| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Snap.do lässt sich nicht entfernenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
24.08.2013, 09:37
| #1 |
 |  Windows 7: Snap.do lässt sich nicht entfernen Hallo, ich hab seit ca einem Monat, wenn nicht sogar länger, das Problem, dass Chrome statt "new tab" die Seite "Snap.do" öffnet. Über die Einstellungen von Chrome habe ich das jedes Mal wieder geändert. Allerdings habe ich gestern einen Punkt erreicht, wo sich dieser Zustand nicht mehr ändern lässt. Wenn ich Chrome starte oder einen neuen Tab öffne, dann öffnet sich "Snap.do". Daher habe ich gestern versucht unter Systemsteuerung ein solches Programm zu finden. Nach dem ich es tatsächlich gefunden habe, habe ich ich versucht es mehrmals zu deinstallieren. Gelistet ist es unter Programmen nun nicht mehr, aber die Symptome bleiben bestehen. In eurem Forum habe ich den Rat gelesen, " Malwarebytes Anti-Malware " und "OTL" zu nutzen. Trotz dem Scan von Malwarebytes und OTL ist Snap.do immernoch aktiv. Ich hoffe ihr könnt mit dem Problem mehr anfangen als ich  mfG Jakob Hier die Logs der beiden Programme (der zweite OTL musste aus Platzgründen erst mal entfernt werden): Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.23.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 Jakobs :: JAKOBS-PC [Administrator] Schutz: Aktiviert 24.08.2013 01:03:32 mbam-log-2013-08-24 (01-03-32).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|J:\|K:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 778714 Laufzeit: 1 Stunde(n), 9 Minute(n), 24 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 36 HKCR\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltaHlpr.1 (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltaHlpr (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\esrv.deltaESrvc.1 (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\esrv.deltaESrvc (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltadskBnd.1 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltadskBnd (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Typelib\{4599D05A-D545-4069-BB42-5895B4EAE05B} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{1231839B-064E-4788-B865-465A1B5266FD} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} (PUP.Optional.QuickShare.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltaappCore.1 (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\delta.deltaappCore (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B} (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\d (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C1C6816E-CBB3-A748-85F9-A8B47B68985B} (PUP.Optional.SilentInstall.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26B5A6D1-1F75-3B59-5825-E4D4CAE3445D} (PUP.Optional.SilentInstall.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\DataMngr (PUP.Optional.DataMngr) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 4 HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Daten: Delta Toolbar -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0L1N1H2O1S -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 5 HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=hp&installDate=07/08/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Search Bar (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|SearchAssistant (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 21 C:\Users\Jakobs\AppData\Roaming\WebCake (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\WebCake\dat (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\WebCake\dat\update (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38} (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Cache (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\Delta (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\CR (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\Shared (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.21.5 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.21.5\bh (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\OpenCandy\60CD7EC072F942E9B04DEFDBF8491CA1 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\OpenCandy\6D9E78EDFB9D45508AC783D38A358C74 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 66 C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.21.5\deltasrv.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaApp.dll (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaEng.dll (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe (Adware.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\continuetosave\uninstall.exe (PUP.Optional.SilentInstall.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\SaveByclick\uninstall.exe (PUP.Optional.SilentInstall.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.exe (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\Shared\BabMaint.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\Shared\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\OpenCandy\6D9E78EDFB9D45508AC783D38A358C74\DeltaTB.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. F:\Sicherung 21.07.2012 kleine festplatte\Sicherung 07.06.2011\Downloads\ConnectifyInstaller.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. F:\Sicherung 21.07.2012 kleine festplatte\Sicherung 07.06.2011\Downloads\SoftonicDownloader_fuer_netmeter.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt. F:\Sicherung 21.07.2012 kleine festplatte\Sicherung 07.06.2011\Downloads\videora-ipod-504-setup.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. F:\Sicherung 21.07.2012 kleine festplatte\Sicherung 09.05.12\Downloads\GetGoYDSetup_1.4.1.480.exe (PUP.Optional.AskToolbar) -> Erfolgreich gelöscht und in Quarantäne gestellt. F:\Sicherung 21.07.2012 kleine festplatte\Sicherung 14.01.12\Downloads\SoftonicDownloader_fuer_icq-banner-remover.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt. G:\Download\DTLite4454-0314.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. G:\Download\FreeYouTubeToMP3Converter.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. G:\Download\MyPhoneExplorer_Setup_1.8.4.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. G:\Download\PhotoScape_V3.6.3.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. G:\einige Sachen von der Großen\Serien\scrubs\Staffel 06\PhotoshopCS3kaputt\asneu.dll (Trojan.Agent.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\WebCake\PlugIns.cache (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\WebCake\dat\Desktop.OS.dll (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\WebCake\dat\Dora.dat (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\WebCake\dat\Maintain.dat (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\WebCake\dat\Paladin.dat (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\WebCake\dat\Phoenix.dat (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\WebCake\dat\sqlite3.dll (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.ico (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.dat (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setup.dll (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\Delta\sqlite3.dll (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\schedule!1143840799.job (PUP.Optional.OptimizerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.settings (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\dm (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\03 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\13 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\23 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\CR\Delta.crx (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\Shared\chu.js (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\Shared\Delta.ico (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\Shared\GUninstaller.exe (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\Shared\SetupParams.ini (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\BabSolution\Shared\sqlite3.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.21.5\GUninstaller.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Delta\delta\1.8.21.5\uninstall.exe (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\OpenCandy\60CD7EC072F942E9B04DEFDBF8491CA1\Installer.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\OpenCandy\6D9E78EDFB9D45508AC783D38A358C74\5471.ico (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\OpenCandy\6D9E78EDFB9D45508AC783D38A358C74\EBB77268-338F-4C6A-8590-AD88FED26F4A (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jakobs\AppData\Roaming\OpenCandy\6D9E78EDFB9D45508AC783D38A358C74\OCBrowserHelper_1.0.6.125.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter OTL logfile created on: 24.08.2013 10:14:33 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jakobs\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16660) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,90 Gb Total Physical Memory | 5,24 Gb Available Physical Memory | 66,39% Memory free 15,79 Gb Paging File | 12,74 Gb Available in Paging File | 80,64% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 111,69 Gb Total Space | 13,52 Gb Free Space | 12,10% Space Free | Partition Type: NTFS Drive F: | 1536,00 Gb Total Space | 1414,88 Gb Free Space | 92,11% Space Free | Partition Type: NTFS Drive G: | 327,01 Gb Total Space | 136,79 Gb Free Space | 41,83% Space Free | Partition Type: NTFS Drive J: | 488,28 Gb Total Space | 107,21 Gb Free Space | 21,96% Space Free | Partition Type: NTFS Drive K: | 443,23 Gb Total Space | 148,13 Gb Free Space | 33,42% Space Free | Partition Type: NTFS Computer Name: JAKOBS-PC | User Name: Jakobs | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Jakobs\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) PRC - C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe () PRC - C:\Program Files (x86)\PDF Architect\ConversionService.exe (pdfforge GbR) PRC - C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) PRC - C:\Program Files (x86)\XFastUSB\XFastUsb.exe (FNet Co., Ltd.) PRC - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe (Symantec Corporation) PRC - C:\Program Files (x86)\MouseServer\MouseServer.exe (wifimouse@necta.us) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe () PRC - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) PRC - C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe (Creative Technology Ltd) PRC - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation) PRC - C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe () PRC - C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated) PRC - c:\cs2\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe () PRC - C:\cs2\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe (Adobe Sytems Incorporated) PRC - c:\cs2\Adobe Version Cue CS2\bin\VersionCueCS2.exe (Adobe Systems Incorporated) ========== Modules (No Company Name) ========== MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\27ea7ac7d265bd9fb73f1b43da0f4569\Microsoft.VisualBasic.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\d4493b0e5a5c6faf89cfeaa5f2a21034\IAStorUtil.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\dd8f4efb7e81c75fe444a180f6f1aacf\System.Runtime.Remoting.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\930e99b2f62cea8c4aa070527d15f748\PresentationFramework.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\28ea347a952d20959ac6ae02d7457d39\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\585b8f6cc7ba86886462d0dc9753c98f\PresentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1f6f220f9efe936d1158c79b9d4b451f\WindowsBase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\8f7d83126a3cf283e5ac97f2d6d99f12\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll () MOD - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll () MOD - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\pdf.dll () MOD - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\libglesv2.dll () MOD - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\libegl.dll () MOD - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\ffmpegsumo.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\6e3778958a8bfd03bf0f2f60c4e25623\IAStorCommon.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll () MOD - c:\progra~2\contin~1\sprote~1.dll () MOD - c:\progra~2\simple~1\sprote~1.dll () MOD - c:\progra~2\saveby~1\sprote~1.dll () MOD - C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\de-DE\THXAudNB.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll () ========== Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) SRV - (HiPatchService) -- C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios) SRV - (PDF Architect Service) -- C:\Program Files (x86)\PDF Architect\ConversionService.exe (pdfforge GbR) SRV - (PDF Architect Helper Service) -- C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (N360) -- C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe (Symantec Corporation) SRV - (ISCTAgent) -- C:\Programme\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe () SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (jhi_service) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) SRV - (Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe () SRV - (Intel(R) -- C:\Programme\Intel\iCLS Client\HeciServer.exe (Intel(R) Corporation) SRV - (cphs) -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Intel Corporation) SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (cFosSpeedS) -- C:\Programme\ASRock\XFast LAN\spd.exe (cFos Software GmbH) SRV - (CLKMSVC10_38F51D56) -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe (CyberLink) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (PDFProFiltSrvPP) -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.) SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (BrYNSvc) -- C:\Program Files (x86)\Browny02\BrYNSvc.exe (Brother Industries, Ltd.) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (AdobeActiveFileMonitor5.0) -- C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe () SRV - (Adobe Version Cue CS2) -- c:\cs2\Adobe Version Cue CS2\bin\VersionCueCS2.exe (Adobe Systems Incorporated) ========== Driver Services (SafeList) ========== DRV:64bit: - (WPRO_41_2001) -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys () DRV:64bit: - (tbhsd) -- C:\Windows\SysNative\drivers\tbhsd.sys (RapidSolution Software AG) DRV:64bit: - (RRNetCapMP) -- C:\Windows\SysNative\drivers\rrnetcap.sys (RapidSolution Software AG) DRV:64bit: - (RRNetCap) -- C:\Windows\SysNative\drivers\rrnetcap.sys (RapidSolution Software AG) DRV:64bit: - (FNETTBOH_305) -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS (FNet Co., Ltd.) DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices) DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys () DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys () DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV:64bit: - (FNETURPX) -- C:\Windows\SysNative\drivers\FNETURPX.SYS (FNet Co., Ltd.) DRV:64bit: - (SRTSPX) -- C:\Windows\SysNative\drivers\N360x64\0604010.00E\srtspx64.sys (Symantec Corporation) DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\drivers\N360x64\0604010.00E\srtsp64.sys (Symantec Corporation) DRV:64bit: - (ANDNetModem) -- C:\Windows\SysNative\drivers\lgandnetmodem64.sys (LG Electronics Inc.) DRV:64bit: - (AndNetDiag) -- C:\Windows\SysNative\drivers\lgandnetdiag64.sys (LG Electronics Inc.) DRV:64bit: - (ccSet_N360) -- C:\Windows\SysNative\drivers\N360x64\0604010.00E\ccsetx64.sys (Symantec Corporation) DRV:64bit: - (SymEFA) -- C:\Windows\SysNative\drivers\N360x64\0604010.00E\symefa64.sys (Symantec Corporation) DRV:64bit: - (USBModem) -- C:\Windows\SysNative\drivers\lgx64modem.sys (LG Electronics Inc.) DRV:64bit: - (UsbDiag) -- C:\Windows\SysNative\drivers\lgx64diag.sys (LG Electronics Inc.) DRV:64bit: - (usbbus) -- C:\Windows\SysNative\drivers\lgx64bus.sys (LG Electronics Inc.) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (ISCT) -- C:\Windows\SysNative\drivers\ISCTD64.sys () DRV:64bit: - (imsevent) -- C:\Windows\SysNative\drivers\imsevent.sys () DRV:64bit: - (ikbevent) -- C:\Windows\SysNative\drivers\ikbevent.sys () DRV:64bit: - (iusb3xhc) -- C:\Windows\SysNative\drivers\iusb3xhc.sys (Intel Corporation) DRV:64bit: - (iusb3hub) -- C:\Windows\SysNative\drivers\iusb3hub.sys (Intel Corporation) DRV:64bit: - (iusb3hcs) -- C:\Windows\SysNative\drivers\iusb3hcs.sys (Intel Corporation) DRV:64bit: - (AsrRamDisk) -- C:\Windows\SysNative\drivers\AsrRamDisk.sys (ASRock Inc.) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (SymNetS) -- C:\Windows\SysNative\drivers\N360x64\0604010.00E\symnets.sys (Symantec Corporation) DRV:64bit: - (SymIRON) -- C:\Windows\SysNative\drivers\N360x64\0604010.00E\ironx64.sys (Symantec Corporation) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (asahci64) -- C:\Windows\SysNative\drivers\asahci64.sys (Asmedia Technology) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (SymDS) -- C:\Windows\SysNative\drivers\N360x64\0604010.00E\symds64.sys (Symantec Corporation) DRV:64bit: - (cFosSpeed) -- C:\Windows\SysNative\drivers\cfosspeed6.sys (cFos Software GmbH) DRV:64bit: - (AsrAppCharger) -- C:\Windows\SysNative\drivers\AsrAppCharger.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (MBfilt) -- C:\Windows\SysNative\drivers\MBfilt64.sys (Creative Technology Ltd.) DRV:64bit: - (LgBttPort) -- C:\Windows\SysNative\drivers\lgbtpt64.sys (LG Electronics Inc.) DRV:64bit: - (LGVMODEM) -- C:\Windows\SysNative\drivers\lgvmdm64.sys (LG Electronics Inc.) DRV:64bit: - (lgbusenum) -- C:\Windows\SysNative\drivers\lgbtbs64.sys (LG Electronics Inc.) DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (tap0801) -- C:\Windows\SysNative\drivers\tap0801.sys (The OpenVPN Project) DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation) DRV - (IDSVia64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130823.001\IDSviA64.sys (Symantec Corporation) DRV - (BHDrvx64) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130715.001\BHDrvx64.sys (Symantec Corporation) DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\ex64.sys (Symantec Corporation) DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\eng64.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013 IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = hxxp://websearch.simplespeedy.info/?l=1&q={searchTerms} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E1 E3 C4 38 8A A1 CD 01 [binary data] IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013 IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SPLEP1&pc=SPLH IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaultenginename,S: S", "" FF - prefs.js..browser.search.defaultthis.engineName: "" FF - prefs.js..browser.search.defaulturl: "hxxp://websearch.simplespeedy.info/?l=1&q=" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.order.1,S: S", "WebSearch" FF - prefs.js..browser.search.selectedEngine,S: S", "WebSearch" FF - prefs.js..extensions.enabledAddons: {b9075e96-a7a8-4c7a-ae84-f80118c62b97}:1.0 FF - prefs.js..extensions.enabledAddons: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2.1 FF - prefs.js..extensions.enabledAddons: youtube2mp3@mondayx.de:1.2.3 FF - prefs.js..extensions.enabledAddons: info@youtube-mp3.org:1.0.4 FF - prefs.js..extensions.enabledAddons: foxyproxy@eric.h.jung:4.1.4 FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.15 FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "" FF - prefs.js..browser.startup.homepage: "" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "" FF - prefs.js..browser.startup.homepage: "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=hp&installDate=07/08/2013" FF - prefs.js..browser.search.selectedEngine: "Web Search" FF - prefs.js..keyword.URL: "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&installDate=07/08/2013&q=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.7: C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Jakobs\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFFPlgn\ [2013.02.17 15:09:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\ [2013.08.24 10:11:05 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013.01.19 20:21:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 14:01:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.08.07 13:27:01 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 14:01:49 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.08.07 13:27:01 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012.07.20 23:26:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Extensions [2012.07.20 23:26:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2013.08.24 00:54:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions [2013.06.07 03:09:43 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013.02.04 19:37:02 | 000,000,000 | ---D | M] (SaveByclick) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\50fae4f9da40b@50fae4f9da445.com [2013.02.04 19:37:02 | 000,000,000 | ---D | M] (continuetosave) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\510fef8a0a5a6@510fef8a0a5df.com [2013.02.13 22:21:33 | 000,000,000 | ---D | M] (continuetosave) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\511bc29a3341a@511bc29a33450.com [2013.02.13 22:21:33 | 000,000,000 | ---D | M] (continuetosave) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\511bc39023e1e@511bc39023e57.com [2013.06.12 22:04:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\ffxtlbr@babylon.com [2013.06.12 22:04:50 | 000,000,000 | ---D | M] (Delta Toolbar) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\ffxtlbr@delta.com [2013.06.07 03:09:42 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\foxyproxy@eric.h.jung [2013.06.12 22:04:07 | 000,000,000 | ---D | M] (WebCake) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\plugin@getwebcake.com [2013.08.24 00:54:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\staged [2013.05.28 00:07:38 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Jakobs\AppData\Roaming\mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\toolbar@ask.com [2013.02.04 19:45:58 | 000,006,796 | ---- | M] () (No name found) -- C:\Users\Jakobs\AppData\Roaming\mozilla\firefox\profiles\s5n1x0rv.default\extensions\info@youtube-mp3.org.xpi [2013.02.04 19:39:53 | 000,011,510 | ---- | M] () (No name found) -- C:\Users\Jakobs\AppData\Roaming\mozilla\firefox\profiles\s5n1x0rv.default\extensions\youtube2mp3@mondayx.de.xpi [2012.07.20 22:52:03 | 000,089,442 | ---- | M] () (No name found) -- C:\Users\Jakobs\AppData\Roaming\mozilla\firefox\profiles\s5n1x0rv.default\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi [2013.02.28 14:14:56 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Jakobs\AppData\Roaming\mozilla\firefox\profiles\s5n1x0rv.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.08.23 23:42:32 | 000,002,435 | ---- | M] () -- C:\Users\Jakobs\AppData\Roaming\mozilla\firefox\profiles\s5n1x0rv.default\searchplugins\Web Search.xml [2012.09.08 14:01:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.09.08 14:01:48 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.09.08 14:01:49 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.02 16:07:47 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=hp&installDate=07/08/2013 CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm\2_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\anepbdekljkmmimmhbniglnnanmmkoja\0.1.13_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdfkbdkkfmmckaadapdipihjfaacnkgd\3_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0\.orig CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehmcijnpodcghlafhmmlhhcaofmmjlae\1\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi\1.1208.30.1_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhdhdjejihpnakibpmcfokecfgbbdgig\1\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\flgdeakeeekllcpldfampgbamohdagdp\1.1_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.5_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijciphidhidaebloioeaefakmcfhegjb\1\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkigggggfoomckaikapfphaocbdbpkhe\1\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcahibnffhnnjcedflmchmokndkjnhpg\5.7.11.1_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\keembkgclppcbilkekfgpobhldjjhpmn\1.5.7_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfomhlbnciicmciejodphlggfbmhbbbo\1.1_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\5.3.7_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcceagdollnkjlogmdckgjakjapmkdjf\3.0.1.2_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.13.5_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmameahlembdcigphohgiodcgjomcgeo\1.27_0\ CHR - Extension: No name found = C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2012.12.22 19:00:46 | 000,000,850 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 74.208.10.249 gs.apple.com O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (continuetosave) - {108059B1-3AFF-A2B0-7959-59D31FE470F4} - C:\ProgramData\continuetosave\511bc29a33591.dll () O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files (x86)\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics) O2 - BHO: (continuetosave) - {2CA5A921-7FBC-8E04-3595-0E324B15B0F0} - C:\ProgramData\continuetosave\511bc39023f8f.dll () O2 - BHO: (continuetosave) - {2DCD6050-E56C-C09E-FFB4-05513EC0FDA5} - C:\ProgramData\continuetosave\510fef8a0a737.dll () O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR) O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation) O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\IPS\IPSBHO.DLL (Symantec Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (PDF Architect Toolbar) - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation) O3 - HKU\S-1-5-21-3798938239-439478928-2569035992-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [THXCfg64] C:\Windows\SysNative\THXCfg64.DLL (Creative Technology Ltd.) O4:64bit: - HKLM..