| |
| |||||||
Log-Analyse und Auswertung: Lilpack....Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
08.08.2013, 10:00
| #1 |
| |  Lilpack.... Guten Morgen, seit einiger zeit öffnen sich bei mir immer einige Fenster, wenn ich Firefox starte oder den Internet Explorer. Als Adresszeile steht dann meist was von LILpack dabei. Manchmal geht auch Werbung auf, oder die Meldung, das mein Arbeitsspeicher nicht ausreicht und mein PC gleich abstürzt. Als erstes habe ich Avira durchlaufen lassen. Es gab Funde, die nun in Quarantäne sind: z.B Java Lamar und Adware. Als dann immer noch Probleme auftraten habe ich Euch entdeckt und einen Beitrag, der mein Problem genau beschrieb: von gonzor vom 01. August. Nun habe ich schon folgende Schritte ausgeführt: Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde! Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm. Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. (von Schrauber) Hier die Combofix.txt ComboFix 13-08-07.01 - PC-1 08.08.2013 9:17.1.2 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.2046.998 [GMT 2:00] ausgeführt von:: c:\users\PC-1\Downloads\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\DealPly c:\program files\DealPly\DealPly.crx c:\program files\DealPly\DealPly.xpi c:\program files\DealPly\DealPlyIE.dll c:\program files\DealPly\DealPlyIE64.dll c:\program files\DealPly\DealPlyUpdateVer.exe c:\program files\DealPly\icon.ico c:\program files\DealPly\uninst.exe c:\program files\LyricsContainer\125.dll c:\program files\LyricsWoofer\125.dll c:\program files\PricePeep c:\program files\PricePeep\uninstall.exe c:\program files\PricePeep\unutil.exe c:\program files\RewardsArcade c:\program files\RewardsArcade\appAPIinternalWrapper.js c:\program files\RewardsArcade\fb.js c:\program files\RewardsArcade\jquery.js c:\program files\RewardsArcade\json.js c:\program files\RewardsArcade\RewardsArcade.dll c:\program files\RewardsArcade\RewardsArcade.exe c:\program files\RewardsArcade\Uninstall.exe c:\program files\RewardsArcade\UserConfirmation.exe c:\users\PC-1\4.0 c:\users\PC-1\AppData\Local\Minibar c:\users\PC-1\AppData\Local\Minibar\chrome\background.html c:\users\PC-1\AppData\Local\Minibar\chrome\extension_info.json c:\users\PC-1\AppData\Local\Minibar\chrome\icons\icon128.png c:\users\PC-1\AppData\Local\Minibar\chrome\icons\icon19.png c:\users\PC-1\AppData\Local\Minibar\chrome\icons\icon32.png c:\users\PC-1\AppData\Local\Minibar\chrome\icons\icon48.png c:\users\PC-1\AppData\Local\Minibar\chrome\manifest.json c:\users\PC-1\AppData\Local\Minibar\chrome\popup.html c:\users\PC-1\AppData\Local\Minibar\chrome\tab.html c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\content.xul c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\extension_info.json c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\icons\icon128.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\icons\icon19.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\icons\icon32.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\icons\icon48.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup_window.xul c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-left.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-middle.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-right.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\middle-left.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\middle-right.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\style.css c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-bottom.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-left.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-right.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-top.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-left.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-middle.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-right.png c:\users\PC-1\AppData\Local\Minibar\firefox\chrome\content\minibar\config.json c:\users\PC-1\AppData\Local\Minibar\firefox\install.rdf c:\users\PC-1\AppData\Local\Minibar\install.json c:\users\PC-1\AppData\Local\Minibar\minibar.crx c:\users\PC-1\AppData\Local\Minibar\minibar.xpi c:\users\PC-1\AppData\Roaming\Microsoft\Windows\Recent\Adito-VPN-Login(1).url c:\users\PC-1\AppData\Roaming\Microsoft\Windows\Recent\Adito-VPN-Login(2).url c:\users\PC-1\AppData\Roaming\Microsoft\Windows\Recent\Adito-VPN-Login.url c:\users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\pricepeep@getpricepeep.com.xpi c:\users\Public\sdelevURL.tmp . . ((((((((((((((((((((((( Dateien erstellt von 2013-07-08 bis 2013-08-08 )))))))))))))))))))))))))))))) . . 2013-08-08 07:25 . 2013-08-08 07:25 -------- d-----w- c:\users\PC-1\AppData\Local\temp 2013-08-08 07:25 . 2013-08-08 07:25 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-08-01 18:55 . 2013-08-01 19:10 -------- d-----w- c:\program files\Optimizer Pro 2013-08-01 18:55 . 2013-08-01 18:55 -------- d-----w- c:\users\PC-1\AppData\Local\Programs 2013-08-01 18:55 . 2013-08-08 07:24 -------- d-----w- c:\program files\LyricsWoofer 2013-07-30 15:24 . 2013-07-30 15:24 -------- d-----w- c:\programdata\Citrix 2013-07-30 15:23 . 2013-07-30 15:23 -------- d-----w- c:\program files\Common Files\Citrix 2013-07-30 14:52 . 2013-07-30 14:52 -------- d-----w- c:\users\PC-1\AppData\Roaming\Avira 2013-07-30 14:05 . 2013-07-30 14:05 67168 ----a-w- c:\windows\system32\drivers\avnetflt.sys 2013-07-30 13:59 . 2013-07-30 13:56 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2013-07-30 13:59 . 2013-07-30 13:56 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys 2013-07-30 13:59 . 2013-07-30 13:56 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys 2013-07-30 13:59 . 2013-07-30 13:59 -------- d-----w- c:\programdata\Avira 2013-07-30 13:59 . 2013-07-30 13:59 -------- d-----w- c:\program files\Avira 2013-07-30 13:04 . 2013-07-30 13:04 -------- d-----w- c:\users\PC-1\Qtrax 2013-07-30 13:04 . 2013-07-30 13:05 -------- d-----w- c:\program files\Plus-HD-1.6 2013-07-30 13:04 . 2013-08-08 07:24 -------- d-----w- c:\program files\LyricsContainer 2013-07-30 05:46 . 2013-07-02 06:54 7143960 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{697937E4-1303-4B1F-A687-607924C06A62}\mpengine.dll 2013-07-24 12:39 . 2013-07-24 12:39 -------- d-----w- c:\program files\Common Files\Windows Live 2013-07-24 12:39 . 2013-07-24 12:39 -------- d-----w- c:\users\PC-1\AppData\Local\DealPlyLive 2013-07-24 12:39 . 2013-07-24 12:39 -------- d-----w- c:\programdata\DealPlyLive 2013-07-24 12:39 . 2013-07-24 12:39 -------- d-----w- c:\program files\DealPlyLive 2013-07-13 13:32 . 2013-07-13 13:32 -------- d-----w- c:\program files\Microsoft 2013-07-12 17:44 . 2013-07-24 13:47 -------- d-----w- c:\users\PC-1\AppData\Roaming\TeamViewer 2013-07-10 18:51 . 2013-07-10 18:51 -------- d-----w- c:\program files\TeamViewer 2013-07-10 18:28 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\system32\DWrite.dll 2013-07-10 18:27 . 2013-05-06 04:56 1620480 ----a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-10 18:27 . 2013-06-04 04:53 509440 ----a-w- c:\windows\system32\qedit.dll 2013-07-10 18:27 . 2013-06-05 03:05 2347520 ----a-w- c:\windows\system32\win32k.sys 2013-07-10 18:27 . 2013-04-10 05:04 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL 2013-07-10 18:27 . 2013-04-10 05:03 936448 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2013-07-10 18:27 . 2013-04-10 05:03 988672 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll 2013-07-10 18:27 . 2013-04-10 05:03 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll 2013-07-10 18:27 . 2013-05-27 04:57 680960 ----a-w- c:\program files\Windows Defender\MpSvc.dll 2013-07-10 18:27 . 2013-05-27 04:57 392704 ----a-w- c:\program files\Windows Defender\MpClient.dll 2013-07-10 18:27 . 2013-05-27 04:57 224768 ----a-w- c:\program files\Windows Defender\MpCommu.dll 2013-07-09 19:18 . 2013-07-09 19:18 -------- d-----w- c:\users\PC-1\AppData\Local\Downloaded Installations 2013-07-09 19:00 . 2013-08-07 19:57 -------- d-----w- c:\users\PC-1\AppData\Roaming\ICAClient 2013-07-09 18:59 . 2013-07-30 15:24 -------- d-----w- c:\users\PC-1\AppData\Local\Citrix 2013-07-09 18:59 . 2013-07-30 15:24 -------- d-----w- c:\program files\Citrix . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-07-13 03:53 . 2012-03-30 14:21 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-07-13 03:53 . 2011-10-20 17:23 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-06-26 03:13 . 2013-06-26 03:13 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-06-26 03:13 . 2012-07-13 11:27 867240 ----a-w- c:\windows\system32\npDeployJava1.dll 2013-06-26 03:13 . 2011-10-26 18:02 789416 ----a-w- c:\windows\system32\deployJava1.dll 2013-05-13 04:45 . 2013-06-12 18:51 1160192 ----a-w- c:\windows\system32\crypt32.dll 2013-05-13 04:45 . 2013-06-12 18:51 140288 ----a-w- c:\windows\system32\cryptsvc.dll 2013-05-13 04:45 . 2013-06-12 18:51 103936 ----a-w- c:\windows\system32\cryptnet.dll 2013-05-13 03:08 . 2013-06-12 18:51 903168 ----a-w- c:\windows\system32\certutil.exe 2013-05-13 03:08 . 2013-06-12 18:51 43008 ----a-w- c:\windows\system32\certenc.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-09-08 343168] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-05-22 7514656] "Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-05-22 1833504] "SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2011-08-01 114992] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-30 345144] "ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2012-12-14 383544] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "InfoCockpit"="c:\program files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2006-10-20 176128] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~2\Citrix\ICACLI~1\RSHook.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux2"=wdmaud.drv . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InfoCockpit] 2006-10-20 10:50 176128 ------w- c:\program files\T-Online\T-Online_Software_6\Info-Cockpit\ic_start.exe . R2 dealplylive;DealPly Live-Dienst (dealplylive);c:\program files\DealPlyLive\Update\DealPlyLive.exe [2013-07-24 148000] R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2013-06-09 116648] R3 dealplylivem;DealPly Live-Dienst (dealplylivem);c:\program files\DealPlyLive\Update\DealPlyLive.exe [2013-07-24 148000] R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt [2005-08-17 7168] R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2013-06-09 116648] R3 netr73;Belkin Wireless 54G USB Network Adapter Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2011-08-18 464384] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-07-30 37352] S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2012-12-05 73544] S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files\HWiNFO32\HWiNFO32.SYS [2011-09-22 21624] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-09-08 291840] S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-07-30 84024] S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2010-11-09 21992] S2 IB Updater;IB Updater;c:\program files\IB Updater\ExtensionUpdaterService.exe [2013-01-29 188760] S2 IBUpdaterService;IBUpdaterService;c:\windows\system32\dmwu.exe [2013-04-07 1156400] S2 TeamViewer8;TeamViewer 8;c:\program files\TeamViewer\Version8\TeamViewer_Service.exe [2013-07-08 4153184] S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-06-06 211984] . . Inhalt des "geplante Tasks" Ordners . 2013-08-08 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 03:53] . 2013-08-08 c:\windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job - c:\program files\DealPlyLive\Update\DealPlyLive.exe [2013-07-24 12:39] . 2013-08-08 c:\windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job - c:\program files\DealPlyLive\Update\DealPlyLive.exe [2013-07-24 12:39] . 2013-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-06-09 18:52] . 2013-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-06-09 18:52] . 2013-08-08 c:\windows\Tasks\LyricsContainer Update.job - c:\program files\LyricsContainer\LrcsCtrUpdr.exe [2013-07-27 21:42] . 2013-08-08 c:\windows\Tasks\LyricsWoofer Update.job - c:\program files\LyricsWoofer\LyricsWooferUPD.exe [2013-07-27 21:27] . 2013-08-08 c:\windows\Tasks\Plus-HD-1.6-chromeinstaller.job - c:\program files\Plus-HD-1.6\Plus-HD-1.6-chromeinstaller.exe [2013-07-30 13:04] . 2013-07-30 c:\windows\Tasks\Plus-HD-1.6-codedownloader.job - c:\program files\Plus-HD-1.6\Plus-HD-1.6-codedownloader.exe [2013-07-30 13:05] . 2013-08-08 c:\windows\Tasks\Plus-HD-1.6-firefoxinstaller.job - c:\program files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe [2013-07-30 13:04] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5CE6002197960FA8&affID=119357&tsp=4961 IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Web-Suche - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\ FF - prefs.js: browser.search.selectedEngine - MyStart Search FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&CUI=UN15730150696318691&UM=&q= FF - prefs.js: browser.startup.homepage - www.google.de FF - ExtSQL: 2013-06-18 06:13; tl_r@jetpack; c:\users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\tl_r@jetpack.xpi FF - ExtSQL: 2013-07-24 14:39; {906000a4-88d9-4d52-b209-7a772970d91f}; c:\users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\{906000a4-88d9-4d52-b209-7a772970d91f} FF - ExtSQL: 2013-07-30 15:04; Lyrics@LyricsContainer.co; c:\program files\LyricsContainer\125.xpi FF - ExtSQL: 2013-07-30 15:05; 6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com; c:\users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com FF - ExtSQL: 2013-08-01 20:55; lwoofer@lyricswoofer.co; c:\program files\LyricsWoofer\125.xpi FF - user.js: browser.search.selectedEngine - Search the web FF - user.js: browser.search.order.1 - Search the web FF - user.js: browser.search.defaultenginename - Search the web FF - user.js: keyword.URL - hxxp://www.browsersafesearch.com?client=mozilla-firefox&cd=UTF-8&search=1&q= FF - user.js: privacy.item.cookies - false FF - user.js: privacy.sanitize.promptOnSanitize - false FF - user.js: extensions.incredibar_i.newTab - false FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8c3bcWyk&loc=IB_TB&i=26&search= FF - user.js: extensions.incredibar_i.id - 5ce65770000000000000002197960fa8 FF - user.js: extensions.incredibar_i.instlDay - 15650 FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1420:43 FF - user.js: extensions.incredibar_i.prtnrId - Incredibar FF - user.js: extensions.incredibar_i.prdct - incredibar FF - user.js: extensions.incredibar_i.aflt - orgnl FF - user.js: extensions.incredibar_i.smplGrp - none FF - user.js: extensions.incredibar_i.tlbrId - base FF - user.js: extensions.incredibar_i.instlRef - FF - user.js: extensions.incredibar_i.dfltLng - FF - user.js: extensions.incredibar_i.excTlbr - false FF - user.js: extensions.incredibar_i.ms_url_id - FF - user.js: extensions.incredibar_i.upn2 - 6R8c3bcWyk FF - user.js: extensions.incredibar_i.upn2n - 92823402307280680 FF - user.js: extensions.incredibar_i.productid - 26 FF - user.js: extensions.incredibar_i.installerproductid - 26 FF - user.js: extensions.incredibar_i.did - 10674 FF - user.js: extensions.incredibar_i.ppd - FF - user.js: extensions.autoDisableScopes - 0 FF - user.js: extensions.shownSelectionUI - true FF - user.js: extensions.delta.tlbrSrchUrl - FF - user.js: extensions.delta.id - 5ce65770000000000000002197960fa8 FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} FF - user.js: extensions.delta.instlDay - 15918 FF - user.js: extensions.delta.vrsn - 1.8.22.0 FF - user.js: extensions.delta.vrsni - 1.8.22.0 FF - user.js: extensions.delta.vrsnTs - 1.8.22.020:55 FF - user.js: extensions.delta.prtnrId - delta FF - user.js: extensions.delta.prdct - delta FF - user.js: extensions.delta.aflt - babsst FF - user.js: extensions.delta.smplGrp - none FF - user.js: extensions.delta.tlbrId - base FF - user.js: extensions.delta.instlRef - sst FF - user.js: extensions.delta.dfltLng - de FF - user.js: extensions.delta.excTlbr - false FF - user.js: extensions.delta.ffxUnstlRst - true FF - user.js: extensions.delta.admin - false FF - user.js: extensions.delta_i.babTrack - affID=119357&tsp=4961 FF - user.js: extensions.delta_i.babExt - FF - user.js: extensions.delta_i.srcExt - ss FF - user.js: extensions.delta.autoRvrt - false FF - user.js: extensions.delta.rvrt - false FF - user.js: extensions.delta.newTab - false . - - - - Entfernte verwaiste Registrierungseinträge - - - - . URLSearchHooks-{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - (no file) URLSearchHooks-{ff88a983-649d-4207-9336-9b999280b436} - (no file) Toolbar-10 - (no file) WebBrowser-{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - (no file) HKLM-Run-F5D7050v3 - c:\program files\Belkin\F5D7050v3\Belkinwcui.exe AddRemove-DealPly - c:\program files\DealPly\uninst.exe AddRemove-RewardsArcade - c:\program files\RewardsArcade\Uninstall.exe . . . ************************************************************************** . Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, hxxp://www.gmer.net Windows 6.1.7601 Disk: WDC_WD80 rev.10.0 -> Harddisk0\DR0 -> \Device\00000064 . device: opened successfully user: MBR read successfully kernel: MBR read successfully user != kernel MBR !!! sectors 156301486 (+255): user != kernel . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\EverestDriver] "ImagePath"="\??\c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt" . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2013-08-08 09:27:21 ComboFix-quarantined-files.txt 2013-08-08 07:27 . Vor Suchlauf: 8 Verzeichnis(se), 46.987.091.968 Bytes frei Nach Suchlauf: 14 Verzeichnis(se), 47.550.443.520 Bytes frei . - - End Of File - - 946C0FB16B61CAFC2BEBEB66273CE930 72B8CE41AF0DE751C946802B3ED844B4 Danach befolgte ich auch die nächste Anweisung: Downloade Dir bitte AdwCleaner auf deinen Desktop. Schließe alle offenen Programme und Browser. Starte die adwcleaner.exe mit einem Doppelklick. Klicke auf Löschen. Bestätige jeweils mit Ok. Dein Rechner wird neu gestartet, je nach Schwere der Infektion auch mehrmals - das ist normal. Nach dem Neustart öffnet sich eine Textdatei. Poste mir den Inhalt mit deiner nächsten Antwort. Die Logdatei findest du auch unter C:\AdwCleaner[Sx].txt. (x = fortlaufende Nummer) Und auch hier das Ergebnis dazu: # AdwCleaner v2.306 - Datei am 08/08/2013 um 09:32:04 erstellt # Aktualisiert am 19/07/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits) # Benutzer : PC-1 - PC-1-PC # Bootmodus : Normal # Ausgeführt unter : C:\Users\PC-1\Downloads\adwcleaner.exe # Option [Löschen] **** [Dienste] **** Gestoppt & Gelöscht : IB Updater Gestoppt & Gelöscht : IBUpdaterService ***** [Dateien / Ordner] ***** Datei Gelöscht : C:\Program Files\Mozilla Firefox\plugins\npmieze.dll Datei Gelöscht : C:\Program Files\Mozilla Firefox\Plugins\npvsharetvplg.dll Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml Datei Gelöscht : C:\Program Files\mozilla firefox\searchplugins\Search the web.src Datei Gelöscht : C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml Datei Gelöscht : C:\user.js Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\bProtector_extensions.rdf Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\freehdsport@freehdsport.tv.xpi Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\Askcom.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\askcomsearch.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\Babylon.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\BrowserDefender.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\delta.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\fileconverter-13-customized-web-search.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\MyStart Search.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\Search_Results.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\Startsear.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\SweetIM Search.xml Datei Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\searchplugins\SweetIm.xml Datei Gelöscht : C:\Windows\system32\conduitEngine.tmp Datei Gelöscht : C:\Windows\Tasks\LyricsContainer Update.job Datei Gelöscht : C:\Windows\Tasks\LyricsWoofer Update.job Gelöscht mit Neustart : C:\Windows\system32\Zynga Gelöscht mit Neustart : C:\Windows\system32\Zynga Ordner Gelöscht : C:\Program Files\BabylonToolbar Ordner Gelöscht : C:\Program Files\DealPlyLive Ordner Gelöscht : C:\Program Files\IB Updater Ordner Gelöscht : C:\Program Files\Ilivid Ordner Gelöscht : C:\Program Files\LyricsContainer Ordner Gelöscht : C:\Program Files\LyricsWoofer Ordner Gelöscht : C:\Program Files\Minibar Ordner Gelöscht : C:\Program Files\optimizer pro Ordner Gelöscht : C:\Program Files\Perion Ordner Gelöscht : C:\Program Files\SweetIM Ordner Gelöscht : C:\Program Files\XingHaoLyrics Ordner Gelöscht : C:\ProgramData\Ask Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\boost_interprocess Ordner Gelöscht : C:\ProgramData\BrowserProtect Ordner Gelöscht : C:\ProgramData\DealPlyLive Ordner Gelöscht : C:\ProgramData\SweetIM Ordner Gelöscht : C:\Users\PC-1\AppData\Local\Conduit Ordner Gelöscht : C:\Users\PC-1\AppData\Local\DealPlyLive Ordner Gelöscht : C:\Users\PC-1\AppData\Local\Ilivid Player Ordner Gelöscht : C:\Users\PC-1\AppData\Local\RewardsArcade Ordner Gelöscht : C:\Users\PC-1\AppData\LocalLow\Conduit Ordner Gelöscht : C:\Users\PC-1\AppData\LocalLow\searchquband Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Babylon Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\BabylonToolbar Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\DealPly Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\eType Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\loadtbs Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\CT3241949 Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\{78e516ef-11de-47a1-8364-a99b917ec5ee} Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\{906000a4-88d9-4d52-b209-7a772970d91f} Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\amo@dealplyshopping.com Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\ffxtlbr@babylon.com Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\pricepeep@getpricepeep.com Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\software@loadtubes.com Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\welcome@toolmin.com Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\jetpack Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\Smartbar Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\pdfforge Ordner Gelöscht : C:\Users\PC-1\AppData\Roaming\Toolplugin Ordner Gelöscht : C:\Windows\system32\ARFC Ordner Gelöscht : C:\Windows\system32\jmdp Ordner Gelöscht : C:\Windows\system32\WNLT ***** [Registrierungsdatenbank] ***** Schlüssel Gelöscht : HKCU\Software\1ClickDownload Schlüssel Gelöscht : HKCU\Software\5e558bdfb13beb41 Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\LyricsContainer Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\LyricsWoofer Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\RewardsArcade Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\searchqutoolbar Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar Schlüssel Gelöscht : HKCU\Software\BabSolution Schlüssel Gelöscht : HKCU\Software\Conduit Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar Schlüssel Gelöscht : HKCU\Software\DealPly Schlüssel Gelöscht : HKCU\Software\Delta Schlüssel Gelöscht : HKCU\Software\delta LTD Schlüssel Gelöscht : HKCU\Software\ilivid Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\InstallCore Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Web-Suche Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DFEFCDEE-CF1A-4FC8-88AD-129872198372} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DFEFCDEE-CF1A-4FC8-88AD-129872198372} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly Schlüssel Gelöscht : HKCU\Software\Softonic Schlüssel Gelöscht : HKCU\Software\StartSearch Schlüssel Gelöscht : HKCU\Software\WNLT Schlüssel Gelöscht : HKLM\SOFTWARE\5e558bdfb13beb41 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0D89DE71-3D99-4288-84DC-F18F1047A7D8} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25514C64-8321-494E-BD3E-3DBAB3F8CEBA} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7F1796B2-BEC6-427B-B734-F9C75ED94A80} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8B218A5F-1A3D-4347-94EF-A79575EB8094} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-129872198372} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickCtrl.9 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.Update3WebControl.3 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CredentialDialogMachine Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CredentialDialogMachine.