| |
| |||||||
Log-Analyse und Auswertung: Windows 7 Avira Fund: adware/bprotect.dWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
09.09.2013, 21:52
| #1 |
 |  Windows 7 Avira Fund: adware/bprotect.d Hallo. Seit ein paar Tagen erhalte ich ständig Meldungen von AVIRA: In der Datei 'C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll' wurde ein Virus oder unerwünschtes Programm 'ADWARE/bProtect.D' [adware] gefunden. Ich habe die allgemeinen Anweisungen befolgt und dies sind die Logs (habe zusätzlich die MBAM-Logdatei und das Avira-Ereignisfile beigefügt, wobei ich von dem Aviraeintrag mittlerweile 200 Stück habe): Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:47 on 09/09/2013 (g780)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-09-2013 01
Ran by g780 (administrator) on G780-PC on 09-09-2013 20:50:32
Running from C:\Users\g780\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
() C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\Bluetooth Headset Helper.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
() C:\Users\g780\Downloads\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [564352 2011-12-15] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2809856 2012-01-16] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-07-03] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6202416 2012-07-03] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo EE Boot Optimizer] - C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-07-03] (Lenovo)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [IntelliType Pro] - c:\Program Files\Microsoft Device Center\itype.exe [1464928 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] - c:\Program Files\Microsoft Device Center\ipoint.exe [2004584 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [XboxStat] - C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
MountPoints2: E - E:\AutoRun.exe
MountPoints2: {47135bd0-c51d-11e1-865c-806e6f6e6963} - F:\Start.exe
MountPoints2: {7b322d3e-5d51-11e2-9895-dc0ea1fa6236} - E:\Startme.exe
MountPoints2: {a50f3e1c-dfcf-11e2-a2c4-c01885d29ca2} - E:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [332BigDog] - C:\Program Files (x86)\USB Camera2\VM332_STI.EXE [548864 2011-12-09] (Vimicro)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Lenovo Registration] - C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2012-01-26] (Lenovo, Inc.)
HKLM-x32\...\Run: [YouCam Mirage] - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-28] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] - C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-28] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.)
HKLM-x32\...\Run: [VeriFaceManager] - C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-07-03] (Lenovo)
HKLM-x32\...\Run: [UpdatePRCShortCut] - C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [LockKey] - C:\Program Files (x86)\LockKey\LockKey.exe [337776 2011-08-25] ( )
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [Lenovo.ShowBand] - C:\Program Files\Lenovo\SimpleTap DeskBand\ShowBand.exe [52584 2013-05-17] (Lenovo)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [260928 2012-05-01] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190\{c16c1~1\browse~1.dll [2691536 2013-07-26] ()
Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=119776&babsrc=HP_ss_din2g&mntrId=CE17C01885D29CA1
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?affID=119776&babsrc=HP_ss_din2g&mntrId=CE17C01885D29CA1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=CE17C01885D29CA1
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.10.0\bh\delta.dll (Delta-search.com)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MyEmoticons Class - {DCC39ACE-709B-44EA-B062-5F6BE2774644} - C:\Users\g780\AppData\Roaming\MyEmoticons\myemoticons-1.6.1.dll (GreenTree Applications)
BHO-x32: smartdownloader Class - {F1AF26F8-1828-4279-ABCE-074EF3235BD7} - C:\Program Files (x86)\PutLockerDownloader\smarterdownloader.dll No File
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.10.0\deltaTlbr.dll (Delta-search.com)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4
FireFox:
========
FF ProfilePath: C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default
FF user.js: detected! => C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\user.js
FF SearchEngineOrder.1: Delta Search
FF Homepage: https://www.facebook.com/|hxxp://www.funkysnooker.com/forums
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\searchplugins\BrowserProtect.xml
FF SearchPlugin: C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\searchplugins\delta.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Ghostery - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\firefox@ghostery.com
FF Extension: LavaFox V2 - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\info@djzig.com
FF Extension: No Name - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\staged
FF Extension: DivXWebPlayer - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\DivXWebPlayer@divx.com.xpi
FF Extension: firefox - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\firefox@ghostery.com.xpi
FF Extension: No Name - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [myemoticons@myemoticons.com] C:\Users\g780\AppData\Roaming\MyEmoticons\myemoticons@myemoticons.com-1.6.1
FF Extension: MyEmoticons - C:\Users\g780\AppData\Roaming\MyEmoticons\myemoticons@myemoticons.com-1.6.1
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 BrowserProtect; C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2847696 2013-07-26] ()
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [945440 2012-02-01] (Broadcom Corporation.)