\Run: [XFast LAN] C:\Programme\ASRock\XFast LAN\cfosspeed.exe (cFos Software GmbH) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Version Cue CS2] c:\cs2\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe (Adobe Sytems Incorporated) O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [PPort12reminder] C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [SmartViewAgent] "C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe" File not found O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [THX TruStudio NB Settings] C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe (Creative Technology Ltd) O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.) O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation) O4 - HKLM..\Run: [XFastUSB] C:\Program Files (x86)\XFastUSB\XFastUsb.exe (FNet Co., Ltd.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3798938239-439478928-2569035992-1000..\Run: [ASRockXTU] File not found O4 - HKU\S-1-5-21-3798938239-439478928-2569035992-1000..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation) O4 - HKU\S-1-5-21-3798938239-439478928-2569035992-1000..\Run: [LG LinkAir] File not found O4 - HKU\S-1-5-21-3798938239-439478928-2569035992-1000..\Run: [MouseServer] C:\Program Files (x86)\MouseServer\MouseServer.exe (wifimouse@necta.us) O4 - HKU\S-1-5-21-3798938239-439478928-2569035992-1000..\Run: [Screenpresso] C:\Users\Jakobs\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe (Learnpulse) O4 - HKU\S-1-5-21-3798938239-439478928-2569035992-1000..\Run: [zASRockInstantBoot] File not found O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jakobs\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Mit PDF Viewer Plus öffnen - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation) O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Jakobs\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Mit PDF Viewer Plus öffnen - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{42F35757-803A-4C80-9922-EF90071DC976}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (c:\progra~2\saveby~1\sprote~1.dll) - c:\progra~2\saveby~1\sprote~1.dll () O20 - AppInit_DLLs: (c:\progra~2\contin~1\sprote~1.dll) - c:\progra~2\contin~1\sprote~1.dll () O20 - AppInit_DLLs: (c:\progra~2\simple~1\sprote~1.dll) - c:\progra~2\simple~1\sprote~1.dll () O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{2323da92-d2a3-11e1-9342-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{2323da92-d2a3-11e1-9342-806e6f6e6963}\Shell\AutoRun\command - "" = D:\ASRSetup.exe O33 - MountPoints2\{25c80f92-08d0-11e2-81af-bc5ff43aca23}\Shell - "" = AutoRun O33 - MountPoints2\{25c80f92-08d0-11e2-81af-bc5ff43aca23}\Shell\AutoRun\command - "" = E:\Autorun.exe O33 - MountPoints2\{6cd55dd6-2a8a-11e2-96ee-bc5ff43aca23}\Shell - "" = AutoRun O33 - MountPoints2\{6cd55dd6-2a8a-11e2-96ee-bc5ff43aca23}\Shell\AutoRun\command - "" = H:\LGAutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.08.24 10:13:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Jakobs\Desktop\OTL.exe [2013.08.24 01:01:47 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\AppData\Roaming\Malwarebytes [2013.08.24 01:01:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.08.24 01:01:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.08.24 01:01:40 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2013.08.24 01:01:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2013.08.19 22:41:08 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\Documents\Electronic Arts [2013.08.19 22:24:00 | 000,447,752 | ---- | C] (On2.com) -- C:\Windows\SysWow64\vp6vfw.dll [2013.08.19 21:20:24 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\Documents\Battlefield 3 [2013.08.19 21:20:02 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\AppData\Local\ESN [2013.08.19 21:20:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlelog Web Plugins [2013.08.19 21:18:35 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs [2013.08.19 21:18:24 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller [2013.08.19 21:18:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 3 [2013.08.19 21:08:51 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core [2013.08.15 17:48:20 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\AppData\Local\Criterion Games [2013.08.15 10:57:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games [2013.08.15 10:54:40 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\AppData\Roaming\Origin [2013.08.15 10:54:39 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\AppData\Local\Origin [2013.08.15 10:48:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin [2013.08.15 10:48:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin [2013.08.15 10:48:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin [2013.08.15 10:48:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts [2013.08.14 15:55:12 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.08.14 15:55:11 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.08.14 15:55:11 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.08.14 15:55:11 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.08.14 15:55:11 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.08.14 15:55:11 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.08.14 15:55:11 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.08.14 15:55:11 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.08.14 15:55:11 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.08.14 15:55:11 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.08.14 15:55:11 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.08.14 15:55:10 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.08.14 15:55:10 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.08.14 15:55:10 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.08.14 15:55:10 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.08.14 15:50:56 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MRT [2013.08.14 12:49:00 | 001,472,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2013.08.14 12:49:00 | 000,224,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll [2013.08.14 12:48:59 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2013.08.14 12:47:55 | 001,888,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL [2013.08.14 12:47:55 | 001,620,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL [2013.08.14 12:47:54 | 001,217,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll [2013.08.14 12:47:50 | 005,550,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2013.08.14 12:47:50 | 003,968,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2013.08.14 12:47:50 | 003,913,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2013.08.14 12:47:50 | 001,732,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll [2013.08.14 12:47:50 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2013.08.14 12:47:50 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2013.08.14 12:47:49 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2013.08.14 12:47:49 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2013.08.14 12:47:49 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2013.08.14 12:47:49 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2013.08.13 20:01:06 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\Desktop\eigenes fotoalbum [2013.08.13 19:29:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Betcat [2013.08.10 20:02:15 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\Desktop\zwergentanz 16.6 [2013.08.10 09:56:48 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\AppData\Roaming\Betcat [2013.08.09 20:12:07 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\Desktop\lieder [2013.08.09 11:23:36 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\AppData\Roaming\Web Cake [2013.08.07 15:24:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft [2013.08.07 15:24:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft [2013.08.07 13:27:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird [2013.08.07 12:53:51 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\Desktop\projekt silberhochzeit [2013.08.04 20:25:08 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\Documents\The Witcher [2013.08.04 20:25:08 | 000,000,000 | ---D | C] -- C:\Users\Jakobs\AppData\Local\The Witcher [2013.08.04 20:24:44 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\The Witcher [2013.08.03 19:52:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.08.24 10:12:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jakobs\Desktop\OTL.exe [2013.08.24 10:11:22 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.08.24 10:11:22 | 000,000,828 | ---- | M] () -- C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job [2013.08.24 10:11:21 | 000,000,390 | -H-- | M] () -- C:\Windows\tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job [2013.08.24 10:11:04 | 000,034,752 | ---- | M] () -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys [2013.08.24 10:11:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.08.24 10:10:58 | 2065,391,615 | -HS- | M] () -- C:\hiberfil.sys [2013.08.24 09:49:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.08.24 09:43:01 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.08.24 09:43:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000UA.job [2013.08.24 01:43:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000Core.job [2013.08.24 01:01:41 | 000,001,116 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.08.23 23:51:55 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.08.23 23:51:55 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013.08.23 23:10:16 | 000,015,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.08.23 23:10:16 | 000,015,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.08.23 23:09:05 | 001,641,292 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.08.23 23:09:05 | 000,707,088 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.08.23 23:09:05 | 000,660,706 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.08.23 23:09:05 | 000,152,680 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.08.23 23:09:05 | 000,124,896 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.08.21 09:52:40 | 000,000,000 | ---- | M] () -- C:\Users\Jakobs\AppData\Roaming\TS3Patch.lck [2013.08.20 11:51:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job [2013.08.20 10:55:06 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2013.08.20 10:55:06 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2013.08.19 22:26:36 | 000,000,867 | ---- | M] () -- C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk [2013.08.19 22:26:11 | 000,000,927 | ---- | M] () -- C:\Users\Public\Desktop\Die Sims™ 3 Late Night.lnk [2013.08.19 22:23:58 | 000,000,909 | ---- | M] () -- C:\Users\Public\Desktop\Die*Sims™*3.lnk [2013.08.19 22:23:37 | 000,447,752 | ---- | M] (On2.com) -- C:\Windows\SysWow64\vp6vfw.dll [2013.08.19 21:20:30 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2013.08.19 21:18:24 | 000,000,655 | ---- | M] () -- C:\Users\Public\Desktop\Battlefield 3.lnk [2013.08.19 21:18:04 | 000,075,136 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe [2013.08.15 10:48:47 | 000,000,986 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk [2013.08.14 15:26:08 | 000,261,909 | ---- | M] () -- C:\Users\Jakobs\Desktop\2013-08-14_15h25_57.jpg [2013.08.14 13:29:27 | 000,129,838 | ---- | M] () -- C:\Users\Jakobs\Documents\Teilnehmerliste2013_Stand_18072013.pdf [2013.08.07 13:10:28 | 000,019,456 | -H-- | M] () -- C:\Users\Jakobs\Desktop\photothumb.db [2013.08.03 19:45:09 | 000,002,378 | ---- | M] () -- C:\Users\Jakobs\Desktop\Google Chrome.lnk [2013.07.26 07:13:58 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.07.26 07:12:27 | 000,603,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.07.26 07:12:08 | 003,958,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.07.26 07:12:08 | 000,855,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.07.26 07:12:04 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.07.26 07:12:04 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.07.26 07:12:03 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.07.26 07:12:03 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.07.26 05:12:04 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.07.26 05:12:00 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.07.26 05:12:00 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.07.26 05:12:00 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.07.26 05:11:59 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.07.26 04:39:38 | 000,089,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.07.26 03:59:38 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.07.25 11:25:54 | 001,888,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL [2013.07.25 10:57:27 | 001,620,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL [1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.08.24 01:01:41 | 000,001,116 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.08.21 09:52:40 | 000,000,000 | ---- | C] () -- C:\Users\Jakobs\AppData\Roaming\TS3Patch.lck [2013.08.19 22:26:36 | 000,000,867 | ---- | C] () -- C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk [2013.08.19 22:26:11 | 000,000,927 | ---- | C] () -- C:\Users\Public\Desktop\Die Sims™ 3 Late Night.lnk [2013.08.19 22:23:58 | 000,000,909 | ---- | C] () -- C:\Users\Public\Desktop\Die*Sims™*3.lnk [2013.08.19 21:18:24 | 000,000,655 | ---- | C] () -- C:\Users\Public\Desktop\Battlefield 3.lnk [2013.08.15 10:48:47 | 000,000,986 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk [2013.08.14 15:26:08 | 000,261,909 | ---- | C] () -- C:\Users\Jakobs\Desktop\2013-08-14_15h25_57.jpg [2013.08.14 13:29:27 | 000,129,838 | ---- | C] () -- C:\Users\Jakobs\Documents\Teilnehmerliste2013_Stand_18072013.pdf [2013.05.20 15:13:06 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll [2013.05.20 15:13:06 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini [2013.02.25 22:26:26 | 000,000,047 | ---- | C] () -- C:\Users\Jakobs\jagex_cl_loginapplet_LIVE.dat [2013.02.18 14:28:52 | 001,065,984 | ---- | C] () -- C:\Users\Jakobs\AppData\Local\file__0.localstorage [2013.01.10 19:37:45 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\pxhpinst.exe [2013.01.07 21:01:10 | 000,016,384 | ---- | C] () -- C:\Windows\SysWow64\FileOps.exe [2012.12.22 17:05:08 | 000,000,600 | ---- | C] () -- C:\Users\Jakobs\AppData\Roaming\winscp.rnd [2012.11.03 21:34:27 | 000,008,192 | ---- | C] () -- C:\Users\Jakobs\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.10.29 19:52:17 | 000,000,045 | ---- | C] () -- C:\Users\Jakobs\jagex_cl_runescape_LIVE.dat [2012.10.29 19:52:17 | 000,000,024 | ---- | C] () -- C:\Users\Jakobs\random.dat [2012.09.24 15:46:58 | 000,000,344 | ---- | C] () -- C:\Windows\lgfwup.ini [2012.09.24 13:18:36 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib [2012.09.04 22:03:10 | 000,000,051 | ---- | C] () -- C:\ProgramData\kmslqakytservea [2012.08.12 12:58:21 | 000,000,245 | ---- | C] () -- C:\Windows\Brpfx04a.ini [2012.08.12 12:58:21 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini [2012.08.12 12:57:53 | 000,000,066 | ---- | C] () -- C:\Windows\Brfaxrx.ini [2012.08.12 12:57:53 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat [2012.08.12 12:57:45 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL [2012.08.12 12:57:43 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI [2012.07.22 22:12:10 | 000,000,094 | ---- | C] () -- C:\Users\Jakobs\AppData\Local\fusioncache.dat [2012.07.22 22:11:27 | 001,618,250 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.07.22 22:10:15 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.07.22 22:10:14 | 002,580,552 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2012.07.22 22:10:14 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2012.07.22 19:45:12 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2012.07.21 01:35:44 | 012,978,688 | ---- | C] () -- C:\Windows\SysWow64\ig7icd32.dll [2012.07.21 01:35:44 | 000,734,772 | ---- | C] () -- C:\Windows\SysWow64\igkrng700.bin [2012.07.21 01:35:44 | 000,557,476 | ---- | C] () -- C:\Windows\SysWow64\igfcg700m.bin [2012.07.21 01:35:44 | 000,058,880 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2012.07.20 22:42:30 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.07.20 22:37:41 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.07.20 22:37:41 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012.07.20 22:37:41 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2012.07.20 19:35:31 | 000,001,424 | ---- | C] () -- C:\Windows\THXCfg_SP_APOIM.ini [2012.07.20 19:35:31 | 000,001,323 | ---- | C] () -- C:\Windows\THXCfg_HP_APOIM.ini [2012.07.20 19:35:31 | 000,001,323 | ---- | C] () -- C:\Windows\THXCfg_APOIM.ini [2012.07.20 19:35:30 | 000,190,464 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2012.07.20 19:35:30 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2012.07.20 19:34:30 | 000,000,003 | ---- | C] () -- C:\Users\Jakobs\AppData\Local\user_data.ini [2012.05.02 14:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2012.02.02 22:08:26 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 04:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.01.09 21:20:02 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\.anki [2012.11.16 19:17:20 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\.minecraft [2013.02.14 14:02:55 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\AnvSoft [2013.06.21 17:25:26 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Audacity [2013.03.20 19:56:23 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Beat Hazard [2013.08.13 22:02:28 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Betcat [2013.02.10 22:32:10 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\calibre [2012.09.02 16:07:39 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\ControlCenter4 [2012.09.27 21:03:20 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\DAEMON Tools Lite [2012.07.20 23:12:06 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\DeviceVm [2013.03.11 21:53:58 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Downloaded Installations [2013.08.07 15:24:56 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\DVDVideoSoft [2012.10.03 11:33:19 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\DVDVideoSoftIEHelpers [2012.09.30 10:49:40 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\fltk.org [2012.12.16 13:04:30 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\GetRightToGo [2012.12.28 14:29:13 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\HDRsoft [2012.09.29 12:40:35 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\ICQ [2013.05.08 19:49:55 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\IrfanView [2013.07.08 21:33:19 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\LG Electronics [2013.05.31 19:32:36 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Little Inferno [2013.07.08 22:08:13 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\ML [2013.02.04 22:58:11 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Mp3tag [2012.11.09 16:32:14 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\MyPhoneExplorer [2012.11.03 01:11:52 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\net [2012.10.10 17:20:01 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Nuance [2012.07.21 00:55:08 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Opera [2013.08.15 17:36:29 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Origin [2013.01.20 14:34:05 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\PDF Architect [2013.01.19 20:21:47 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\pdfforge [2013.04.25 16:12:49 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\PhotoScape [2012.08.18 20:02:33 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Play withSIX [2012.08.18 20:02:36 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\six-zsync [2013.05.31 16:43:27 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Splashtop [2012.08.23 11:52:56 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Spotify [2012.08.13 22:59:14 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\The Sky Games [2012.07.20 23:26:15 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Thunderbird [2012.09.05 11:15:14 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Tific [2013.07.06 19:46:46 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\TS3Client [2012.10.05 16:49:24 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Ubisoft [2013.07.01 14:49:11 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Warner Bros. Interactive Entertainment [2013.08.13 22:10:13 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Web Cake [2012.10.10 17:20:03 | 000,000,000 | ---D | M] -- C:\Users\Jakobs\AppData\Roaming\Zeon [2012.08.05 22:45:32 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\AnvSoft [2012.11.22 19:53:56 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\calibre [2012.09.04 22:16:34 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\ControlCenter4 [2012.10.28 16:11:57 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\IrfanView [2012.07.21 19:46:20 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Opera [2013.05.31 16:43:27 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Splashtop [2013.06.01 19:01:01 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Spotify ========== Purity Check ========== < End of report > |
|
24.08.2013, 10:15
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Snap.do lässt sich nicht entfernen hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
24.08.2013, 12:15
| #3 |
| | Windows 7: Snap.do lässt sich nicht entfernen Danke für die schnelle Antwort
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-08-2013 01
Ran by Jakobs (administrator) on 24-08-2013 13:12:49
Running from C:\Users\Jakobs\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Adobe Systems Incorporated) c:\cs2\Adobe Version Cue CS2\bin\VersionCueCS2.exe
() C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() c:\cs2\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(wifimouse@necta.us) C:\Program Files (x86)\MouseServer\MouseServer.exe
(Learnpulse) C:\Users\Jakobs\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe
(Adobe Sytems Incorporated) C:\cs2\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [XFast LAN] - C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [1441152 2011-10-19] (cFos Software GmbH)
HKLM\...\Run: [THXCfg64] - C:\Windows\system32\THXCfg64.dll [26624 2011-05-13] (Creative Technology Ltd.)
HKCU\...\Run: [ASRockXTU] - [x]
HKCU\...\Run: [zASRockInstantBoot] - [x]
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKCU\...\Run: [Google Update] - C:\Users\Jakobs\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-10-24] (Google Inc.)
HKCU\...\Run: [LG LinkAir] - [x]
HKCU\...\Run: [MouseServer] - C:\Program Files (x86)\MouseServer\MouseServer.exe [122880 2012-03-21] (wifimouse@necta.us)
HKCU\...\Run: [Screenpresso] - C:\Users\Jakobs\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [10881040 2013-08-17] (Learnpulse)
MountPoints2: {2323da92-d2a3-11e1-9342-806e6f6e6963} - D:\ASRSetup.exe
MountPoints2: {25c80f92-08d0-11e2-81af-bc5ff43aca23} - E:\Autorun.exe
MountPoints2: {6cd55dd6-2a8a-11e2-96ee-bc5ff43aca23} - H:\LGAutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)
HKLM-x32\...\Run: [XFastUSB] - C:\Program Files (x86)\XFastUSB\XFastUsb.exe [5019360 2012-07-20] (FNet Co., Ltd.)