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachineFallback Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachineFallback.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachine Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachine.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachineFallback Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebMachineFallback.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebSvc Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3WebSvc.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ilivid Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\F479A18A22A86E3429341589FF57D81A Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\F479A18A22A86E3429341589FF57D81A Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RewardsArcade.FBApi Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RewardsArcade.FBApi.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sim-packages Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2724386 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3031778 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Schlüssel Gelöscht : HKLM\Software\DealPly Schlüssel Gelöscht : HKLM\Software\Delta Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\abfmigjiaapipflmopkaaooigcjjdojh Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fgfdfcbeamjnjdejakdidpniblllnbpg Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf Schlüssel Gelöscht : HKLM\Software\IB Updater Schlüssel Gelöscht : HKLM\Software\ilivid Schlüssel Gelöscht : HKLM\Software\Iminent Schlüssel Gelöscht : HKLM\Software\ImInstaller Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31} Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75D5168E5E176C24981B4E5DBD991078 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8724E58E6C7D00C48A0D4F3345EB2C26 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB676B0E1B9EFA049B9F7DDDA9645734 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B31BBB0B825EDEF45AB0FE7099C68C81 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B471D8D7319336B4CA89374ED0D7B806 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC30043663AA2CA4DA1DAA9CA5FDCC75 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9 Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FDC83385E6C239F4C876A77A37DF581D Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F479A18A22A86E3429341589FF57D81A Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A81A974F-8A22-43E6-9243-5198FF758DA1} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\loadtbs-2.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Lyrics@LyricsContainer.co Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3 Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9 Schlüssel Gelöscht : HKLM\Software\WNLT Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SweetIM] Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}] Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] ***** [Internet Browser] ***** -\\ Internet Explorer v10.0.9200.16635 Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=5CE6002197960FA8&affID=119357&tsp=4961 --> hxxp://www.google.com -\\ Mozilla Firefox v22.0 (de) Datei : C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\prefs.js C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\user.js ... Gelöscht ! Gelöscht : user_pref("CT3241949.1000082.isPlayDisplay", "true"); Gelöscht : user_pref("CT3241949.1000082.state", "{\"state\":\"stopped\",\"text\":\"Radio 8\",\"description\":\"[...] Gelöscht : user_pref("CT3241949.1000234.TWC_TMP_city", "DORTMUND"); Gelöscht : user_pref("CT3241949.1000234.TWC_TMP_country", "DE"); Gelöscht : user_pref("CT3241949.1000234.TWC_country", "GERMANY"); Gelöscht : user_pref("CT3241949.1000234.TWC_locId", "GMXX0024"); Gelöscht : user_pref("CT3241949.1000234.TWC_location", "Dortmund, Germany"); Gelöscht : user_pref("CT3241949.1000234.TWC_region", "DE"); Gelöscht : user_pref("CT3241949.1000234.TWC_temp_dis", "c"); Gelöscht : user_pref("CT3241949.1000234.TWC_wind_dis", "kmh"); Gelöscht : user_pref("CT3241949.1000234.weatherData", "{\"icon\":\"28.png\",\"temperature\":\"15°C\",\"temperat[...] Gelöscht : user_pref("CT3241949.CBOpenMAMSettings.enc", "MA=="); Gelöscht : user_pref("CT3241949.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); Gelöscht : user_pref("CT3241949.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...] Gelöscht : user_pref("CT3241949.FirstTime", "true"); Gelöscht : user_pref("CT3241949.FirstTimeFF3", "true"); Gelöscht : user_pref("CT3241949.LoginRevertSettingsEnabled", true); Gelöscht : user_pref("CT3241949.PG_ENABLE", "dHJ1ZQ=="); Gelöscht : user_pref("CT3241949.PG_ENABLE.enc", "dHJ1ZQ=="); Gelöscht : user_pref("CT3241949.SF_JUST_INSTALLED.enc", "RkFMU0U="); Gelöscht : user_pref("CT3241949.SF_STATUS.enc", "RU5BQkxFRA=="); Gelöscht : user_pref("CT3241949.SF_USER_ID.enc", "Y2lkXzIyNDIwMTMxOTU5NDA4OTU3MzQ1"); Gelöscht : user_pref("CT3241949.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT324[...] Gelöscht : user_pref("CT3241949.UserID", "UN15730150696318691"); Gelöscht : user_pref("CT3241949.addressBarTakeOverEnabledInHidden", "true"); Gelöscht : user_pref("CT3241949.browser.search.defaultthis.engineName", true); Gelöscht : user_pref("CT3241949.cb_experience_000.enc", "Nzc="); Gelöscht : user_pref("CT3241949.cb_firstuse0100.enc", "MQ=="); Gelöscht : user_pref("CT3241949.cb_user_id_000.enc", "Q0I2ODIzNTY5NDUzNjhfMTM1OTg5ODMzNzU1Ml9GaXJlZm94"); Gelöscht : user_pref("CT3241949.cbcountry_001.enc", "REU="); Gelöscht : user_pref("CT3241949.cbfirsttime.enc", "TW9uIEphbiAyOCAyMDEzIDA4OjMyOjQ2IEdNVCswMTAw"); Gelöscht : user_pref("CT3241949.countryCode", "DE"); Gelöscht : user_pref("CT3241949.enableAlerts", "never"); Gelöscht : user_pref("CT3241949.enableFix404ByUser", "FALSE"); Gelöscht : user_pref("CT3241949.event_data.enc", "JTVCJTVE"); Gelöscht : user_pref("CT3241949.fired_events.enc", ""); Gelöscht : user_pref("CT3241949.firstTimeDialogOpened", "true"); Gelöscht : user_pref("CT3241949.fixPageNotFoundErrorByUser", "TRUE"); Gelöscht : user_pref("CT3241949.fixPageNotFoundErrorInHidden", "true"); Gelöscht : user_pref("CT3241949.fixUrls", true); Gelöscht : user_pref("CT3241949.fullUserID", "UN15730150696318691.UP.20130626051416"); Gelöscht : user_pref("CT3241949.homepageuserchanged", true); Gelöscht : user_pref("CT3241949.hxxp___www_socialgrowthtechnologies_com_couponbuddy_v001.APP_WIN_FEATURES.enc",[...] Gelöscht : user_pref("CT3241949.installType", "Unknown"); Gelöscht : user_pref("CT3241949.isCheckedStartAsHidden", true); Gelöscht : user_pref("CT3241949.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); Gelöscht : user_pref("CT3241949.isFirstTimeToolbarLoading", "false"); Gelöscht : user_pref("CT3241949.isPerformedSmartBarTransition", "true"); Gelöscht : user_pref("CT3241949.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); Gelöscht : user_pref("CT3241949.key_date.enc", "MTQ="); Gelöscht : user_pref("CT3241949.keyword", true); Gelöscht : user_pref("CT3241949.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...] Gelöscht : user_pref("CT3241949.lastVersion", "10.16.70.505"); Gelöscht : user_pref("CT3241949.mam_gk_appStateReportTime.enc", "MTM3Mzc3ODUwMDkzOQ=="); Gelöscht : user_pref("CT3241949.mam_gk_appState_CouponBuddy.enc", "b24="); Gelöscht : user_pref("CT3241949.mam_gk_appState_Easytobook.enc", "b24="); Gelöscht : user_pref("CT3241949.mam_gk_appState_Easytobook_targeted.enc", "b24="); Gelöscht : user_pref("CT3241949.mam_gk_appState_PriceGong.enc", "b24="); Gelöscht : user_pref("CT3241949.mam_gk_appState_WindowShopper.enc", "b24="); Gelöscht : user_pref("CT3241949.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9w[...] Gelöscht : user_pref("CT3241949.mam_gk_appsDefaultEnabled.enc", "bnVsbA=="); Gelöscht : user_pref("CT3241949.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkVhc3l0b2Jvb2tfdGF[...] Gelöscht : user_pref("CT3241949.mam_gk_currentBadgeValue.enc", "MQ=="); Gelöscht : user_pref("CT3241949.mam_gk_currentVersion.enc", "MS44LjAuNA=="); Gelöscht : user_pref("CT3241949.mam_gk_first_time.enc", "MQ=="); Gelöscht : user_pref("CT3241949.mam_gk_lastLoginTime.enc", "MTM3Mzc3ODQ5ODM2OQ=="); Gelöscht : user_pref("CT3241949.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50[...] Gelöscht : user_pref("CT3241949.mam_gk_newApps.enc", "W10="); Gelöscht : user_pref("CT3241949.mam_gk_pgUnloadedOnce.enc", "dHJ1ZQ=="); Gelöscht : user_pref("CT3241949.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVyd[...] Gelöscht : user_pref("CT3241949.mam_gk_settings1.6.0.1.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVyd[...] Gelöscht : user_pref("CT3241949.mam_gk_settings1.8.0.4.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVyd[...] Gelöscht : user_pref("CT3241949.mam_gk_showCloseButton.enc", "dHJ1ZQ=="); Gelöscht : user_pref("CT3241949.mam_gk_showWelcomeGadget.enc", "ZmFsc2U="); Gelöscht : user_pref("CT3241949.mam_gk_userId.enc", "YzMwYjBmMTItYmY4Zi00NmNiLTk2ZTMtMDkxOTIxMzVkYWQw"); Gelöscht : user_pref("CT3241949.migrateAppsAndComponents", true); Gelöscht : user_pref("CT3241949.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Ffilepony.de%2Fdo[...] Gelöscht : user_pref("CT3241949.originalHomepage", "hxxp://mystart.incredibar.com/mb203?a=6PR5n8LgqC&i=26|hxxp:[...] Gelöscht : user_pref("CT3241949.originalSearchAddressUrl", "hxxp://www.browsersafesearch.com?client=mozilla-fir[...] Gelöscht : user_pref("CT3241949.personalApps", "{\"dataType\":\"object\",\"data\":\"[\\\"BROWSER_COMPONENT\\\"][...] Gelöscht : user_pref("CT3241949.revertSettingsEnabled", "false"); Gelöscht : user_pref("CT3241949.search.searchAppId", "129887071061272563"); Gelöscht : user_pref("CT3241949.search.searchCount", "0"); Gelöscht : user_pref("CT3241949.searchInNewTabEnabledByUser", "true"); Gelöscht : user_pref("CT3241949.searchInNewTabEnabledInHidden", "true"); Gelöscht : user_pref("CT3241949.searchSuggestEnabledByUser", "false"); Gelöscht : user_pref("CT3241949.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); Gelöscht : user_pref("CT3241949.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...] Gelöscht : user_pref("CT3241949.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...] Gelöscht : user_pref("CT3241949.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...] Gelöscht : user_pref("CT3241949.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...] Gelöscht : user_pref("CT3241949.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...] Gelöscht : user_pref("CT3241949.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...] Gelöscht : user_pref("CT3241949.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data[...] Gelöscht : user_pref("CT3241949.serviceLayer_services_Configuration_lastUpdate", "1375905943963"); Gelöscht : user_pref("CT3241949.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1373560585555"); Gelöscht : user_pref("CT3241949.serviceLayer_services_appTracking_lastUpdate", "1366432053305"); Gelöscht : user_pref("CT3241949.serviceLayer_services_appsMetadata_lastUpdate", "1373688045331"); Gelöscht : user_pref("CT3241949.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1373097777733"); Gelöscht : user_pref("CT3241949.serviceLayer_services_location_lastUpdate", "1372051053562"); Gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.14.42.7_lastUpdate", "1360773702387"); Gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.14.65.43_lastUpdate", "1363990587462"); Gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.15.0.562_lastUpdate", "1369333903243"); Gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.15.2.523_lastUpdate", "1368898203911"); Gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.16.2.509_lastUpdate", "1372127605314"); Gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.16.4.519_lastUpdate", "1374414768886"); Gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.16.70.505_lastUpdate", "1375940606357"); Gelöscht : user_pref("CT3241949.serviceLayer_services_menu_769c590835a76d075fe33b9a87a87786_lastUpdate", "13735[...] Gelöscht : user_pref("CT3241949.serviceLayer_services_menu_d32f45618f5a02bd965c56155a643855_lastUpdate", "13735[...] Gelöscht : user_pref("CT3241949.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1373097777792"); Gelöscht : user_pref("CT3241949.serviceLayer_services_searchAPI_lastUpdate", "1375905943946"); Gelöscht : user_pref("CT3241949.serviceLayer_services_serviceMap_lastUpdate", "1375905943508"); Gelöscht : user_pref("CT3241949.serviceLayer_services_setupAPI_lastUpdate", "1363976187590"); Gelöscht : user_pref("CT3241949.serviceLayer_services_toolbarContextMenu_lastUpdate", "1373097777665"); Gelöscht : user_pref("CT3241949.serviceLayer_services_toolbarSettings_lastUpdate", "1375940606696"); Gelöscht : user_pref("CT3241949.serviceLayer_services_translation_lastUpdate", "1375905943520"); Gelöscht : user_pref("CT3241949.settingsINI", true); Gelöscht : user_pref("CT3241949.showToolbarPermission", "false"); Gelöscht : user_pref("CT3241949.smartbar.CTID", "CT3241949"); Gelöscht : user_pref("CT3241949.smartbar.Uninstall", "0"); Gelöscht : user_pref("CT3241949.smartbar.homepage", true); Gelöscht : user_pref("CT3241949.smartbar.isHidden", true); Gelöscht : user_pref("CT3241949.smartbar.toolbarName", "FileConverter 1.3 "); Gelöscht : user_pref("CT3241949.toolbarBornServerTime", "28-1-2013"); Gelöscht : user_pref("CT3241949.toolbarCurrentServerTime", "8-8-2013"); Gelöscht : user_pref("CT3241949.toolbarLoginClientTime", "Sat Mar 23 2013 07:26:04 GMT+0100"); Gelöscht : user_pref("CT3241949.url_history0001.enc", "aHR0cDovL3d3dy5mYWNlYm9vay5jb20vZ3JvdXBzLzI2NjYzMTAyMzM3[...] Gelöscht : user_pref("CT3241949_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...] Gelöscht : user_pref("Smartbar.ConduitHomepagesList", ""); Gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "FileConverter 1.3 Customized Web Search"); Gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949[...] Gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT3241949"); Gelöscht : user_pref("browser.search.defaultengine", "Ask.com"); Gelöscht : user_pref("browser.search.defaultenginename", "FileConverter 1.3 Customized Web Search"); Gelöscht : user_pref("browser.search.order.1", "Search the web"); Gelöscht : user_pref("browser.search.selectedEngine", "Search the web"); Gelöscht : user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.3200[...] Gelöscht : user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.3200[...] Gelöscht : user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.3200[...] Gelöscht : user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.3200[...] Gelöscht : user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.3200[...] Gelöscht : user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.3200[...] Gelöscht : user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.3200[...] Gelöscht : user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.3200[...] Gelöscht : user_pref("extensions.delta.admin", false); Gelöscht : user_pref("extensions.delta.aflt", "babsst"); Gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}"); Gelöscht : user_pref("extensions.delta.autoRvrt", "false"); Gelöscht : user_pref("extensions.delta.bbDpng", "1"); Gelöscht : user_pref("extensions.delta.cntry", "DE"); Gelöscht : user_pref("extensions.delta.dfltLng", "de"); Gelöscht : user_pref("extensions.delta.excTlbr", false); Gelöscht : user_pref("extensions.delta.ffxUnstlRst", true); Gelöscht : user_pref("extensions.delta.hdrMd5", "ECA149727B45F4ECFB1C11933D5B3261"); Gelöscht : user_pref("extensions.delta.hpFFXOld", "hxxp://mystart.incredibar.com/mb203?a=6PR5n8LgqC&i=26"); Gelöscht : user_pref("extensions.delta.id", "5ce65770000000000000002197960fa8"); Gelöscht : user_pref("extensions.delta.instlDay", "15918"); Gelöscht : user_pref("extensions.delta.instlRef", "sst"); Gelöscht : user_pref("extensions.delta.kwURLOld", "hxxp://mystart.incredibar.com/mb203?a=6PR5n8LgqC&i=26&search[...] Gelöscht : user_pref("extensions.delta.lastVrsnTs", "1.8.22.020:55:35"); Gelöscht : user_pref("extensions.delta.newTab", false); Gelöscht : user_pref("extensions.delta.prdct", "delta"); Gelöscht : user_pref("extensions.delta.prtnrId", "delta"); Gelöscht : user_pref("extensions.delta.rvrt", "false"); Gelöscht : user_pref("extensions.delta.sg", "azb"); Gelöscht : user_pref("extensions.delta.smplGrp", "none"); Gelöscht : user_pref("extensions.delta.tlbrId", "base"); Gelöscht : user_pref("extensions.delta.tlbrSrchUrl", ""); Gelöscht : user_pref("extensions.delta.vrsn", "1.8.22.0"); Gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.22.020:55:35"); Gelöscht : user_pref("extensions.delta.vrsni", "1.8.22.0"); Gelöscht : user_pref("extensions.delta_i.babExt", ""); Gelöscht : user_pref("extensions.delta_i.babTrack", "affID=119357&tsp=4961"); Gelöscht : user_pref("extensions.delta_i.srcExt", "ss"); Gelöscht : user_pref("extensions.enabledAddons", "amo%40dealplyshopping.com:2.0,%7B78e516ef-11de-47a1-8364-a99b[...] Gelöscht : user_pref("extensions.incredibar.actvtyRptTime", "1375345899632"); Gelöscht : user_pref("extensions.incredibar.admin", false); Gelöscht : user_pref("extensions.incredibar.aflt", "orgnl"); Gelöscht : user_pref("extensions.incredibar.afterInstallRpt", "sent"); Gelöscht : user_pref("extensions.incredibar.cntry", "DE"); Gelöscht : user_pref("extensions.incredibar.dfltlng", "EN"); Gelöscht : user_pref("extensions.incredibar.dfltsrch", "false"); Gelöscht : user_pref("extensions.incredibar.did", "10674"); Gelöscht : user_pref("extensions.incredibar.envrmnt", "production"); Gelöscht : user_pref("extensions.incredibar.excTlbr", false); Gelöscht : user_pref("extensions.incredibar.hdrMd5", "8C58CDEAE81B9EAC5E2F8A08847633AF"); Gelöscht : user_pref("extensions.incredibar.hmpg", false); Gelöscht : user_pref("extensions.incredibar.hrdid", "5ce65770000000000000002197960fa8"); Gelöscht : user_pref("extensions.incredibar.id", "5ce65770000000000000002197960fa8"); Gelöscht : user_pref("extensions.incredibar.installerproductid", "26"); Gelöscht : user_pref("extensions.incredibar.instlday", "15650"); Gelöscht : user_pref("extensions.incredibar.instlref", ""); Gelöscht : user_pref("extensions.incredibar.isdcmntcmplt", "false"); Gelöscht : user_pref("extensions.incredibar.keywordurl", ""); Gelöscht : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1420:43:27"); Gelöscht : user_pref("extensions.incredibar.mntrvrsn", "1.2.0"); Gelöscht : user_pref("extensions.incredibar.newtab", "false"); Gelöscht : user_pref("extensions.incredibar.newtaburl", ""); Gelöscht : user_pref("extensions.incredibar.noFFXTlbr", false); Gelöscht : user_pref("extensions.incredibar.ppd", ""); Gelöscht : user_pref("extensions.incredibar.prdct", "incredibar"); Gelöscht : user_pref("extensions.incredibar.productid", "26"); Gelöscht : user_pref("extensions.incredibar.prtnrid", "Incredibar"); Gelöscht : user_pref("extensions.incredibar.sg", "{smplGrp}"); Gelöscht : user_pref("extensions.incredibar.smplgrp", "none"); Gelöscht : user_pref("extensions.incredibar.srch", ""); Gelöscht : user_pref("extensions.incredibar.srchprvdr", ""); Gelöscht : user_pref("extensions.incredibar.tlbrid", "base"); Gelöscht : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6R8c3bcWyk&loc=IB_T[...] Gelöscht : user_pref("extensions.incredibar.upn2", "6R8c3bcWyk"); Gelöscht : user_pref("extensions.incredibar.upn2n", "92823402307280680"); Gelöscht : user_pref("extensions.incredibar.vrsn", "1.5.11.14"); Gelöscht : user_pref("extensions.incredibar.vrsni", "1.5.11.14"); Gelöscht : user_pref("extensions.incredibar.vrsnts", "1.5.11.1420:43:27"); Gelöscht : user_pref("extensions.incredibar_i.aflt", "orgnl"); Gelöscht : user_pref("extensions.incredibar_i.dfltLng", ""); Gelöscht : user_pref("extensions.incredibar_i.did", "10674"); Gelöscht : user_pref("extensions.incredibar_i.excTlbr", false); Gelöscht : user_pref("extensions.incredibar_i.id", "5ce65770000000000000002197960fa8"); Gelöscht : user_pref("extensions.incredibar_i.installerproductid", "26"); Gelöscht : user_pref("extensions.incredibar_i.instlDay", "15650"); Gelöscht : user_pref("extensions.incredibar_i.instlRef", ""); Gelöscht : user_pref("extensions.incredibar_i.ms_url_id", ""); Gelöscht : user_pref("extensions.incredibar_i.newTab", false); Gelöscht : user_pref("extensions.incredibar_i.ppd", ""); Gelöscht : user_pref("extensions.incredibar_i.prdct", "incredibar"); Gelöscht : user_pref("extensions.incredibar_i.productid", "26"); Gelöscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar"); Gelöscht : user_pref("extensions.incredibar_i.smplGrp", "none"); Gelöscht : user_pref("extensions.incredibar_i.tlbrId", "base"); Gelöscht : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8c3bcWyk&loc=IB[...] Gelöscht : user_pref("extensions.incredibar_i.upn2", "6R8c3bcWyk"); Gelöscht : user_pref("extensions.incredibar_i.upn2n", "92823402307280680"); Gelöscht : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14"); Gelöscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1420:43:27"); Gelöscht : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14"); Gelöscht : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&CU[...] Gelöscht : user_pref("smartBar.searchInNewTabOwner", "CT3241949"); Gelöscht : user_pref("smartbar.addressBarOwnerCTID", "CT3241949"); Gelöscht : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3241949&SearchSource=13[...] Gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...] Gelöscht : user_pref("smartbar.homePageOwnerCTID", "CT3241949"); Gelöscht : user_pref("smartbar.machineId", "KB+IIB3EWTFLV31HUZ+RDSCS6JRCO129Y9NYTMTBDZHSTR6C4QAZJG6Z/+E4RZXGIN4[...] Gelöscht : user_pref("smartbar.originalHomepage", "hxxp://www.searchnu.com/406"); Gelöscht : user_pref("smartbar.originalSearchEngine", "Search the web"); Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=too[...] Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_dateValidation", "de.search-results[...] Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_product_domain", "Incredibar"); Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...] Gelöscht : user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=too[...] Gelöscht : user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_referrer", "hxxp://search.conduit.c[...] Gelöscht : user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_temp_referer", "hxxp://search.condu[...] Gelöscht : user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...] -\\ Google Chrome v [Version kann nicht ermittelt werden] Datei : C:\Users\PC-1\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] Die Datei ist sauber. ************************* AdwCleaner[S1].txt - [47756 octets] - [08/08/2013 09:32:04] ########## EOF - C:\AdwCleaner[S1].txt - [47817 octets] ########## Dann kommt der nächste Schritt: Downloade Dir bitte Malwarebytes Anti-Malware Installiere das Programm in den vorgegebenen Pfad. Windows Vista und höher: mit Rechtsklick "als Administrator starten" Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung Wenn das Update beendet wurde, aktiviere -Scan durchführen gemäß Anleitung zu Malwareybytes Anti-Malware drücke auf Scannen. Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen. Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl. Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread. Nachträglich kannst du den Bericht unter "Log Dateien" finden. Hier mein Ergebnis dazu: Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.08.02 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 10.0.9200.16635 PC-1 :: PC-1-PC [Administrator] Schutz: Aktiviert 08.08.2013 09:41:58 mbam-log-2013-08-08 (09-41-58).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 207483 Laufzeit: 9 Minute(n), 37 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKLM\SYSTEM\CurrentControlSet\Services\dealplylive (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SYSTEM\CurrentControlSet\Services\dealplylivem (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 15 C:\Users\PC-1\Downloads\Setup(1).exe (PUP.Optional.Solimba) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\setup_codec_3dx(1).exe (PUP.LoadTubes) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\setup_codec_3dx(2).exe (PUP.LoadTubes) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\setup_codec_3dx(3).exe (PUP.LoadTubes) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\setup_codec_3dx(4).exe (PUP.LoadTubes) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\setup_codec_3dx(5).exe (PUP.LoadTubes) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\setup_codec_3dx(6).exe (PUP.LoadTubes) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\setup_codec_3dx.exe (PUP.LoadTubes) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\sweetimsetup(3).exe (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\VideoPerformer(1).exe (PUP.BundleInstaller.IB) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\VideoPerformer.exe (PUP.BundleInstaller.IB) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\windows live messenger setup(1).exe (PUP.Soft32Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\PC-1\Downloads\windows live messenger setup.exe (PUP.Soft32Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Installer\2d33278.msi (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Ich bin nun beim nächsten Schritt: ESET Online Scanner Vorbereitung Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an. Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren. Los geht's Lade und starte Eset Smartinstaller Haken setzen bei YES, I accept the Terms of Use. Klick auf Start. Setze einen Haken bei "Scan archives". Gehe sicher, dass bei Remove Found Threads kein Haken gesetzt ist. Klick auf Start. Signaturen werden heruntergeladen, der Scan beginnt automatisch. Finish drücken. Schließe das Fenster von ESET. Explorer öffnen. C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert). Logfile hier posten. Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen. Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset Meine Frage bis hierher, mache ich das so alles richtig?....ich hab nun nämlich Angst bekommen, weil ich erst jetzt gelesen habe, das man nichts machen soll, was andere bei wohl ähnlich gleich aussehenden Problemen tun. Vielen Dank im Vorraus. LG Katrin |
