobface.N.), bitte um Hilfe |
| aktuelle, aktuellen, bitte um hilfe, dateien, facebook, freue, gefangen, gen, hilfe, hänge, laufe, laufen, pup.optional.ibryte, pup.rewardsarcade, troja, trojaner, würde |
Linear-Darstellung