HKLM-x32\...\Run: [THX TruStudio NB Settings] - C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe [909824 2011-05-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [SmartViewAgent] - "C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe" [x]
HKLM-x32\...\Run: [Adobe Photo Downloader] - C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe [67752 2006-12-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PPort12reminder] - C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe [328992 2010-02-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Version Cue CS2] - c:\cs2\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [856064 2005-04-06] (Adobe Sytems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1646216 2013-03-31] (Ask)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Papa\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)
HKU\Papa\...\Run: [ASRockXTU] - [x]
HKU\Papa\...\Run: [zASRockInstantBoot] - [x]
HKU\Papa\...\Run: [Spotify] - C:\Users\Jakobs\AppData\Roaming\Spotify\Spotify.exe [5576408 2012-08-23] (Spotify Ltd)
HKU\Papa\...\Run: [Spotify Web Helper] - C:\Users\Jakobs\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-08-23] ()
HKU\Papa\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
AppInit_DLLs-x32: c:\progra~2\saveby~1\sprote~1.dll c:\progra~2\contin~1\sprote~1.dll c:\progra~2\simple~1\sprote~1.dll [1057280 2013-01-24] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.simplespeedy.info/?l=1&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&q={searchTerms}&installDate=07/08/2013
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLEP1&pc=SPLH
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: continuetosave - {108059B1-3AFF-A2B0-7959-59D31FE470F4} - C:\ProgramData\continuetosave\511bc29a33591.dll ()
BHO-x32: HistoryTriggerBHO Class - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files (x86)\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)
BHO-x32: continuetosave - {2CA5A921-7FBC-8E04-3595-0E324B15B0F0} - C:\ProgramData\continuetosave\511bc39023f8f.dll ()
BHO-x32: continuetosave - {2DCD6050-E56C-C09E-FFB4-05513EC0FDA5} - C:\ProgramData\continuetosave\510fef8a0a737.dll ()
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: 74.208.10.249 gs.apple.com
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default
FF user.js: detected! => C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\user.js
FF Homepage: hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=hp&installDate=07/08/2013
FF SelectedSearchEngine: Web Search
FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&installDate=07/08/2013&q=
FF NewTab: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jakobs\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
FF Extension: SaveByclick - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\50fae4f9da40b@50fae4f9da445.com
FF Extension: continuetosave - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\510fef8a0a5a6@510fef8a0a5df.com
FF Extension: continuetosave - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\511bc29a3341a@511bc29a33450.com
FF Extension: continuetosave - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\511bc39023e1e@511bc39023e57.com
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\ffxtlbr@babylon.com
FF Extension: Delta Toolbar - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\ffxtlbr@delta.com
FF Extension: FoxyProxy Basic - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\foxyproxy@eric.h.jung
FF Extension: WebCake - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\plugin@getwebcake.com
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\staged
FF Extension: Ask Toolbar - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\toolbar@ask.com
FF Extension: DownloadHelper - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: info - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\info@youtube-mp3.org.xpi
FF Extension: youtube2mp3 - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\youtube2mp3@mondayx.de.xpi
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
Chrome:
=======
CHR Extension: (Bejeweled) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm\2_0
CHR Extension: (Snap.Do ) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0
CHR Extension: (Media Hint) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\anepbdekljkmmimmhbniglnnanmmkoja\0.1.13_0
CHR Extension: (Splendid) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdfkbdkkfmmckaadapdipihjfaacnkgd\3_0
CHR Extension: (YouTube) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Grooveshark Germany unlocker) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0
CHR Extension: (SaveByclick) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehmcijnpodcghlafhmmlhhcaofmmjlae\1
CHR Extension: (Photo Zoom for Facebook) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi\1.1208.30.1_0
CHR Extension: (continuetosave) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhdhdjejihpnakibpmcfokecfgbbdgig\1
CHR Extension: (Grooveshark Non-Stop) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\flgdeakeeekllcpldfampgbamohdagdp\1.1_0
CHR Extension: (AdBlock) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.5_0
CHR Extension: (continuetosave) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijciphidhidaebloioeaefakmcfhegjb\1
CHR Extension: (continuetosave) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkigggggfoomckaikapfphaocbdbpkhe\1
CHR Extension: (StumbleUpon) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcahibnffhnnjcedflmchmokndkjnhpg\5.7.11.1_0
CHR Extension: (Cargo Bridge) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\keembkgclppcbilkekfgpobhldjjhpmn\1.5.7_0
CHR Extension: (Siege Hero \u2013 Viking Vengeance) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfomhlbnciicmciejodphlggfbmhbbbo\1.1_0
CHR Extension: (FVD Downloader) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\5.3.7_0
CHR Extension: (Download Master) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcceagdollnkjlogmdckgjakjapmkdjf\3.0.1.2_0
CHR Extension: (Norton Identity Protection) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.13.5_0
CHR Extension: (Facebook Notifications) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmameahlembdcigphohgiodcgjomcgeo\1.27_0
CHR Extension: (Gmail) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [aaaaojmikegpiepcfdkkjaplodkpfmlo] - C:\Users\Jakobs\AppData\Local\APN\GoogleCRXs\apnorjtoolbar.crx
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\Exts\Chrome.crx
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-10] (Adobe Systems)
R2 Adobe Version Cue CS2; c:\cs2\Adobe Version Cue CS2\bin\VersionCueCS2.exe [163840 2005-04-06] (Adobe Systems Incorporated)
R2 AdobeActiveFileMonitor5.0; C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe [108712 2006-12-22] ()
R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [395136 2011-10-19] (cFos Software GmbH)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [121344 2012-02-07] ()
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2013-08-19] ()
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] ()
S2 SmartViewService; C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe [x]
==================== Drivers (Whitelisted) ====================
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2011-09-21] (Asmedia Technology)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [31016 2012-01-13] (ASRock Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-10-05] ()
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\0604010.00E\ccSetx64.sys [167072 2012-06-07] (Symantec Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-09-27] (DT Soft Ltd)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-08-21] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-08-21] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-08-09] (Symantec Corporation)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2013-04-19] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-07-20] (FNet Co., Ltd.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130823.001\IDSvia64.sys [520280 2013-08-14] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130823.001\IDSvia64.sys [520280 2013-08-14] (Symantec Corporation)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [44992 2012-02-09] ()
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtpt64.sys [16384 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbs64.sys [14848 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmdm64.sys [17408 2009-09-29] (LG Electronics Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-10-05] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\0604010.00E\SRTSP64.SYS [737952 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\0604010.00E\SRTSPX64.SYS [37536 2012-07-06] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\0604010.00E\SYMDS64.SYS [451192 2011-08-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\0604010.00E\SYMEFA64.SYS [1129120 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2013-02-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\0604010.00E\Ironx64.SYS [190072 2011-11-16] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\0604010.00E\SYMNETS.SYS [405624 2011-11-16] (Symantec Corporation)
S3 tap0801; C:\Windows\System32\DRIVERS\tap0801.sys [30720 2005-04-13] (The OpenVPN Project)
S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2012-03-02] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [28160 2012-03-02] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [34816 2012-03-02] (LG Electronics Inc.)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2013-08-24] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-24 13:12 - 2013-08-24 13:11 - 01576584 _____ (Farbar) C:\Users\Jakobs\Desktop\FRST64.exe
2013-08-24 10:18 - 2013-08-24 10:36 - 00145096 _____ C:\Users\Jakobs\Desktop\OTL.Txt
2013-08-24 10:18 - 2013-08-24 10:18 - 00126164 _____ C:\Users\Jakobs\Desktop\Extras.Txt
2013-08-24 10:13 - 2013-08-24 10:12 - 00602112 _____ (OldTimer Tools) C:\Users\Jakobs\Desktop\OTL.exe
2013-08-24 01:01 - 2013-08-24 01:01 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-24 01:01 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-21 09:52 - 2013-08-21 09:52 - 00000000 _____ C:\Users\Jakobs\AppData\Roaming\TS3Patch.lck
2013-08-19 22:41 - 2013-08-19 22:41 - 00000000 ____D C:\Users\Jakobs\Documents\Electronic Arts
2013-08-19 22:26 - 2013-08-19 22:26 - 00000927 _____ C:\Users\Public\Desktop\Die Sims™ 3 Late Night.lnk
2013-08-19 22:26 - 2013-08-19 22:26 - 00000867 _____ C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk
2013-08-19 22:24 - 2013-08-19 22:23 - 00447752 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2013-08-19 22:23 - 2013-08-19 22:23 - 00000909 _____ C:\Users\Public\Desktop\Die*Sims™*3.lnk
2013-08-19 21:20 - 2013-08-19 21:21 - 00000000 ____D C:\Users\Jakobs\Documents\Battlefield 3
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Users\Jakobs\AppData\Local\ESN
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-08-19 21:18 - 2013-08-19 21:18 - 00000655 _____ C:\Users\Public\Desktop\Battlefield 3.lnk
2013-08-19 21:09 - 2013-08-19 21:09 - 00003168 _____ C:\Windows\System32\Tasks\{984D6FFE-F118-44EB-8CF2-69CD5E8132FD}
2013-08-19 21:08 - 2013-08-19 21:08 - 00000000 ____D C:\ProgramData\EA Core
2013-08-15 17:48 - 2013-08-15 17:48 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Criterion Games
2013-08-15 10:57 - 2013-08-15 10:57 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-08-15 10:54 - 2013-08-19 21:09 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Origin
2013-08-15 10:54 - 2013-08-15 17:36 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Origin
2013-08-15 10:48 - 2013-08-21 09:51 - 00000000 ____D C:\Program Files (x86)\Origin
2013-08-15 10:48 - 2013-08-19 21:18 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-08-15 10:48 - 2013-08-15 17:38 - 00000000 ____D C:\ProgramData\Origin
2013-08-15 10:48 - 2013-08-15 10:48 - 00000986 _____ C:\Users\Public\Desktop\Origin.lnk
2013-08-15 10:42 - 2013-08-24 10:11 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-08-14 15:55 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 15:55 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 15:55 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 15:55 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 15:55 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 15:55 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 15:55 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 15:55 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 15:55 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 15:55 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 15:55 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 15:55 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 15:50 - 2013-08-14 15:51 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 12:49 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 12:49 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 12:49 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 12:49 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 12:49 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 12:49 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 12:48 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 12:48 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 12:48 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 12:48 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 12:47 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 12:47 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 12:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 12:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 12:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 12:47 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 12:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 12:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 12:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 12:47 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 12:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 12:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 12:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 12:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 12:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 12:47 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 12:47 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 20:01 - 2013-08-13 21:41 - 00000000 ____D C:\Users\Jakobs\Desktop\eigenes fotoalbum
2013-08-13 19:29 - 2013-08-13 19:29 - 00000000 ____D C:\Program Files (x86)\Betcat
2013-08-10 20:02 - 2013-08-10 20:02 - 00000000 ____D C:\Users\Jakobs\Desktop\zwergentanz 16.6
2013-08-10 09:56 - 2013-08-13 22:02 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Betcat
2013-08-09 20:12 - 2013-08-09 20:23 - 00000000 ____D C:\Users\Jakobs\Desktop\lieder
2013-08-09 11:23 - 2013-08-13 22:10 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Web Cake
2013-08-07 15:24 - 2013-08-07 15:25 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-08-07 13:27 - 2013-08-07 18:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-07 12:53 - 2013-08-09 20:13 - 00000000 ____D C:\Users\Jakobs\Desktop\projekt silberhochzeit
2013-08-04 20:25 - 2013-08-04 21:02 - 00000000 ____D C:\Users\Jakobs\Documents\The Witcher
2013-08-04 20:25 - 2013-08-04 21:02 - 00000000 ____D C:\Users\Jakobs\AppData\Local\The Witcher
2013-08-04 20:24 - 2013-08-04 20:24 - 00000000 ____D C:\Users\Public\Documents\The Witcher
==================== One Month Modified Files and Folders =======
2013-08-24 13:12 - 2013-08-24 13:12 - 00000000 ____D C:\FRST
2013-08-24 13:11 - 2013-08-24 13:12 - 01576584 _____ (Farbar) C:\Users\Jakobs\Desktop\FRST64.exe
2013-08-24 13:09 - 2013-03-27 23:23 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-24 13:09 - 2012-10-24 22:19 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000UA.job
2013-08-24 13:09 - 2012-07-22 18:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-24 13:09 - 2012-07-20 19:31 - 00000830 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2013-08-24 13:09 - 2009-07-14 06:51 - 00196795 _____ C:\Windows\setupact.log
2013-08-24 10:36 - 2013-08-24 10:18 - 00145096 _____ C:\Users\Jakobs\Desktop\OTL.Txt
2013-08-24 10:18 - 2013-08-24 10:18 - 00126164 _____ C:\Users\Jakobs\Desktop\Extras.Txt
2013-08-24 10:18 - 2009-07-14 06:45 - 00015648 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-24 10:18 - 2009-07-14 06:45 - 00015648 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-24 10:16 - 2009-07-14 19:58 - 00707088 _____ C:\Windows\system32\perfh007.dat
2013-08-24 10:16 - 2009-07-14 19:58 - 00152680 _____ C:\Windows\system32\perfc007.dat
2013-08-24 10:16 - 2009-07-14 07:13 - 01641292 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-24 10:14 - 2012-07-20 21:46 - 01736624 _____ C:\Windows\WindowsUpdate.log
2013-08-24 10:12 - 2013-08-24 10:13 - 00602112 _____ (OldTimer Tools) C:\Users\Jakobs\Desktop\OTL.exe
2013-08-24 10:11 - 2013-08-15 10:42 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-08-24 10:11 - 2013-03-27 23:23 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-24 10:11 - 2013-01-19 20:24 - 00000390 ____H C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job
2013-08-24 10:11 - 2012-07-20 19:33 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys
2013-08-24 10:11 - 2012-07-20 19:31 - 00000828 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2013-08-24 10:11 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-24 10:10 - 2012-07-20 19:34 - 00878504 _____ C:\Windows\PFRO.log
2013-08-24 10:09 - 2013-06-06 13:58 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-08-24 10:09 - 2013-02-04 19:30 - 00000000 ____D C:\ProgramData\continuetosave
2013-08-24 10:09 - 2013-01-19 20:22 - 00000000 ____D C:\ProgramData\SaveByclick
2013-08-24 02:48 - 2013-06-12 22:04 - 00000000 ____D C:\Program Files (x86)\WebCake
2013-08-24 01:43 - 2012-10-24 22:19 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000Core.job
2013-08-24 01:01 - 2013-08-24 01:01 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-23 23:51 - 2012-07-22 18:32 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-23 23:51 - 2012-07-22 18:32 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-23 23:51 - 2012-07-20 23:15 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-21 09:52 - 2013-08-21 09:52 - 00000000 _____ C:\Users\Jakobs\AppData\Roaming\TS3Patch.lck
2013-08-21 09:51 - 2013-08-15 10:48 - 00000000 ____D C:\Program Files (x86)\Origin
2013-08-20 10:55 - 2013-05-08 18:05 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-20 10:55 - 2012-07-22 22:10 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-19 22:41 - 2013-08-19 22:41 - 00000000 ____D C:\Users\Jakobs\Documents\Electronic Arts
2013-08-19 22:26 - 2013-08-19 22:26 - 00000927 _____ C:\Users\Public\Desktop\Die Sims™ 3 Late Night.lnk
2013-08-19 22:26 - 2013-08-19 22:26 - 00000867 _____ C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk
2013-08-19 22:26 - 2012-07-21 01:36 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-19 22:23 - 2013-08-19 22:24 - 00447752 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2013-08-19 22:23 - 2013-08-19 22:23 - 00000909 _____ C:\Users\Public\Desktop\Die*Sims™*3.lnk
2013-08-19 21:21 - 2013-08-19 21:20 - 00000000 ____D C:\Users\Jakobs\Documents\Battlefield 3
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Users\Jakobs\AppData\Local\ESN
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-08-19 21:20 - 2013-05-08 18:05 - 00000000 ____D C:\Users\Jakobs\AppData\Local\PunkBuster
2013-08-19 21:20 - 2012-07-22 22:10 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-08-19 21:18 - 2013-08-19 21:18 - 00000655 _____ C:\Users\Public\Desktop\Battlefield 3.lnk
2013-08-19 21:18 - 2013-08-15 10:48 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-08-19 21:18 - 2012-07-22 22:10 - 00075136 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-19 21:17 - 2012-07-22 22:01 - 00317097 _____ C:\Windows\DirectX.log
2013-08-19 21:09 - 2013-08-19 21:09 - 00003168 _____ C:\Windows\System32\Tasks\{984D6FFE-F118-44EB-8CF2-69CD5E8132FD}
2013-08-19 21:09 - 2013-08-15 10:54 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Origin
2013-08-19 21:08 - 2013-08-19 21:08 - 00000000 ____D C:\ProgramData\EA Core
2013-08-15 17:48 - 2013-08-15 17:48 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Criterion Games
2013-08-15 17:38 - 2013-08-15 10:48 - 00000000 ____D C:\ProgramData\Origin
2013-08-15 17:36 - 2013-08-15 10:54 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Origin
2013-08-15 11:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 10:57 - 2013-08-15 10:57 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-08-15 10:48 - 2013-08-15 10:48 - 00000986 _____ C:\Users\Public\Desktop\Origin.lnk
2013-08-14 15:52 - 2012-07-20 23:56 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-14 15:51 - 2013-08-14 15:50 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 15:50 - 2012-09-03 22:26 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-13 22:10 - 2013-08-09 11:23 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Web Cake
2013-08-13 22:02 - 2013-08-10 09:56 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Betcat
2013-08-13 21:41 - 2013-08-13 20:01 - 00000000 ____D C:\Users\Jakobs\Desktop\eigenes fotoalbum
2013-08-13 19:29 - 2013-08-13 19:29 - 00000000 ____D C:\Program Files (x86)\Betcat
2013-08-13 12:47 - 2012-07-21 19:30 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\vlc
2013-08-13 10:58 - 2013-01-10 19:39 - 00000000 ____D C:\Users\Jakobs\Documents\Adobe
2013-08-13 10:58 - 2012-07-20 19:35 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Adobe
2013-08-13 10:17 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-10 20:02 - 2013-08-10 20:02 - 00000000 ____D C:\Users\Jakobs\Desktop\zwergentanz 16.6
2013-08-09 20:23 - 2013-08-09 20:12 - 00000000 ____D C:\Users\Jakobs\Desktop\lieder
2013-08-09 20:13 - 2013-08-07 12:53 - 00000000 ____D C:\Users\Jakobs\Desktop\projekt silberhochzeit
2013-08-09 13:22 - 2012-07-20 19:36 - 00000000 ____D C:\Users\Jakobs\AppData\Local\CrashDumps
2013-08-08 12:17 - 2012-07-20 22:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-07 18:27 - 2013-08-07 13:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-07 15:25 - 2013-08-07 15:24 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-08-07 15:24 - 2012-10-03 11:32 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\DVDVideoSoft
2013-08-07 13:10 - 2012-12-23 23:26 - 00019456 ____H C:\Users\Jakobs\Desktop\photothumb.db
2013-08-05 13:26 - 2012-07-22 22:12 - 00000000 ____D C:\Users\Jakobs\Documents\My Games
2013-08-05 10:56 - 2012-07-21 19:42 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Adobe
2013-08-04 21:02 - 2013-08-04 20:25 - 00000000 ____D C:\Users\Jakobs\Documents\The Witcher
2013-08-04 21:02 - 2013-08-04 20:25 - 00000000 ____D C:\Users\Jakobs\AppData\Local\The Witcher
2013-08-04 20:24 - 2013-08-04 20:24 - 00000000 ____D C:\Users\Public\Documents\The Witcher
2013-08-03 19:52 - 2013-03-27 23:23 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-03 19:45 - 2013-07-01 22:28 - 00002378 _____ C:\Users\Jakobs\Desktop\Google Chrome.lnk
2013-07-26 07:13 - 2013-08-14 15:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-14 15:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-14 15:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-14 15:55 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-14 15:55 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-14 15:55 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-14 15:55 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-14 15:55 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-14 15:55 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-14 15:55 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 04:39 - 2013-08-14 15:55 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-26 03:59 - 2013-08-14 15:55 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 11:25 - 2013-08-14 12:47 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-25 10:57 - 2013-08-14 12:47 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