|
08.08.2013, 10:03
| #2 |
| /// TB-Ausbilder   | Lilpack.... Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Ich habe dein Thema in Arbeit und melde mich so schnell wie möglich mit weiteren Anweisungen. |
|
08.08.2013, 10:05
| #3 |
| /// TB-Ausbilder | Lilpack.... Servus,
__________________nein, das ist nicht alles richtig so, wie du es machst... vor allem, wenn du keine Ahnung hast. ComboFix ist kein Spielzeug und sollte "nicht einfach mal so" ausgeführt werden. So geht es weiter: Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
|
08.08.2013, 10:07
| #4 |
| | Lilpack.... Vielen Dank, das ging ja super schnell, den Teamviewer hab ich bereits auf dem PC. Nun solltet ihr vielleicht auch wissen, das ich sehr unbeholfen bin, was meinen PC angeht und mich vielleicht nicht so anstelle, wie andere*lach....ich werde mir die größte Mühe geben. LG |
|
08.08.2013, 10:08
| #5 |
| /// TB-Ausbilder | Lilpack.... Servus, na dann fang mal mit FRST an... die Anleitungen haben schon hundertfach bzw. tausendfach funktioniert, du schaffst das bestimmt.  |
|
08.08.2013, 10:14
| #6 |
| | Lilpack.... FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 08-08-2013 Ran by PC-1 at 2013-08-08 11:12:47 Running from C:\Users\PC-1\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Adobe Flash Player 11 ActiveX (Version: 11.7.700.224) Adobe Flash Player 11 Plugin (Version: 11.8.800.94) Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7) Adobe Shockwave Player 11.6 (Version: 11.6.8.638) AMD APP SDK Runtime (Version: 2.5.732.1) AMD Catalyst Install Manager (Version: 3.0.842.0) AMD Drag and Drop Transcoding (Version: 2.00.0000) AMD Fuel (Version: 2011.0908.1355.23115) AMD Media Foundation Decoders (Version: 1.0.60914.1135) AMD VISION Engine Control Center (Version: 2011.0908.1355.23115) Avira Free Antivirus (Version: 13.0.0.3885) Belkin 54Mbps Wireless Network Adapter (Version: 1.00.01) Catalyst Control Center - Branding (Version: 1.00.0000) Catalyst Control Center Graphics Previews Common (Version: 2011.0908.1355.23115) Catalyst Control Center InstallProxy (Version: 2011.0908.1355.23115) CCC Help English (Version: 2011.0908.1354.23115) ccc-utility (Version: 2011.0908.1355.23115) Citrix Authentication Manager (Version: 4.0.0.53726) Citrix Receiver (DV) (Version: 13.4.0.25) Citrix Receiver (HDX Flash-Umleitung) (Version: 13.4.0.25) Citrix Receiver (USB) (Version: 13.4.0.25) Citrix Receiver (Version: 13.4.0.25) Citrix Receiver Inside (Version: 3.4.0.29585) Citrix Receiver Updater (Version: 3.4.0.29577) Citrix Receiver(Aero) (Version: 13.4.0.25) CPUID CPU-Z 1.58 ESET Online Scanner v3 EVEREST Home Edition v2.20 (Version: 2.20) Google Earth (Version: 7.1.1.1888) Google Update Helper (Version: 1.3.21.153) HWiNFO32 Version 3.88 (Version: 3.88) Java 7 Update 25 (Version: 7.0.250) Java Auto Updater (Version: 2.1.9.5) JavaFX 2.1.1 (Version: 2.1.1) LyricsWoofer Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 (Version: 1.1.4322) Microsoft .NET Framework 1.1 German Language Pack (Version: 1.1.4322) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1) Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual J# .NET Redistributable Package 1.1 (Version: 1.1.4322) Mozilla Firefox 22.0 (x86 de) (Version: 22.0) Mozilla Maintenance Service (Version: 22.0) NVIDIA Drivers (Version: 1.5) Online Plug-in (Version: 13.4.0.25) PDFCreator (Version: 1.2.3) Philips Speech Drivers (Version: 2.8.260.20) Plus-HD-1.6 (Version: 1.27.153.10) Realtek High Definition Audio Driver (Version: 6.0.1.5859) Self-Service Plug-in (Version: 3.4.0.33684) Smart PDF Converter 6.3.0.467 (Version: 6.3.0.467) Smarty Uninstaller Pro (Version: 3.0.1) SpeechMagic Citrix Extension Client (Version: 16.2.66.1) SpeechMagic TS Extension Server (Version: 16.2.66.1) swMSM (Version: 12.0.0.1) TeamViewer 8 (Version: 8.0.19617) T-Online 6.0 T-Online WLAN-Access Finder Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1) VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0) ==================== Restore Points ========================= 04-08-2013 17:00:21 Windows-Sicherung 07-08-2013 19:54:35 Wiederherstellungsvorgang ==================== Hosts content: ========================== 2009-07-14 04:04 - 2013-08-08 09:25 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {195BB844-EA23-483B-9070-6070CA3FED80} - System32\Tasks\DealPlyLiveUpdateTaskMachineUA => C:\Program Files\DealPlyLive\Update\DealPlyLive.exe No File Task: {1AC52319-04D1-44E2-95DF-F5E0EF863454} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation) Task: {24CB33D4-6723-43D7-AB5B-39FABE8F84C3} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {30C00B4E-5BBC-433C-A281-46A674FF1998} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-13] (Adobe Systems Incorporated) Task: {49677093-B168-4439-8BC2-8DF489671F54} - System32\Tasks\Plus-HD-1.6-chromeinstaller => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-chromeinstaller.exe [2013-07-30] (Plus HD) Task: {5F233F14-38A8-4F87-B90D-CD162D8FB437} - System32\Tasks\Plus-HD-1.6-firefoxinstaller => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe [2013-07-30] (Plus HD) Task: {7789A030-3577-4C99-A801-C856CAEB601E} - System32\Tasks\Plus-HD-1.6-codedownloader => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-codedownloader.exe [2013-07-30] (Plus HD) Task: {9FB603DB-4A78-4807-BB2B-4E6FCD36CD20} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation) Task: {ADB58E99-3DE9-4893-8722-E8FF3E969D19} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-09] (Google Inc.) Task: {F81CB146-6E5F-46EF-BC3C-DBAC0DF84B60} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-09] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job => C:\Program Files\DealPlyLive\Update\DealPlyLive.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\Plus-HD-1.6-chromeinstaller.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-chromeinstaller.exe Task: C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-codedownloader.exe Task: C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/08/2013 10:05:45 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT) Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich. Error: (08/08/2013 10:00:47 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (08/08/2013 09:35:40 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (08/08/2013 09:07:57 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (08/08/2013 07:31:24 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (08/08/2013 07:31:02 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (08/08/2013 07:30:28 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (08/08/2013 07:29:19 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (08/08/2013 07:25:53 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (08/07/2013 10:03:08 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. System errors: ============= Error: (08/08/2013 09:59:56 AM) (Source: atikmdag) (User: ) Description: Display is not active Error: (08/08/2013 09:59:56 AM) (Source: atikmdag) (User: ) Description: CPLIB :: General - Invalid Parameter Error: (08/08/2013 09:36:32 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "DealPly Live-Dienst (dealplylive)" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (08/08/2013 09:34:12 AM) (Source: atikmdag) (User: ) Description: Display is not active Error: (08/08/2013 09:34:12 AM) (Source: atikmdag) (User: ) Description: CPLIB :: General - Invalid Parameter Error: (08/08/2013 09:25:48 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (08/08/2013 09:22:06 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (08/08/2013 09:17:17 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (08/08/2013 09:07:40 AM) (Source: atikmdag) (User: ) Description: Display is not active Error: (08/08/2013 09:07:40 AM) (Source: atikmdag) (User: ) Description: CPLIB :: General - Invalid Parameter Microsoft Office Sessions: ========================= Error: (08/08/2013 10:05:45 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT) Description: Performance1637070000000000000000000009030000 Error: (08/08/2013 10:00:47 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 Error: (08/08/2013 09:35:40 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 Error: (08/08/2013 09:07:57 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 Error: (08/08/2013 07:31:24 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 Error: (08/08/2013 07:31:02 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 Error: (08/08/2013 07:30:28 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 Error: (08/08/2013 07:29:19 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 Error: (08/08/2013 07:25:53 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 Error: (08/07/2013 10:03:08 PM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 ==================== Memory info =========================== Percentage of memory in use: 57% Total physical RAM: 2046.49 MB Available physical RAM: 863.1 MB Total Pagefile: 4092.98 MB Available Pagefile: 2506.94 MB Total Virtual: 2047.88 MB Available Virtual: 1904.07 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:74.52 GB) (Free:43.67 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive e: () (Fixed) (Total:232.88 GB) (Free:115.39 GB) NTFS Drive f: (UDISK PRO) (Removable) (Total:3.72 GB) (Free:3.55 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: 785E785E) Partition 1: (Active) - (Size=75 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 233 GB) (Disk ID: AB6FAB6F) Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (Size: 4 GB) (Disk ID: F7E2177D) Partition 1: (Not Active) - (Size=4 GB) - (Type=0C) ==================== End Of Log ============================ So, hier das zweite..... FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-08-2013
Ran by PC-1 (administrator) on 08-08-2013 11:11:54
Running from C:\Users\PC-1\Downloads
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\Receiver\Receiver.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\wfcrun32.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(ESET) C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe
() C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avcenter.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-09-08] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7514656 2009-05-22] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-05-22] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-30] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ConnectionCenter] - C:\Program Files\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {E79B759E-8EEE-4A63-86ED-E7A285B725E5} URL = hxxp://search.sweetim.com/search.asp?src=6&st=1&q={searchTerms}&barid={85346285-2E7E-411A-88CA-E01009B3C75E}
SearchScopes: HKCU - {A331FC9D-A7F1-4B5C-B572-02DEFBCFE044} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=95933ff2-fbd1-48ec-b00a-5b627cf52413&apn_sauid=A27859B1-51EA-4A0E-83B9-299D92FB3C3F
SearchScopes: HKCU - {D3DD8A1C-DA89-43FE-A433-F9EF1A7CFE36} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {E79B759E-8EEE-4A63-86ED-E7A285B725E5} URL = hxxp://search.sweetim.com/search.asp?src=6&st=1&q={searchTerms}&barid={85346285-2E7E-411A-88CA-E01009B3C75E}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - !{DFEFCDEE-CF1A-4FC8-88AD-129872198372} - No File
Toolbar: HKCU -No Name - {00000000-0000-0000-0000-000000000000} - No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: msdaipp - No CLSID Value -
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF Plugin: @Citrix.com/npican - C:\Program Files\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\PC-1\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\Extensions\6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com
FF Extension: tl_r - C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\Extensions\tl_r@jetpack.xpi
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [crossriderapp498@crossrider.com] C:\Users\PC-1\AppData\Local\RewardsArcade\498\Firefox
FF HKCU\...\Firefox\Extensions: [Lyrics@LyricsContainer.co] C:\Program Files\LyricsContainer\125.xpi
FF HKCU\...\Firefox\Extensions: [lwoofer@lyricswoofer.co] C:\Program Files\LyricsWoofer\125.xpi
Chrome:
=======
CHR Extension: (Plus-HD-1.6) - C:\Users\PC-1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidjhchcblhlapbcpheibgdjkajekhbh\1.23.35_0
CHR HKLM\...\Chrome\Extension: [bgnnidmnbdkmhfkjgdnngciimpdgohok] - C:\Program Files\FirstRowSportApp.com\stv11.crx
CHR HKLM\...\Chrome\Extension: [jnikkfemnfogahcandhlchoengjbeaij] - C:\Program Files\LyricsWoofer\125.crx
CHR HKLM\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files\Perion\ChromeInfoBar\ChromeInfoBar.crx
========================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2011-09-08] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-30] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-07-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-07-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-07-30] (Avira Operations GmbH & Co. KG)
R2 cpuz135; C:\Windows\system32\drivers\cpuz135_x32.sys [21992 2010-11-09] (CPUID)
S3 EverestDriver; C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [7168 2005-08-18] ()
R1 HWiNFO32; C:\Program Files\HWiNFO32\HWiNFO32.SYS [21624 2011-09-22] (REALiX(tm))
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-07-30] (Avira GmbH)
S3 catchme; \??\C:\Users\PC-1\AppData\Local\Temp\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-08 11:10 - 2013-08-08 11:10 - 01229980 _____ (Farbar) C:\Users\PC-1\Downloads\FRST.exe
2013-08-08 10:05 - 2013-08-08 10:05 - 00000000 ____D C:\Program Files\ESET
2013-08-08 10:04 - 2013-08-08 10:04 - 02347384 _____ (ESET) C:\Users\PC-1\Downloads\esetsmartinstaller_enu.exe
2013-08-08 09:40 - 2013-08-08 09:40 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\Malwarebytes
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-08 09:40 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-08 09:39 - 2013-08-08 09:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\PC-1\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-08 09:36 - 2013-08-08 09:36 - 00047887 _____ C:\Users\PC-1\Desktop\AdwCleaner[S1].txt
2013-08-08 09:32 - 2013-08-08 09:32 - 00047887 _____ C:\AdwCleaner[S1].txt
2013-08-08 09:32 - 2013-08-08 09:32 - 00000130 _____ C:\Windows\DeleteOnReboot.bat
2013-08-08 09:31 - 2013-08-08 09:31 - 00666633 _____ C:\Users\PC-1\Downloads\adwcleaner.exe
2013-08-08 09:28 - 2013-08-08 09:28 - 00020663 _____ C:\Users\PC-1\Desktop\suchlauf.txt
2013-08-08 09:27 - 2013-08-08 09:27 - 00020663 _____ C:\ComboFix.txt
2013-08-08 09:15 - 2013-08-08 09:27 - 00000000 ____D C:\Qoobox
2013-08-08 09:15 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-08 09:15 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-08 09:15 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-08 09:14 - 2013-08-08 09:26 - 00000000 ____D C:\Windows\erdnt
2013-08-08 09:10 - 2013-08-08 09:10 - 05100713 ____R (Swearware) C:\Users\PC-1\Downloads\ComboFix.exe
2013-08-07 21:43 - 2013-08-07 21:43 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 07.08.2013.xls
2013-08-06 12:41 - 2013-08-06 23:40 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 06.08.2013.xls
2013-08-05 23:33 - 2013-08-05 23:33 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 05.08.2013.xls
2013-08-03 17:12 - 2013-08-03 17:12 - 00007605 _____ C:\Users\PC-1\AppData\Local\Resmon.ResmonCfg
2013-08-01 21:08 - 2013-08-01 21:08 - 00002170 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-01 20:55 - 2013-08-01 20:54 - 00817280 _____ C:\Users\PC-1\Downloads\adblock-plus.xpi
2013-08-01 20:53 - 2013-08-01 20:53 - 00617824 _____ C:\Users\PC-1\Downloads\adblock-plus.exe
2013-08-01 17:50 - 2013-08-07 21:44 - 00044032 _____ C:\Users\PC-1\Desktop\Nordseeklinik August für mich.xls
2013-08-01 17:44 - 2013-08-01 17:48 - 00000000 ____D C:\Users\PC-1\Desktop\Nordsee Juli
2013-08-01 10:26 - 2013-08-08 09:59 - 00000896 _____ C:\Windows\setupact.log
2013-08-01 10:26 - 2013-08-01 10:26 - 00000000 _____ C:\Windows\setuperr.log
2013-08-01 01:01 - 2013-08-01 01:01 - 00043520 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik -Katrin juli 2013.xls
2013-07-30 17:24 - 2013-07-30 17:24 - 00000000 ____D C:\ProgramData\Citrix
2013-07-30 17:23 - 2013-07-30 17:23 - 00000000 ____D C:\Program Files\Common Files\Citrix
2013-07-30 16:52 - 2013-07-30 16:52 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\Avira
2013-07-30 16:05 - 2013-07-30 16:05 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-07-30 15:59 - 2013-07-30 15:59 - 00002012 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-30 15:59 - 2013-07-30 15:59 - 00000000 ____D C:\ProgramData\Avira
2013-07-30 15:59 - 2013-07-30 15:59 - 00000000 ____D C:\Program Files\Avira
2013-07-30 15:59 - 2013-07-30 15:56 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-30 15:59 - 2013-07-30 15:56 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-30 15:59 - 2013-07-30 15:56 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-30 15:54 - 2013-07-30 15:54 - 02092792 _____ C:\Users\PC-1\Downloads\avira_free_antivirus(1).exe
2013-07-30 15:06 - 2013-07-30 15:08 - 00001090 _____ C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job
2013-07-30 15:04 - 2013-08-08 10:00 - 00001882 _____ C:\Windows\Tasks\Plus-HD-1.6-chromeinstaller.job
2013-07-30 15:04 - 2013-08-08 10:00 - 00001806 _____ C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
2013-07-30 15:04 - 2013-07-30 15:05 - 00000000 ____D C:\Program Files\Plus-HD-1.6
2013-07-30 15:04 - 2013-07-30 15:04 - 00000000 ____D C:\Users\PC-1\Qtrax
2013-07-30 14:59 - 2013-07-30 15:00 - 110095128 _____ C:\Users\PC-1\Downloads\avira_professional_security_en.exe
2013-07-24 17:00 - 2013-07-24 17:00 - 00533469 _____ C:\Users\PC-1\Downloads\noscript-2.6.6.9.zip
2013-07-24 15:28 - 2013-07-24 15:28 - 53565824 _____ (Citrix Systems, Inc.) C:\Users\PC-1\Downloads\CitrixReceiverWeb.exe
2013-07-24 14:39 - 2013-08-08 10:44 - 00000890 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-07-24 14:39 - 2013-07-24 14:39 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2013-07-12 19:44 - 2013-07-24 15:47 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\TeamViewer
2013-07-10 22:43 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-10 22:43 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-10 22:43 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-10 22:43 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 20:51 - 2013-07-10 20:51 - 00001120 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-07-10 20:51 - 2013-07-10 20:51 - 00000000 ____D C:\Program Files\TeamViewer
2013-07-10 20:50 - 2013-07-10 20:51 - 05487912 _____ (TeamViewer GmbH) C:\Users\PC-1\Downloads\TeamViewer_Setup_de_8.0.19617.exe
2013-07-10 20:28 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 20:27 - 2013-06-05 05:05 - 02347520 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 20:27 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 20:27 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-09 21:18 - 2013-07-09 21:18 - 00000000 ____D C:\Users\PC-1\AppData\Local\Downloaded Installations
2013-07-09 21:12 - 2013-07-30 17:31 - 00000093 _____ C:\Users\PC-1\AppData\Roaming\ARCompanion.log
2013-07-09 21:10 - 2013-07-09 21:10 - 00000000 ____D C:\Users\PC-1\Desktop\4
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\3
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\2
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\1
2013-07-09 21:00 - 2013-08-07 21:57 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\ICAClient
2013-07-09 20:59 - 2013-07-30 17:24 - 00000000 ____D C:\Users\PC-1\AppData\Local\Citrix
2013-07-09 20:59 - 2013-07-30 17:24 - 00000000 ____D C:\Program Files\Citrix
118
==================== One Month Modified Files and Folders =======
2013-08-08 11:11 - 2013-08-08 11:11 - 00000000 ____D C:\FRST
2013-08-08 11:10 - 2013-08-08 11:10 - 01229980 _____ (Farbar) C:\Users\PC-1\Downloads\FRST.exe
2013-08-08 11:07 - 2013-06-09 20:52 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-08 11:07 - 2012-03-30 16:21 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-08 10:44 - 2013-07-24 14:39 - 00000890 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-08 10:07 - 2009-07-14 06:34 - 00013216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-08 10:07 - 2009-07-14 06:34 - 00013216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-08 10:05 - 2013-08-08 10:05 - 00000000 ____D C:\Program Files\ESET
2013-08-08 10:05 - 2011-08-18 14:06 - 00337386 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-08 10:04 - 2013-08-08 10:04 - 02347384 _____ (ESET) C:\Users\PC-1\Downloads\esetsmartinstaller_enu.exe
2013-08-08 10:00 - 2013-07-30 15:04 - 00001882 _____ C:\Windows\Tasks\Plus-HD-1.6-chromeinstaller.job
2013-08-08 10:00 - 2013-07-30 15:04 - 00001806 _____ C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
2013-08-08 10:00 - 2013-06-09 20:52 - 00001090 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-08 10:00 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-08 09:59 - 2013-08-01 10:26 - 00000896 _____ C:\Windows\setupact.log
2013-08-08 09:59 - 2011-10-21 05:36 - 00269758 _____ C:\Windows\PFRO.log
2013-08-08 09:59 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\security
2013-08-08 09:58 - 2011-08-18 13:55 - 01655657 _____ C:\Windows\WindowsUpdate.log
2013-08-08 09:40 - 2013-08-08 09:40 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\Malwarebytes
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-08 09:39 - 2013-08-08 09:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\PC-1\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-08 09:36 - 2013-08-08 09:36 - 00047887 _____ C:\Users\PC-1\Desktop\AdwCleaner[S1].txt
2013-08-08 09:32 - 2013-08-08 09:32 - 00047887 _____ C:\AdwCleaner[S1].txt
2013-08-08 09:32 - 2013-08-08 09:32 - 00000130 _____ C:\Windows\DeleteOnReboot.bat
2013-08-08 09:31 - 2013-08-08 09:31 - 00666633 _____ C:\Users\PC-1\Downloads\adwcleaner.exe