S4 DamageGuardSvc; C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [572976 2012-03-26] (Lenovo (Beijing) Limited)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2012-11-07] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-31] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
S4 DamageGuard; C:\Windows\System32\DRIVERS\DamageGuardX64.sys [217392 2012-02-10] (Lenovo)
S4 dgFltr; C:\Windows\System32\drivers\dgFltrX64.sys [23648 2011-12-13] (Lenovo)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104048 2012-03-02] (Qualcomm Atheros Co., Ltd.)
R3 UHSfiltv; C:\Windows\System32\drivers\UHSfiltv.sys [23552 2012-09-28] (Creative Technology Ltd.)
S3 zte_cdc_acm; C:\Windows\System32\DRIVERS\zte_cdc_acm.sys [79872 2011-04-14] (ZTE)
S3 zte_cdc_ecm; C:\Windows\System32\DRIVERS\zte_cdc_ecm.sys [36864 2011-04-14] (ZTE)
S3 zte_cpo; C:\Windows\System32\DRIVERS\zte_cpo.sys [14336 2011-04-14] (ZTE)
S3 zte_ecm_enum; C:\Windows\System32\DRIVERS\zte_ecm_enum.sys [55808 2011-04-14] (ZTE)
S3 zte_ecm_enum_filter; C:\Windows\System32\DRIVERS\zte_ecm_enum_filter.sys [55808 2011-04-14] (ZTE)
U3 BcmSqlStartupSvc;
U2 CLKMSVC10_3A60B698;
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
U2 IviRegMgr;
U2 Oasis2Service;
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SeaPort;
U2 SoftwareService;
U3 SQLWriter;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-09 20:49 - 2013-09-09 20:49 - 01949196 _____ (Farbar) C:\Users\g780\Downloads\FRST64.exe
2013-09-09 20:47 - 2013-09-09 20:47 - 00000470 _____ C:\Users\g780\Downloads\defogger_disable.log
2013-09-09 20:47 - 2013-09-09 20:47 - 00000000 _____ C:\Users\g780\defogger_reenable
2013-09-09 20:45 - 2013-09-09 20:45 - 00050477 _____ C:\Users\g780\Downloads\Defogger.exe
2013-09-06 18:59 - 2013-09-09 19:12 - 96732368 _____ C:\Windows\SysWOW64\Ŷ崫�‡
2013-09-06 18:57 - 2013-09-06 18:57 - 00000000 ____D C:\Users\g780\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-05 08:38 - 2013-09-05 08:39 - 00006526 _____ C:\Users\g780\Desktop\6O4EZJ.txt
2013-08-31 21:06 - 2013-08-31 21:06 - 00000000 ____D C:\Users\g780\AppData\Local\{F8FE575E-E5F5-4967-B4FA-D9E95310428D}
2013-08-31 21:04 - 2013-08-31 21:04 - 00000000 ____D C:\Users\g780\Desktop\Neuer Ordner
2013-08-28 05:15 - 2013-09-05 20:51 - 00003432 _____ C:\Windows\System32\Tasks\BrowserProtect
2013-08-25 20:53 - 2013-08-25 20:54 - 00309248 _____ (Microsoft Corporation) C:\Users\g780\Downloads\wmpfirefoxplugin.exe
2013-08-25 06:30 - 2013-08-25 06:30 - 13503963 _____ C:\Users\g780\Downloads\Supersoma.zip
2013-08-25 06:29 - 2013-08-25 06:32 - 87154461 _____ C:\Users\g780\Downloads\Glenn Hughes- Underground Nuclear Kitchen.zip
2013-08-21 11:07 - 2013-08-21 11:07 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-08-20 22:06 - 2013-08-20 22:06 - 00001299 _____ C:\Users\Public\Desktop\Paint.NET.lnk
2013-08-14 03:00 - 2013-07-25 05:54 - 17830400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 03:00 - 2013-07-25 05:37 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 03:00 - 2013-07-25 05:35 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 03:00 - 2013-07-25 05:31 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 03:00 - 2013-07-25 05:30 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 03:00 - 2013-07-25 05:29 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-14 03:00 - 2013-07-25 05:29 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-14 03:00 - 2013-07-25 05:29 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-14 03:00 - 2013-07-25 05:27 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 03:00 - 2013-07-25 05:27 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-14 03:00 - 2013-07-25 05:26 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 03:00 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 03:00 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 03:00 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 03:00 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 03:00 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 03:00 