Files to move or delete:
====================
C:\Users\Jakobs\jagex_cl_loginapplet_LIVE.dat
C:\Users\Jakobs\jagex_cl_runescape_LIVE.dat
C:\Users\Jakobs\random.dat
C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-24 02:47
==================== End Of Log ============================
--- --- --- Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-08-2013 01 Ran by Jakobs at 2013-08-24 13:13:18 Running from C:\Users\Jakobs\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Acrobat.com (x32 Version: 0.0.0) Acrobat.com (x32 Version: 1.1.377) Adobe AIR (x32 Version: 1.0.4990) Adobe AIR (x32 Version: 1.0.8.4990) Adobe Bridge 1.0 (x32 Version: 1.0.1.1) Adobe Common File Installer (x32 Version: 1.00.002) Adobe Creative Suite 2 (x32) Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Adobe Help Center 2.1 (x32 Version: 2.1) Adobe Illustrator CS2 (x32 Version: 12.000.000) Adobe InDesign CS2 (x32 Version: 004.000.000) Adobe Photoshop CS2 (x32 Version: 9.0) Adobe Photoshop Elements 5.0 (x32 Version: 5.0) Adobe Photoshop Lightroom 5 64-bit (Version: 5.0.1) Adobe Premiere Pro 2.0 (x32 Version: 2.000.000) Adobe Premiere Pro FC (x32 Version: 1.00.0000) Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7) Adobe Stock Photos 1.0 (x32 Version: 1.0.1) Adobe Stock Photos 1.0 (x32 Version: 1.0.2) Adobe SVG Viewer 3.0 (x32 Version: 3.0) Adobe Version Cue CS2 (x32 Version: 2.0) Alan Wake (x32) Alan Wake's American Nightmare (x32) AMD Accelerated Video Transcoding (Version: 12.5.100.21219) AMD APP SDK Runtime (Version: 10.0.1084.4) AMD Catalyst Install Manager (Version: 8.0.903.0) AMD Drag and Drop Transcoding (Version: 2.00.0000) AMD Media Foundation Decoders (Version: 1.0.71219.1540) Amnesia: The Dark Descent (x32) Anki (x32) Anno 1404 (x32 Version: 1.00.0000) ANNO 1404 (x32 Version: 1.03.0000) Any Video Converter 3.4.1 (x32) Apple Application Support (x32 Version: 2.3.2) Apple Mobile Device Support (Version: 6.0.1.3) Apple Software Update (x32 Version: 2.1.3.127) ARMA 2 (x32) ARMA 2: Operation Arrowhead (x32) Ask Toolbar (x32 Version: 1.15.23.0) Ask Toolbar Updater (HKCU Version: 1.2.5.36191) Asmedia ASM106x SATA Host Controller Driver (x32 Version: 1.3.1.000) ASRock App Charger v1.0.5 ASRock eXtreme Tuner v0.1.181 (x32) ASRock InstantBoot v1.29 (x32) ASRock SmartConnect v1.0.6 ASRock XFast RAM v2.0.9 Assassin's Creed(R) III v1.03 (x32 Version: 1.03) Audacity 2.0.3 (x32 Version: 2.0.3) Audials (x32 Version: 10.2.19305.500) Awesomenauts (x32) Back to the Future: Ep 1 - It's About Time (x32) Back to the Future: Ep 2 - Get Tannen! (x32) Back to the Future: Ep 3 - Citizen Brown (x32) Back to the Future: Ep 4 - Double Visions (x32) Back to the Future: Ep 5 - OUTATIME (x32) Bastion (x32) Battlefield 3™ (x32 Version: 1.6.0.0) Battlelog Web Plugins (x32 Version: 2.1.7) BattlEye for OA Uninstall (x32) BattlEye Uninstall (x32) Beat Hazard (x32) BioShock Infinite (x32) Bonjour (Version: 3.0.0.10) Borderlands 2 (x32) Brother MFL-Pro Suite MFC-7360N (x32 Version: 1.0.9.0) BrowserDefender (x32) Burnout Paradise: The Ultimate Box (x32) calibre (x32 Version: 0.9.6) Capsized (x32) Castle Crashers (x32) Catalyst Control Center - Branding (x32 Version: 1.00.0000) Catalyst Control Center (x32 Version: 2012.1219.1521.27485) Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485) Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485) Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485) CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485) CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485) CCC Help Czech (x32 Version: 2012.1219.1520.27485) CCC Help Danish (x32 Version: 2012.1219.1520.27485) CCC Help Dutch (x32 Version: 2012.1219.1520.27485) CCC Help English (x32 Version: 2012.1219.1520.27485) CCC Help Finnish (x32 Version: 2012.1219.1520.27485) CCC Help French (x32 Version: 2012.1219.1520.27485) CCC Help German (x32 Version: 2012.1219.1520.27485) CCC Help Greek (x32 Version: 2012.1219.1520.27485) CCC Help Hungarian (x32 Version: 2012.1219.1520.27485) CCC Help Italian (x32 Version: 2012.1219.1520.27485) CCC Help Japanese (x32 Version: 2012.1219.1520.27485) CCC Help Korean (x32 Version: 2012.1219.1520.27485) CCC Help Norwegian (x32 Version: 2012.1219.1520.27485) CCC Help Polish (x32 Version: 2012.1219.1520.27485) CCC Help Portuguese (x32 Version: 2012.1219.1520.27485) CCC Help Russian (x32 Version: 2012.1219.1520.27485) CCC Help Spanish (x32 Version: 2012.1219.1520.27485) CCC Help Swedish (x32 Version: 2012.1219.1520.27485) CCC Help Thai (x32 Version: 2012.1219.1520.27485) CCC Help Turkish (x32 Version: 2012.1219.1520.27485) ccc-utility64 (Version: 2012.1219.1521.27485) ContinueToSave (Version: 1.0) ContinueToSave 1.74 (x32) Crashday Patch#2 (x32 Version: 1.00.0000) Crysis (x32) Crysis 2 Maximum Edition (x32) DAEMON Tools Lite (x32 Version: 4.45.4.0314) Darksiders (x32) Dead Space (x32) Dear Esther (x32) Deus Ex: Human Revolution (x32) Die Sims™ 3 Late Night (x32 Version: 6.5.1) Die Sims™ 3 Luxus-Accessoires (x32 Version: 3.0.38) Die*Sims™*3 (x32 Version: 1.42.130) Dota 2 (x32) Dungeon Defenders (x32) ESN Sonar (x32 Version: 0.70.4) Free YouTube to MP3 Converter version 3.12.9.725 (x32 Version: 3.12.9.725) GameSpy Comrade (x32 Version: 1.5.0.156) Google Chrome (HKCU Version: 28.0.1500.95) Google Earth Plug-in (x32 Version: 7.1.1.1888) Google Update Helper (x32 Version: 1.3.21.153) GUILD WARS (x32) Hector: Ep 1 (x32) Hector: Ep 2 (x32) Hector: Ep 3 (x32) High-Definition Video Playback 10 (x32 Version: 7.0.11000.25.1) Hi-Rez Studios Authenticate and Update Service (x32 Version: 3.0.0.0) Hitman: Absolution (x32) Hitman: Sniper Challenge (x32) Hotline Miami (x32) ICQ7M (x32 Version: 7.8) Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) Manageability Engine Firmware Recovery Agent (x32 Version: 1.0.0.35342) Intel(R) Management Engine Components (x32 Version: 8.0.2.1410) Intel(R) OpenCL CPU Runtime (x32) Intel(R) Processor Graphics (x32 Version: 8.15.10.2618) Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032) Intel(R) Smart Connect Technology 2.0 x64 (Version: 2.0.1083.0) Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.3.214) Intel® Trusted Connect Service Client (Version: 1.23.605.1) IP Camera DS Filter (x32 Version: 5.5.0.0) ipswDownloader 1.6 (x32 Version: 1.6) IrfanView (remove only) (x32 Version: 4.35) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Java(TM) 7 Update 5 (64-bit) (Version: 7.0.50) JavaFX 2.1.1 (x32 Version: 2.1.1) JC2-MP version 0.0.11 (x32 Version: 0.0.11) JDownloader 0.9 (x32 Version: 0.9) Just Cause 2 (x32) K-Lite Codec Pack 6.0.4 (Basic) (x32 Version: 6.0.4) LAME v3.99.3 (for Windows) (x32) LEGO Lord of the Rings (x32) LG Bluetooth Drivers (x32 Version: 1.1) LG Burning Tool (x32 Version: 6.2.6009) LG CyberLink BD Advisor (x32 Version: 2.0.4606) LG CyberLink LabelPrint (x32 Version: 2.5.3624) LG CyberLink Media Suite (x32 Version: 8.0.2820) LG CyberLink MediaEspresso (x32 Version: 6.5.1622_37397b) LG CyberLink MediaShow (x32 Version: 4.1.3402) LG CyberLink PowerDVD (x32 Version: 10.0.3424.52) LG CyberLink PowerProducer (x32 Version: 5.0.2.2820a) LG CyberLink YouCam (x32 Version: 2.0.3718) LG PC Suite (x32 Version: 5.2.37.20130520) LG PC Suite IV (x32 Version: 4.3.46.20111117) LG Tool Kit (x32 Version: 10.01.0712.01) LG United Mobile Driver (x32 Version: 3.8.1) LightScribe System Software (x32 Version: 1.18.22.2) Little Inferno (x32) Luminance HDR 2.3.0 Magicka (x32) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) ManiaPlanet (x32) Medal of Honor(TM) Multiplayer (x32) Medal of Honor(TM) Single Player (x32) Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft Image Composite Editor (Version: 1.4.4) Microsoft Office 2007 Service Pack 3 (SP3) (x32) Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32) Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Primary Interoperability Assemblies 2005 (x32 Version: 8.0.50727.42) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1) Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727) Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727) Microsoft XNA Framework Redistributable 3.1 (x32 Version: 3.1.10527.0) Microsoft XNA Framework Redistributable 4.0 (x32 Version: 4.0.20823.0) Mirror's Edge (x32) MouseServer Version 1.2.0 (x32 Version: 1.2.0) Mozilla Firefox 15.0 (x86 de) (x32 Version: 15.0) Mozilla Firefox 15.0.1 (x86 de) (HKCU Version: 15.0.1) Mozilla Maintenance Service (x32 Version: 17.0.8) Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8) Mp3tag v2.54 (x32 Version: v2.54) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) MSXML 4.0 SP2 Parser and SDK (x32 Version: 4.20.9818.0) MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0) MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0) MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0) MyPhoneExplorer (x32 Version: 1.8.4) Naval War: Arctic Circle (x32) Nero 10 ClipartPack (x32 Version: 10.0.10300.0.0) Nero 10 Menu TemplatePack 1 (x32 Version: 10.0.10300.0.0) Nero 10 Menu TemplatePack 2 (x32 Version: 10.0.10300.0.0) Nero 10 Menu TemplatePack 3 (x32 Version: 10.0.10300.0.0) Nero 10 Menu TemplatePack Basic (x32 Version: 10.0.10300.0.0) Nero 10 Movie ThemePack 1 (x32 Version: 10.0.10300.1.0) Nero 10 Movie ThemePack 2 (x32 Version: 10.0.10300.1.0) Nero 10 Movie ThemePack Basic (x32 Version: 10.0.10300.1.0) Nero 10 Sample ImagePack (x32 Version: 10.0.10300.0.0) Nero 10 Sample Videos (x32 Version: 10.0.10300.2.0) Nero BackItUp 10 (x32 Version: 5.4.11100.14.101) Nero BackItUp 10 Help (CHM) (x32 Version: 1.0.10500) Nero Burning ROM 10 (x32 Version: 10.0.10700.7.100) Nero BurningROM 10 Help (CHM) (x32 Version: 1.0.10500) Nero BurnRights 10 (x32 Version: 4.0.10600.9.100) Nero BurnRights 10 Help (CHM) (x32 Version: 1.0.10500) Nero Control Center 10 (x32 Version: 10.0.11500.1.0) Nero Core Components 10 (x32 Version: 2.0.13100.0.1) Nero CoverDesigner 10 (x32 Version: 5.0.10500.7.100) Nero CoverDesigner 10 Help (CHM) (x32 Version: 1.0.10500) Nero DiscSpeed 10 (x32 Version: 6.0.10400.4.100) Nero DiscSpeed 10 Help (CHM) (x32 Version: 1.0.10500) Nero Dolby Files 10 (x32 Version: 2.0.11000.0.10) Nero Express 10 (x32 Version: 10.0.10500.7.100) Nero Express 10 Help (CHM) (x32 Version: 1.0.10500) Nero InfoTool 10 (x32 Version: 7.0.10400.5.100) Nero InfoTool 10 Help (CHM) (x32 Version: 1.0.10500) Nero MediaHub 10 (x32 Version: 1.0.11000.6.100) Nero MediaHub 10 Help (CHM) (x32 Version: 1.0.10500) Nero Multimedia Suite 10 (x32 Version: 10.0.11200) Nero Recode 10 (x32 Version: 4.6.10600.1.100) Nero Recode 10 Help (CHM) (x32 Version: 1.0.10500) Nero RescueAgent 10 (x32 Version: 3.0.10500.5.100) Nero RescueAgent 10 Help (CHM) (x32 Version: 1.0.10500) Nero SoundTrax 10 (x32 Version: 4.6.10500.1.100) Nero SoundTrax 10 Help (CHM) (x32 Version: 1.0.10500) Nero StartSmart 10 (x32 Version: 10.0.10500.4.100) Nero StartSmart 10 Help (CHM) (x32 Version: 1.0.10500) Nero Update (x32 Version: 1.0.0012) Nero Vision 10 (x32 Version: 7.0.10700.4.100) Nero Vision 10 Help (CHM) (x32 Version: 1.0.10500) Nero WaveEditor 10 (x32 Version: 5.6.10500.1.100) Nero WaveEditor 10 Help (CHM) (x32 Version: 1.0.10500) Norton 360 (x32 Version: 6.4.1.14) Nuance PaperPort 12 (x32 Version: 12.1.0000) Nuance PDF Viewer Plus (x32 Version: 5.30.3290) OpenAL (x32) Opera 12.02 (x32 Version: 12.02.1578) Orcs Must Die! (x32) Origin (x32 Version: 9.3.1.4482) osu! (x32 Version: 0.0.0.0) PaperPort Image Printer 64-bit (Version: 1.00.0001) PDF Architect (x32 Version: 1.0.52.8917) PDFCreator (x32 Version: 1.6.2) Photomatix Pro version 4.2.5 (Version: 4.2.5) PhotoScape (x32) Play withSIX (x32 Version: 1.00.0058) Poker Night at the Inventory (x32) Portal 2 (x32) PunkBuster Services (x32 Version: 0.991) Puzzle Agent (x32) Puzzle Agent 2 (x32) Realtek Ethernet Controller Driver (x32 Version: 7.48.823.2011) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6482) Rochard (x32) Rome: Total War Gold Edition (x32) Saints Row: The Third (x32) Sam & Max 301: The Penal Zone (x32) Sam & Max 302: The Tomb of Sammun-Mak (x32) Sam & Max 303: They Stole Max's Brain! (x32) Sam & Max 304: Beyond the Alley of the Dolls (x32) Sam & Max 305: The City that Dares not Sleep (x32) Samsung_MonSetup (x32 Version: 1.00.0000) SaveByClick (Version: 1.0) Scansoft PDF Professional (x32) Screenpresso (HKCU Version: 1.4.1.0) Search Assistant SimpleSpeedy 1.74 (x32) Skype Click to Call (x32 Version: 5.6.8442) Skype™ 5.10 (x32 Version: 5.10.116) Sleeping Dogs™ (x32) Smite (x32 Version: 0.1.1051.1) Spotify (HKCU Version: 0.8.4.124.ga3559d86) Steam (x32 Version: 1.0.0.0) Stronghold Crusader (x32) Suite Specific (x32 Version: 2.0.0) Super Hexagon (x32) Super Meat Boy (x32) TeamSpeak 3 Client (x32 Version: 3.0.9.2) Terraria (x32) The Binding of Isaac (x32) The Walking Dead (x32) The Witcher 2: Assassins of Kings Enhanced Edition (x32) The Witcher: Enhanced Edition (x32) Thomas Was Alone (x32) THX TruStudio (x32 Version: 1.00.01) Tomb Raider (x32) Torchlight II (x32) Trainz: Settle & Carlisle (x32) Unigine Valley Benchmark version 1.0 (x32 Version: 1.0) Unity Web Player (HKCU Version: ) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update für Microsoft Office Excel 2007 Help (KB963678) (x32) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32) Update für Microsoft Office Word 2007 Help (KB963665) (x32) Uplay (x32 Version: 2.0) us Mod Manager (Version: 0.45.2) VLC media player 2.0.2 (x32 Version: 2.0.2) Wallace & Gromit Ep 1: Fright of the Bumblebees (x32) Wallace & Gromit Ep 2: The Last Resort (x32) Wallace & Gromit Ep 3: Muzzled! (x32) Wallace & Gromit Ep 4: The Bogey Man (x32) WebCake 3.00 (Version: 3.00) WinRAR 4.20 (64-Bit) (Version: 4.20.0) WinSCP 5.1.2 (x32 Version: 5.1.2) XFast LAN v6.61 (Version: 6.61) XFastUSB (x32 Version: 3.02.28) ==================== Restore Points ========================= 17-08-2013 17:05:39 Geplanter Prüfpunkt 19-08-2013 18:38:41 Windows-Sicherung 19-08-2013 19:17:37 DirectX wurde installiert 19-08-2013 20:23:46 Installiert The Sims 3 19-08-2013 20:26:05 Installiert The Sims 3 Late Night 19-08-2013 20:26:31 Installiert The Sims 3 High-End Loft Stuff 19-08-2013 20:42:37 Installiert The Sims 3 Late Night ==================== Hosts content: ========================== 2009-07-14 04:34 - 2012-12-22 19:00 - 00000850 ____A C:\Windows\system32\Drivers\etc\hosts 74.208.10.249 gs.apple.com ==================== Scheduled Tasks (whitelisted) ============= Task: {0F721D66-08FE-45D5-BFAE-D80BBFBE1DA2} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation) Task: {1F0589FE-3696-4458-A9D0-C7C51811E554} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-23] (Adobe Systems Incorporated) Task: {20DA4436-2F2F-438F-80D8-CE8BA32DBF8F} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation) Task: {287C245D-1EF6-4046-B269-A415062E12DF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000Core => C:\Users\Jakobs\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-24] (Google Inc.) Task: {2BE8D8B0-F984-4B87-95A8-421CBA11E5F7} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-03-31] () Task: {3A942FC0-5835-41F1-B84D-3D1D98E93342} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {53AE08E0-86DC-46DE-A30B-3FF766097746} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {6A8A0AE5-3213-4C0E-84D5-9C88E34F57CA} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\WSCStub.exe [2013-02-02] (Symantec Corporation) Task: {7F43DB24-1829-4306-BE3B-22C77DC5B398} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-27] (Google Inc.) Task: {840551A7-2506-43DA-8F6E-30B825CB479D} - System32\Tasks\EPUpdater => C:\Users\Jakobs\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe No File Task: {862D677E-29D8-422A-9554-85435CA54E01} - System32\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe [2013-01-17] () Task: {9095936C-17C7-4B90-8E59-04D3FC3CB2B5} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000UA => C:\Users\Jakobs\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-24] (Google Inc.) Task: {90FB67AB-1839-4A40-B559-9154AD1BD87A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-27] (Google Inc.) Task: {A3EA0136-89CD-4ADC-91B5-D58D674147B8} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation) Task: {BD9F5F9C-3FCC-47AB-B185-8B0DA5B5796D} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\SymErr.exe [2012-02-04] (Symantec Corporation) Task: {D1E0A369-222B-4FF6-9697-1BE8B2CF2569} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\SymErr.exe [2012-02-04] (Symantec Corporation) Task: {D43F80CD-30F7-4959-A169-93D58690D02A} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation) Task: {DD183952-DC1B-45BF-A112-67AAC35D7A1D} - System32\Tasks\BrowserDefendert => C:\Windows\system32\sc.exe [2009-07-14] (Microsoft Corporation) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000Core.job => C:\Users\Jakobs\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000UA.job => C:\Users\Jakobs\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe Task: C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/24/2013 10:42:36 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 5008 Error: (08/24/2013 10:42:36 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 5008 Error: (08/24/2013 10:42:36 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (08/24/2013 10:42:35 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 4009 Error: (08/24/2013 10:42:35 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 4009 Error: (08/24/2013 10:42:35 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (08/24/2013 10:42:34 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 3011 Error: (08/24/2013 10:42:34 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 3011 Error: (08/24/2013 10:42:34 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (08/24/2013 10:42:33 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 2013 System errors: ============= Error: (08/17/2013 05:57:35 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden. Error: (08/16/2013 00:00:30 AM) (Source: DCOM) (User: ) Description: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623} Error: (08/15/2013 05:41:54 PM) (Source: DCOM) (User: ) Description: {0B5A2C52-3EB9-470A-96E2-6C6D4570E40F} Error: (08/14/2013 03:36:28 PM) (Source: DCOM) (User: ) Description: {0B5A2C52-3EB9-470A-96E2-6C6D4570E40F} Error: (08/13/2013 10:03:01 PM) (Source: Service Control Manager) (User: ) Description: Dienst "WebCake Desktop Updater" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (08/13/2013 08:43:04 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden. Error: (08/10/2013 11:56:41 AM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR7 gefunden. Error: (08/08/2013 02:15:30 AM) (Source: DCOM) (User: ) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF} Error: (08/07/2013 02:06:18 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR4 gefunden. Error: (08/04/2013 06:02:43 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Microsoft Office Sessions: ========================= Error: (12/20/2012 11:30:09 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash. Error: (12/20/2012 11:29:58 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 17 seconds with 0 seconds of active time. This session ended with a crash. Error: (12/20/2012 11:29:30 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash. Error: (12/20/2012 11:29:18 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 59 seconds with 0 seconds of active time. This session ended with a crash. Error: (12/20/2012 11:28:01 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 47 seconds with 0 seconds of active time. This session ended with a crash. Error: (12/20/2012 11:24:43 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 0 seconds with 0 seconds of active time. This session ended with a crash. Error: (12/20/2012 11:24:14 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 110 seconds with 60 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2012-11-29 20:54:25.615 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-11-29 20:54:25.587 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\tap0801.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-10-05 16:15:39.209 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-10-05 16:15:39.189 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-10-05 16:15:38.669 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-10-05 16:15:38.649 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-10-05 16:09:27.415 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-10-05 16:09:27.395 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-10-05 16:09:26.915 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2012-10-05 16:09:26.895 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. ==================== Memory info =========================== Percentage of memory in use: 22% Total physical RAM: 8087.62 MB Available physical RAM: 6251.96 MB Total Pagefile: 16173.42 MB Available Pagefile: 12921.07 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: (Windoof) (Fixed) (Total:111.69 GB) (Free:13.41 GB) NTFS Drive f: (Jakobs Sicherung) (Fixed) (Total:1536 GB) (Free:1414.88 GB) NTFS Drive g: (Entertainment) (Fixed) (Total:327.01 GB) (Free:136.79 GB) NTFS Drive j: (Zocken) (Fixed) (Total:488.28 GB) (Free:107.21 GB) NTFS Drive k: (Windoof Backup) (Fixed) (Total:443.23 GB) (Free:148.13 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: D54340F6) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 493B2172) Partition 1: (Not Active) - (Size=488 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=443 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 645CF504) Partition 1: (Not Active) - (Size=-549755813888) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=327 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
|
24.08.2013, 15:37
| #4 | |
| /// the machine /// TB-Ausbilder | Windows 7: Snap.do lässt sich nicht entfernenCombofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.08.2013, 21:52
| #5 |
| | Windows 7: Snap.do lässt sich nicht entfernenCode:
ATTFilter ComboFix 13-08-22.01 - Jakobs 24.08.2013 22:44:50.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8088.5532 [GMT 2:00]
ausgeführt von:: c:\users\Jakobs\Desktop\ComboFix.exe
AV: Norton 360 Online *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton 360 Online *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton 360 Online *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\continuetosave
c:\programdata\continuetosave\510fef8a0a737.dll
c:\programdata\continuetosave\510fef8a0a737.tlb
c:\programdata\continuetosave\511bc29a33591.dll
c:\programdata\continuetosave\511bc29a33591.tlb
c:\programdata\continuetosave\511bc39023f8f.dll
c:\programdata\continuetosave\511bc39023f8f.tlb
c:\programdata\continuetosave\data\continuetosave.dat
c:\programdata\continuetosave\settings.ini
c:\programdata\Microsoft\Windows\Start Menu\Programs\continuetosave
c:\programdata\Microsoft\Windows\Start Menu\Programs\continuetosave\continuetosave.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\continuetosave\Uninstall.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\SaveByclick
c:\programdata\Microsoft\Windows\Start Menu\Programs\SaveByclick\SaveByclick.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\SaveByclick\Uninstall.lnk
c:\programdata\ntuser.dat
c:\programdata\SaveByclick
c:\programdata\SaveByclick\50fae4f9da59c.tlb
c:\programdata\SaveByClick\data\SaveByclick.dat
c:\programdata\SaveByclick\settings.ini
c:\users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
c:\users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences
c:\users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
c:\users\Jakobs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender\Uninstall BrowserDefender.lnk
c:\windows\isRS-000.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-24 bis 2013-08-24 ))))))))))))))))))))))))))))))
.