2013-08-08 09:28 - 2013-08-08 09:28 - 00020663 _____ C:\Users\PC-1\Desktop\suchlauf.txt
2013-08-08 09:27 - 2013-08-08 09:27 - 00020663 _____ C:\ComboFix.txt
2013-08-08 09:27 - 2013-08-08 09:15 - 00000000 ____D C:\Qoobox
2013-08-08 09:27 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-08-08 09:26 - 2013-08-08 09:14 - 00000000 ____D C:\Windows\erdnt
2013-08-08 09:25 - 2011-08-18 14:02 - 00000000 ____D C:\Users\PC-1
2013-08-08 09:25 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-08-08 09:10 - 2013-08-08 09:10 - 05100713 ____R (Swearware) C:\Users\PC-1\Downloads\ComboFix.exe
2013-08-07 21:58 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\wfp
2013-08-07 21:57 - 2013-07-09 21:00 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\ICAClient
2013-08-07 21:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-08-07 21:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-08-07 21:44 - 2013-08-01 17:50 - 00044032 _____ C:\Users\PC-1\Desktop\Nordseeklinik August für mich.xls
2013-08-07 21:43 - 2013-08-07 21:43 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 07.08.2013.xls
2013-08-06 23:40 - 2013-08-06 12:41 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 06.08.2013.xls
2013-08-05 23:33 - 2013-08-05 23:33 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 05.08.2013.xls
2013-08-03 17:12 - 2013-08-03 17:12 - 00007605 _____ C:\Users\PC-1\AppData\Local\Resmon.ResmonCfg
2013-08-01 21:08 - 2013-08-01 21:08 - 00002170 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-01 21:08 - 2011-12-06 22:27 - 00000000 ____D C:\Program Files\Google
2013-08-01 20:54 - 2013-08-01 20:55 - 00817280 _____ C:\Users\PC-1\Downloads\adblock-plus.xpi
2013-08-01 20:53 - 2013-08-01 20:53 - 00617824 _____ C:\Users\PC-1\Downloads\adblock-plus.exe
2013-08-01 17:48 - 2013-08-01 17:44 - 00000000 ____D C:\Users\PC-1\Desktop\Nordsee Juli
2013-08-01 10:39 - 2011-10-29 13:19 - 00000000 ____D C:\Users\PC-1\Desktop\Pro6100IW_Alles
2013-08-01 10:26 - 2013-08-01 10:26 - 00000000 _____ C:\Windows\setuperr.log
2013-08-01 10:21 - 2010-11-07 14:01 - 00000000 ___RD C:\Programme
2013-08-01 07:12 - 2011-12-18 03:49 - 00000000 ____D C:\Users\PC-1\Desktop\bewerbung
2013-08-01 06:50 - 2011-11-07 14:19 - 00000000 ____D C:\Users\PC-1\Desktop\ich
2013-08-01 01:01 - 2013-08-01 01:01 - 00043520 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik -Katrin juli 2013.xls
2013-07-30 17:31 - 2013-07-09 21:12 - 00000093 _____ C:\Users\PC-1\AppData\Roaming\ARCompanion.log
2013-07-30 17:24 - 2013-07-30 17:24 - 00000000 ____D C:\ProgramData\Citrix
2013-07-30 17:24 - 2013-07-09 20:59 - 00000000 ____D C:\Users\PC-1\AppData\Local\Citrix
2013-07-30 17:24 - 2013-07-09 20:59 - 00000000 ____D C:\Program Files\Citrix
2013-07-30 17:23 - 2013-07-30 17:23 - 00000000 ____D C:\Program Files\Common Files\Citrix
2013-07-30 16:52 - 2013-07-30 16:52 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\Avira
2013-07-30 16:35 - 2012-03-04 16:59 - 00000000 ____D C:\Users\PC-1\AppData\Local\Unity
2013-07-30 16:05 - 2013-07-30 16:05 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-07-30 15:59 - 2013-07-30 15:59 - 00002012 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-30 15:59 - 2013-07-30 15:59 - 00000000 ____D C:\ProgramData\Avira
2013-07-30 15:59 - 2013-07-30 15:59 - 00000000 ____D C:\Program Files\Avira
2013-07-30 15:56 - 2013-07-30 15:59 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-30 15:56 - 2013-07-30 15:59 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-30 15:56 - 2013-07-30 15:59 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-30 15:56 - 2013-02-24 09:42 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-07-30 15:54 - 2013-07-30 15:54 - 02092792 _____ C:\Users\PC-1\Downloads\avira_free_antivirus(1).exe
2013-07-30 15:42 - 2011-12-18 03:50 - 00000000 ____D C:\Users\PC-1\Desktop\adipositas
2013-07-30 15:08 - 2013-07-30 15:06 - 00001090 _____ C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job
2013-07-30 15:05 - 2013-07-30 15:04 - 00000000 ____D C:\Program Files\Plus-HD-1.6
2013-07-30 15:04 - 2013-07-30 15:04 - 00000000 ____D C:\Users\PC-1\Qtrax
2013-07-30 15:00 - 2013-07-30 14:59 - 110095128 _____ C:\Users\PC-1\Downloads\avira_professional_security_en.exe
2013-07-24 17:00 - 2013-07-24 17:00 - 00533469 _____ C:\Users\PC-1\Downloads\noscript-2.6.6.9.zip
2013-07-24 15:47 - 2013-07-12 19:44 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\TeamViewer
2013-07-24 15:28 - 2013-07-24 15:28 - 53565824 _____ (Citrix Systems, Inc.) C:\Users\PC-1\Downloads\CitrixReceiverWeb.exe
2013-07-24 14:57 - 2013-06-02 11:13 - 00000000 ____D C:\Program Files\GameSpy Arcade
2013-07-24 14:56 - 2011-11-27 19:07 - 00000000 ____D C:\Users\PC-1\AppData\Local\Google
2013-07-24 14:39 - 2013-07-24 14:39 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2013-07-23 19:27 - 2009-07-14 06:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-13 15:32 - 2011-10-21 12:03 - 00000000 ____D C:\Program Files\Microsoft Office
2013-07-13 05:54 - 2012-01-10 19:39 - 00000000 ____D C:\Users\PC-1\AppData\Local\Adobe
2013-07-13 05:53 - 2012-03-30 16:21 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-07-13 05:53 - 2011-10-20 19:23 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-07-11 06:46 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-11 05:41 - 2009-07-14 06:33 - 00385464 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 05:40 - 2013-04-02 19:47 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 05:40 - 2009-07-14 10:56 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 05:40 - 2009-07-14 06:52 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 22:44 - 2009-07-14 04:04 - 00000528 _____ C:\Windows\win.ini
2013-07-10 22:40 - 2011-10-27 13:14 - 75699896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-10 21:06 - 2011-08-18 14:06 - 00094376 _____ C:\Users\PC-1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-10 20:51 - 2013-07-10 20:51 - 00001120 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-07-10 20:51 - 2013-07-10 20:51 - 00000000 ____D C:\Program Files\TeamViewer
2013-07-10 20:51 - 2013-07-10 20:50 - 05487912 _____ (TeamViewer GmbH) C:\Users\PC-1\Downloads\TeamViewer_Setup_de_8.0.19617.exe
2013-07-09 21:18 - 2013-07-09 21:18 - 00000000 ____D C:\Users\PC-1\AppData\Local\Downloaded Installations
2013-07-09 21:10 - 2013-07-09 21:10 - 00000000 ____D C:\Users\PC-1\Desktop\4
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\3
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\2
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\1
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-03 04:07
==================== End Of Log ============================
--- --- --- |
|
08.08.2013, 10:21
| #7 |
| /// TB-Ausbilder | Lilpack.... Servus, das klappt doch gut. so geht es weiter: Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
|
|
08.08.2013, 10:31
| #8 |
| | Lilpack.... Dankeschön, Du erklärst das ja auch prima :-) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 5.3.8 (08.07.2013:4) OS: Windows 7 Home Premium x86 Ran by PC-1 on 08.08.2013 at 11:26:58,05 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\dealplylive.exe Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\dealplylive Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\trolltech Successfully deleted: [Registry Key] "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\SweetIM" Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dealplylive Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A331FC9D-A7F1-4B5C-B572-02DEFBCFE044} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E79B759E-8EEE-4A63-86ED-E7A285B725E5} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{E79B759E-8EEE-4A63-86ED-E7A285B725E5} ~~~ Files Successfully deleted [File] C:\Windows\system32\Tasks\DealPlyLiveUpdateTaskMachineUA Successfully deleted: [File] "C:\Windows\system32\dmwu.exe" Successfully deleted: [File] "C:\Windows\system32\imhttpcomm.dll" Successfully deleted: [File] C:\Windows\prefetch\LYRICSWOOFERUPD.EXE-7C2673E6.pf ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\big fish games" Successfully deleted: [Folder] "C:\Users\PC-1\appdata\locallow\datamngr" Successfully deleted: [Folder] "C:\Users\PC-1\Qtrax" ~~~ FireFox Successfully deleted: [File] C:\Users\PC-1\AppData\Roaming\mozilla\firefox\profiles\2gchnwo1.default\invalidprefs.js Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\\lyrics@lyricscontainer.co Successfully deleted the following from C:\Users\PC-1\AppData\Roaming\mozilla\firefox\profiles\2gchnwo1.default\prefs.js user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.backgroundjs", "\n\n/**************************************************** user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.internaldb.cache/530e52021dc20843b1aa62957edeb9f8.value", "%22var%20adsDe user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.js", "\n\n /************************************************************ user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_1.code", "appAPI._cr_config={appID:function(){var a=appAPI user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_102.code", "if (typeof appAPI.internal.monetization === \" user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_119.code", "if (typeof appAPI.internal.monetization === \" user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_120.code", "if (typeof appAPI.internal.monetization === \" user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_123.code", "if (typeof appAPI.internal.monetization === \" user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_138.code", "if (typeof appAPI.internal.monetization === \" user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_14.name", "CrossriderUtils"); user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_21.code", "var CrossriderDebugManager=(function(h){var f={ user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_22.code", "(function(a){appAPI.queueManager={queue:[],regi user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_28.code", "var CrossriderInitializerPlugin=(function(e){va user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_47.code", "(function(){appAPI.ready=function(a){appAPI.res user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_78.name", "CrossriderInfo"); user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_87.code", "var CROSSRIDER_PLATFORM=true;var JQ=bbrsJQ=$jqu user_pref("extensions.a6c937ed6be664f729a60ce5789cc7f0953ba67122cae46e2b82195baea44e049com32002.32002.plugins.plugin_92.code", "if(typeof appAPI.internal.monetization===\"unde user_pref("extensions.crossrider.bic", "1402fb318694fbf86ee2b236c362e73a"); Emptied folder: C:\Users\PC-1\AppData\Roaming\mozilla\firefox\profiles\2gchnwo1.default\minidumps [474 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 08.08.2013 at 11:29:42,00 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ So das ist das nächste Ergebnis. |
|
08.08.2013, 10:38
| #9 |
| /// TB-Ausbilder | Lilpack.... Servus, sieht gut aus. Wir spüren die letzten Reste auf, damit wie sie später entfernen können: Schritt 1 Kontrollscan mit FRST Führe wie zuvor beschrieben einen Scan mit FRST aus. Setze dazu eine Haken bei Addition.txt rechts unten und klicke auf Scan. Es werden wieder zwei Logdateien erzeugt. Poste mir diese. Schritt 2 Lade SystemLook von jpshortstuff vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop. SystemLook (64 bit)
Gibt es noch Probleme mit Malware? Wenn ja, welche? Wie läuft der Rechner derzeit? Bitte poste mit deiner nächsten Antwort
|
|
08.08.2013, 10:49
| #10 |
| | Lilpack.... Logdatei FRST die Erste: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-08-2013
Ran by PC-1 (administrator) on 08-08-2013 11:42:40
Running from C:\Users\PC-1\Downloads
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(ESET) C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe
() C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(Citrix Systems, Inc.) C:\Users\PC-1\AppData\Local\Temp\ARCompanionForSession1.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\Receiver\Receiver.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\wfcrun32.exe
(Citrix Systems, Inc.) C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-09-08] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7514656 2009-05-22] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] - C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-05-22] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-30] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [CitrixReceiver] - "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk" [x]
HKLM\...\Run: [ConnectionCenter] - C:\Program Files\Citrix\ICA Client\concentr.exe [383544 2012-12-14] (Citrix Systems, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {D3DD8A1C-DA89-43FE-A433-F9EF1A7CFE36} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - !{DFEFCDEE-CF1A-4FC8-88AD-129872198372} - No File
Toolbar: HKCU -No Name - {00000000-0000-0000-0000-000000000000} - No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: msdaipp - No CLSID Value -
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF Plugin: @Citrix.com/npican - C:\Program Files\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\PC-1\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\Extensions\6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com
FF Extension: tl_r - C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\Extensions\tl_r@jetpack.xpi
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [crossriderapp498@crossrider.com] C:\Users\PC-1\AppData\Local\RewardsArcade\498\Firefox
FF HKCU\...\Firefox\Extensions: [lwoofer@lyricswoofer.co] C:\Program Files\LyricsWoofer\125.xpi
Chrome:
=======
CHR Extension: (Plus-HD-1.6) - C:\Users\PC-1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidjhchcblhlapbcpheibgdjkajekhbh\1.23.35_0
CHR HKLM\...\Chrome\Extension: [bgnnidmnbdkmhfkjgdnngciimpdgohok] - C:\Program Files\FirstRowSportApp.com\stv11.crx
CHR HKLM\...\Chrome\Extension: [jnikkfemnfogahcandhlchoengjbeaij] - C:\Program Files\LyricsWoofer\125.crx
CHR HKLM\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files\Perion\ChromeInfoBar\ChromeInfoBar.crx
========================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2011-09-08] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-30] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-30] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-07-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-07-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-07-30] (Avira Operations GmbH & Co. KG)
R2 cpuz135; C:\Windows\system32\drivers\cpuz135_x32.sys [21992 2010-11-09] (CPUID)
S3 EverestDriver; C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [7168 2005-08-18] ()
R1 HWiNFO32; C:\Program Files\HWiNFO32\HWiNFO32.SYS [21624 2011-09-22] (REALiX(tm))
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-07-30] (Avira GmbH)
S3 catchme; \??\C:\Users\PC-1\AppData\Local\Temp\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-08 11:36 - 2013-08-08 11:36 - 00000000 ____D C:\Program Files\Common Files\Citrix
2013-08-08 11:29 - 2013-08-08 11:31 - 00005573 _____ C:\Users\PC-1\Desktop\JRT.txt
2013-08-08 11:26 - 2013-08-08 11:26 - 00957230 _____ (Oleg N. Scherbakov) C:\Users\PC-1\Downloads\JRT.exe
2013-08-08 11:26 - 2013-08-08 11:26 - 00000000 ____D C:\Windows\ERUNT
2013-08-08 11:16 - 2013-08-08 11:16 - 00023684 _____ C:\Users\PC-1\Desktop\Addition.txt
2013-08-08 11:15 - 2013-08-08 11:15 - 00032352 _____ C:\Users\PC-1\Desktop\FRST.txt
2013-08-08 11:12 - 2013-08-08 11:13 - 00023684 _____ C:\Users\PC-1\Downloads\Addition.txt
2013-08-08 11:11 - 2013-08-08 11:11 - 00000000 ____D C:\FRST
2013-08-08 11:10 - 2013-08-08 11:10 - 01229980 _____ (Farbar) C:\Users\PC-1\Downloads\FRST.exe
2013-08-08 10:05 - 2013-08-08 10:05 - 00000000 ____D C:\Program Files\ESET
2013-08-08 10:04 - 2013-08-08 10:04 - 02347384 _____ (ESET) C:\Users\PC-1\Downloads\esetsmartinstaller_enu.exe
2013-08-08 09:40 - 2013-08-08 09:40 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\Malwarebytes
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-08 09:40 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-08 09:39 - 2013-08-08 09:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\PC-1\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-08 09:36 - 2013-08-08 09:36 - 00047887 _____ C:\Users\PC-1\Desktop\AdwCleaner[S1].txt
2013-08-08 09:32 - 2013-08-08 09:32 - 00047887 _____ C:\AdwCleaner[S1].txt
2013-08-08 09:32 - 2013-08-08 09:32 - 00000130 _____ C:\Windows\DeleteOnReboot.bat
2013-08-08 09:31 - 2013-08-08 09:31 - 00666633 _____ C:\Users\PC-1\Downloads\adwcleaner.exe
2013-08-08 09:28 - 2013-08-08 09:28 - 00020663 _____ C:\Users\PC-1\Desktop\suchlauf.txt
2013-08-08 09:27 - 2013-08-08 09:27 - 00020663 _____ C:\ComboFix.txt
2013-08-08 09:15 - 2013-08-08 09:27 - 00000000 ____D C:\Qoobox
2013-08-08 09:15 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-08 09:15 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-08 09:15 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-08 09:15 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-08 09:14 - 2013-08-08 09:26 - 00000000 ____D C:\Windows\erdnt
2013-08-08 09:10 - 2013-08-08 09:10 - 05100713 ____R (Swearware) C:\Users\PC-1\Downloads\ComboFix.exe
2013-08-07 21:43 - 2013-08-07 21:43 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 07.08.2013.xls
2013-08-06 12:41 - 2013-08-06 23:40 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 06.08.2013.xls
2013-08-05 23:33 - 2013-08-05 23:33 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 05.08.2013.xls
2013-08-03 17:12 - 2013-08-03 17:12 - 00007605 _____ C:\Users\PC-1\AppData\Local\Resmon.ResmonCfg
2013-08-01 21:08 - 2013-08-01 21:08 - 00002170 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-01 20:55 - 2013-08-01 20:54 - 00817280 _____ C:\Users\PC-1\Downloads\adblock-plus.xpi
2013-08-01 20:53 - 2013-08-01 20:53 - 00617824 _____ C:\Users\PC-1\Downloads\adblock-plus.exe
2013-08-01 17:50 - 2013-08-07 21:44 - 00044032 _____ C:\Users\PC-1\Desktop\Nordseeklinik August für mich.xls
2013-08-01 17:44 - 2013-08-01 17:48 - 00000000 ____D C:\Users\PC-1\Desktop\Nordsee Juli
2013-08-01 10:26 - 2013-08-08 09:59 - 00000896 _____ C:\Windows\setupact.log
2013-08-01 10:26 - 2013-08-01 10:26 - 00000000 _____ C:\Windows\setuperr.log
2013-08-01 01:01 - 2013-08-01 01:01 - 00043520 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik -Katrin juli 2013.xls
2013-07-30 16:52 - 2013-07-30 16:52 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\Avira
2013-07-30 16:05 - 2013-07-30 16:05 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-07-30 15:59 - 2013-07-30 15:59 - 00002012 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-30 15:59 - 2013-07-30 15:59 - 00000000 ____D C:\ProgramData\Avira
2013-07-30 15:59 - 2013-07-30 15:59 - 00000000 ____D C:\Program Files\Avira
2013-07-30 15:59 - 2013-07-30 15:56 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-30 15:59 - 2013-07-30 15:56 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-30 15:59 - 2013-07-30 15:56 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-30 15:54 - 2013-07-30 15:54 - 02092792 _____ C:\Users\PC-1\Downloads\avira_free_antivirus(1).exe
2013-07-30 15:06 - 2013-07-30 15:08 - 00001090 _____ C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job
2013-07-30 15:04 - 2013-08-08 10:00 - 00001882 _____ C:\Windows\Tasks\Plus-HD-1.6-chromeinstaller.job
2013-07-30 15:04 - 2013-08-08 10:00 - 00001806 _____ C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
2013-07-30 15:04 - 2013-07-30 15:05 - 00000000 ____D C:\Program Files\Plus-HD-1.6
2013-07-30 14:59 - 2013-07-30 15:00 - 110095128 _____ C:\Users\PC-1\Downloads\avira_professional_security_en.exe
2013-07-24 17:00 - 2013-07-24 17:00 - 00533469 _____ C:\Users\PC-1\Downloads\noscript-2.6.6.9.zip
2013-07-24 15:28 - 2013-07-24 15:28 - 53565824 _____ (Citrix Systems, Inc.) C:\Users\PC-1\Downloads\CitrixReceiverWeb.exe
2013-07-24 14:39 - 2013-08-08 10:44 - 00000890 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-07-24 14:39 - 2013-07-24 14:39 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2013-07-12 19:44 - 2013-07-24 15:47 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\TeamViewer
2013-07-10 22:43 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 22:43 - 2013-06-12 01:43 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-10 22:43 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-10 22:43 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-10 22:43 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-10 22:43 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 20:51 - 2013-07-10 20:51 - 00001120 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-07-10 20:51 - 2013-07-10 20:51 - 00000000 ____D C:\Program Files\TeamViewer
2013-07-10 20:50 - 2013-07-10 20:51 - 05487912 _____ (TeamViewer GmbH) C:\Users\PC-1\Downloads\TeamViewer_Setup_de_8.0.19617.exe
2013-07-10 20:28 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 20:27 - 2013-06-05 05:05 - 02347520 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 20:27 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 20:27 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-09 21:18 - 2013-07-09 21:18 - 00000000 ____D C:\Users\PC-1\AppData\Local\Downloaded Installations
2013-07-09 21:12 - 2013-08-08 11:35 - 00000093 _____ C:\Users\PC-1\AppData\Roaming\ARCompanion.log
2013-07-09 21:10 - 2013-07-09 21:10 - 00000000 ____D C:\Users\PC-1\Desktop\4
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\3
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\2
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\1
2013-07-09 21:00 - 2013-08-07 21:57 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\ICAClient
2013-07-09 20:59 - 2013-08-08 11:37 - 00000000 ____D C:\Users\PC-1\AppData\Local\Citrix
2013-07-09 20:59 - 2013-08-08 11:37 - 00000000 ____D C:\Program Files\Citrix
123
==================== One Month Modified Files and Folders =======
2013-08-08 11:39 - 2009-07-14 06:34 - 00013216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-08 11:39 - 2009-07-14 06:34 - 00013216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-08 11:37 - 2013-08-08 11:37 - 00000000 ____D C:\ProgramData\Citrix
2013-08-08 11:37 - 2013-07-09 20:59 - 00000000 ____D C:\Users\PC-1\AppData\Local\Citrix
2013-08-08 11:37 - 2013-07-09 20:59 - 00000000 ____D C:\Program Files\Citrix
2013-08-08 11:36 - 2013-08-08 11:36 - 00000000 ____D C:\Program Files\Common Files\Citrix
2013-08-08 11:35 - 2013-07-09 21:12 - 00000093 _____ C:\Users\PC-1\AppData\Roaming\ARCompanion.log
2013-08-08 11:31 - 2013-08-08 11:29 - 00005573 _____ C:\Users\PC-1\Desktop\JRT.txt
2013-08-08 11:27 - 2011-08-18 14:02 - 00000000 ____D C:\Users\PC-1
2013-08-08 11:26 - 2013-08-08 11:26 - 00957230 _____ (Oleg N. Scherbakov) C:\Users\PC-1\Downloads\JRT.exe
2013-08-08 11:26 - 2013-08-08 11:26 - 00000000 ____D C:\Windows\ERUNT
2013-08-08 11:16 - 2013-08-08 11:16 - 00023684 _____ C:\Users\PC-1\Desktop\Addition.txt
2013-08-08 11:15 - 2013-08-08 11:15 - 00032352 _____ C:\Users\PC-1\Desktop\FRST.txt
2013-08-08 11:14 - 2011-08-18 13:55 - 01657344 _____ C:\Windows\WindowsUpdate.log
2013-08-08 11:13 - 2013-08-08 11:12 - 00023684 _____ C:\Users\PC-1\Downloads\Addition.txt
2013-08-08 11:11 - 2013-08-08 11:11 - 00000000 ____D C:\FRST
2013-08-08 11:10 - 2013-08-08 11:10 - 01229980 _____ (Farbar) C:\Users\PC-1\Downloads\FRST.exe
2013-08-08 11:07 - 2013-06-09 20:52 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-08 11:07 - 2012-03-30 16:21 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-08 10:44 - 2013-07-24 14:39 - 00000890 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2013-08-08 10:05 - 2013-08-08 10:05 - 00000000 ____D C:\Program Files\ESET
2013-08-08 10:05 - 2011-08-18 14:06 - 00337386 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-08 10:04 - 2013-08-08 10:04 - 02347384 _____ (ESET) C:\Users\PC-1\Downloads\esetsmartinstaller_enu.exe
2013-08-08 10:00 - 2013-07-30 15:04 - 00001882 _____ C:\Windows\Tasks\Plus-HD-1.6-chromeinstaller.job
2013-08-08 10:00 - 2013-07-30 15:04 - 00001806 _____ C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
2013-08-08 10:00 - 2013-06-09 20:52 - 00001090 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-08 10:00 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-08 09:59 - 2013-08-01 10:26 - 00000896 _____ C:\Windows\setupact.log