.
2013-08-24 20:48 . 2013-08-24 20:48 -------- d-----w- c:\users\Papa\AppData\Local\temp
2013-08-24 20:48 . 2013-08-24 20:48 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-24 11:12 . 2013-08-24 11:12 -------- d-----w- C:\FRST
2013-08-23 23:01 . 2013-08-23 23:01 -------- d-----w- c:\users\Jakobs\AppData\Roaming\Malwarebytes
2013-08-23 23:01 . 2013-08-23 23:01 -------- d-----w- c:\programdata\Malwarebytes
2013-08-23 23:01 . 2013-08-23 23:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-08-23 23:01 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-19 20:24 . 2013-08-19 20:23 447752 ----a-w- c:\windows\SysWow64\vp6vfw.dll
2013-08-19 19:20 . 2013-08-19 19:20 -------- d-----w- c:\users\Jakobs\AppData\Local\ESN
2013-08-19 19:20 . 2013-08-19 19:20 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins
2013-08-19 19:18 . 2013-08-20 08:54 -------- d-----w- c:\programdata\EA Logs
2013-08-19 19:18 . 2013-08-19 19:18 -------- d--h--w- c:\program files (x86)\Common Files\EAInstaller
2013-08-19 19:08 . 2013-08-19 19:08 -------- d-----w- c:\programdata\EA Core
2013-08-15 15:48 . 2013-08-15 15:48 -------- d-----w- c:\users\Jakobs\AppData\Local\Criterion Games
2013-08-15 08:57 . 2013-08-15 08:57 -------- d-----w- c:\program files (x86)\Origin Games
2013-08-15 08:54 . 2013-08-15 15:36 -------- d-----w- c:\users\Jakobs\AppData\Roaming\Origin
2013-08-15 08:54 . 2013-08-19 19:09 -------- d-----w- c:\users\Jakobs\AppData\Local\Origin
2013-08-15 08:48 . 2013-08-15 15:38 -------- d-----w- c:\programdata\Origin
2013-08-15 08:48 . 2013-08-21 07:51 -------- d-----w- c:\program files (x86)\Origin
2013-08-15 08:48 . 2013-08-19 19:18 -------- d-----w- c:\programdata\Electronic Arts
2013-08-15 08:42 . 2013-08-24 20:38 94656 ----a-w- c:\windows\system32\WPRO_41_2001woem.tmp
2013-08-14 13:50 . 2013-08-14 13:51 -------- d-----w- c:\windows\system32\MRT
2013-08-14 10:49 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-08-14 10:49 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-14 10:49 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-08-14 10:49 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-08-14 10:49 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-08-14 10:49 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-08-14 10:48 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-14 10:48 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-08-14 10:48 . 2013-07-19 01:58 2048 ----a-w- c:\windows\system32\tzres.dll
2013-08-14 10:48 . 2013-07-19 01:41 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-08-13 17:29 . 2013-08-13 17:29 -------- d-----w- c:\program files (x86)\Betcat
2013-08-10 07:56 . 2013-08-13 20:02 -------- d-----w- c:\users\Jakobs\AppData\Roaming\Betcat
2013-08-09 09:23 . 2013-08-13 20:10 -------- d-----w- c:\users\Jakobs\AppData\Roaming\Web Cake
2013-08-07 13:24 . 2013-08-07 13:25 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2013-08-07 13:24 . 2013-08-07 13:25 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2013-08-07 11:27 . 2013-08-07 16:27 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2013-08-04 18:25 . 2013-08-04 19:02 -------- d-----w- c:\users\Jakobs\AppData\Local\The Witcher
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-24 20:38 . 2012-07-20 17:33 34752 ----a-w- c:\windows\system32\drivers\WPRO_41_2001.sys
2013-08-23 21:51 . 2012-07-22 16:32 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-23 21:51 . 2012-07-20 21:15 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-20 08:55 . 2013-05-08 16:05 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-08-20 08:55 . 2012-07-22 20:10 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-08-19 19:20 . 2012-07-22 20:10 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-08-19 19:18 . 2012-07-22 20:10 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-08-14 13:50 . 2012-09-03 20:26 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-07-09 04:45 . 2013-08-14 10:47 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-03 08:44 . 2013-07-03 08:44 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-03 08:44 . 2012-07-20 21:26 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-07-03 08:44 . 2012-07-20 21:26 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-06-21 22:45 . 2013-06-21 22:45 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-06-21 22:45 . 2013-06-21 22:45 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-06-21 22:45 . 2013-06-21 22:45 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-06-21 22:45 . 2013-06-21 22:45 81408 ----a-w- c:\windows\system32\icardie.dll
2013-06-21 22:45 . 2013-06-21 22:45 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-06-21 22:45 . 2013-06-21 22:45 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-06-21 22:45 . 2013-06-21 22:45 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-06-21 22:45 . 2013-06-21 22:45 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-06-21 22:45 . 2013-06-21 22:45 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-06-21 22:45 . 2013-06-21 22:45 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-06-21 22:45 . 2013-06-21 22:45 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-06-21 22:45 . 2013-06-21 22:45 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-06-21 22:45 . 2013-06-21 22:45 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-06-21 22:45 . 2013-06-21 22:45 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-06-21 22:45 . 2013-06-21 22:45 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-06-21 22:45 . 2013-06-21 22:45 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-06-21 22:45 . 2013-06-21 22:45 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-06-21 22:45 . 2013-06-21 22:45 441856 ----a-w- c:\windows\system32\html.iec
2013-06-21 22:45 . 2013-06-21 22:45 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-06-21 22:45 . 2013-06-21 22:45 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-06-21 22:45 . 2013-06-21 22:45 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-06-21 22:45 . 2013-06-21 22:45 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-06-21 22:45 . 2013-06-21 22:45 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-06-21 22:45 . 2013-06-21 22:45 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-06-21 22:45 . 2013-06-21 22:45 235008 ----a-w- c:\windows\system32\url.dll
2013-06-21 22:45 . 2013-06-21 22:45 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-06-21 22:45 . 2013-06-21 22:45 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-06-21 22:45 . 2013-06-21 22:45 216064 ----a-w- c:\windows\system32\msls31.dll
2013-06-21 22:45 . 2013-06-21 22:45 197120 ----a-w- c:\windows\system32\msrating.dll
2013-06-21 22:45 . 2013-06-21 22:45 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-06-21 22:45 . 2013-06-21 22:45 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-06-21 22:45 . 2013-06-21 22:45 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-06-21 22:45 . 2013-06-21 22:45 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-06-21 22:45 . 2013-06-21 22:45 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-06-21 22:45 . 2013-06-21 22:45 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-06-21 22:45 . 2013-06-21 22:45 149504 ----a-w- c:\windows\system32\occache.dll
2013-06-21 22:45 . 2013-06-21 22:45 144896 ----a-w- c:\windows\system32\wextract.exe
2013-06-21 22:45 . 2013-06-21 22:45 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-06-21 22:45 . 2013-06-21 22:45 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-06-21 22:45 . 2013-06-21 22:45 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-06-21 22:45 . 2013-06-21 22:45 13824 ----a-w- c:\windows\system32\mshta.exe
2013-06-21 22:45 . 2013-06-21 22:45 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-06-21 22:45 . 2013-06-21 22:45 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-06-21 22:45 . 2013-06-21 22:45 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-06-21 22:45 . 2013-06-21 22:45 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-06-21 22:45 . 2013-06-21 22:45 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-06-21 22:45 . 2013-06-21 22:45 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-06-21 22:45 . 2013-06-21 22:45 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-06-21 22:45 . 2013-06-21 22:45 102912 ----a-w- c:\windows\system32\inseng.dll
2013-06-05 03:34 . 2013-07-22 22:44 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 06:00 . 2013-07-22 23:14 624128 ----a-w- c:\windows\system32\qedit.dll
2013-06-04 04:53 . 2013-07-22 23:14 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2013-05-29 16:09 . 2013-05-29 16:09 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2013-05-29 16:09 . 2013-05-29 16:09 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2013-05-29 16:09 . 2013-05-29 16:09 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2013-05-29 16:09 . 2013-05-29 16:09 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2013-03-31 12:57 1520776 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-03-31 1520776]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
"MouseServer"="c:\program files (x86)\MouseServer\MouseServer.exe" [2012-03-21 122880]
"Screenpresso"="c:\users\Jakobs\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe" [2013-08-17 10881040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-29 284440]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-26 291608]
"XFastUSB"="c:\program files (x86)\XFastUSB\XFastUsb.exe" [2012-07-20 5019360]
"THX TruStudio NB Settings"="c:\program files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" [2011-05-19 909824]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"Adobe Photo Downloader"="c:\program files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-12-22 67752]
"PPort12reminder"="c:\program files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" [2010-02-09 328992]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"Adobe Version Cue CS2"="c:\cs2\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-06 856064]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2013-03-31 1646216]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
R2 CLKMSVC10_38F51D56;CyberLink Product - 2012/09/24 15:44;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SmartViewService;SmartView service;c:\program files (x86)\DeviceVM\SmartView\SmartViewService.exe;c:\program files (x86)\DeviceVM\SmartView\SmartViewService.exe [x]
R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x]
R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x]
R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS;c:\windows\SYSNATIVE\drivers\FNETTBOH_305.SYS [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\DRIVERS\tap0801.sys;c:\windows\SYSNATIVE\DRIVERS\tap0801.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
R4 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [x]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S0 asahci64;asahci64;c:\windows\system32\DRIVERS\asahci64.sys;c:\windows\SYSNATIVE\DRIVERS\asahci64.sys [x]
S0 AsrRamDisk;AsrRamDisk;c:\windows\system32\DRIVERS\AsrRamDisk.sys;c:\windows\SYSNATIVE\DRIVERS\AsrRamDisk.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0604010.00E\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\0604010.00E\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0604010.00E\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\0604010.00E\SYMEFA64.SYS [x]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AsrAppCharger.sys [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130715.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [x]
S1 ccSet_N360;Norton 360 Settings Manager;c:\windows\system32\drivers\N360x64\0604010.00E\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\N360x64\0604010.00E\ccSetx64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS;c:\windows\SYSNATIVE\drivers\FNETURPX.SYS [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130823.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130823.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0604010.00E\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\0604010.00E\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0604010.00E\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\N360x64\0604010.00E\SYMNETS.SYS [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 ISCTAgent;ISCT Always Updated Agent;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe;c:\program files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 ikbevent;Intel Upper keyboard Class Filter Driver;c:\windows\system32\DRIVERS\ikbevent.sys;c:\windows\SYSNATIVE\DRIVERS\ikbevent.sys [x]
S3 imsevent;Intel Upper Mouse Class Filter Driver;c:\windows\system32\DRIVERS\imsevent.sys;c:\windows\SYSNATIVE\DRIVERS\imsevent.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\DRIVERS\ISCTD64.sys;c:\windows\SYSNATIVE\DRIVERS\ISCTD64.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtpt64.sys;c:\windows\SYSNATIVE\DRIVERS\lgbtpt64.sys [x]
S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbs64.sys;c:\windows\SYSNATIVE\DRIVERS\lgbtbs64.sys [x]
S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmdm64.sys;c:\windows\SYSNATIVE\DRIVERS\lgvmdm64.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);c:\windows\system32\drivers\WPRO_41_2001.sys;c:\windows\SYSNATIVE\drivers\WPRO_41_2001.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - CLKMDRV10_38F51D56
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 10:29 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-22 21:51]
.
2013-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-27 21:23]
.
2013-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-27 21:23]
.
2013-08-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000Core.job
- c:\users\Jakobs\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-24 20:19]
.
2013-08-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000UA.job
- c:\users\Jakobs\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-24 20:19]
.
2013-08-24 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 11:41]
.
2013-08-24 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 11:41]
.
2013-08-24 c:\windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job
- c:\programdata\BetterSoft\SaveByClick\SaveByClick.exe [2013-01-19 18:59]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-01-12 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-01-12 398104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-01-12 440600]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-17 13307496]
"XFast LAN"="c:\program files\ASRock\XFast LAN\cFosSpeed.exe" [2011-10-19 1441152]
"THXCfg64"="c:\windows\system32\THXCfg64.dll" [2011-05-13 26624]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com
IE: Free YouTube to MP3 Converter - c:\users\Jakobs\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Mit PDF Viewer Plus öffnen - c:\program files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://websearch.simplespeedy.info/?l=1&q=
FF - prefs.js: browser.startup.homepage - hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=hp&installDate=07/08/2013
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: keyword.URL - hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&installDate=07/08/2013&q=
FF - user.js: extensions.Softonic.rvrtMsg - Click Yes to keep current home page and default search settings, Click No to restore original settings
FF - user.js: extensions.Softonic.autoRvrt - false
FF - user.js: extensions.Softonic_i.newTab - false
FF - user.js: extensions.Softonic.tlbrSrchUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=
FF - user.js: extensions.Softonic.id - 2e235ddb000000000000bc5ff43aca23
FF - user.js: extensions.Softonic.instlDay - 15588
FF - user.js: extensions.Softonic.vrsn - 1.6.7.4
FF - user.js: extensions.Softonic.vrsni - 1.6.7.4
FF - user.js: extensions.Softonic_i.vrsnTs - 1.6.7.416:06
FF - user.js: extensions.Softonic.prtnrId - softonic
FF - user.js: extensions.Softonic.prdct - Softonic
FF - user.js: extensions.Softonic.aflt - SD
FF - user.js: extensions.Softonic_i.smplGrp - none
FF - user.js: extensions.Softonic.tlbrId - base
FF - user.js: extensions.Softonic.instlRef - MON00015
FF - user.js: extensions.Softonic.dfltLng - de
FF - user.js: extensions.Softonic.excTlbr - false
FF - user.js: extensions.Softonic.admin - false
FF - user.js: extentions.webcake.installId - 7a37487d-2507-4426-a7c0-46956ec7cd4a
FF - user.js: extentions.webcake.defaultEnableAppsList - layers,brain/features,newOffers/wc
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 2e235ddb000000000000bc5ff43aca23
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15868
FF - user.js: extensions.delta.vrsn - 1.8.21.5
FF - user.js: extensions.delta.vrsni - 1.8.21.5
FF - user.js: extensions.delta.vrsnTs - 1.8.21.522:04
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=121845&tt=120613_ctrl
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{108059B1-3AFF-A2B0-7959-59D31FE470F4} - c:\programdata\continuetosave\511bc29a33591.dll
BHO-{2CA5A921-7FBC-8E04-3595-0E324B15B0F0} - c:\programdata\continuetosave\511bc39023f8f.dll
BHO-{2DCD6050-E56C-C09E-FFB4-05513EC0FDA5} - c:\programdata\continuetosave\510fef8a0a737.dll
Wow6432Node-HKCU-Run-ASRockXTU - (no file)
Wow6432Node-HKCU-Run-zASRockInstantBoot - (no file)
Wow6432Node-HKCU-Run-LG LinkAir - (no file)
Wow6432Node-HKLM-Run-SmartViewAgent - c:\program files (x86)\DeviceVM\SmartView\SmartViewAgent.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-BattlEye for A2 - c:\program files (x86)\steam\steamapps\common\arma 2BattlEye\UnInstallBE.exe
AddRemove-IPCameraDSFilter - c:\program files (x86)\wLite\ipds-uninst.exe
AddRemove-Steam App 113200 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 17300 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 33910 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 33930 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 42910 - c:\program files (x86)\Steam\steam.exe
AddRemove-{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} - c:\programdata\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\6.4.1.14\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-24 22:50:10
ComboFix-quarantined-files.txt 2013-08-24 20:50
.
Vor Suchlauf: 20 Verzeichnis(se), 14.273.155.072 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 14.033.416.192 Bytes frei
.
- - End Of File - - 6B350DCDAF50C6F7EA0FF394D85DC029
|
|
25.08.2013, 10:22
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Snap.do lässt sich nicht entfernen Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Windows 7: Snap.do lässt sich nicht entfernen |
|
25.08.2013, 17:14
| #7 |
| | Windows 7: Snap.do lässt sich nicht entfernen Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.25.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 Jakobs :: JAKOBS-PC [Administrator] Schutz: Aktiviert 25.08.2013 17:54:22 mbam-log-2013-08-25 (17-54-22).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 250065 Laufzeit: 1 Minute(n), 42 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.001 - Report created 25/08/2013 at 18:00:15
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Jakobs - JAKOBS-PC
# Running from : C:\Users\Jakobs\Desktop\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\BetterSoft
Folder Deleted : C:\ProgramData\BrowserDefender
Folder Deleted : C:\ProgramData\clsoft ltd
Folder Deleted : C:\ProgramData\DeviceVM
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\RightClick
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\Betcat
Folder Deleted : C:\Program Files (x86)\continuetosave
Folder Deleted : C:\Program Files (x86)\delta
Folder Deleted : C:\Program Files (x86)\SaveByClick
Folder Deleted : C:\Program Files (x86)\SimpleSpeedy
Folder Deleted : C:\Program Files (x86)\WebCake
Folder Deleted : C:\Users\Jakobs\AppData\Local\apn
Folder Deleted : C:\Users\Jakobs\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Jakobs\AppData\LocalLow\continuetosave
Folder Deleted : C:\Users\Jakobs\AppData\LocalLow\delta
Folder Deleted : C:\Users\Jakobs\AppData\LocalLow\SaveByClick
Folder Deleted : C:\Users\Jakobs\AppData\LocalLow\Softonic
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\Betcat
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\DeviceVM
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\dvdvideosoftiehelpers
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\Web Cake
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
Folder Deleted : C:\Users\Papa\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\ffxtlbr@babylon.com
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\ffxtlbr@delta.com
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\plugin@getwebcake.com
Folder Deleted : C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\toolbar@ask.com
Folder Deleted : C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
File Deleted : C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\searchplugins\Web Search.xml
File Deleted : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\27bvzy9f.default\searchplugins\Web Search.xml
File Deleted : C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\bprotector_extensions.sqlite
File Deleted : C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\user.js
File Deleted : C:\Windows\System32\Tasks\BrowserDefendert
File Deleted : C:\Windows\System32\Tasks\EPUpdater
File Deleted : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ContinueToSave_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ContinueToSave_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SaveByClick_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SaveByClick_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_661c9f97
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_ccfde35c
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_e14dcdfa
Key Deleted : HKCU\Software\5953dcdab168b813
Key Deleted : HKLM\SOFTWARE\5953dcdab168b813
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_dieuhr_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_dieuhr_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A0B10EBE-4E51-4CAE-949B-E6B9E7D68CEA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\Delta
Key Deleted : HKCU\Software\AppDataLow\SProtector
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Delta
Key Deleted : HKLM\Software\SP Global
Key Deleted : HKLM\Software\SProtector
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}
***** [ Browsers ] *****
-\\ Internet Explorer v10.0.9200.16660
-\\ Mozilla Firefox v15.0 (de)
[ File : C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\prefs.js ]
Line Deleted : user_pref("aol_toolbar.default.homepage.check", false);
Line Deleted : user_pref("aol_toolbar.default.search.check", false);
Line Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Line Deleted : user_pref("browser.search.defaultenginename", "Ask.com");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://websearch.simplespeedy.info/?l=1&q=");
Line Deleted : user_pref("browser.search.order.1", "Ask.com");
Line Deleted : user_pref("browser.search.order.1,S", "WebSearch");
Line Deleted : user_pref("browser.search.selectedEngine,S", "WebSearch");
Line Deleted : user_pref("extensions.50fae4f9da4b9.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.location.hostname)>-1) return;}c[...]