2013-08-08 09:59 - 2011-10-21 05:36 - 00269758 _____ C:\Windows\PFRO.log
2013-08-08 09:59 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\security
2013-08-08 09:40 - 2013-08-08 09:40 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\Malwarebytes
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 09:40 - 2013-08-08 09:40 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-08 09:39 - 2013-08-08 09:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\PC-1\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-08 09:36 - 2013-08-08 09:36 - 00047887 _____ C:\Users\PC-1\Desktop\AdwCleaner[S1].txt
2013-08-08 09:32 - 2013-08-08 09:32 - 00047887 _____ C:\AdwCleaner[S1].txt
2013-08-08 09:32 - 2013-08-08 09:32 - 00000130 _____ C:\Windows\DeleteOnReboot.bat
2013-08-08 09:31 - 2013-08-08 09:31 - 00666633 _____ C:\Users\PC-1\Downloads\adwcleaner.exe
2013-08-08 09:28 - 2013-08-08 09:28 - 00020663 _____ C:\Users\PC-1\Desktop\suchlauf.txt
2013-08-08 09:27 - 2013-08-08 09:27 - 00020663 _____ C:\ComboFix.txt
2013-08-08 09:27 - 2013-08-08 09:15 - 00000000 ____D C:\Qoobox
2013-08-08 09:27 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-08-08 09:26 - 2013-08-08 09:14 - 00000000 ____D C:\Windows\erdnt
2013-08-08 09:25 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-08-08 09:10 - 2013-08-08 09:10 - 05100713 ____R (Swearware) C:\Users\PC-1\Downloads\ComboFix.exe
2013-08-07 21:58 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\wfp
2013-08-07 21:57 - 2013-07-09 21:00 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\ICAClient
2013-08-07 21:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-08-07 21:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\AppCompat
2013-08-07 21:44 - 2013-08-01 17:50 - 00044032 _____ C:\Users\PC-1\Desktop\Nordseeklinik August für mich.xls
2013-08-07 21:43 - 2013-08-07 21:43 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 07.08.2013.xls
2013-08-06 23:40 - 2013-08-06 12:41 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 06.08.2013.xls
2013-08-05 23:33 - 2013-08-05 23:33 - 00042496 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik Katrin Ernst 05.08.2013.xls
2013-08-03 17:12 - 2013-08-03 17:12 - 00007605 _____ C:\Users\PC-1\AppData\Local\Resmon.ResmonCfg
2013-08-01 21:08 - 2013-08-01 21:08 - 00002170 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-01 21:08 - 2011-12-06 22:27 - 00000000 ____D C:\Program Files\Google
2013-08-01 20:54 - 2013-08-01 20:55 - 00817280 _____ C:\Users\PC-1\Downloads\adblock-plus.xpi
2013-08-01 20:53 - 2013-08-01 20:53 - 00617824 _____ C:\Users\PC-1\Downloads\adblock-plus.exe
2013-08-01 17:48 - 2013-08-01 17:44 - 00000000 ____D C:\Users\PC-1\Desktop\Nordsee Juli
2013-08-01 10:39 - 2011-10-29 13:19 - 00000000 ____D C:\Users\PC-1\Desktop\Pro6100IW_Alles
2013-08-01 10:26 - 2013-08-01 10:26 - 00000000 _____ C:\Windows\setuperr.log
2013-08-01 10:21 - 2010-11-07 14:01 - 00000000 ___RD C:\Programme
2013-08-01 07:12 - 2011-12-18 03:49 - 00000000 ____D C:\Users\PC-1\Desktop\bewerbung
2013-08-01 06:50 - 2011-11-07 14:19 - 00000000 ____D C:\Users\PC-1\Desktop\ich
2013-08-01 01:01 - 2013-08-01 01:01 - 00043520 _____ C:\Users\PC-1\Desktop\Kopie von Nordseeklinik -Katrin juli 2013.xls
2013-07-30 16:52 - 2013-07-30 16:52 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\Avira
2013-07-30 16:35 - 2012-03-04 16:59 - 00000000 ____D C:\Users\PC-1\AppData\Local\Unity
2013-07-30 16:05 - 2013-07-30 16:05 - 00067168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-07-30 15:59 - 2013-07-30 15:59 - 00002012 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-07-30 15:59 - 2013-07-30 15:59 - 00000000 ____D C:\ProgramData\Avira
2013-07-30 15:59 - 2013-07-30 15:59 - 00000000 ____D C:\Program Files\Avira
2013-07-30 15:56 - 2013-07-30 15:59 - 00135136 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-07-30 15:56 - 2013-07-30 15:59 - 00084744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-07-30 15:56 - 2013-07-30 15:59 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-07-30 15:56 - 2013-02-24 09:42 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-07-30 15:54 - 2013-07-30 15:54 - 02092792 _____ C:\Users\PC-1\Downloads\avira_free_antivirus(1).exe
2013-07-30 15:42 - 2011-12-18 03:50 - 00000000 ____D C:\Users\PC-1\Desktop\adipositas
2013-07-30 15:08 - 2013-07-30 15:06 - 00001090 _____ C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job
2013-07-30 15:05 - 2013-07-30 15:04 - 00000000 ____D C:\Program Files\Plus-HD-1.6
2013-07-30 15:00 - 2013-07-30 14:59 - 110095128 _____ C:\Users\PC-1\Downloads\avira_professional_security_en.exe
2013-07-24 17:00 - 2013-07-24 17:00 - 00533469 _____ C:\Users\PC-1\Downloads\noscript-2.6.6.9.zip
2013-07-24 15:47 - 2013-07-12 19:44 - 00000000 ____D C:\Users\PC-1\AppData\Roaming\TeamViewer
2013-07-24 15:28 - 2013-07-24 15:28 - 53565824 _____ (Citrix Systems, Inc.) C:\Users\PC-1\Downloads\CitrixReceiverWeb.exe
2013-07-24 14:57 - 2013-06-02 11:13 - 00000000 ____D C:\Program Files\GameSpy Arcade
2013-07-24 14:56 - 2011-11-27 19:07 - 00000000 ____D C:\Users\PC-1\AppData\Local\Google
2013-07-24 14:39 - 2013-07-24 14:39 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2013-07-23 19:27 - 2009-07-14 06:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-13 15:32 - 2011-10-21 12:03 - 00000000 ____D C:\Program Files\Microsoft Office
2013-07-13 05:54 - 2012-01-10 19:39 - 00000000 ____D C:\Users\PC-1\AppData\Local\Adobe
2013-07-13 05:53 - 2012-03-30 16:21 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-07-13 05:53 - 2011-10-20 19:23 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-07-11 06:46 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-11 05:41 - 2009-07-14 06:33 - 00385464 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 05:40 - 2013-04-02 19:47 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 05:40 - 2009-07-14 10:56 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 05:40 - 2009-07-14 06:52 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 22:44 - 2009-07-14 04:04 - 00000528 _____ C:\Windows\win.ini
2013-07-10 22:40 - 2011-10-27 13:14 - 75699896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-10 21:06 - 2011-08-18 14:06 - 00094376 _____ C:\Users\PC-1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-10 20:51 - 2013-07-10 20:51 - 00001120 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-07-10 20:51 - 2013-07-10 20:51 - 00000000 ____D C:\Program Files\TeamViewer
2013-07-10 20:51 - 2013-07-10 20:50 - 05487912 _____ (TeamViewer GmbH) C:\Users\PC-1\Downloads\TeamViewer_Setup_de_8.0.19617.exe
2013-07-09 21:18 - 2013-07-09 21:18 - 00000000 ____D C:\Users\PC-1\AppData\Local\Downloaded Installations
2013-07-09 21:10 - 2013-07-09 21:10 - 00000000 ____D C:\Users\PC-1\Desktop\4
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\3
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\2
2013-07-09 21:09 - 2013-07-09 21:09 - 00000000 ____D C:\Users\PC-1\Desktop\1
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-03 04:07
==================== End Of Log ============================
Die Zweite: Additional scan result of Farbar Recovery Scan Tool (x86) Version: 08-08-2013 Ran by PC-1 at 2013-08-08 11:43:26 Running from C:\Users\PC-1\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Adobe Flash Player 11 ActiveX (Version: 11.7.700.224) Adobe Flash Player 11 Plugin (Version: 11.8.800.94) Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7) Adobe Shockwave Player 11.6 (Version: 11.6.8.638) AMD APP SDK Runtime (Version: 2.5.732.1) AMD Catalyst Install Manager (Version: 3.0.842.0) AMD Drag and Drop Transcoding (Version: 2.00.0000) AMD Fuel (Version: 2011.0908.1355.23115) AMD Media Foundation Decoders (Version: 1.0.60914.1135) AMD VISION Engine Control Center (Version: 2011.0908.1355.23115) Avira Free Antivirus (Version: 13.0.0.3885) Belkin 54Mbps Wireless Network Adapter (Version: 1.00.01) Catalyst Control Center - Branding (Version: 1.00.0000) Catalyst Control Center Graphics Previews Common (Version: 2011.0908.1355.23115) Catalyst Control Center InstallProxy (Version: 2011.0908.1355.23115) CCC Help English (Version: 2011.0908.1354.23115) ccc-utility (Version: 2011.0908.1355.23115) Citrix Authentication Manager (Version: 4.0.0.53726) Citrix Receiver (DV) (Version: 13.4.0.25) Citrix Receiver (HDX Flash-Umleitung) (Version: 13.4.0.25) Citrix Receiver (USB) (Version: 13.4.0.25) Citrix Receiver (Version: 13.4.0.25) Citrix Receiver Inside (Version: 3.4.0.29585) Citrix Receiver Updater (Version: 3.4.0.29577) Citrix Receiver(Aero) (Version: 13.4.0.25) CPUID CPU-Z 1.58 ESET Online Scanner v3 EVEREST Home Edition v2.20 (Version: 2.20) Google Earth (Version: 7.1.1.1888) Google Update Helper (Version: 1.3.21.153) HWiNFO32 Version 3.88 (Version: 3.88) Java 7 Update 25 (Version: 7.0.250) Java Auto Updater (Version: 2.1.9.5) JavaFX 2.1.1 (Version: 2.1.1) LyricsWoofer Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 (Version: 1.1.4322) Microsoft .NET Framework 1.1 German Language Pack (Version: 1.1.4322) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1) Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual J# .NET Redistributable Package 1.1 (Version: 1.1.4322) Mozilla Firefox 22.0 (x86 de) (Version: 22.0) Mozilla Maintenance Service (Version: 22.0) NVIDIA Drivers (Version: 1.5) Online Plug-in (Version: 13.4.0.25) PDFCreator (Version: 1.2.3) Philips Speech Drivers (Version: 2.8.260.20) Plus-HD-1.6 (Version: 1.27.153.10) Realtek High Definition Audio Driver (Version: 6.0.1.5859) Self-Service Plug-in (Version: 3.4.0.33684) Smart PDF Converter 6.3.0.467 (Version: 6.3.0.467) Smarty Uninstaller Pro (Version: 3.0.1) SpeechMagic Citrix Extension Client (Version: 16.2.66.1) SpeechMagic TS Extension Server (Version: 16.2.66.1) swMSM (Version: 12.0.0.1) TeamViewer 8 (Version: 8.0.19617) T-Online 6.0 T-Online WLAN-Access Finder Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1) VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0) ==================== Restore Points ========================= 04-08-2013 17:00:21 Windows-Sicherung 07-08-2013 19:54:35 Wiederherstellungsvorgang ==================== Hosts content: ========================== 2009-07-14 04:04 - 2013-08-08 09:25 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {195BB844-EA23-483B-9070-6070CA3FED80} - \DealPlyLiveUpdateTaskMachineUA No Task File Task: {1AC52319-04D1-44E2-95DF-F5E0EF863454} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation) Task: {24CB33D4-6723-43D7-AB5B-39FABE8F84C3} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {30C00B4E-5BBC-433C-A281-46A674FF1998} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-13] (Adobe Systems Incorporated) Task: {49677093-B168-4439-8BC2-8DF489671F54} - System32\Tasks\Plus-HD-1.6-chromeinstaller => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-chromeinstaller.exe [2013-07-30] (Plus HD) Task: {5F233F14-38A8-4F87-B90D-CD162D8FB437} - System32\Tasks\Plus-HD-1.6-firefoxinstaller => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe [2013-07-30] (Plus HD) Task: {7789A030-3577-4C99-A801-C856CAEB601E} - System32\Tasks\Plus-HD-1.6-codedownloader => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-codedownloader.exe [2013-07-30] (Plus HD) Task: {9FB603DB-4A78-4807-BB2B-4E6FCD36CD20} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation) Task: {ADB58E99-3DE9-4893-8722-E8FF3E969D19} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-09] (Google Inc.) Task: {F81CB146-6E5F-46EF-BC3C-DBAC0DF84B60} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-06-09] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job => C:\Program Files\DealPlyLive\Update\DealPlyLive.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\Plus-HD-1.6-chromeinstaller.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-chromeinstaller.exe Task: C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-codedownloader.exe Task: C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/08/2013 11:37:19 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Fehler in Manifest- oder Richtliniendatei "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"2" in Zeile Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0". Definition: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. System errors: ============= Microsoft Office Sessions: ========================= Error: (08/08/2013 11:37:19 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"Microsoft.VC80.MFCLOC,processorA rchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\Citrix\ICA Client\MFC80.DLLC:\Program Files\Citrix\ICA Client\Microsoft.VC80.MFCLOC.MANIFEST5 ==================== Memory info =========================== Percentage of memory in use: 54% Total physical RAM: 2046.49 MB Available physical RAM: 940.44 MB Total Pagefile: 4092.98 MB Available Pagefile: 2713.97 MB Total Virtual: 2047.88 MB Available Virtual: 1900.07 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:74.52 GB) (Free:43.6 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive e: () (Fixed) (Total:232.88 GB) (Free:115.39 GB) NTFS Drive f: (UDISK PRO) (Removable) (Total:3.72 GB) (Free:3.55 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: 785E785E) Partition 1: (Active) - (Size=75 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 233 GB) (Disk ID: AB6FAB6F) Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (Size: 4 GB) (Disk ID: F7E2177D) Partition 1: (Not Active) - (Size=4 GB) - (Type=0C) ==================== End Of Log ============================ Nächster Schritt: Schritt 2 Lade SystemLook von jpshortstuff vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop. SystemLook (64 bit) Das geht leider nicht, ich habe nur 32 bit und bekomme darauf hin auch eine Fehlermeldung, das ich mir die Eigenschaften meines PC anschauen soll. |
|
08.08.2013, 11:03
| #11 | |
| /// TB-Ausbilder | Lilpack.... Servus, Zitat:
Lade SystemLook von jpshortstuff vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit)
|
|
08.08.2013, 11:15
| #12 |
| | Lilpack.... Püüü....dann war ja gut...so das nächste Ergebnis : SystemLook 30.07.11 by jpshortstuff Log created at 12:05 on 08/08/2013 by PC-1 Administrator - Elevation successful ========== filefind ========== Searching for "*dealply*" C:\Qoobox\Quarantine\C\Program Files\DealPly\DealPly.crx.vir --a---- 51067 bytes [19:38 30/04/2013] [11:25 04/06/2013] 29FC84C64F635CD17446505A7F6255CB C:\Qoobox\Quarantine\C\Program Files\DealPly\DealPly.xpi.vir --a---- 4126 bytes [19:38 30/04/2013] [11:25 04/06/2013] 27B770456F15DB758E4AD201B157A2A6 C:\Qoobox\Quarantine\C\Program Files\DealPly\DealPlyIE.dll.vir --a---- 100384 bytes [19:38 30/04/2013] [11:25 04/06/2013] 4CB5A572328504FFD7A579DACBF41FB2 C:\Qoobox\Quarantine\C\Program Files\DealPly\DealPlyIE64.dll.vir --a---- 0 bytes [12:39 24/07/2013] [11:26 04/06/2013] D41D8CD98F00B204E9800998ECF8427E C:\Qoobox\Quarantine\C\Program Files\DealPly\DealPlyUpdateVer.exe.vir --a---- 102968 bytes [12:39 24/07/2013] [21:45 03/06/2013] 311BCE25242D9D00CBD7BB9D8B6E1315 C:\Qoobox\Quarantine\Registry_backups\AddRemove-DealPly.reg.dat --a---- 1072 bytes [07:27 08/08/2013] [07:27 08/08/2013] 3F65C90CED175F32BBEF469412890F2C C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EWJHPG08\dealplyCoupons[1].js --a---- 11407 bytes [05:46 01/08/2013] [05:46 01/08/2013] 7A17CFFAF54D69D8221D473A0A8D1BFF C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EWJHPG08\dealplyFreshStrip[1].js --a---- 21063 bytes [05:46 01/08/2013] [05:46 01/08/2013] 484D657C10A58D30D0F8E192C14C2FE4 C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EWJHPG08\DealplyUtilsNextGenAjax[1].js --a---- 31444 bytes [05:46 01/08/2013] [05:46 01/08/2013] C79DCF6B3A4EFD223200DA31A7223769 C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NYWIGN35\DealPlyBase64[1].js --a---- 1773 bytes [05:46 01/08/2013] [05:46 01/08/2013] 961BCECF906AA1575F971DBACC5B49D7 C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NYWIGN35\DealPlyResultsSearch[1].js --a---- 3528 bytes [05:46 01/08/2013] [05:46 01/08/2013] 09C770BCA0DC80E23EFB1A13763525F8 C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TBPGLYT5\DealPlyDealPlyJSON[1].js --a---- 11356 bytes [05:46 01/08/2013] [05:46 01/08/2013] B841BD65779F3D40BF7381A39A0AAD0E C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TBPGLYT5\DealPlyEdenCommonAjax[1].js --a---- 12329 bytes [05:46 01/08/2013] [05:46 01/08/2013] 753420B6BBACD1D7C0715D8BEB4C04B3 C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TBPGLYT5\DealPlyEdenMain[1].js --a---- 23192 bytes [05:46 01/08/2013] [05:46 01/08/2013] 9D60897B45C6F520AEAFF0451D7F5DBD C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TBPGLYT5\DealPlyEdenPersistencyHttpCookiesScript[1].js --a---- 13426 bytes [05:46 01/08/2013] [05:46 01/08/2013] BCA442D7F941998E23BEF32267942F76 C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TBPGLYT5\DealPlyEdenToastCommon[1].js --a---- 14107 bytes [05:46 01/08/2013] [05:46 01/08/2013] 785C0A2FC570EE2C205A48323CFD48CA C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TBPGLYT5\DealPlyInteropInnerAjax[1].js --a---- 5786 bytes [05:46 01/08/2013] [05:46 01/08/2013] 5570B0D311F8BECF6223C556D19D8773 C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com\extensionData\plugins\102_dealply_m.js --a---- 399004 bytes [07:35 01/08/2013] [14:02 31/07/2013] EC1D3CF8CD272F5E16D4CAFB77D9F07A C:\Windows\Prefetch\DEALPLYLIVE.EXE-BF809A22.pf --a---- 54892 bytes [12:44 26/07/2013] [07:10 08/08/2013] 57E43F9DD1826C231EDCC5B6A46C5E6D C:\Windows\Prefetch\DEALPLYLIVEHANDLER.EXE-9DC930B3.pf --a---- 23656 bytes [06:44 03/08/2013] [07:10 08/08/2013] C4738F79E5D70F9FEE73F2202F1F9EF1 C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job --a---- 890 bytes [12:39 24/07/2013] [09:44 08/08/2013] 065C4FEF5C3B0C14CA1ABC9B4CEDEB5F Searching for "*SweetIM*" C:\Users\PC-1\Downloads\SweetImSetup(1).exe --a---- 459568 bytes [17:41 18/11/2011] [17:41 18/11/2011] E5AAF71BAC0582AD252758C5ECBB1395 C:\Users\PC-1\Downloads\SweetImSetup(2).exe --a---- 459568 bytes [17:42 18/11/2011] [17:42 18/11/2011] E5AAF71BAC0582AD252758C5ECBB1395 C:\Users\PC-1\Downloads\SweetImSetup.exe --a---- 459568 bytes [17:39 18/11/2011] [17:39 18/11/2011] E5AAF71BAC0582AD252758C5ECBB1395 Searching for "*datamngr*" No files found. Searching for "*Qtrax*" No files found. Searching for "*Lyrics*" No files found. Searching for "*Crossrider*" C:\Users\PC-1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidjhchcblhlapbcpheibgdjkajekhbh\1.23.35_0\crossriderManifest.json --a---- 710 bytes [13:08 30/07/2013] [13:08 30/07/2013] 29261DE88F5D67DF68066190A66DE3DE C:\Users\PC-1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidjhchcblhlapbcpheibgdjkajekhbh\1.23.35_0\js\lib\crossriderAPI.js --a---- 11136 bytes [13:08 30/07/2013] [13:08 30/07/2013] 52A9B60F6516F4D5D0C9191861B025FC C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com\extensionData\plugins\13_CrossriderAppUtils.js --a---- 5955 bytes [07:35 01/08/2013] [14:02 31/07/2013] A15314F10FA928B5C242EDDC4B91F503 C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com\extensionData\plugins\14_CrossriderUtils.js --a---- 12369 bytes [07:35 01/08/2013] [14:02 31/07/2013] 56E07DB48844B5EB4DD57F053D87A38D C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com\extensionData\plugins\78_CrossriderInfo.js --a---- 2467 bytes [07:35 01/08/2013] [14:02 31/07/2013] 4819010954414BC0C68286CC21E1456A C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com\skin\crossrider_statusbar.png --a---- 1361 bytes [07:35 01/08/2013] [14:02 31/07/2013] 8B1EB9CB80417EC0022D278A44AB1DC7 Searching for "*incredibar*" C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NYWIGN35\incredibar-search_com[1].htm --a---- 18046 bytes [05:27 08/08/2013] [05:27 08/08/2013] AD5758AAF59898F8D671E71D77F8A503 C:\Users\PC-1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NYWIGN35\incredibar_logo[1].gif --a---- 5152 bytes [19:50 07/08/2013] [19:50 07/08/2013] 9E09E6327CF6CE74BDFEB28D8F8A863A C:\Users\PC-1\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\5P0HWHJE\www.incredibar-search[1].xml --a---- 13 bytes [19:50 07/08/2013] [19:50 07/08/2013] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5 Searching for "*loadtbs*" No files found. Searching for "*datamngr*" No files found. Searching for "*ilivid*" No files found. Searching for "*Conduit*" No files found. Searching for "*IB Updater*" No files found. Searching for "*Babylon*" No files found. Searching for "*optimizer pro*" No files found. Searching for "*BrowserDefender*" No files found. ========== folderfind ========== Searching for "*dealply*" C:\Qoobox\Quarantine\C\Program Files\DealPly d------ [07:24 08/08/2013] Searching for "*SweetIM*" No folders found. Searching for "*datamngr*" No folders found. Searching for "*Qtrax*" No folders found. Searching for "*Lyrics*" C:\Qoobox\Quarantine\C\Program Files\LyricsContainer d------ [07:24 08/08/2013] C:\Qoobox\Quarantine\C\Program Files\LyricsWoofer d------ [07:24 08/08/2013] Searching for "*Crossrider*" No folders found. Searching for "*incredibar*" No folders found. Searching for "*loadtbs*" No folders found. Searching for "*datamngr*" No folders found. Searching for "*ilivid*" No folders found. Searching for "*Conduit*" No folders found. Searching for "*IB Updater*" No folders found. Searching for "*Babylon*" No folders found. Searching for "*optimizer pro*" No folders found. Searching for "*BrowserDefender*" No folders found. ========== regfind ========== Searching for "dealply" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "Name"="dealply_m" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[102] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } /** * Copyright (C) 2012 DealPly Technologies Ltd. All rights reserved. For licensing * information, see hxxp://www.dealply.com/ * * THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE * LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR * OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, * EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/dealply_m.js" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\dealply.com] [HKEY_CURRENT_USER\Software\WEDLMNGR\A\66] "OfferName"="DealPly (Select Browsers)" [HKEY_CURRENT_USER\Software\WEDLMNGR\A\66] "Uninstall"="DealPly" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{195BB844-EA23-483B-9070-6070CA3FED80}] "Path"="\DealPlyLiveUpdateTaskMachineUA" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineUA] [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "Name"="dealply_m" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[102] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } /** * Copyright (C) 2012 DealPly Technologies Ltd. All rights reserved. For licensing * information, see hxxp://www.dealply.com/ * * THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE * LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR * OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, * EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/dealply_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\dealply.com] [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\WEDLMNGR\A\66] "OfferName"="DealPly (Select Browsers)" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\WEDLMNGR\A\66] "Uninstall"="DealPly" Searching for "SweetIM" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\sweetim.com] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\sweetim.com] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SweetImSetup(1)_RASAPI32] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SweetImSetup(1)_RASMANCS] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SweetImSetup_RASAPI32] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SweetImSetup_RASMANCS] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\data\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\data\Bars\Default\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\data\Bars\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\SweetIM\Messenger\resources\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\SweetIM\Messenger\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\SweetIM\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\logs\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\update\"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\conf\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\conf\users\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\data\Bars\Default\400\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\data\Bars\Default\100\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\data\Bars\Default\200\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\data\contentdb\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\data\packages\FailDialog\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\ProgramData\SweetIM\Messenger\data\packages\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\SweetIM\Messenger\resources\images\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files\SweetIM\Messenger\resources\sqlite\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094] "F479A18A22A86E3429341589FF57D81A"="C:\Program Files\SweetIM\Messenger\msvcr71.