Line Deleted : user_pref("extensions.510fef8a0a652.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.location.hostname)>-1) return;}c[...]
Line Deleted : user_pref("extensions.511bc29a334be.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.location.hostname)>-1) return;}c[...]
Line Deleted : user_pref("extensions.511bc39023ec9.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,search.gboxapp.com'.indexOf(window.self.location.hostname)>-1) return;}c[...]
Line Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Line Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Line Deleted : user_pref("extensions.Softonic.admin", false);
Line Deleted : user_pref("extensions.Softonic.aflt", "SD");
Line Deleted : user_pref("extensions.Softonic.autoRvrt", "false");
Line Deleted : user_pref("extensions.Softonic.cntry", "DE");
Line Deleted : user_pref("extensions.Softonic.cv", "cv5");
Line Deleted : user_pref("extensions.Softonic.dfltLng", "de");
Line Deleted : user_pref("extensions.Softonic.envrmnt", "production");
Line Deleted : user_pref("extensions.Softonic.excTlbr", false);
Line Deleted : user_pref("extensions.Softonic.hdrMd5", "71F0016273C4A3B9A5986AF84D3B899A");
Line Deleted : user_pref("extensions.Softonic.hmpg", false);
Line Deleted : user_pref("extensions.Softonic.id", "2e235ddb000000000000bc5ff43aca23");
Line Deleted : user_pref("extensions.Softonic.instlDay", "15588");
Line Deleted : user_pref("extensions.Softonic.instlRef", "MON00015");
Line Deleted : user_pref("extensions.Softonic.isdcmntcmplt", true);
Line Deleted : user_pref("extensions.Softonic.lastVrsnTs", "1.6.7.416:06:54");
Line Deleted : user_pref("extensions.Softonic.mntrvrsn", "1.3.0");
Line Deleted : user_pref("extensions.Softonic.newTab", false);
Line Deleted : user_pref("extensions.Softonic.prdct", "Softonic");
Line Deleted : user_pref("extensions.Softonic.prtnrId", "softonic");
Line Deleted : user_pref("extensions.Softonic.rvrtMsg", "Click Yes to keep current home page and default search settings, Click No to restore original settings");
Line Deleted : user_pref("extensions.Softonic.sg", "tz");
Line Deleted : user_pref("extensions.Softonic.smplGrp", "none");
Line Deleted : user_pref("extensions.Softonic.tlbrId", "base");
Line Deleted : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=");
Line Deleted : user_pref("extensions.Softonic.vrsn", "1.6.7.4");
Line Deleted : user_pref("extensions.Softonic.vrsnTs", "1.6.7.416:06:54");
Line Deleted : user_pref("extensions.Softonic.vrsni", "1.6.7.4");
Line Deleted : user_pref("extensions.Softonic_i.newTab", false);
Line Deleted : user_pref("extensions.Softonic_i.smplGrp", "none");
Line Deleted : user_pref("extensions.Softonic_i.vrsnTs", "1.6.7.416:06:54");
Line Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://websearch.simplespeedy.info/?l=1&q=");
Line Deleted : user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"{BBDA0591-3099-440a-AA10-41764D9DB4DB}\":{\"descriptor\":\"C:\\\\ProgramData\\\\Norton\\\\{0C55C096-0F1D-4F28-AAA2-[...]
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Line Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Line Deleted : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.enable", "");
Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");
[ File : C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\27bvzy9f.default\prefs.js ]
Line Deleted : user_pref("aol_toolbar.default.homepage.check", false);
Line Deleted : user_pref("aol_toolbar.default.search.check", false);
Line Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Line Deleted : user_pref("browser.search.defaultenginename", "Ask.com");
Line Deleted : user_pref("browser.search.order.1", "Ask.com");
Line Deleted : user_pref("browser.search.selectedEngine", "Web Search");
Line Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Line Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Line Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Line Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Line Deleted : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.enable", "");
-\\ Google Chrome v
[ File : C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [17219 octets] - [25/08/2013 17:59:14]
AdwCleaner[S0].txt - [17363 octets] - [25/08/2013 18:00:15]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [17424 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.4 (08.22.2013:1)
OS: Windows 7 Home Premium x64
Ran by Jakobs on 25.08.2013 at 18:02:36,53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\\Default
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\searchURL\\Default
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\features\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\products\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricegong_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricegong_rasmancs
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\splashtop"
Successfully deleted: [Folder] "C:\Users\Jakobs\AppData\Roaming\splashtop"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Folder] "C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}"
~~~ FireFox
Successfully deleted: [Folder] C:\Users\Jakobs\AppData\Roaming\mozilla\firefox\profiles\s5n1x0rv.default\extensions\staged
Successfully deleted the following from C:\Users\Jakobs\AppData\Roaming\mozilla\firefox\profiles\s5n1x0rv.default\prefs.js
user_pref("browser.startup.homepage", "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=hp&installDate
user_pref("keyword.URL", "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=ds&installDate=07/08/2013&q
Emptied folder: C:\Users\Jakobs\AppData\Roaming\mozilla\firefox\profiles\s5n1x0rv.default\minidumps [49 files]
~~~ Chrome
Successfully deleted: [Folder] C:\Users\Jakobs\appdata\local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.08.2013 at 18:06:41,93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2013 01
Ran by Jakobs (administrator) on 25-08-2013 18:11:14
Running from C:\Users\Jakobs\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Adobe Systems Incorporated) c:\cs2\Adobe Version Cue CS2\bin\VersionCueCS2.exe
() C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() c:\cs2\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(wifimouse@necta.us) C:\Program Files (x86)\MouseServer\MouseServer.exe
(Learnpulse) C:\Users\Jakobs\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe
(Adobe Sytems Incorporated) C:\cs2\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Jakobs\Desktop\FRST64 (1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [XFast LAN] - C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [1441152 2011-10-19] (cFos Software GmbH)
HKLM\...\Run: [THXCfg64] - C:\Windows\system32\THXCfg64.dll [26624 2011-05-13] (Creative Technology Ltd.)
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKCU\...\Run: [MouseServer] - C:\Program Files (x86)\MouseServer\MouseServer.exe [122880 2012-03-21] (wifimouse@necta.us)
HKCU\...\Run: [Screenpresso] - C:\Users\Jakobs\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [10881040 2013-08-17] (Learnpulse)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)
HKLM-x32\...\Run: [XFastUSB] - C:\Program Files (x86)\XFastUSB\XFastUsb.exe [5019360 2012-07-20] (FNet Co., Ltd.)
HKLM-x32\...\Run: [THX TruStudio NB Settings] - C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe [909824 2011-05-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Adobe Photo Downloader] - C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe [67752 2006-12-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PPort12reminder] - C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe [328992 2010-02-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Version Cue CS2] - c:\cs2\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [856064 2005-04-06] (Adobe Sytems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Papa\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)
HKU\Papa\...\Run: [ASRockXTU] - [x]
HKU\Papa\...\Run: [zASRockInstantBoot] - [x]
HKU\Papa\...\Run: [Spotify] - C:\Users\Jakobs\AppData\Roaming\Spotify\Spotify.exe [5576408 2012-08-23] (Spotify Ltd)
HKU\Papa\...\Run: [Spotify Web Helper] - C:\Users\Jakobs\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-08-23] ()
HKU\Papa\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLEP1&pc=SPLH
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLEP1&pc=SPLH
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: continuetosave - {108059B1-3AFF-A2B0-7959-59D31FE470F4} - C:\ProgramData\continuetosave\511bc29a33591.dll No File
BHO-x32: HistoryTriggerBHO Class - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files (x86)\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)
BHO-x32: continuetosave - {2CA5A921-7FBC-8E04-3595-0E324B15B0F0} - C:\ProgramData\continuetosave\511bc39023f8f.dll No File
BHO-x32: continuetosave - {2DCD6050-E56C-C09E-FFB4-05513EC0FDA5} - C:\ProgramData\continuetosave\510fef8a0a737.dll No File
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default
FF NewTab: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jakobs\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
FF Extension: SaveByclick - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\50fae4f9da40b@50fae4f9da445.com
FF Extension: continuetosave - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\510fef8a0a5a6@510fef8a0a5df.com
FF Extension: continuetosave - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\511bc29a3341a@511bc29a33450.com
FF Extension: continuetosave - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\511bc39023e1e@511bc39023e57.com
FF Extension: FoxyProxy Basic - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\foxyproxy@eric.h.jung
FF Extension: DownloadHelper - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: info - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\info@youtube-mp3.org.xpi
FF Extension: youtube2mp3 - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\youtube2mp3@mondayx.de.xpi
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
Chrome:
=======
CHR HomePage: hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=hp&installDate=07/08/2013
CHR RestoreOnStartup: "hxxp://google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Google Update) - C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (Bejeweled) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm\2_0
CHR Extension: (Media Hint) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\anepbdekljkmmimmhbniglnnanmmkoja\0.1.13_0
CHR Extension: (Splendid) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdfkbdkkfmmckaadapdipihjfaacnkgd\3_0
CHR Extension: (YouTube) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Grooveshark Germany unlocker) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0
CHR Extension: (SaveByclick) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehmcijnpodcghlafhmmlhhcaofmmjlae\1
CHR Extension: (Photo Zoom for Facebook) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi\1.1208.30.1_0
CHR Extension: (continuetosave) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhdhdjejihpnakibpmcfokecfgbbdgig\1
CHR Extension: (Grooveshark Non-Stop) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\flgdeakeeekllcpldfampgbamohdagdp\1.1_0
CHR Extension: (AdBlock) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.5_0
CHR Extension: (continuetosave) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijciphidhidaebloioeaefakmcfhegjb\1
CHR Extension: (continuetosave) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkigggggfoomckaikapfphaocbdbpkhe\1
CHR Extension: (StumbleUpon) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcahibnffhnnjcedflmchmokndkjnhpg\5.7.11.1_0
CHR Extension: (Cargo Bridge) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\keembkgclppcbilkekfgpobhldjjhpmn\1.5.7_0
CHR Extension: (Siege Hero \u2013 Viking Vengeance) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfomhlbnciicmciejodphlggfbmhbbbo\1.1_0
CHR Extension: (FVD Downloader) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\5.3.7_0
CHR Extension: (Download Master) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcceagdollnkjlogmdckgjakjapmkdjf\3.0.1.2_0
CHR Extension: (Norton Identity Protection) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.13.5_0
CHR Extension: (Facebook Notifications) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmameahlembdcigphohgiodcgjomcgeo\1.27_0
CHR Extension: (Gmail) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\Exts\Chrome.crx
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-10] (Adobe Systems)
R2 Adobe Version Cue CS2; c:\cs2\Adobe Version Cue CS2\bin\VersionCueCS2.exe [163840 2005-04-06] (Adobe Systems Incorporated)
R2 AdobeActiveFileMonitor5.0; C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe [108712 2006-12-22] ()
R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [395136 2011-10-19] (cFos Software GmbH)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [121344 2012-02-07] ()
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2013-08-19] ()
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] ()
S2 SmartViewService; C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe [x]
==================== Drivers (Whitelisted) ====================
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2011-09-21] (Asmedia Technology)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [31016 2012-01-13] (ASRock Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-10-05] ()
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\0604010.00E\ccSetx64.sys [167072 2012-06-07] (Symantec Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-09-27] (DT Soft Ltd)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-08-21] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-08-21] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-08-09] (Symantec Corporation)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2013-04-19] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-07-20] (FNet Co., Ltd.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130823.001\IDSvia64.sys [520280 2013-08-14] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130823.001\IDSvia64.sys [520280 2013-08-14] (Symantec Corporation)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [44992 2012-02-09] ()
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtpt64.sys [16384 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbs64.sys [14848 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmdm64.sys [17408 2009-09-29] (LG Electronics Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-10-05] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130823.019\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R3 SRTSP; C:\Windows\System32\Drivers\N360x64\0604010.00E\SRTSP64.SYS [737952 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\0604010.00E\SRTSPX64.SYS [37536 2012-07-06] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\0604010.00E\SYMDS64.SYS [451192 2011-08-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\0604010.00E\SYMEFA64.SYS [1129120 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2013-02-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\0604010.00E\Ironx64.SYS [190072 2011-11-16] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\0604010.00E\SYMNETS.SYS [405624 2011-11-16] (Symantec Corporation)
S3 tap0801; C:\Windows\System32\DRIVERS\tap0801.sys [30720 2005-04-13] (The OpenVPN Project)
S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2012-03-02] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [28160 2012-03-02] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [34816 2012-03-02] (LG Electronics Inc.)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2013-08-25] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-25 18:06 - 2013-08-25 18:06 - 00002905 _____ C:\Users\Jakobs\Desktop\JRT.txt
2013-08-25 18:02 - 2013-08-25 18:02 - 00000000 ____D C:\Windows\ERUNT
2013-08-25 18:01 - 2013-08-25 18:01 - 00017517 _____ C:\Users\Jakobs\Desktop\AdwCleaner[S0].txt
2013-08-25 17:59 - 2013-08-25 18:00 - 00000000 ____D C:\AdwCleaner
2013-08-25 17:58 - 2013-08-25 17:58 - 01021434 _____ (Thisisu) C:\Users\Jakobs\Desktop\JRT.exe
2013-08-25 17:58 - 2013-08-25 17:58 - 00994642 _____ C:\Users\Jakobs\Desktop\adwcleaner.exe
2013-08-24 22:50 - 2013-08-24 22:50 - 00037071 _____ C:\ComboFix.txt
2013-08-24 22:43 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-24 22:43 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-24 22:43 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-24 22:42 - 2013-08-24 22:50 - 00000000 ____D C:\Qoobox
2013-08-24 22:42 - 2013-08-24 22:49 - 00000000 ____D C:\Windows\erdnt
2013-08-24 22:41 - 2013-08-24 22:41 - 05111180 ____R (Swearware) C:\Users\Jakobs\Desktop\ComboFix.exe
2013-08-24 13:13 - 2013-08-24 13:13 - 00034573 _____ C:\Users\Jakobs\Desktop\Addition.txt
2013-08-24 13:12 - 2013-08-24 13:12 - 00000000 ____D C:\FRST
2013-08-24 10:18 - 2013-08-24 10:36 - 00145096 _____ C:\Users\Jakobs\Desktop\OTL.Txt
2013-08-24 10:18 - 2013-08-24 10:18 - 00126164 _____ C:\Users\Jakobs\Desktop\Extras.Txt
2013-08-24 10:13 - 2013-08-24 10:12 - 00602112 _____ (OldTimer Tools) C:\Users\Jakobs\Desktop\OTL.exe
2013-08-24 01:01 - 2013-08-24 01:01 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-24 01:01 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-21 09:52 - 2013-08-21 09:52 - 00000000 _____ C:\Users\Jakobs\AppData\Roaming\TS3Patch.lck
2013-08-19 22:41 - 2013-08-19 22:41 - 00000000 ____D C:\Users\Jakobs\Documents\Electronic Arts
2013-08-19 22:26 - 2013-08-19 22:26 - 00000927 _____ C:\Users\Public\Desktop\Die Sims™ 3 Late Night.lnk
2013-08-19 22:26 - 2013-08-19 22:26 - 00000867 _____ C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk
2013-08-19 22:24 - 2013-08-19 22:23 - 00447752 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2013-08-19 22:23 - 2013-08-19 22:23 - 00000909 _____ C:\Users\Public\Desktop\Die*Sims™*3.lnk
2013-08-19 21:20 - 2013-08-19 21:21 - 00000000 ____D C:\Users\Jakobs\Documents\Battlefield 3
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Users\Jakobs\AppData\Local\ESN
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-08-19 21:18 - 2013-08-19 21:18 - 00000655 _____ C:\Users\Public\Desktop\Battlefield 3.lnk
2013-08-19 21:09 - 2013-08-19 21:09 - 00003168 _____ C:\Windows\System32\Tasks\{984D6FFE-F118-44EB-8CF2-69CD5E8132FD}
2013-08-19 21:08 - 2013-08-19 21:08 - 00000000 ____D C:\ProgramData\EA Core
2013-08-15 17:48 - 2013-08-15 17:48 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Criterion Games
2013-08-15 10:57 - 2013-08-15 10:57 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-08-15 10:54 - 2013-08-19 21:09 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Origin
2013-08-15 10:54 - 2013-08-15 17:36 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Origin
2013-08-15 10:48 - 2013-08-21 09:51 - 00000000 ____D C:\Program Files (x86)\Origin
2013-08-15 10:48 - 2013-08-19 21:18 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-08-15 10:48 - 2013-08-15 17:38 - 00000000 ____D C:\ProgramData\Origin
2013-08-15 10:48 - 2013-08-15 10:48 - 00000986 _____ C:\Users\Public\Desktop\Origin.lnk
2013-08-15 10:42 - 2013-08-25 18:01 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-08-14 15:55 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 15:55 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 15:55 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 15:55 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 15:55 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 15:55 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 15:55 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 15:55 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 15:55 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 15:55 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 15:55 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 15:55 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 15:50 - 2013-08-14 15:51 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 12:49 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 12:49 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 12:49 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 12:49 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 12:49 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 12:49 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 12:48 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 12:48 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 12:48 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 12:48 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 12:47 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 12:47 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 12:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 12:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 12:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 12:47 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 12:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 12:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 12:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 12:47 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 12:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 12:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 12:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 12:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 12:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 12:47 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 12:47 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 20:01 - 2013-08-13 21:41 - 00000000 ____D C:\Users\Jakobs\Desktop\eigenes fotoalbum
2013-08-10 20:02 - 2013-08-10 20:02 - 00000000 ____D C:\Users\Jakobs\Desktop\zwergentanz 16.6
2013-08-09 20:12 - 2013-08-09 20:23 - 00000000 ____D C:\Users\Jakobs\Desktop\lieder
2013-08-07 15:24 - 2013-08-07 15:25 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-08-07 13:27 - 2013-08-07 18:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-07 12:53 - 2013-08-09 20:13 - 00000000 ____D C:\Users\Jakobs\Desktop\projekt silberhochzeit
2013-08-04 20:25 - 2013-08-04 21:02 - 00000000 ____D C:\Users\Jakobs\Documents\The Witcher
2013-08-04 20:25 - 2013-08-04 21:02 - 00000000 ____D C:\Users\Jakobs\AppData\Local\The Witcher
2013-08-04 20:24 - 2013-08-04 20:24 - 00000000 ____D C:\Users\Public\Documents\The Witcher
==================== One Month Modified Files and Folders =======
2013-08-25 18:09 - 2013-08-25 18:11 - 01576600 _____ (Farbar) C:\Users\Jakobs\Desktop\FRST64 (1).exe
2013-08-25 18:08 - 2009-07-14 06:45 - 00015648 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-25 18:08 - 2009-07-14 06:45 - 00015648 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-25 18:07 - 2009-07-14 19:58 - 00707088 _____ C:\Windows\system32\perfh007.dat
2013-08-25 18:07 - 2009-07-14 19:58 - 00152680 _____ C:\Windows\system32\perfc007.dat
2013-08-25 18:07 - 2009-07-14 07:13 - 01641292 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-25 18:06 - 2013-08-25 18:06 - 00002905 _____ C:\Users\Jakobs\Desktop\JRT.txt
2013-08-25 18:02 - 2013-08-25 18:02 - 00000000 ____D C:\Windows\ERUNT
2013-08-25 18:01 - 2013-08-25 18:01 - 00017517 _____ C:\Users\Jakobs\Desktop\AdwCleaner[S0].txt