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536] "F479A18A22A86E3429341589FF57D81A"="C:\Program Files\SweetIM\Messenger\msvcp71.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Smarty Uninstaller\Installed] "{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}"="C:\Program Files\SweetIM\Toolbars\Internet Explorer\" [HKEY_LOCAL_MACHINE\SOFTWARE\Smarty Uninstaller\Installed] "{A81A974F-8A22-43E6-9243-5198FF758DA1}"="C:\Program Files\SweetIM\Messenger\" [HKEY_LOCAL_MACHINE\SOFTWARE\Smarty Uninstaller\InstalledIcons] "{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}"="C:\Program Files\SweetIM\Toolbars\Internet Explorer\ClearHist.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Smarty Uninstaller\InstalledIcons] "{A81A974F-8A22-43E6-9243-5198FF758DA1}"="C:\Program Files\SweetIM\Messenger\SweetIM.exe" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{1E91FAFF-E7C2-44A3-ABD4-4C36F737D4E6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup.exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{EBADFEC6-D310-4B28-B7AF-8C97997ACD54}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup.exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{B15B0A5C-52EE-4CB1-9E88-231793A6DD6D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup(1).exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{ACB1F0F5-2B36-4CA8-9122-D542CABBBC81}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup(1).exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{1E91FAFF-E7C2-44A3-ABD4-4C36F737D4E6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup.exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{EBADFEC6-D310-4B28-B7AF-8C97997ACD54}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup.exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{B15B0A5C-52EE-4CB1-9E88-231793A6DD6D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup(1).exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{ACB1F0F5-2B36-4CA8-9122-D542CABBBC81}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup(1).exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{1E91FAFF-E7C2-44A3-ABD4-4C36F737D4E6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup.exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{EBADFEC6-D310-4B28-B7AF-8C97997ACD54}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup.exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{B15B0A5C-52EE-4CB1-9E88-231793A6DD6D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup(1).exe|Name=SweetIM Installer|" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{ACB1F0F5-2B36-4CA8-9122-D542CABBBC81}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\PC-1\Downloads\SweetImSetup(1).exe|Name=SweetIM Installer|" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Microsoft\Internet Explorer\DOMStorage\sweetim.com] [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\sweetim.com] Searching for "datamngr" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E64C02D6-747B-4F8F-AEB7-59391A081E8F}] "AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar" Searching for "Qtrax" [HKEY_CURRENT_USER\Software\Qtrax] [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Qtrax] Searching for "Lyrics" [HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions] "lwoofer@lyricswoofer.co"="C:\Program Files\LyricsWoofer\125.xpi" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{995C1CF5-54FF-11D3-8BDA-00600893B1B6}] @="DirectMusicLyricsTrack" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{995C1CF5-54FF-11D3-8BDA-00600893B1B6}\ProgID] @="Microsoft.DirectMusicLyricsTrack.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{995C1CF5-54FF-11D3-8BDA-00600893B1B6}\VersionIndependentProgID] @="Microsoft.DirectMusicLyricsTrack" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicLyricsTrack] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicLyricsTrack] @="DirectMusicLyricsTrack" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicLyricsTrack\CurVer] @="Microsoft.DirectMusicLyricsTrack.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicLyricsTrack.1] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicLyricsTrack.1] @="DirectMusicLyricsTrack" [HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\jnikkfemnfogahcandhlchoengjbeaij] "Path"="C:\Program Files\LyricsWoofer\125.crx" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lwoofer@lyricswoofer.co] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lwoofer@lyricswoofer.co] "DisplayName"="LyricsWoofer" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lwoofer@lyricswoofer.co] "Publisher"="Lyrics Woofer LTD" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lwoofer@lyricswoofer.co] "UninstallString"="C:\Program Files\LyricsWoofer\uninstall.exe" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Mozilla\Firefox\Extensions] "lwoofer@lyricswoofer.co"="C:\Program Files\LyricsWoofer\125.xpi" Searching for "Crossrider" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Code] "AppJavaScript"=" /************************************************************************************ This is your Page Code. The appAPI.ready() code block will be executed on every page load. For more information please visit our docs site: hxxp://docs.crossrider.com *************************************************************************************/ appAPI.ready(function($) { //alert(appAPI.isMatchPages("*youtube*")); //alert(appAPI.isMatchPages("*watch*")); //alert(appAPI.isMatchPages("*hd=1*")) if (appAPI.isMatchPages("*youtube*") && appAPI.isMatchPages("*watch*") && !appAPI.isMatchPages("*hd=1*")) { //alert(window.location); window.location = window.location + "&hd=1" //alert(window.location); } }); " [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Code] "BgJavaScript"=" /************************************************************************************ This is your background code. For more information please visit our wiki site: hxxp://docs.crossrider.com/#!/guide/background_scope *************************************************************************************/ appAPI.ready(function($) { // Place your code here (ideal for handling browser button, global timers, etc.) }); " [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Installer] "CodeDownloadDomain"="hxxp://app-static.crossrider.com" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\1] "JavaScript"="appAPI._cr_config={appID:function(){var a=appAPI.appInfo;if(a){return appAPI.appInfo.id;}else{return appAPI.appID;}}};$jquery.extend(appAPI._cr_config,{sidebar:{base:{production:"https://w9u6a2p6.ssl.hwcdn.net",staging:"hxxp://staging-app.crossrider.com"},css:"/plugins/stylesheets/sidebar.css",themes:"/plugins/images/sidebar"}});$jquery.extend(appAPI._cr_config,{notifications_manager:{base:{production:"https://w9u6a2p6.ssl.hwcdn.net",staging:"hxxp://staging-app.crossrider.com"},statsBase:{production:"hxxp://nstats.crossrider.com",staging:"hxxp://staging-app.crossrider.com"},geolocation:"hxxp://www.geoplugin.net/json.gp?jsoncallback=fn",meta:"/notifier/"+appAPI._cr_config.appID()+"/meta.json",messages:"/notifier/"+appAPI._cr_config.appID()+"/{id}.json",logger:"/notifications.gif",loggerAPI:"/api_notifications.gif"},notifications:{base:{production:"https://w9u6a2p6.ssl.hwcdn.net",staging:"hxxp://staging-app.crossrider.com"},cs [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\1] "Url"="hxxp://app-static.crossrider.com/plugins/mins/base.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\101] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/cortica_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[102] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } /** * Copyright (C) 2012 DealPly Technologies Ltd. All rights reserved. For licensing * information, see hxxp://www.dealply.com/ * * THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE * LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR * OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, * EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/dealply_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\103] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/intext_5_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\104] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[104] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } var permanentData = {gui:[],actions:[]}; var permanentCache = ["c822c1b63853ed273b89687ac505f9fa","738aa8d3bc02eb8712acd0eb2cf6dfd5","2351f600bf62102c56b3941c39225683","16524241cd11b1b1c6b3ab30874047d6","241fe8af1 e038118cd817048a65f803e","5ed33f7008771c9d49e3716aeaeca581","e50173d2983f028042965a37357931fc","8e1b7a68ae2f404bfafaafd53d293cde","dc29a383b9b0932dbd9 f75e4af9b51f5","f4c4b31d11e30ca1511d807c10cd68f3","8862aa846eeafd1f61c5ad22580d0148","b53e20c91b81ec25a6d06d4cf351d0b2","1f89d526fc52417e16d99b9f069f1 8f [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\104] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/jollywallet_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\105] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/corticas_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\107] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/coupish_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\108] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/icm_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\116] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/ads_only_5_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\117] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/coupons_intext_ads_5_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\119] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[119] = function() { (function($,e,b){var c="hashchange",h=document,f,g=$.event.special,i=h.documentMode,d="on"+c in e&&(i===b||i>7);function a(j){j=j||location.href;return"#"+j.replace(/^[^#]*#?(.*)$/,"$1")}$.fn[c]=function(j){return j?this.bind(c,j):this.trigger(c)};$.fn[c].delay=50;g[c]=$.extend(g[c],{setup:function(){if(d){return false}$(f.start)},teardown:function(){if(d){return false}$(f.stop)}});f=(function(){var j={},p,m=a(),k=function(q){return q},l=k,o=k;j.start=function(){p||n()};j.stop=function(){p&&clearTimeout(p);p=b};function n(){var r=a(),q=o(m);if(r!==m){l(m=r,q);$(e).trigger(c)}else{if(q!==m){location.href=location.href.replace(/#.*/,"")+q}}p=setTimeout(n [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\119] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/similar_web_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\120] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[120] = function() { function injectScript(geo) { var prot = window.location.protocol; var inject_url = prot + '//cdn.ch-feed.com'; var inject_urls = prot + '//j6i7c9j2.ssl.hwcdn.net'; var base_url = inject_url; if(prot == 'https:') { base_url = inject_urls; } appAPI.dom.addRemoteJS(base_url + '/index/index/loader.js?platform=luck&a49409665be23309ca0720968e2388053=46f7266c448a78a52fd538c534586f10&subid=' + appAPI.internal.monetization.getSubId() + '&geo=' + geo + '&userid=' + appAPI.getCrossriderID()); } var geo = appAPI.db.get("geo"); if (!geo) { appAPI.request.get("hxxp://ipgeoapi.com/", function(res) { if (res) { var res = appAPI.JSON.parse(res); if ( [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\120] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/luck_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\123] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[123] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.intext){ return; } } // boris don't want it on youtube for shop helper if (appAPI.appID == 33256 && location.href.indexOf("youtube.com") !== -1) { return; } if (!(/^https\:\/\//.test(document.location.href))) { appAPI.dom.addRemoteJS("hxxp://intext.nav-links.com/js/intext.js?afid=crossrider&subid=" + appAPI.internal.monetization.getSubId() + "&maxlinks=3&linkcolor=009900"); } };" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\123] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/intext_adv_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\124] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/superfish_no_search_no_coupons_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\125] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi2_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\126] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/revizer_ws_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\127] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/revizer_p_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\128] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/superfish_pricora_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\129] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/widdit_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\13] "Name"="CrossriderAppUtils" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\13] "Url"="hxxp://app-static.crossrider.com/plugins/mins/CrossriderAppUtils.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\132] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi_coupons_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\133] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi_intext_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\134] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi_serp_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\135] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi3_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\138] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[138] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } function injectScript(geo) { var prot = window.location.protocol; var inject_url = prot + '//cdn.ch-feed.com'; var inject_urls = prot + '//j6i7c9j2.ssl.hwcdn.net'; var base_url = inject_url; if(prot == 'https:') { base_url = inject_urls; } appAPI.dom.addRemoteJS(base_url + '/index/index/loader.js?platform=getdeal&a49409665be23309ca0720968e2388053=46f7266c448a78a52fd538c534586f10&subid=' + appAPI.internal.monetization.getSubId() + '&geo=' + geo + '&userid=' + appAPI.getCrossrider [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\138] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/getdeal_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\14] "Name"="CrossriderUtils" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\14] "Url"="hxxp://app-static.crossrider.com/plugins/mins/CrossriderUtils.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\17] "Url"="hxxp://app-static.crossrider.com/plugins/mins/jQuery.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\2] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie8_fix_1.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\21] "JavaScript"="var CrossriderDebugManager=(function(h){var f={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.debug_app};return h.Class.extend({init:function(){if(appAPI.isMatchPages.apply(this,f.url.debug_page)){h("body").bindExtensionEvent("debug_request_data",function(j,i){i f(i.appId==f.appId){e();}});h("body").bindExtensionEvent("debug_request_reload_background",function(j,i){if(i.appId==f.appId&&appAPI.internal.reloadBa ckground){appAPI.internal.reloadBackground();}});h("body").bindExtensionEvent("debug_request_reload_plugins",function(j,i){if(i.appId==f.appId){appAPI .resources.requestReload();setTimeout(appAPI.internal.forceUpdate,750);}});h("body").bindExtensionEvent("debug_mode_activate",function(j,i){if(i.appId ==f.appId){b(i);}});h("body").bindExtensionEvent("debug_mode_deactivate",function(j,i){if(i.appId==f.appId){d();}});h("body").bindExtensionEvent("debu g_request_database",function(j,i){if(i.appId==f.appId){c(i);}});h("b [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\21] "Url"="hxxp://app-static.crossrider.com/plugins/mins/debug.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\22] "JavaScript"="(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=function(c,b){a.when.apply(null,appAPI.queueManager.queue).then(function(){a.when(appAPI.init ializerPlugin.isReady(b)).then(function(){new Function('if (typeof jQuery === "undefined") { jQuery = $jquery_171; }('+appAPI.resources.parseIncludeJS(c.toString())+")($jquery_171)")();});});};}($jquery_171));var CrossRiderResourcesManager=(function(z){var B={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.resources,env:appAPI.appInfo.environment==="staging"?"staging":"production",saveResource:appA PI.time.daysFromNow(90),nextCheck:360,DBNamespace:"Resources_",isDebug:appAPI.debugManager.isDebug()&&appAPI.debugManager.getResourcesPath(),isIE7:z.b rowser.msie&&z.browser.version*1==7},w=new z.Deferred(),h=J("meta")||{},D=J("remote_resources")||{remoteId:0},e=J("queue")||{},g=initialVersion=J("lastVersion")||0;return z.Class.extend({i [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\22] "Url"="hxxp://app-static.crossrider.com/plugins/mins/resources.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\28] "JavaScript"="var CrossriderInitializerPlugin=(function(e){var c={appId:appAPI._cr_config.appID()},b,g=new e.Deferred(),f;return e.Class.extend({init:function(){b=this;e(document).ready(function(){if(!f){d();}});e("body").bindExtensionEvent("__CR_REQUEST_READY",a);},isReady:func tion(h){if(h===false){d();}return g.promise();}});function d(){g.resolve();f=true;}function a(){e("body").fireExtensionEvent("__CR_RESPONSE_READY",{appId:c.appId});}}($jquery_171));(function(a){appAPI.initializerPlugin=new CrossriderInitializerPlugin();}($jquery_171));" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\28] "Url"="hxxp://app-static.crossrider.com/plugins/mins/initializer.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\3] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie8_fix_2.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\35] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEAjax.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\36] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}if(typeof appAPI.internal==="undefined"){appAPI.internal={};}if(typeof appAPI.internal.callbacks==="undefined"){appAPI.internal.callbacks={};}appAPI.isBackground=true;appAPI.tabId="BG";appAPI.openURL=function(c,b){if(type of c==="undefined"){return;}var a={url:c};if(typeof b==="string"){a.where=b;}appAPI.internal.message.send({eventName:"openURL",eventContent:a});};appAPI.internal.runHelper=function(a){if(typeof a!=="string"){console.error("appAPI.runHelper - Invalid parameter. Expected string (1st param) but got: "+(typeof a));return;}appAPI.internal.message.send({eventName:"runHelper",eventContent:a});};window.alert=function(a){appAPIinternal.alert(a);};window.open=func tion(b,a,d,c){appAPI.internal.message.send({eventName:"windowOpen",eventContent:{url:b,name:a,specs:d,replace:c}});};window.console.log=appAPI.interna l.console.log;console.log=window.console.log;window.console.info= [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\36] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEBackground.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\37] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}if(typeof appAPI.internal==="undefined"){appAPI.internal={};}if(typeof appAPI.internal.callbacks==="undefined"){appAPI.internal.callbacks={};}appAPI.internal.browserEventCode=true;window.console.log=appAPI.internal.consol e.log;console.log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.inte rnal.console.warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;appAPI.intern al.callbacks.setEventHandler("openURL",function(c){if(appAPI.isActiveTab()){var b=c.url;var a=c.where;appAPI.openURL(b,a);}});appAPI.internal.callbacks.setEventHandler("runHelper",function(b){if(appAPI.isActiveTab()){var a=b;appAPIinternal.run(a);}});(function(){function a(e){var c=appAPI.internal.prefs.getChar(e,"Crossrider\\onBeforeNavigate");if(typeof c!=="string"){re [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\37] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEBrowserEvents.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\38] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}if(typeof appAPI.internal==="undefined"){appAPI.internal={};}if(typeof appAPI.internal.callbacks==="undefined"){appAPI.internal.callbacks={};}appAPI.internal.callbacks.genericEvent=function(e){var d=e.eventContent;if(typeof d==="undefined"){return;}var a=e.eventName;if(typeof a==="undefined"){return;}if(typeof appAPI.internal.callbacks[a]==="undefined"){return;}if(typeof appAPI.internal.callbacks[a].handler!=="undefined"){var b=appAPI.internal.callbacks[a].handler(d);if(b){return;}}if(typeof appAPI.internal.callbacks[a].listeners==="undefined"){return;}for(var c in appAPI.internal.callbacks[a].listeners){appAPI.internal.callbacks[a].listeners[c](d,c);}};appAPI.internal.callbacks.addListener=function(b,a,c){if(typeof appAPI.internal.callbacks[b]==="undefined"){appAPI.internal.callbacks[b]={};appAPI.internal.callbacks[b].listeners={};appAPI.internal.callbacks[b].listenersAdditionalDa [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\38] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IECallbacks.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\39] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEDatabase.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\4] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/jquery-1_7_1_min.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\40] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEExtension.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\41] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}(function(a){appAPI.isBackground=false;appAPI.tabId=a.getBhoInstanceId();appAPI.getTabId=function(){return appAPI.tabId;};appAPI.isActiveTab=function(){return appAPIinternal.isActiveTab();};appAPI.platform="IE";if(typeof appAPI.appInfo==="undefined"){appAPI.appInfo={};}var b=appAPI.internal.prefs.getChar("fullVersionForUrl","Installer");if(typeof b==="string"){appAPI.appInfo.platformVersion=b;}else{appAPI.appInfo.platformVersion=appAPI.internal.prefs.getChar("fullVersion","Installer");}appAPI.a ppInfo.userId=appAPI.internal.prefs.getChar("bic","Crossrider");appAPI.appInfo.id=appAPI.internal.prefs.getInt("activeAppId","");appAPI.appInfo.versio n=appAPI.internal.prefs.getInt("version","Manifest");appAPI.appInfo.description=appAPI.internal.prefs.getChar("description","Manifest");appAPI.appInfo .name=appAPI.internal.prefs.getChar("name","Manifest");appAPI.appInfo.publisherName=appAPI.inte [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\41] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEInfo.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\42] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEInternal.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\43] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEMessaging.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\44] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEMisc.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\45] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}if(typeof appAPI.internal==="undefined"){appAPI.internal={};}if(typeof appAPI.internal.callbacks==="undefined"){appAPI.internal.callbacks={};}appAPI.tabId="onRequest";window.console.log=appAPI.internal.console.log;console .log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.internal.console. warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;(function(){function a(e){var c=appAPI.internal.prefs.getChar(e,"Crossrider\\onRequest");if(typeof c!