2013-08-25 18:01 - 2013-08-15 10:42 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-08-25 18:01 - 2013-03-27 23:23 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-25 18:01 - 2013-01-19 20:24 - 00000390 ____H C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job
2013-08-25 18:01 - 2012-07-20 19:34 - 00880168 _____ C:\Windows\PFRO.log
2013-08-25 18:01 - 2012-07-20 19:33 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys
2013-08-25 18:01 - 2012-07-20 19:31 - 00000828 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2013-08-25 18:01 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-25 18:01 - 2009-07-14 06:51 - 00197187 _____ C:\Windows\setupact.log
2013-08-25 18:00 - 2013-08-25 17:59 - 00000000 ____D C:\AdwCleaner
2013-08-25 18:00 - 2012-07-20 21:46 - 01807301 _____ C:\Windows\WindowsUpdate.log
2013-08-25 17:58 - 2013-08-25 17:58 - 01021434 _____ (Thisisu) C:\Users\Jakobs\Desktop\JRT.exe
2013-08-25 17:58 - 2013-08-25 17:58 - 00994642 _____ C:\Users\Jakobs\Desktop\adwcleaner.exe
2013-08-24 22:50 - 2013-08-24 22:50 - 00037071 _____ C:\ComboFix.txt
2013-08-24 22:50 - 2013-08-24 22:42 - 00000000 ____D C:\Qoobox
2013-08-24 22:49 - 2013-08-24 22:42 - 00000000 ____D C:\Windows\erdnt
2013-08-24 22:49 - 2012-07-22 18:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-24 22:48 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-24 22:43 - 2013-03-27 23:23 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-24 22:43 - 2012-10-24 22:19 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000UA.job
2013-08-24 22:41 - 2013-08-24 22:41 - 05111180 ____R (Swearware) C:\Users\Jakobs\Desktop\ComboFix.exe
2013-08-24 13:13 - 2013-08-24 13:13 - 00034573 _____ C:\Users\Jakobs\Desktop\Addition.txt
2013-08-24 13:12 - 2013-08-24 13:12 - 00000000 ____D C:\FRST
2013-08-24 13:09 - 2012-07-20 19:31 - 00000830 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2013-08-24 10:36 - 2013-08-24 10:18 - 00145096 _____ C:\Users\Jakobs\Desktop\OTL.Txt
2013-08-24 10:18 - 2013-08-24 10:18 - 00126164 _____ C:\Users\Jakobs\Desktop\Extras.Txt
2013-08-24 10:12 - 2013-08-24 10:13 - 00602112 _____ (OldTimer Tools) C:\Users\Jakobs\Desktop\OTL.exe
2013-08-24 01:43 - 2012-10-24 22:19 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000Core.job
2013-08-24 01:01 - 2013-08-24 01:01 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-23 23:51 - 2012-07-22 18:32 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-23 23:51 - 2012-07-22 18:32 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-23 23:51 - 2012-07-20 23:15 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-21 09:52 - 2013-08-21 09:52 - 00000000 _____ C:\Users\Jakobs\AppData\Roaming\TS3Patch.lck
2013-08-21 09:51 - 2013-08-15 10:48 - 00000000 ____D C:\Program Files (x86)\Origin
2013-08-20 10:55 - 2013-05-08 18:05 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-20 10:55 - 2012-07-22 22:10 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-19 22:41 - 2013-08-19 22:41 - 00000000 ____D C:\Users\Jakobs\Documents\Electronic Arts
2013-08-19 22:26 - 2013-08-19 22:26 - 00000927 _____ C:\Users\Public\Desktop\Die Sims™ 3 Late Night.lnk
2013-08-19 22:26 - 2013-08-19 22:26 - 00000867 _____ C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk
2013-08-19 22:26 - 2012-07-21 01:36 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-19 22:23 - 2013-08-19 22:24 - 00447752 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2013-08-19 22:23 - 2013-08-19 22:23 - 00000909 _____ C:\Users\Public\Desktop\Die*Sims™*3.lnk
2013-08-19 21:21 - 2013-08-19 21:20 - 00000000 ____D C:\Users\Jakobs\Documents\Battlefield 3
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Users\Jakobs\AppData\Local\ESN
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-08-19 21:20 - 2013-05-08 18:05 - 00000000 ____D C:\Users\Jakobs\AppData\Local\PunkBuster
2013-08-19 21:20 - 2012-07-22 22:10 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-08-19 21:18 - 2013-08-19 21:18 - 00000655 _____ C:\Users\Public\Desktop\Battlefield 3.lnk
2013-08-19 21:18 - 2013-08-15 10:48 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-08-19 21:18 - 2012-07-22 22:10 - 00075136 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-19 21:17 - 2012-07-22 22:01 - 00317097 _____ C:\Windows\DirectX.log
2013-08-19 21:09 - 2013-08-19 21:09 - 00003168 _____ C:\Windows\System32\Tasks\{984D6FFE-F118-44EB-8CF2-69CD5E8132FD}
2013-08-19 21:09 - 2013-08-15 10:54 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Origin
2013-08-19 21:08 - 2013-08-19 21:08 - 00000000 ____D C:\ProgramData\EA Core
2013-08-15 17:48 - 2013-08-15 17:48 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Criterion Games
2013-08-15 17:38 - 2013-08-15 10:48 - 00000000 ____D C:\ProgramData\Origin
2013-08-15 17:36 - 2013-08-15 10:54 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Origin
2013-08-15 11:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 10:57 - 2013-08-15 10:57 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-08-15 10:48 - 2013-08-15 10:48 - 00000986 _____ C:\Users\Public\Desktop\Origin.lnk
2013-08-14 15:52 - 2012-07-20 23:56 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-14 15:51 - 2013-08-14 15:50 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 15:50 - 2012-09-03 22:26 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-13 21:41 - 2013-08-13 20:01 - 00000000 ____D C:\Users\Jakobs\Desktop\eigenes fotoalbum
2013-08-13 12:47 - 2012-07-21 19:30 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\vlc
2013-08-13 10:58 - 2013-01-10 19:39 - 00000000 ____D C:\Users\Jakobs\Documents\Adobe
2013-08-13 10:58 - 2012-07-20 19:35 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Adobe
2013-08-13 10:17 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-10 20:02 - 2013-08-10 20:02 - 00000000 ____D C:\Users\Jakobs\Desktop\zwergentanz 16.6
2013-08-09 20:23 - 2013-08-09 20:12 - 00000000 ____D C:\Users\Jakobs\Desktop\lieder
2013-08-09 20:13 - 2013-08-07 12:53 - 00000000 ____D C:\Users\Jakobs\Desktop\projekt silberhochzeit
2013-08-09 13:22 - 2012-07-20 19:36 - 00000000 ____D C:\Users\Jakobs\AppData\Local\CrashDumps
2013-08-08 12:17 - 2012-07-20 22:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-07 18:27 - 2013-08-07 13:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-07 15:25 - 2013-08-07 15:24 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-08-07 15:24 - 2012-10-03 11:32 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\DVDVideoSoft
2013-08-07 13:10 - 2012-12-23 23:26 - 00019456 ____H C:\Users\Jakobs\Desktop\photothumb.db
2013-08-05 13:26 - 2012-07-22 22:12 - 00000000 ____D C:\Users\Jakobs\Documents\My Games
2013-08-05 10:56 - 2012-07-21 19:42 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Adobe
2013-08-04 21:02 - 2013-08-04 20:25 - 00000000 ____D C:\Users\Jakobs\Documents\The Witcher
2013-08-04 21:02 - 2013-08-04 20:25 - 00000000 ____D C:\Users\Jakobs\AppData\Local\The Witcher
2013-08-04 20:24 - 2013-08-04 20:24 - 00000000 ____D C:\Users\Public\Documents\The Witcher
2013-08-03 19:52 - 2013-03-27 23:23 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-03 19:45 - 2013-07-01 22:28 - 00002378 _____ C:\Users\Jakobs\Desktop\Google Chrome.lnk
2013-07-26 07:13 - 2013-08-14 15:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-14 15:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-14 15:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-14 15:55 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-14 15:55 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-14 15:55 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-14 15:55 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-14 15:55 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-14 15:55 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-14 15:55 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-14 15:55 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-14 15:55 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 04:39 - 2013-08-14 15:55 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-26 03:59 - 2013-08-14 15:55 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
Files to move or delete:
====================
C:\Users\Jakobs\jagex_cl_loginapplet_LIVE.dat
C:\Users\Jakobs\jagex_cl_runescape_LIVE.dat
C:\Users\Jakobs\random.dat
C:\Users\Jakobs\AppData\Local\Temp\Quarantine.exe
C:\Users\Jakobs\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
C:\Users\Jakobs\AppData\Local\Temp\jrt\erunt\ERUNT.EXE.manifest
C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-24 02:47
==================== End Of Log ============================
--- --- --- |
|
25.08.2013, 19:52
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Snap.do lässt sich nicht entfernenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.08.2013, 09:57
| #9 |
| | Windows 7: Snap.do lässt sich nicht entfernen ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=8e073b7b712eed429e6ecd3357264546
# engine=14899
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-26 01:12:12
# local_time=2013-08-26 03:12:12 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3592 16777213 100 95 1683802 128142028 0 0
# compatibility_mode=5893 16776574 66 85 2907063 129109382 0 0
# scanned=645723
# found=26
# cleaned=0
# scan_time=17511
sh=9B7AFC05F48AE3F56DBE1A2114F8FDF50067A187 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.C application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\plugin@getwebcake.com\content\overlay.js.vir"
sh=5B51174625237777712FAECBCDAAE90233EAC829 ft=0 fh=0000000000000000 vn="HTML/Ransom.B trojan" ac=I fn="C:\ProgramData\fewmzlmvthdkexs\main.html"
sh=A696C5A0D50145AFDE3D3A71F70B1C3006AC2199 ft=1 fh=da0003b6601dbc17 vn="a variant of Win32/Adware.MultiPlug.I application" ac=I fn="C:\Qoobox\Quarantine\C\ProgramData\continuetosave\510fef8a0a737.dll.vir"
sh=A696C5A0D50145AFDE3D3A71F70B1C3006AC2199 ft=1 fh=da0003b6601dbc17 vn="a variant of Win32/Adware.MultiPlug.I application" ac=I fn="C:\Qoobox\Quarantine\C\ProgramData\continuetosave\511bc29a33591.dll.vir"
sh=A696C5A0D50145AFDE3D3A71F70B1C3006AC2199 ft=1 fh=da0003b6601dbc17 vn="a variant of Win32/Adware.MultiPlug.I application" ac=I fn="C:\Qoobox\Quarantine\C\ProgramData\continuetosave\511bc39023f8f.dll.vir"
sh=5B51174625237777712FAECBCDAAE90233EAC829 ft=0 fh=0000000000000000 vn="HTML/Ransom.B trojan" ac=I fn="C:\Users\All Users\fewmzlmvthdkexs\main.html"
sh=E342EB639EB551554ED7C0C3A5C002CA0090514F ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehmcijnpodcghlafhmmlhhcaofmmjlae\1\50fae4f9da35c3.53041243.js"
sh=7A4B466ACD2701349951862E165F5192D0FC1CBD ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhdhdjejihpnakibpmcfokecfgbbdgig\1\511bc39023d7d4.16289079.js"
sh=AAC1143A8E6630045F6E1C5BE6016DA085DB271C ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijciphidhidaebloioeaefakmcfhegjb\1\511bc29a333822.02713616.js"
sh=DD6B0D06EC4FE5C446FCEF8FCDB323F14DDD652B ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkigggggfoomckaikapfphaocbdbpkhe\1\510fef8a0a4f00.98766571.js"
sh=77B486414A4130FC89B1E94889FA73E303297310 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\50fae4f9da40b@50fae4f9da445.com\content\bg.js"
sh=5584FBBFB9E650962DEEFEEDDD0B6010EE58930C ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\510fef8a0a5a6@510fef8a0a5df.com\content\bg.js"
sh=BB569D6894A2054723450FBF06D8376C48E90449 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\511bc29a3341a@511bc29a33450.com\content\bg.js"
sh=14B84124B3EB7950C9091CE5C28E2EFC6CEDAEF7 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\extensions\511bc39023e1e@511bc39023e57.com\content\bg.js"
sh=86D6F1F8718FB832AAA3BB63D68E113CAD719D2B ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="K:\JAKOBS-PC\Backup Set 2012-09-05 130534\Backup Files 2012-09-05 130534\Backup files 5.zip"
sh=45789A1AAC1D54704BEFB7AE54DB702BB3F08C13 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="K:\JAKOBS-PC\Backup Set 2012-12-24 225709\Backup Files 2013-01-21 201451\Backup files 1.zip"
sh=4742F3EA29925FB6EC14FC45BC941920FEEBA6BC ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="K:\JAKOBS-PC\Backup Set 2012-12-24 225709\Backup Files 2013-01-21 201451\Backup files 2.zip"
sh=E5CE0DCDCEA32D693D8F1315161EEBC0F5B91C23 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="K:\JAKOBS-PC\Backup Set 2012-12-24 225709\Backup Files 2013-02-04 200001\Backup files 1.zip"
sh=2CC5F05AB5A3CF8445B4EBA8928BF4E0301251DE ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="K:\JAKOBS-PC\Backup Set 2012-12-24 225709\Backup Files 2013-02-04 200001\Backup files 2.zip"
sh=7DC5AB466940FBC112EF68C7F0BB2DB97B21D23B ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="K:\JAKOBS-PC\Backup Set 2012-12-24 225709\Backup Files 2013-03-25 201624\Backup files 2.zip"
sh=81A5D0CCF3FA4833DFC93D122066E729DBC93DDD ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="K:\JAKOBS-PC\Backup Set 2012-12-24 225709\Backup Files 2013-03-25 201624\Backup files 4.zip"
sh=7F2C3C7C9A34DD4E63A1E5702C88F680E7133D8C ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="K:\JAKOBS-PC\Backup Set 2013-05-20 200002\Backup Files 2013-05-20 200002\Backup files 11.zip"
sh=C0D89416718EA3A9BF5D3BB34D32F1BFD5FC39A9 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="K:\JAKOBS-PC\Backup Set 2013-05-20 200002\Backup Files 2013-05-20 200002\Backup files 9.zip"
sh=1C842B0E3CAD0D79A40445C30789DFBE550CBEE4 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.C application" ac=I fn="K:\JAKOBS-PC\Backup Set 2013-05-20 200002\Backup Files 2013-06-24 200009\Backup files 1.zip"
sh=56883DCDA1013548E65D77E806364F7B176432C3 ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H application" ac=I fn="K:\JAKOBS-PC\Backup Set 2013-07-01 145218\Backup Files 2013-07-01 145218\Backup files 10.zip"
sh=0869BBD1FBF13E64CC62A69510458A1E9A498FAB ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="K:\JAKOBS-PC\Backup Set 2013-07-01 145218\Backup Files 2013-07-01 145218\Backup files 8.zip"
Code:
ATTFilter Results of screen317's Security Check version 0.99.72 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Norton 360 Online WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 JavaFX 2.1.1 Java 7 Update 25 Adobe Flash Player 11.8.800.94 Adobe Reader 10.1.7 Adobe Reader out of Date! Mozilla Firefox 15.0 Firefox out of Date! Mozilla Thunderbird (17.0.8) Google Chrome 28.0.1500.72 Google Chrome 28.0.1500.95 ````````Process Check: objlist.exe by Laurent```````` Norton ccSvcHst.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2013 01
Ran by Jakobs (administrator) on 26-08-2013 10:52:50
Running from C:\Users\Jakobs\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Adobe Systems Incorporated) c:\cs2\Adobe Version Cue CS2\bin\VersionCueCS2.exe
() C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\spd.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() c:\cs2\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(cFos Software GmbH) C:\Program Files\ASRock\XFast LAN\cfosspeed.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(wifimouse@necta.us) C:\Program Files (x86)\MouseServer\MouseServer.exe
(Learnpulse) C:\Users\Jakobs\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(FNet Co., Ltd.) C:\Program Files (x86)\XFastUSB\XFastUsb.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe
(Adobe Sytems Incorporated) C:\cs2\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Farbar) C:\Users\Jakobs\Desktop\FRST64 (1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [XFast LAN] - C:\Program Files\ASRock\XFast LAN\cFosSpeed.exe [1441152 2011-10-19] (cFos Software GmbH)
HKLM\...\Run: [THXCfg64] - C:\Windows\system32\THXCfg64.dll [26624 2011-05-13] (Creative Technology Ltd.)
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKCU\...\Run: [MouseServer] - C:\Program Files (x86)\MouseServer\MouseServer.exe [122880 2012-03-21] (wifimouse@necta.us)
HKCU\...\Run: [Screenpresso] - C:\Users\Jakobs\AppData\Local\Learnpulse\Screenpresso\Screenpresso.exe [10881040 2013-08-17] (Learnpulse)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)
HKLM-x32\...\Run: [XFastUSB] - C:\Program Files (x86)\XFastUSB\XFastUsb.exe [5019360 2012-07-20] (FNet Co., Ltd.)
HKLM-x32\...\Run: [THX TruStudio NB Settings] - C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe [909824 2011-05-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Adobe Photo Downloader] - C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe [67752 2006-12-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PPort12reminder] - C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe [328992 2010-02-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Version Cue CS2] - c:\cs2\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [856064 2005-04-06] (Adobe Sytems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Papa\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2741616 2011-03-04] (Hewlett-Packard Company)
HKU\Papa\...\Run: [ASRockXTU] - [x]
HKU\Papa\...\Run: [zASRockInstantBoot] - [x]
HKU\Papa\...\Run: [Spotify] - C:\Users\Jakobs\AppData\Roaming\Spotify\Spotify.exe [5576408 2012-08-23] (Spotify Ltd)
HKU\Papa\...\Run: [Spotify Web Helper] - C:\Users\Jakobs\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-08-23] ()
HKU\Papa\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLEP1&pc=SPLH
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLEP1&pc=SPLH
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: continuetosave - {108059B1-3AFF-A2B0-7959-59D31FE470F4} - C:\ProgramData\continuetosave\511bc29a33591.dll No File
BHO-x32: HistoryTriggerBHO Class - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files (x86)\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)
BHO-x32: continuetosave - {2CA5A921-7FBC-8E04-3595-0E324B15B0F0} - C:\ProgramData\continuetosave\511bc39023f8f.dll No File
BHO-x32: continuetosave - {2DCD6050-E56C-C09E-FFB4-05513EC0FDA5} - C:\ProgramData\continuetosave\510fef8a0a737.dll No File
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default
FF NewTab: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jakobs\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
FF Extension: SaveByclick - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\50fae4f9da40b@50fae4f9da445.com
FF Extension: continuetosave - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\510fef8a0a5a6@510fef8a0a5df.com
FF Extension: continuetosave - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\511bc29a3341a@511bc29a33450.com
FF Extension: continuetosave - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\511bc39023e1e@511bc39023e57.com
FF Extension: FoxyProxy Basic - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\foxyproxy@eric.h.jung
FF Extension: DownloadHelper - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: info - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\info@youtube-mp3.org.xpi
FF Extension: youtube2mp3 - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\youtube2mp3@mondayx.de.xpi
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi
FF Extension: No Name - C:\Users\Jakobs\AppData\Roaming\Mozilla\Firefox\Profiles\s5n1x0rv.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
Chrome:
=======
CHR HomePage: hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=b9075e96-a7a8-4c7a-ae84-f80118c62b97&searchtype=hp&installDate=07/08/2013
CHR RestoreOnStartup: "hxxp://google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jakobs\AppData\Local\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Google Update) - C:\Users\Jakobs\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (Bejeweled) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm\2_0
CHR Extension: (Media Hint) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\anepbdekljkmmimmhbniglnnanmmkoja\0.1.13_0
CHR Extension: (Splendid) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdfkbdkkfmmckaadapdipihjfaacnkgd\3_0
CHR Extension: (YouTube) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Grooveshark Germany unlocker) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.4_0
CHR Extension: (SaveByclick) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehmcijnpodcghlafhmmlhhcaofmmjlae\1
CHR Extension: (Photo Zoom for Facebook) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi\1.1208.30.1_0
CHR Extension: (continuetosave) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhdhdjejihpnakibpmcfokecfgbbdgig\1
CHR Extension: (Grooveshark Non-Stop) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\flgdeakeeekllcpldfampgbamohdagdp\1.1_0
CHR Extension: (AdBlock) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.6_0
CHR Extension: (continuetosave) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijciphidhidaebloioeaefakmcfhegjb\1
CHR Extension: (continuetosave) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkigggggfoomckaikapfphaocbdbpkhe\1
CHR Extension: (StumbleUpon) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcahibnffhnnjcedflmchmokndkjnhpg\5.7.11.1_0
CHR Extension: (Cargo Bridge) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\keembkgclppcbilkekfgpobhldjjhpmn\1.5.7_0
CHR Extension: (Siege Hero \u2013 Viking Vengeance) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfomhlbnciicmciejodphlggfbmhbbbo\1.1_0
CHR Extension: (FVD Downloader) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\5.3.7_0
CHR Extension: (Download Master) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcceagdollnkjlogmdckgjakjapmkdjf\3.0.1.2_0
CHR Extension: (Norton Identity Protection) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.13.5_0
CHR Extension: (Facebook Notifications) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmameahlembdcigphohgiodcgjomcgeo\1.27_0
CHR Extension: (Gmail) - C:\Users\Jakobs\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\Exts\Chrome.crx
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-10] (Adobe Systems)
R2 Adobe Version Cue CS2; c:\cs2\Adobe Version Cue CS2\bin\VersionCueCS2.exe [163840 2005-04-06] (Adobe Systems Incorporated)
R2 AdobeActiveFileMonitor5.0; C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe [108712 2006-12-22] ()
R2 cFosSpeedS; C:\Program Files\ASRock\XFast LAN\spd.exe [395136 2011-10-19] (cFos Software GmbH)
S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [121344 2012-02-07] ()
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\6.4.1.14\ccSvcHst.exe [138272 2012-06-16] (Symantec Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2013-08-19] ()
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] ()
S2 SmartViewService; C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe [x]
==================== Drivers (Whitelisted) ====================
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2011-09-21] (Asmedia Technology)
R0 AsrRamDisk; C:\Windows\System32\DRIVERS\AsrRamDisk.sys [31016 2012-01-13] (ASRock Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-10-05] ()
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\0604010.00E\ccSetx64.sys [167072 2012-06-07] (Symantec Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-09-27] (DT Soft Ltd)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-08-21] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-08-21] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-08-09] (Symantec Corporation)
S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [32320 2013-04-19] (FNet Co., Ltd.)