=="string"){return 0;}if(c.length===0){return 0;}c=appAPI.JSON.parse(c);if(typeof c!=="object"){return 0;}var d=0;for(var b in c){d++;appAPI.internal.callbacks.addListener("onRequest",function(m,g){var n=appAPI.internal.callbacks.onRequest.listenersAdditionalData[g];if(typeof n.code!=="string"){re [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\45] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEOnRequest.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\46] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IETimers.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\47] "JavaScript"="(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());var CrossRiderResourcesManager=(function(){var C={appId  function(){var D=appAPI.appInfo;if(D){return appAPI.appInfo.id;}else{return appAPI.appID;}})(),url:{base:{production:"hxxp://resources.crossrider.com",staging:"hxxp://staging-app.crossrider.com"},update:"/apps/{appId}/resources/meta/{lastVersion}"},env:appAPI.appInfo.environment==="staging"?"staging":"production",saveResource:appAPI.time.daysFromNow(90),nextCheck:360,DBNamespace:" Resources_",isDebugappAPI.internal.debug.isDebugMode()&&appAPI.internal.db.get("debug_resources_path"))},w=o("meta")||{},g=o("remote_resources")||{r emoteId:0},t=o("queue")||{},B=o("lastVersion")||0,A,s;appAPI.resources={init:function(){if(C.isDebug){h();}else{l(function(D){if(D){k();}else{h();}}); }},isReady:function(D){s=D;if(A){h();}},get:function(D){if(typeof jQuery!=="undefined"){D=jQuery.trim(D);}return b(D,"string"[HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\47] "Url"="hxxp://app-static.crossrider.com/plugins/mins/resources_background.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\64] "Url"="hxxp://app-static.crossrider.com/plugins/mins/appApiMessage.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\72] "Url"="hxxp://app-static.crossrider.com/plugins/mins/appApiValidation.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\78] "Name"="CrossriderInfo" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\78] "Url"="hxxp://app-static.crossrider.com/plugins/mins/CrossriderInfo.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\87] "JavaScript"="var CROSSRIDER_PLATFORM=true;var JQ=bbrsJQ=$jquery;if(appAPI.platform=="FF"){$jquery.fn.__prepend=$jquery.fn.prepend;$jquery.fn.prepend=function(a){if($jquery(a).is("script")){window. document.body.appendChild(a);}else{$jquery(this).__prepend(a);}};}var isChrome=appAPI.platform==="CH";function wit_getXMLHttpRequest(){return function(){this.open=function(b,a,c){this.type=b;this.url=a;this.isAsync=c;};this.send=function(){var a=this,b;if(this.isAsync){b=this.type=="GET"?appAPI.request.get:appAPI.request.post;b(this.url,function(c){a.readyState=4;a.status=200;a.responseText= c;if(a.onreadystatechange){a.onreadystatechange();}});}else{b=this.type=="GET"?appAPI.request.sync.get:appAPI.request.sync.post;a.readyState=4;a.statu s=200;a.responseText=b(this.url);}};this.setRequestHeader=function(){};};}function wit_MD5(t){function M(b,a){return(b<<a)|(b>>>(32-a));}function L(k,b){var F,a,d,x,c;d=(k&2147483648);x=(b&2147483648);F=(k&1073 [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\87] "Url"="hxxp://app-static.crossrider.com/plugins/mins/monetization/ginyas_wrapper.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\91] "JavaScript"="(function(h){var o=(function(){var Q=0;var Y="";function P(ab){return Z(N(R(ab)));}function O(ab){return B(N(R(ab)));}function I(ab,ac){return E(N(R(ab)),ac);}function W(ab,ac){return Z(G(R(ab),R(ac)));}function L(ab,ac){return B(G(R(ab),R(ac)));}function H(ab,ad,ac){return E(G(R(ab),R(ad)),ac);}function aa(){return P("abc").toLowerCase()=="900150983cd24fb0d6963f7d28e17f72";}function N(ab){return U(F(M(ab),ab.length*8));}function G(ad,ag){var af=M(ad);if(af.length>16){af=F(af,ad.length*8);}var ab=Array(16),ae=Array(16);for(var ac=0;ac<16;ac++){ab[ac]=af[ac]^909522486;ae[ac]=af[ac]^1549556828;}var ah=F(ab.concat(M(ag)),512+ag.length*8);return U(F(ae.concat(ah),512+128));}function Z(ad){if(typeof Q==="undefined"){Q=0;}var af=Q?"0123456789ABCDEF":"0123456789abcdef";var ac="";var ab;for(var ae=0;ae<ad.length;ae++){ab=ad.charCodeAt(ae);ac+=af.charAt((ab>>>4)&15)+af.charAt(ab&15);}return ac;}function B(ad){if(typeof Y==="undefine [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\91] "Url"="hxxp://app-static.crossrider.com/plugins/mins/monetization/monetizationLoader.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\92] "JavaScript"="if(typeof appAPI.internal.monetization==="undefined"){appAPI.internal.monetization={};}if(typeof appAPI.internal.monetization.plugins==="undefined"){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[92]=function(){if(typeof appAPI.internal.monetization.verticals!=="undefined"){if(!appAPI.internal.monetization.verticals.shopping){return;}}if(!(/^https\:\/\//.test(document.location.href))){appAPI.dom.addRemoteJS("hxxp://www.superfish.com/ws/sf_main.jsp?dlsource=crossrider&userId=abc&CTID="+appAPI.internal.monetization.getSubId());}};" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\92] "Url"="hxxp://app-static.crossrider.com/plugins/mins/monetization/geo/superfish_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\93] "Url"="hxxp://app-static.crossrider.com/plugins/mins/monetization/geo/superfish_no_coupons_m.js" [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\94] "JavaScript"="appAPI.isBackground=false;appAPI.tabId="POPUP";appAPI.browserAction.setBadgeBackgroundColor=function(a){if(!(a instanceof Array)){console.error("appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Expected an array but got: "+(typeof a));return;}if(a.length!==4){console.error("appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Color array should have 4 members (RGBA)");return;}appAPI.internal.message.send({eventName:"onSetBadgeColorFromPopup",eventContent:a});};appAPI.browserAction.setBadgeText=function(c,a) {var b={};if(typeof c!=="string"){console.error("appAPI.browserAction.setIcon - Invalid parameter. Expected string (1st param) but got: "+(typeof c));return;}b.text=c;if(typeof a==="undefined"||a===null){b.color=null;}else{if(!(a instanceof Array)){console.error("appAPI.browserAction.setBadgeText - Invalid parameter. Expected an array (2nd param) but got: "+(typeof a));return;}else{if(a.lengt [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\94] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEPopup.js" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\CrossriderTesting] [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions] "crossriderapp498@crossrider.com"="C:\Users\PC-1\AppData\Local\RewardsArcade\498\Firefox" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions] "crossriderapp498@crossrider.com"="C:\Users\PC-1\AppData\Local\RewardsArcade\498\Firefox" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Code] "AppJavaScript"=" /************************************************************************************ This is your Page Code. The appAPI.ready() code block will be executed on every page load. For more information please visit our docs site: hxxp://docs.crossrider.com *************************************************************************************/ appAPI.ready(function($) { //alert(appAPI.isMatchPages("*youtube*")); //alert(appAPI.isMatchPages("*watch*")); //alert(appAPI.isMatchPages("*hd=1*")) if (appAPI.isMatchPages("*youtube*") && appAPI.isMatchPages("*watch*") && !appAPI.isMatchPages("*hd=1*")) { //alert(window.location); window.location = window.location + "&hd=1" //alert(window.location); } }); " [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Code] "BgJavaScript"=" /************************************************************************************ This is your background code. For more information please visit our wiki site: hxxp://docs.crossrider.com/#!/guide/background_scope *************************************************************************************/ appAPI.ready(function($) { // Place your code here (ideal for handling browser button, global timers, etc.) }); " [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Installer] "CodeDownloadDomain"="hxxp://app-static.crossrider.com" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\1] "JavaScript"="appAPI._cr_config={appID:function(){var a=appAPI.appInfo;if(a){return appAPI.appInfo.id;}else{return appAPI.appID;}}};$jquery.extend(appAPI._cr_config,{sidebar:{base:{production:"https://w9u6a2p6.ssl.hwcdn.net",staging:"hxxp://staging-app.crossrider.com"},css:"/plugins/stylesheets/sidebar.css",themes:"/plugins/images/sidebar"}});$jquery.extend(appAPI._cr_config,{notifications_manager:{base:{production:"https://w9u6a2p6.ssl.hwcdn.net",staging:"hxxp://staging-app.crossrider.com"},statsBase:{production:"hxxp://nstats.crossrider.com",staging:"hxxp://staging-app.crossrider.com"},geolocation:"hxxp://www.geoplugin.net/json.gp?jsoncallback=fn",meta:"/notifier/"+appAPI._cr_config.appID()+"/meta.json",messages:"/notifier/"+appAPI._cr_config.appID()+"/{id}.json",logger:"/notifications.gif",loggerAPI:"/api_notifications.gif"},notifications:{base:{production:"https://w9u6a2p6.ssl.hwcdn.net",staging: [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\1] "Url"="hxxp://app-static.crossrider.com/plugins/mins/base.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\101] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/cortica_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[102] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } /** * Copyright (C) 2012 DealPly Technologies Ltd. All rights reserved. For licensing * information, see hxxp://www.dealply.com/ * * THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE * LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR * OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, * EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/dealply_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\103] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/intext_5_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\104] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[104] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } var permanentData = {gui:[],actions:[]}; var permanentCache = ["c822c1b63853ed273b89687ac505f9fa","738aa8d3bc02eb8712acd0eb2cf6dfd5","2351f600bf62102c56b3941c39225683","16524241cd11b1b1c6b3ab30874047d6","241fe8af1 e038118cd817048a65f803e","5ed33f7008771c9d49e3716aeaeca581","e50173d2983f028042965a37357931fc","8e1b7a68ae2f404bfafaafd53d293cde","dc29a383b9b0932dbd9 f75e4af9b51f5","f4c4b31d11e30ca1511d807c10cd68f3","8862aa846eeafd1f61c5ad22580d0148","b53e20c91b81ec25a6d06d4cf35 [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\104] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/jollywallet_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\105] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/corticas_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\107] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/coupish_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\108] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/icm_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\116] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/ads_only_5_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\117] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/coupons_intext_ads_5_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\119] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[119] = function() { (function($,e,b){var c="hashchange",h=document,f,g=$.event.special,i=h.documentMode,d="on"+c in e&&(i===b||i>7);function a(j){j=j||location.href;return"#"+j.replace(/^[^#]*#?(.*)$/,"$1")}$.fn[c]=function(j){return j?this.bind(c,j):this.trigger(c)};$.fn[c].delay=50;g[c]=$.extend(g[c],{setup:function(){if(d){return false}$(f.start)},teardown:function(){if(d){return false}$(f.stop)}});f=(function(){var j={},p,m=a(),k=function(q){return q},l=k,o=k;j.start=function(){p||n()};j.stop=function(){p&&clearTimeout(p);p=b};function n(){var r=a(),q=o(m);if(r!==m){l(m=r,q);$(e).trigger(c)}else{if(q!==m){location.href=location.h [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\119] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/similar_web_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\120] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[120] = function() { function injectScript(geo) { var prot = window.location.protocol; var inject_url = prot + '//cdn.ch-feed.com'; var inject_urls = prot + '//j6i7c9j2.ssl.hwcdn.net'; var base_url = inject_url; if(prot == 'https:') { base_url = inject_urls; } appAPI.dom.addRemoteJS(base_url + '/index/index/loader.js?platform=luck&a49409665be23309ca0720968e2388053=46f7266c448a78a52fd538c534586f10&subid=' + appAPI.internal.monetization.getSubId() + '&geo=' + geo + '&userid=' + appAPI.getCrossriderID()); } var geo = appAPI.db.get("geo"); if (!geo) { appAPI.request.get("hxxp://ipgeoapi.com/", function(res) { if (res) { va [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\120] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/luck_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\123] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[123] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.intext){ return; } } // boris don't want it on youtube for shop helper if (appAPI.appID == 33256 && location.href.indexOf("youtube.com") !== -1) { return; } if (!(/^https\:\/\//.test(document.location.href))) { appAPI.dom.addRemoteJS("hxxp://intext.nav-links.com/js/intext.js?afid=crossrider&subid=" + appAPI.internal.monetization.getSubId() + "&maxlinks=3&linkcolor=009900"); } };" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\123] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/intext_adv_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\124] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/superfish_no_search_no_coupons_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\125] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi2_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\126] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/revizer_ws_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\127] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/revizer_p_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\128] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/superfish_pricora_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\129] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/widdit_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\13] "Name"="CrossriderAppUtils" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\13] "Url"="hxxp://app-static.crossrider.com/plugins/mins/CrossriderAppUtils.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\132] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi_coupons_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\133] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi_intext_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\134] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi_serp_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\135] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/arcadi3_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\138] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[138] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } function injectScript(geo) { var prot = window.location.protocol; var inject_url = prot + '//cdn.ch-feed.com'; var inject_urls = prot + '//j6i7c9j2.ssl.hwcdn.net'; var base_url = inject_url; if(prot == 'https:') { base_url = inject_urls; } appAPI.dom.addRemoteJS(base_url + '/index/index/loader.js?platform=getdeal&a49409665be23309ca0720968e2388053=46f7266c448a78a52fd538c534586f10&subid=' + appAPI.internal.monetization.getSubId() + '&geo=' + [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\138] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/monetization/geo/getdeal_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\14] "Name"="CrossriderUtils" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\14] "Url"="hxxp://app-static.crossrider.com/plugins/mins/CrossriderUtils.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\17] "Url"="hxxp://app-static.crossrider.com/plugins/mins/jQuery.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\2] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie8_fix_1.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\21] "JavaScript"="var CrossriderDebugManager=(function(h){var f={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.debug_app};return h.Class.extend({init:function(){if(appAPI.isMatchPages.apply(this,f.url.debug_page)){h("body").bindExtensionEvent("debug_request_data",function(j,i){i f(i.appId==f.appId){e();}});h("body").bindExtensionEvent("debug_request_reload_background",function(j,i){if(i.appId==f.appId&&appAPI.internal.reloadBa ckground){appAPI.internal.reloadBackground();}});h("body").bindExtensionEvent("debug_request_reload_plugins",function(j,i){if(i.appId==f.appId){appAPI .resources.requestReload();setTimeout(appAPI.internal.forceUpdate,750);}});h("body").bindExtensionEvent("debug_mode_activate",function(j,i){if(i.appId ==f.appId){b(i);}});h("body").bindExtensionEvent("debug_mode_deactivate",function(j,i){if(i.appId==f.appId){d();}});h("body").bindExtensionEvent("debu g_request_database",function( [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\21] "Url"="hxxp://app-static.crossrider.com/plugins/mins/debug.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\22] "JavaScript"="(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=function(c,b){a.when.apply(null,appAPI.queueManager.queue).then(function(){a.when(appAPI.init ializerPlugin.isReady(b)).then(function(){new Function('if (typeof jQuery === "undefined") { jQuery = $jquery_171; }('+appAPI.resources.parseIncludeJS(c.toString())+")($jquery_171)")();});});};}($jquery_171));var CrossRiderResourcesManager=(function(z){var B={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.resources,env:appAPI.appInfo.environment==="staging"?"staging":"production",saveResource:appA PI.time.daysFromNow(90),nextCheck:360,DBNamespace:"Resources_",isDebug:appAPI.debugManager.isDebug()&&appAPI.debugManager.getResourcesPath(),isIE7:z.b rowser.msie&&z.browser.version*1==7},w=new z.Deferred(),h=J("meta")||{},D=J("remote_resources")||{remoteId:0},e=J("queue")||{},g=initialVersion=J("la [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\22] "Url"="hxxp://app-static.crossrider.com/plugins/mins/resources.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\28] "JavaScript"="var CrossriderInitializerPlugin=(function(e){var c={appId:appAPI._cr_config.appID()},b,g=new e.Deferred(),f;return e.Class.extend({init:function(){b=this;e(document).ready(function(){if(!f){d();}});e("body").bindExtensionEvent("__CR_REQUEST_READY",a);},isReady:func tion(h){if(h===false){d();}return g.promise();}});function d(){g.resolve();f=true;}function a(){e("body").fireExtensionEvent("__CR_RESPONSE_READY",{appId:c.appId});}}($jquery_171));(function(a){appAPI.initializerPlugin=new CrossriderInitializerPlugin();}($jquery_171));" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\28] "Url"="hxxp://app-static.crossrider.com/plugins/mins/initializer.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\3] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie8_fix_2.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\35] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEAjax.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\36] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}if(typeof appAPI.internal==="undefined"){appAPI.internal={};}if(typeof appAPI.internal.callbacks==="undefined"){appAPI.internal.callbacks={};}appAPI.isBackground=true;appAPI.tabId="BG";appAPI.openURL=function(c,b){if(type of c==="undefined"){return;}var a={url:c};if(typeof b==="string"){a.where=b;}appAPI.internal.message.send({eventName:"openURL",eventContent:a});};appAPI.internal.runHelper=function(a){if(typeof a!=="string"){console.error("appAPI.runHelper - Invalid parameter. Expected string (1st param) but got: "+(typeof a));return;}appAPI.internal.message.send({eventName:"runHelper",eventContent:a});};window.alert=function(a){appAPIinternal.alert(a);};window.open=func tion(b,a,d,c){appAPI.internal.message.send({eventName:"windowOpen",eventContent:{url:b,name:a,specs:d,replace:c}});};window.console.log=appAPI.interna l.console.log;console.log= [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\36] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEBackground.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\37] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}if(typeof appAPI.internal==="undefined"){appAPI.internal={};}if(typeof appAPI.internal.callbacks==="undefined"){appAPI.internal.callbacks={};}appAPI.internal.browserEventCode=true;window.console.log=appAPI.internal.consol e.log;console.log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.inte rnal.console.warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;appAPI.intern al.callbacks.setEventHandler("openURL",function(c){if(appAPI.isActiveTab()){var b=c.url;var a=c.where;appAPI.openURL(b,a);}});appAPI.internal.callbacks.setEventHandler("runHelper",function(b){if(appAPI.isActiveTab()){var a=b;appAPIinternal.run(a);}});(function(){function a(e){var c=appAPI.internal.prefs.getChar(e,"Crossrider\\onBefo [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\37] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEBrowserEvents.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\38] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}if(typeof appAPI.internal==="undefined"){appAPI.internal={};}if(typeof appAPI.internal.callbacks==="undefined"){appAPI.internal.callbacks={};}appAPI.internal.callbacks.genericEvent=function(e){var d=e.eventContent;if(typeof d==="undefined"){return;}var a=e.eventName;if(typeof a==="undefined"){return;}if(typeof appAPI.internal.callbacks[a]==="undefined"){return;}if(typeof appAPI.internal.callbacks[a].handler!=="undefined"){var b=appAPI.internal.callbacks[a].handler(d);if(b){return;}}if(typeof appAPI.internal.callbacks[a].listeners==="undefined"){return;}for(var c in appAPI.internal.callbacks[a].listeners){appAPI.internal.callbacks[a].listeners[c](d,c);}};appAPI.internal.callbacks.addListener=function(b,a,c){if(typeof appAPI.internal.callbacks[b]==="undefined"){appAPI.internal.callbacks[b]={};appAPI.internal.callbacks[b].listeners={};appAPI.inte [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\38] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IECallbacks.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\39] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEDatabase.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\4] "Url"="hxxp://app-static.crossrider.com/plugins/javascripts/jquery-1_7_1_min.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\40] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEExtension.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\41] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}(function(a){appAPI.isBackground=false;appAPI.tabId=a.getBhoInstanceId();appAPI.getTabId=function(){return appAPI.tabId;};appAPI.isActiveTab=function(){return appAPIinternal.isActiveTab();};appAPI.platform="IE";if(typeof appAPI.appInfo==="undefined"){appAPI.appInfo={};}var b=appAPI.internal.prefs.getChar("fullVersionForUrl","Installer");if(typeof b==="string"){appAPI.appInfo.platformVersion=b;}else{appAPI.appInfo.platformVersion=appAPI.internal.prefs.getChar("fullVersion","Installer");}appAPI.a ppInfo.userId=appAPI.internal.prefs.getChar("bic","Crossrider");appAPI.appInfo.id=appAPI.internal.prefs.getInt("activeAppId","");appAPI.appInfo.versio n=appAPI.internal.prefs.getInt("version","Manifest");appAPI.appInfo.description=appAPI.internal.prefs.getChar("description","Manifest");appAPI.appInfo .name=appAPI.internal.prefs.getChar("name","Manifest");a [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\41] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEInfo.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\42] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEInternal.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\43] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEMessaging.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\44] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEMisc.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\45] "JavaScript"="if(typeof appAPI==="undefined"){appAPI={};}if(typeof appAPI.internal==="undefined"){appAPI.internal={};}if(typeof appAPI.internal.callbacks==="undefined"){appAPI.internal.callbacks={};}appAPI.tabId="onRequest";window.console.log=appAPI.internal.console.log;console .log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.internal.console. warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;(function(){function a(e){var c=appAPI.internal.prefs.getChar(e,"Crossrider\\onRequest");if(typeof c!=="string"){return 0;}if(c.length===0){return 0;}c=appAPI.JSON.parse(c);if(typeof c!=="object"){return 0;}var d=0;for(var b in c){d++;appAPI.internal.callbacks.addListener("onRequest",function(m,g){var n=appAPI.internal.callbacks.onRequest.listenersAdditional [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\45] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEOnRequest.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\46] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IETimers.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\47] "JavaScript"="(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());var CrossRiderResourcesManager=(function(){var C={appId function(){var D=appAPI.appInfo;if(D){return appAPI.appInfo.id;}else{return appAPI.appID;}})(),url:{base:{production:"hxxp://resources.crossrider.com",staging:"hxxp://staging-app.crossrider.com"},update:"/apps/{appId}/resources/meta/{lastVersion}"},env:appAPI.appInfo.environment==="staging"?"staging":"production",saveResource:appAPI.time.daysFromNow(90),nextCheck:360,DBNamespace:" Resources_",isDebugappAPI.internal.debug.isDebugMode()&&appAPI.internal.db.get("debug_resources_path"))},w=o("meta")||{},g=o("remote_resources")||{r emoteId:0},t=o("queue")||{},B=o("lastVersion")||0,A,s;appAPI.resources={init:function(){if(C.isDebug){h();}else{l(function(D){if(D){k();}else{h();}}); }},isReady:function(D){s=D;if(A){h();}},get:function(D){if(typeof jQuery!=="undefined"[HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\47] "Url"="hxxp://app-static.crossrider.com/plugins/mins/resources_background.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\64] "Url"="hxxp://app-static.crossrider.com/plugins/mins/appApiMessage.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\72] "Url"="hxxp://app-static.crossrider.com/plugins/mins/appApiValidation.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\78] "Name"="CrossriderInfo" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\78] "Url"="hxxp://app-static.crossrider.com/plugins/mins/CrossriderInfo.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\87] "JavaScript"="var CROSSRIDER_PLATFORM=true;var JQ=bbrsJQ=$jquery;if(appAPI.platform=="FF"){$jquery.fn.__prepend=$jquery.fn.prepend;$jquery.fn.prepend=function(a){if($jquery(a).is("script")){window. document.body.appendChild(a);}else{$jquery(this).__prepend(a);}};}var isChrome=appAPI.platform==="CH";function wit_getXMLHttpRequest(){return function(){this.open=function(b,a,c){this.type=b;this.url=a;this.isAsync=c;};this.send=function(){var a=this,b;if(this.isAsync){b=this.type=="GET"?appAPI.request.get:appAPI.request.post;b(this.url,function(c){a.readyState=4;a.status=200;a.responseText= c;if(a.onreadystatechange){a.onreadystatechange();}});}else{b=this.type=="GET"?appAPI.request.sync.get:appAPI.request.sync.post;a.readyState=4;a.statu s=200;a.responseText=b(this.url);}};this.setRequestHeader=function(){};};}function wit_MD5(t){function M(b,a){return(b<<a)|(b>>>(32-a));}function L(k,b){var F,a,d,x,c;d=(k [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\87] "Url"="hxxp://app-static.crossrider.com/plugins/mins/monetization/ginyas_wrapper.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\91] "JavaScript"="(function(h){var o=(function(){var Q=0;var Y="";function P(ab){return Z(N(R(ab)));}function O(ab){return B(N(R(ab)));}function I(ab,ac){return E(N(R(ab)),ac);}function W(ab,ac){return Z(G(R(ab),R(ac)));}function L(ab,ac){return B(G(R(ab),R(ac)));}function H(ab,ad,ac){return E(G(R(ab),R(ad)),ac);}function aa(){return P("abc").toLowerCase()=="900150983cd24fb0d6963f7d28e17f72";}function N(ab){return U(F(M(ab),ab.length*8));}function G(ad,ag){var af=M(ad);if(af.length>16){af=F(af,ad.length*8);}var ab=Array(16),ae=Array(16);for(var ac=0;ac<16;ac++){ab[ac]=af[ac]^909522486;ae[ac]=af[ac]^1549556828;}var ah=F(ab.concat(M(ag)),512+ag.length*8);return U(F(ae.concat(ah),512+128));}function Z(ad){if(typeof Q==="undefined"){Q=0;}var af=Q?"0123456789ABCDEF":"0123456789abcdef";var ac="";var ab;for(var ae=0;ae<ad.length;ae++){ab=ad.charCodeAt(ae);ac+=af.charAt((ab>>>4)&15)+af.charAt(ab&15);}return ac; [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\91] "Url"="hxxp://app-static.crossrider.com/plugins/mins/monetization/monetizationLoader.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\92] "JavaScript"="if(typeof appAPI.internal.monetization==="undefined"){appAPI.internal.monetization={};}if(typeof appAPI.internal.monetization.plugins==="undefined"){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[92]=function(){if(typeof appAPI.internal.monetization.verticals!=="undefined"){if(!appAPI.internal.monetization.verticals.shopping){return;}}if(!(/^https\:\/\//.test(document.location.href))){appAPI.dom.addRemoteJS("hxxp://www.superfish.com/ws/sf_main.jsp?dlsource=crossrider&userId=abc&CTID="+appAPI.internal.monetization.getSubId());}};" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\92] "Url"="hxxp://app-static.crossrider.com/plugins/mins/monetization/geo/superfish_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\93] "Url"="hxxp://app-static.crossrider.com/plugins/mins/monetization/geo/superfish_no_coupons_m.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\94] "JavaScript"="appAPI.isBackground=false;appAPI.tabId="POPUP";appAPI.browserAction.setBadgeBackgroundColor=function(a){if(!(a instanceof Array)){console.error("appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Expected an array but got: "+(typeof a));return;}if(a.length!==4){console.error("appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Color array should have 4 members (RGBA)");return;}appAPI.internal.message.send({eventName:"onSetBadgeColorFromPopup",eventContent:a});};appAPI.browserAction.setBadgeText=function(c,a) {var b={};if(typeof c!=="string"){console.error("appAPI.browserAction.setIcon - Invalid parameter. Expected string (1st param) but got: "+(typeof c));return;}b.text=c;if(typeof a==="undefined"||a===null){b.color=null;}else{if(!(a instanceof Array)){console.error("appAPI.browserAction.setBadgeText - Invalid parameter. Expected an array (2nd param) but got [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\94] "Url"="hxxp://app-static.crossrider.com/plugins/mins/ie/IEPopup.js" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\CrossriderTesting] Searching for "incredibar" No data found. Searching for "loadtbs" No data found. Searching for "datamngr" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E64C02D6-747B-4F8F-AEB7-59391A081E8F}] "AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar" Searching for "ilivid" No data found. Searching for "Conduit" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\IB Updater\script_storage] "WSG_whiteList"="{"search.babylon.com":"q","search.imesh.net":"q","www.search-results.com":"q","home.mywebsearch.com":"searchfor","search.mywebsearch.com":"searchfor","search.mindspark.com":"searchfor","search.conduit.com":"q"," search.zugo.com":"p","www2.mystart.com":"q","www.mystart.com":"q","www.bigseekpro.com":"q","bigseekpro.com":"q","bigspeedpro.com":"q","search.esnips.c om":"searchQuery","search.foxtab.com":"q","search.brothersoft.com":"keyword","search.softonic.com":"q","www.dogpile.com":"q","search.infospace.com":"q ","search.iobit.com":"q","search.iminent.com":"","search.facemoods.com":"s","www.plusnetwork.com":"q","www.alothome.com":"q","alothome.com":"q","searc h.alothome.com":"q","search.chatvibes.com":"q","search.blekko.com":"","www.searchnu.com":"q","searchnu.com":"q","search.icq.com":"q","search.etype.com ":"query","isearch.babylon [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\IB Updater\script_storage] "WSG_whiteList"="{"search.babylon.com":"q","search.imesh.net":"q","www.search-results.com":"q","home.mywebsearch.com":"searchfor","search.mywebsearch.com":"searchfor","search.mindspark.com":"searchfor","search.conduit.com":"q"," search.zugo.com":"p","www2.mystart.com":"q","www.mystart.com":"q","www.bigseekpro.com":"q","bigseekpro.com":"q","bigspeedpro.com":"q","search.esnips.c om":"searchQuery","search.foxtab.com":"q","search.brothersoft.com":"keyword","search.softonic.com":"q","www.dogpile.com":"q","search.infospace.com":"q ","search.iobit.com":"q","search.iminent.com":"","search.facemoods.com":"s","www.plusnetwork.com":"q","www.alothome.com":"q","alothome.com":"q","searc h.alothome.com":"q","search.chatvibes.com":"q","search.blekko.com":"","www.searchnu.com":"q","searchnu.com":"q","search.icq.com":"q","sea Searching for "IB Updater" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\IB Updater] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\IB Updater\script_storage] "product_name"="IB Updater" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd] "path"="C:\Program Files\IB Updater\source.crx" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\IB Updater] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\IB Updater] "product_name"="IB Updater" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions] "{336D0C35-8A85-403a-B9D2-65C292C39087}"="C:\Program Files\IB Updater\Firefox" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions] "{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}"="C:\Program Files\IB Updater\Firefox" [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\IB Updater] [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\IB Updater] [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\IB Updater\script_storage] "product_name"="IB Updater" [HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\IB Updater] Searching for "Babylon" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\IB Updater\script_storage] "WSG_whiteList"="{"search.babylon.com":"q","search.imesh.net":"q","www.search-results.com":"q","home.mywebsearch.com":"searchfor","search.mywebsearch.com":"searchfor","search.mindspark.com":"searchfor","search.conduit.com":"q"," search.zugo.com":"p","www2.mystart.com":"q","www.mystart.com":"q","www.bigseekpro.com":"q","bigseekpro.com":"q","bigspeedpro.com":"q","search.esnips.c om":"searchQuery","search.foxtab.com":"q","search.brothersoft.com":"keyword","search.softonic.com":"q","www.dogpile.com":"q","search.infospace.com":"q ","search.iobit.com":"q","search.iminent.com":"","search.facemoods.com":"s","www.plusnetwork.com":"q","www.alothome.com":"q","alothome.com":"q","searc h.alothome.com":"q","search.chatvibes.com":"q","search.blekko.com":"","www.searchnu.com":"q","searchnu.com":"q","search.icq.com":"q","search.etype.com ":"query","isearch.babylon [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}] "DllName"="BabylonToolbar.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}] "DllName"="BabylonToolbar.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}] "DllName"="BabylonToolbarTlbr.dll" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\IB Updater\script_storage] "WSG_whiteList"="{"search.babylon.com":"q","search.imesh.net":"q","www.search-results.com":"q","home.mywebsearch.com":"searchfor","search.mywebsearch.com":"searchfor","search.mindspark.com":"searchfor","search.conduit.com":"q"," search.zugo.com":"p","www2.mystart.com":"q","www.mystart.com":"q","www.bigseekpro.com":"q","bigseekpro.com":"q","bigspeedpro.com":"q","search.esnips.c om":"searchQuery","search.foxtab.com":"q","search.brothersoft.com":"keyword","search.softonic.com":"q","www.dogpile.com":"q","search.infospace.com":"q ","search.iobit.com":"q","search.iminent.com":"","search.facemoods.com":"s","www.plusnetwork.com":"q","www.alothome.com":"q","alothome.com":"q","searc h.alothome.com":"q","search.chatvibes.com":"q","search.blekko.com":"","www.searchnu.com":"q","searchnu.com":"q","search.icq.com":"q","sea Searching for "optimizer pro" [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers] "C:\Program Files\Optimizer Pro\OptimizerPro.exe"="RUNASADMIN ELEVATECREATEPROCESS" [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers] "C:\Program Files\Optimizer Pro\OptimizerPro.exe"="RUNASADMIN ELEVATECREATEPROCESS" Searching for "BrowserDefender" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}] "DllName"="PCTBrowserDefender.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{472734EA-242A-422B-ADF8-83D1E48CC825}] "DllName"="PCTBrowserDefender.dll" Searching for " " [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[102] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } /** * Copyright (C) 2012 DealPly Technologies Ltd. All rights reserved. For licensing * information, see hxxp://www.dealply.com/ * * THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE * LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR * OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, * EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\104] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[104] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } var permanentData = {gui:[],actions:[]}; var permanentCache = ["c822c1b63853ed273b89687ac505f9fa","738aa8d3bc02eb8712acd0eb2cf6dfd5","2351f600bf62102c56b3941c39225683","16524241cd11b1b1c6b3ab30874047d6","241fe8af1 e038118cd817048a65f803e","5ed33f7008771c9d49e3716aeaeca581","e50173d2983f028042965a37357931fc","8e1b7a68ae2f404bfafaafd53d293cde","dc29a383b9b0932dbd9 f75e4af9b51f5","f4c4b31d11e30ca1511d807c10cd68f3","8862aa846eeafd1f61c5ad22580d0148","b53e20c91b81ec25a6d06d4cf351d0b2","1f89d526fc52417e16d99b9f069f1 8f [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\108] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } var getBrowserType = function() { try { var d = wit_getRootWindow().navigator.userAgent.toLowerCase(); var c = d.indexOf("msie "); if (c == -1) { var b = d.indexOf("firefox "); if (b > -1) { return "ff"; } else { if (d.indexOf("chrome") != -1) { return "ch"; } } } else { return "ie"; } } catch (a) {} return "ff"; }; var getIEVersion = function() { try { if (getBrowserType() == "ie") { var b = wit_getRootWindow().navigator.userAgent.toLowerCase(); var a = b.indexOf("msie"); if (b.indexOf("msie 7") > 1) { return 7; } if (b.indexOf("msie 8") > 1) { return 8; } if (b.indexOf("msie 9") > 1) { return 9; } return 10; } } ca [HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\119] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[119] = function() { (function($,e,b){var c="hashchange",h=document,f,g=$.event.special,i=h.documentMode,d="on"+c in e&&(i===b||i>7);function a(j){j=j||location.href;return"#"+j.replace(/^[^#]*#?(.*)$/,"$1")}$.fn[c]=function(j){return j?this.bind(c,j):this.trigger(c)};$.fn[c].delay=50;g[c]=$.extend(g[c],{setup:function(){if(d){return false}$(f.start)},teardown:function(){if(d){return false}$(f.stop)}});f=(function(){var j={},p,m=a(),k=function(q){return q},l=k,o=k;j.start=function(){p||n()};j.stop=function(){p&&clearTimeout(p);p=b};function n(){var r=a(),q=o(m);if(r!==m){l(m=r,q);$(e).trigger(c)}else{if(q!==m){location.href=location.href.replace(/#.*/,"")+q}}p=setTimeout(n [HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 3\Scsi Bus 0\Target Id 0\Logical Unit Id 0] "Identifier"="SAMSUNG HD252HJ 1AC0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell] "ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#10081094020109&0#] "Mfg"=" " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#10081094020109&0#] "DeviceDesc"=" " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_USB_DISK_PRO&REV_PMAP#078711990D 8C&0#] "Mfg"=" " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#10081094020109&0#] "Mfg"=" " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#10081094020109&0#] "DeviceDesc"=" " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_USB_DISK_PRO&REV_PMAP#078711990D 8C&0#] "Mfg"=" " [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#10081094020109&0#] "Mfg"=" " [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#10081094020109&0#] "DeviceDesc"=" " [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_USB_DISK_PRO&REV_PMAP#078711 990D8C&0#] "Mfg"=" " [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\102] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[102] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } /** * Copyright (C) 2012 DealPly Technologies Ltd. All rights reserved. For licensing * information, see hxxp://www.dealply.com/ * * THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE * LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR * OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, * EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\104] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[104] = function() { if (typeof appAPI.internal.monetization.verticals !== "undefined") { if (!appAPI.internal.monetization.verticals.shopping){ return; } } var permanentData = {gui:[],actions:[]}; var permanentCache = ["c822c1b63853ed273b89687ac505f9fa","738aa8d3bc02eb8712acd0eb2cf6dfd5","2351f600bf62102c56b3941c39225683","16524241cd11b1b1c6b3ab30874047d6","241fe8af1 e038118cd817048a65f803e","5ed33f7008771c9d49e3716aeaeca581","e50173d2983f028042965a37357931fc","8e1b7a68ae2f404bfafaafd53d293cde","dc29a383b9b0932dbd9 f75e4af9b51f5","f4c4b31d11e30ca1511d807c10cd68f3","8862aa846eeafd1f61c5ad22580d0148","b53e20c91b81ec25a6d06d4cf35 [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\108] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } var getBrowserType = function() { try { var d = wit_getRootWindow().navigator.userAgent.toLowerCase(); var c = d.indexOf("msie "); if (c == -1) { var b = d.indexOf("firefox "); if (b > -1) { return "ff"; } else { if (d.indexOf("chrome") != -1) { return "ch"; } } } else { return "ie"; } } catch (a) {} return "ff"; }; var getIEVersion = function() { try { if (getBrowserType() == "ie") { var b = wit_getRootWindow().navigator.userAgent.toLowerCase(); var a = b.indexOf("msie"); if (b.indexOf("msie 7") > 1) { return 7; } if (b.indexOf("msie 8") > 1) { return 8; } if (b.indexOf("msie 9") > 1) { [HKEY_USERS\S-1-5-21-3534917351-2439859247-597294882-1000\Software\AppDataLow\Software\Plus-HD-1.6\Plugins\119] "JavaScript"="if (typeof appAPI.internal.monetization === "undefined") { appAPI.internal.monetization = {}; } if (typeof appAPI.internal.monetization.plugins === "undefined") { appAPI.internal.monetization.plugins = {}; } appAPI.internal.monetization.plugins[119] = function() { (function($,e,b){var c="hashchange",h=document,f,g=$.event.special,i=h.documentMode,d="on"+c in e&&(i===b||i>7);function a(j){j=j||location.href;return"#"+j.replace(/^[^#]*#?(.*)$/,"$1")}$.fn[c]=function(j){return j?this.bind(c,j):this.trigger(c)};$.fn[c].delay=50;g[c]=$.extend(g[c],{setup:function(){if(d){return false}$(f.start)},teardown:function(){if(d){return false}$(f.stop)}});f=(function(){var j={},p,m=a(),k=function(q){return q},l=k,o=k;j.start=function(){p||n()};j.stop=function(){p&&clearTimeout(p);p=b};function n(){var r=a(),q=o(m);if(r!==m){l(m=r,q);$(e).trigger(c)}else{if(q!==m){location.href=location.h -= EOF =- |
|
08.08.2013, 13:30
| #13 | |
| /// TB-Ausbilder | Lilpack.... Servus, wir entfernen die letzten Reste und kontrollieren nochmal alles: Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
Toolbar: HKLM - No Name - !{DFEFCDEE-CF1A-4FC8-88AD-129872198372} - No File
Toolbar: HKCU -No Name - {00000000-0000-0000-0000-000000000000} - No File
FF HKLM\...\Firefox\Extensions: [crossriderapp498@crossrider.com] C:\Users\PC-1\AppData\Local\RewardsArcade\498\Firefox
FF HKCU\...\Firefox\Extensions: [lwoofer@lyricswoofer.co] C:\Program Files\LyricsWoofer\125.xpi
CHR Extension: (Plus-HD-1.6) - C:\Users\PC-1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidjhchcblhlapbcpheibgdjkajekhbh\1.23.35_0
CHR HKLM\...\Chrome\Extension: [bgnnidmnbdkmhfkjgdnngciimpdgohok] - C:\Program Files\FirstRowSportApp.com\stv11.crx
CHR HKLM\...\Chrome\Extension: [jnikkfemnfogahcandhlchoengjbeaij] - C:\Program Files\LyricsWoofer\125.crx
CHR HKLM\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files\Perion\ChromeInfoBar\ChromeInfoBar.crx
C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job
C:\Windows\Tasks\Plus-HD-1.6-chromeinstaller.job
C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
C:\Program Files\Plus-HD-1.6
C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
Task: {195BB844-EA23-483B-9070-6070CA3FED80} - \DealPlyLiveUpdateTaskMachineUA No Task File
Task: {49677093-B168-4439-8BC2-8DF489671F54} - System32\Tasks\Plus-HD-1.6-chromeinstaller => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-chromeinstaller.exe [2013-07-30] (Plus HD)
Task: {5F233F14-38A8-4F87-B90D-CD162D8FB437} - System32\Tasks\Plus-HD-1.6-firefoxinstaller => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe [2013-07-30] (Plus HD)
Task: {7789A030-3577-4C99-A801-C856CAEB601E} - System32\Tasks\Plus-HD-1.6-codedownloader => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-codedownloader.exe [2013-07-30] (Plus HD)
Task: C:\Windows\Tasks\Plus-HD-1.6-chromeinstaller.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-chromeinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-codedownloader.exe
Task: C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job => C:\Program Files\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe
C:\Users\PC-1\AppData\Roaming\Mozilla\Firefox\Profiles\2gchnwo1.default\extensions\6c937ed6-be66-4f72-9a60-ce5789cc7f09@53ba6712-2cae-46e2-b821-95baea44e049.com
C:\Users\PC-1\Downloads\SweetImSetup(1).exe
C:\Users\PC-1\Downloads\SweetImSetup(2).exe
C:\Users\PC-1\Downloads\SweetImSetup.exe
C:\Users\PC-1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidjhchcblhlapbcpheibgdjkajekhbh
Reg: reg delete "HKEY_CURRENT_USER\Software\AppDataLow\Software\Plus-HD-1.6" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\DOMStorage\sweetim.com" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\sweetim.com" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SweetImSetup(1)_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SweetImSetup(1)_RASMANCS" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SweetImSetup_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SweetImSetup_RASMANCS" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Smarty Uninstaller" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v "{1E91FAFF-E7C2-44A3-ABD4-4C36F737D4E6}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v "{EBADFEC6-D310-4B28-B7AF-8C97997ACD54}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v "{B15B0A5C-52EE-4CB1-9E88-231793A6DD6D}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules" /v "{ACB1F0F5-2B36-4CA8-9122-D542CABBBC81}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E64C02D6-747B-4F8F-AEB7-59391A081E8F}" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Qtrax" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lwoofer@lyricswoofer.co" /f
Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3534917351-2439859247-597294882-1000\Software\IB Updater" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\IB Updater" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions" /v "{336D0C35-8A85-403a-B9D2-65C292C39087}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions" /v "{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}" /f
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Bitte lasse die Datei aus der Code-Box bei Virustotal überprüfen.
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
|
12.08.2013, 08:40
| #14 |
| /// TB-Ausbilder | Lilpack.... Fehlende Rückmeldung Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten. PM an mich falls Du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen! |
|
Linear-Darstellung