R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [15936 2012-07-20] (FNet Co., Ltd.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130823.001\IDSvia64.sys [520280 2013-08-14] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20130823.001\IDSvia64.sys [520280 2013-08-14] (Symantec Corporation)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [44992 2012-02-09] ()
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtpt64.sys [16384 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbs64.sys [14848 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmdm64.sys [17408 2009-09-29] (LG Electronics Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-10-05] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130825.004\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130825.004\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130825.004\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20130825.004\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\0604010.00E\SRTSP64.SYS [737952 2012-07-06] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\0604010.00E\SRTSPX64.SYS [37536 2012-07-06] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\0604010.00E\SYMDS64.SYS [451192 2011-08-16] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\0604010.00E\SYMEFA64.SYS [1129120 2012-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2013-02-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\0604010.00E\Ironx64.SYS [190072 2011-11-16] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\0604010.00E\SYMNETS.SYS [405624 2011-11-16] (Symantec Corporation)
S3 tap0801; C:\Windows\System32\DRIVERS\tap0801.sys [30720 2005-04-13] (The OpenVPN Project)
S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2012-03-02] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [28160 2012-03-02] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [34816 2012-03-02] (LG Electronics Inc.)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2013-08-26] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-25 22:15 - 2013-08-25 22:15 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-25 18:11 - 2013-08-25 18:09 - 01576600 _____ (Farbar) C:\Users\Jakobs\Desktop\FRST64 (1).exe
2013-08-25 18:06 - 2013-08-25 18:06 - 00002905 _____ C:\Users\Jakobs\Desktop\JRT.txt
2013-08-25 18:02 - 2013-08-25 18:02 - 00000000 ____D C:\Windows\ERUNT
2013-08-25 18:01 - 2013-08-25 18:01 - 00017517 _____ C:\Users\Jakobs\Desktop\AdwCleaner[S0].txt
2013-08-25 17:59 - 2013-08-25 18:00 - 00000000 ____D C:\AdwCleaner
2013-08-25 17:58 - 2013-08-25 17:58 - 01021434 _____ (Thisisu) C:\Users\Jakobs\Desktop\JRT.exe
2013-08-25 17:58 - 2013-08-25 17:58 - 00994642 _____ C:\Users\Jakobs\Desktop\adwcleaner.exe
2013-08-24 22:50 - 2013-08-24 22:50 - 00037071 _____ C:\ComboFix.txt
2013-08-24 22:43 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-24 22:43 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-24 22:43 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-24 22:43 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-24 22:42 - 2013-08-24 22:50 - 00000000 ____D C:\Qoobox
2013-08-24 22:42 - 2013-08-24 22:49 - 00000000 ____D C:\Windows\erdnt
2013-08-24 22:41 - 2013-08-24 22:41 - 05111180 ____R (Swearware) C:\Users\Jakobs\Desktop\ComboFix.exe
2013-08-24 13:13 - 2013-08-24 13:13 - 00034573 _____ C:\Users\Jakobs\Desktop\Addition.txt
2013-08-24 13:12 - 2013-08-24 13:12 - 00000000 ____D C:\FRST
2013-08-24 10:18 - 2013-08-24 10:36 - 00145096 _____ C:\Users\Jakobs\Desktop\OTL.Txt
2013-08-24 10:18 - 2013-08-24 10:18 - 00126164 _____ C:\Users\Jakobs\Desktop\Extras.Txt
2013-08-24 10:13 - 2013-08-24 10:12 - 00602112 _____ (OldTimer Tools) C:\Users\Jakobs\Desktop\OTL.exe
2013-08-24 01:01 - 2013-08-24 01:01 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-24 01:01 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-19 22:41 - 2013-08-19 22:41 - 00000000 ____D C:\Users\Jakobs\Documents\Electronic Arts
2013-08-19 22:26 - 2013-08-19 22:26 - 00000927 _____ C:\Users\Public\Desktop\Die Sims™ 3 Late Night.lnk
2013-08-19 22:26 - 2013-08-19 22:26 - 00000867 _____ C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk
2013-08-19 22:24 - 2013-08-19 22:23 - 00447752 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2013-08-19 22:23 - 2013-08-19 22:23 - 00000909 _____ C:\Users\Public\Desktop\Die*Sims™*3.lnk
2013-08-19 21:20 - 2013-08-19 21:21 - 00000000 ____D C:\Users\Jakobs\Documents\Battlefield 3
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Users\Jakobs\AppData\Local\ESN
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-08-19 21:18 - 2013-08-19 21:18 - 00000655 _____ C:\Users\Public\Desktop\Battlefield 3.lnk
2013-08-19 21:09 - 2013-08-19 21:09 - 00003168 _____ C:\Windows\System32\Tasks\{984D6FFE-F118-44EB-8CF2-69CD5E8132FD}
2013-08-19 21:08 - 2013-08-19 21:08 - 00000000 ____D C:\ProgramData\EA Core
2013-08-15 17:48 - 2013-08-15 17:48 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Criterion Games
2013-08-15 10:57 - 2013-08-15 10:57 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-08-15 10:54 - 2013-08-19 21:09 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Origin
2013-08-15 10:54 - 2013-08-15 17:36 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Origin
2013-08-15 10:48 - 2013-08-25 18:15 - 00000000 ____D C:\Program Files (x86)\Origin
2013-08-15 10:48 - 2013-08-19 21:18 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-08-15 10:48 - 2013-08-15 17:38 - 00000000 ____D C:\ProgramData\Origin
2013-08-15 10:48 - 2013-08-15 10:48 - 00000986 _____ C:\Users\Public\Desktop\Origin.lnk
2013-08-15 10:42 - 2013-08-26 10:40 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-08-14 15:55 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 15:55 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 15:55 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 15:55 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 15:55 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 15:55 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 15:55 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 15:55 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-14 15:55 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 15:55 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 15:55 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-14 15:55 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 15:55 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 15:55 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 15:50 - 2013-08-14 15:51 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 12:49 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 12:49 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 12:49 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 12:49 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 12:49 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 12:49 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 12:48 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 12:48 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 12:48 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 12:48 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 12:47 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 12:47 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 12:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 12:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 12:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 12:47 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 12:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 12:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 12:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 12:47 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 12:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 12:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 12:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 12:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 12:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 12:47 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 12:47 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 20:01 - 2013-08-13 21:41 - 00000000 ____D C:\Users\Jakobs\Desktop\eigenes fotoalbum
2013-08-10 20:02 - 2013-08-10 20:02 - 00000000 ____D C:\Users\Jakobs\Desktop\zwergentanz 16.6
2013-08-09 20:12 - 2013-08-09 20:23 - 00000000 ____D C:\Users\Jakobs\Desktop\lieder
2013-08-07 15:24 - 2013-08-07 15:25 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-08-07 13:27 - 2013-08-07 18:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-07 12:53 - 2013-08-09 20:13 - 00000000 ____D C:\Users\Jakobs\Desktop\projekt silberhochzeit
2013-08-04 20:25 - 2013-08-04 21:02 - 00000000 ____D C:\Users\Jakobs\Documents\The Witcher
2013-08-04 20:25 - 2013-08-04 21:02 - 00000000 ____D C:\Users\Jakobs\AppData\Local\The Witcher
2013-08-04 20:24 - 2013-08-04 20:24 - 00000000 ____D C:\Users\Public\Documents\The Witcher
==================== One Month Modified Files and Folders =======
2013-08-26 10:50 - 2013-08-26 10:50 - 00891115 _____ C:\Users\Jakobs\Desktop\SecurityCheck.exe
2013-08-26 10:49 - 2012-07-22 18:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-26 10:48 - 2013-03-27 23:23 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-26 10:48 - 2013-01-19 20:24 - 00000390 ____H C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job
2013-08-26 10:48 - 2012-07-20 19:31 - 00000828 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2013-08-26 10:48 - 2009-07-14 06:45 - 00015648 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-26 10:48 - 2009-07-14 06:45 - 00015648 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-26 10:45 - 2009-07-14 19:58 - 00707088 _____ C:\Windows\system32\perfh007.dat
2013-08-26 10:45 - 2009-07-14 19:58 - 00152680 _____ C:\Windows\system32\perfc007.dat
2013-08-26 10:45 - 2009-07-14 07:13 - 01641292 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-26 10:44 - 2012-07-20 21:46 - 01850854 _____ C:\Windows\WindowsUpdate.log
2013-08-26 10:43 - 2013-03-27 23:23 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-26 10:43 - 2012-10-24 22:19 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000UA.job
2013-08-26 10:40 - 2013-08-15 10:42 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-08-26 10:40 - 2012-07-20 19:34 - 00883572 _____ C:\Windows\PFRO.log
2013-08-26 10:40 - 2012-07-20 19:33 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys
2013-08-26 10:40 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-26 10:40 - 2009-07-14 06:51 - 00198587 _____ C:\Windows\setupact.log
2013-08-26 01:43 - 2012-10-24 22:19 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3798938239-439478928-2569035992-1000Core.job
2013-08-25 22:15 - 2013-08-25 22:15 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-25 18:15 - 2013-08-15 10:48 - 00000000 ____D C:\Program Files (x86)\Origin
2013-08-25 18:09 - 2013-08-25 18:11 - 01576600 _____ (Farbar) C:\Users\Jakobs\Desktop\FRST64 (1).exe
2013-08-25 18:06 - 2013-08-25 18:06 - 00002905 _____ C:\Users\Jakobs\Desktop\JRT.txt
2013-08-25 18:02 - 2013-08-25 18:02 - 00000000 ____D C:\Windows\ERUNT
2013-08-25 18:01 - 2013-08-25 18:01 - 00017517 _____ C:\Users\Jakobs\Desktop\AdwCleaner[S0].txt
2013-08-25 18:00 - 2013-08-25 17:59 - 00000000 ____D C:\AdwCleaner
2013-08-25 17:58 - 2013-08-25 17:58 - 01021434 _____ (Thisisu) C:\Users\Jakobs\Desktop\JRT.exe
2013-08-25 17:58 - 2013-08-25 17:58 - 00994642 _____ C:\Users\Jakobs\Desktop\adwcleaner.exe
2013-08-24 22:50 - 2013-08-24 22:50 - 00037071 _____ C:\ComboFix.txt
2013-08-24 22:50 - 2013-08-24 22:42 - 00000000 ____D C:\Qoobox
2013-08-24 22:49 - 2013-08-24 22:42 - 00000000 ____D C:\Windows\erdnt
2013-08-24 22:48 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-24 22:41 - 2013-08-24 22:41 - 05111180 ____R (Swearware) C:\Users\Jakobs\Desktop\ComboFix.exe
2013-08-24 13:13 - 2013-08-24 13:13 - 00034573 _____ C:\Users\Jakobs\Desktop\Addition.txt
2013-08-24 13:12 - 2013-08-24 13:12 - 00000000 ____D C:\FRST
2013-08-24 13:09 - 2012-07-20 19:31 - 00000830 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2013-08-24 10:36 - 2013-08-24 10:18 - 00145096 _____ C:\Users\Jakobs\Desktop\OTL.Txt
2013-08-24 10:18 - 2013-08-24 10:18 - 00126164 _____ C:\Users\Jakobs\Desktop\Extras.Txt
2013-08-24 10:12 - 2013-08-24 10:13 - 00602112 _____ (OldTimer Tools) C:\Users\Jakobs\Desktop\OTL.exe
2013-08-24 01:01 - 2013-08-24 01:01 - 00001116 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-24 01:01 - 2013-08-24 01:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-23 23:51 - 2012-07-22 18:32 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-23 23:51 - 2012-07-22 18:32 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-23 23:51 - 2012-07-20 23:15 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-20 10:55 - 2013-05-08 18:05 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-08-20 10:55 - 2012-07-22 22:10 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-08-19 22:41 - 2013-08-19 22:41 - 00000000 ____D C:\Users\Jakobs\Documents\Electronic Arts
2013-08-19 22:26 - 2013-08-19 22:26 - 00000927 _____ C:\Users\Public\Desktop\Die Sims™ 3 Late Night.lnk
2013-08-19 22:26 - 2013-08-19 22:26 - 00000867 _____ C:\Users\Public\Desktop\Die Sims™ 3 Luxus-Accessoires.lnk
2013-08-19 22:26 - 2012-07-21 01:36 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-19 22:23 - 2013-08-19 22:24 - 00447752 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2013-08-19 22:23 - 2013-08-19 22:23 - 00000909 _____ C:\Users\Public\Desktop\Die*Sims™*3.lnk
2013-08-19 21:21 - 2013-08-19 21:20 - 00000000 ____D C:\Users\Jakobs\Documents\Battlefield 3
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Users\Jakobs\AppData\Local\ESN
2013-08-19 21:20 - 2013-08-19 21:20 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-08-19 21:20 - 2013-05-08 18:05 - 00000000 ____D C:\Users\Jakobs\AppData\Local\PunkBuster
2013-08-19 21:20 - 2012-07-22 22:10 - 00280904 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-08-19 21:18 - 2013-08-19 21:18 - 00000655 _____ C:\Users\Public\Desktop\Battlefield 3.lnk
2013-08-19 21:18 - 2013-08-15 10:48 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-08-19 21:18 - 2012-07-22 22:10 - 00075136 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-08-19 21:17 - 2012-07-22 22:01 - 00317097 _____ C:\Windows\DirectX.log
2013-08-19 21:09 - 2013-08-19 21:09 - 00003168 _____ C:\Windows\System32\Tasks\{984D6FFE-F118-44EB-8CF2-69CD5E8132FD}
2013-08-19 21:09 - 2013-08-15 10:54 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Origin
2013-08-19 21:08 - 2013-08-19 21:08 - 00000000 ____D C:\ProgramData\EA Core
2013-08-15 17:48 - 2013-08-15 17:48 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Criterion Games
2013-08-15 17:38 - 2013-08-15 10:48 - 00000000 ____D C:\ProgramData\Origin
2013-08-15 17:36 - 2013-08-15 10:54 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Origin
2013-08-15 11:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 10:57 - 2013-08-15 10:57 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-08-15 10:48 - 2013-08-15 10:48 - 00000986 _____ C:\Users\Public\Desktop\Origin.lnk
2013-08-14 15:52 - 2012-07-20 23:56 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-14 15:51 - 2013-08-14 15:50 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 15:50 - 2012-09-03 22:26 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-13 21:41 - 2013-08-13 20:01 - 00000000 ____D C:\Users\Jakobs\Desktop\eigenes fotoalbum
2013-08-13 12:47 - 2012-07-21 19:30 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\vlc
2013-08-13 10:58 - 2013-01-10 19:39 - 00000000 ____D C:\Users\Jakobs\Documents\Adobe
2013-08-13 10:58 - 2012-07-20 19:35 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\Adobe
2013-08-13 10:17 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-10 20:02 - 2013-08-10 20:02 - 00000000 ____D C:\Users\Jakobs\Desktop\zwergentanz 16.6
2013-08-09 20:23 - 2013-08-09 20:12 - 00000000 ____D C:\Users\Jakobs\Desktop\lieder
2013-08-09 20:13 - 2013-08-07 12:53 - 00000000 ____D C:\Users\Jakobs\Desktop\projekt silberhochzeit
2013-08-09 13:22 - 2012-07-20 19:36 - 00000000 ____D C:\Users\Jakobs\AppData\Local\CrashDumps
2013-08-08 12:17 - 2012-07-20 22:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-07 18:27 - 2013-08-07 13:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-07 15:25 - 2013-08-07 15:24 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-08-07 15:24 - 2012-10-03 11:32 - 00000000 ____D C:\Users\Jakobs\AppData\Roaming\DVDVideoSoft
2013-08-07 13:10 - 2012-12-23 23:26 - 00019456 ____H C:\Users\Jakobs\Desktop\photothumb.db
2013-08-05 13:26 - 2012-07-22 22:12 - 00000000 ____D C:\Users\Jakobs\Documents\My Games
2013-08-05 10:56 - 2012-07-21 19:42 - 00000000 ____D C:\Users\Jakobs\AppData\Local\Adobe
2013-08-04 21:02 - 2013-08-04 20:25 - 00000000 ____D C:\Users\Jakobs\Documents\The Witcher
2013-08-04 21:02 - 2013-08-04 20:25 - 00000000 ____D C:\Users\Jakobs\AppData\Local\The Witcher
2013-08-04 20:24 - 2013-08-04 20:24 - 00000000 ____D C:\Users\Public\Documents\The Witcher
2013-08-03 19:52 - 2013-03-27 23:23 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-03 19:45 - 2013-07-01 22:28 - 00002378 _____ C:\Users\Jakobs\Desktop\Google Chrome.lnk
Files to move or delete:
====================
C:\Users\Jakobs\jagex_cl_loginapplet_LIVE.dat
C:\Users\Jakobs\jagex_cl_runescape_LIVE.dat
C:\Users\Jakobs\random.dat
C:\Users\Jakobs\AppData\Local\Temp\RarSFX0\SecurityCheck\Objlist.exe
C:\Users\Jakobs\AppData\Local\Temp\RarSFX0\SecurityCheck\runprocesses.exe
C:\Users\Jakobs\AppData\Local\Temp\RarSFX0\SecurityCheck\uninstalllist.exe
C:\Users\Jakobs\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\cmdinfo.exe
C:\Users\Jakobs\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\nircmdc.exe
C:\Users\Jakobs\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\sed.exe
C:\Users\Jakobs\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\swreg.exe
C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-24 02:47
==================== End Of Log ============================
--- --- --- --- --- --- Probleme habe ich glaub keine mehr, also snap.do ist nicht mehr in meinem chrome enthalten, allerdings versucht chrome statt dem "new tab" den Ort "chrome-extension://amfclgb..." zu öffnen (Erfolglos).. vermutlich muss ich Chrome einfach nur neuinstallieren? Achso und der ESET hat aber glaube ich noch 15 Threads angezeigt, wie soll ich mit denen verfahren? Danke für deine Hilfe |
|
26.08.2013, 13:30
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Snap.do lässt sich nicht entfernen Machen wir jetzt. Adobe updaten. Firefox und Chrome deinstallieren, keine Daten behalten, neu installieren. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\ProgramData\fewmzlmvthdkexs
C:\Users\All Users\fewmzlmvthdkexs
C:\Users\Jakobs\jagex_cl_loginapplet_LIVE.dat
C:\Users\Jakobs\jagex_cl_runescape_LIVE.dat
C:\Users\Jakobs\random.dat
C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.08.2013, 14:11
| #11 |
| | Windows 7: Snap.do lässt sich nicht entfernenCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-08-2013 01
Ran by Jakobs at 2013-08-26 15:09:28 Run:1
Running from C:\Users\Jakobs\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\ProgramData\fewmzlmvthdkexs
C:\Users\All Users\fewmzlmvthdkexs
C:\Users\Jakobs\jagex_cl_loginapplet_LIVE.dat
C:\Users\Jakobs\jagex_cl_runescape_LIVE.dat
C:\Users\Jakobs\random.dat
C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job
*****************
C:\ProgramData\fewmzlmvthdkexs => Moved successfully.
"C:\Users\All Users\fewmzlmvthdkexs" => File/Directory not found.
C:\Users\Jakobs\jagex_cl_loginapplet_LIVE.dat => Moved successfully.
C:\Users\Jakobs\jagex_cl_runescape_LIVE.dat => Moved successfully.
C:\Users\Jakobs\random.dat => Moved successfully.
C:\Windows\Tasks\{FA3B3E81-B10F-4550-A4B3-343259F3C23B}.job => Moved successfully.
==== End of Fixlog ====
|
|
26.08.2013, 18:01
| #12 |
| /// the machine /// TB-Ausbilder | Windows 7: Snap.do lässt sich nicht entfernen Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.08.2013, 19:01
| #13 |
| | Windows 7: Snap.do lässt sich nicht entfernen Alles klar kann geschlossen werden. Danke vielmals für diese super Hilfe |
|
27.08.2013, 09:45
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7: Snap.do lässt sich nicht entfernen Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