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-14 03:00 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-14 03:00 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-14 03:00 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 03:00 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 03:00 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-14 02:52 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 02:52 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 02:52 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 02:52 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 02:52 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 02:52 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 02:52 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 02:52 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 02:51 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 02:51 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 02:51 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 02:51 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 02:51 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 02:51 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 02:51 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 02:51 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 02:51 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 02:51 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 02:51 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 02:51 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 02:51 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 02:51 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 02:51 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 02:51 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 02:51 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 02:51 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 02:51 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
==================== One Month Modified Files and Folders =======
2013-09-09 20:50 - 2013-09-09 20:50 - 00000000 ____D C:\FRST
2013-09-09 20:49 - 2013-09-09 20:49 - 01949196 _____ (Farbar) C:\Users\g780\Downloads\FRST64.exe
2013-09-09 20:47 - 2013-09-09 20:47 - 00000470 _____ C:\Users\g780\Downloads\defogger_disable.log
2013-09-09 20:47 - 2013-09-09 20:47 - 00000000 _____ C:\Users\g780\defogger_reenable
2013-09-09 20:47 - 2012-08-10 14:31 - 00000000 ____D C:\Users\g780
2013-09-09 20:45 - 2013-09-09 20:45 - 00050477 _____ C:\Users\g780\Downloads\Defogger.exe
2013-09-09 20:42 - 2012-08-26 18:41 - 00000000 ____D C:\Users\g780\AppData\Roaming\Skype
2013-09-09 20:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing
2013-09-09 20:15 - 2012-07-03 16:30 - 01168934 _____ C:\Windows\WindowsUpdate.log
2013-09-09 20:13 - 2012-07-03 17:15 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-09 20:11 - 2012-08-25 22:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-09 20:01 - 2012-11-06 05:07 - 00043534 _____ C:\Windows\setupact.log
2013-09-09 19:15 - 2012-07-04 02:14 - 00698078 _____ C:\Windows\system32\perfh007.dat
2013-09-09 19:15 - 2012-07-04 02:14 - 00153138 _____ C:\Windows\system32\perfc007.dat
2013-09-09 19:15 - 2009-07-14 07:13 - 01645110 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-09 19:12 - 2013-09-06 18:59 - 96732368 _____ C:\Windows\SysWOW64\Ŷ崫�‡
2013-09-09 19:12 - 2012-08-10 14:31 - 01642542 _____ C:\FaceProv.log
2013-09-09 19:12 - 2012-07-03 17:15 - 00000000 ____D C:\ProgramData\VeriFace
2013-09-08 22:21 - 2012-08-28 11:21 - 00000000 ____D C:\Users\g780\AppData\Local\Paint.NET
2013-09-06 19:13 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-06 19:13 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-06 18:57 - 2013-09-06 18:57 - 00000000 ____D C:\Users\g780\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-05 20:52 - 2012-07-03 17:17 - 00616509 _____ C:\Windows\system32\fastboot.set
2013-09-05 20:52 - 2012-07-03 17:15 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-05 20:51 - 2013-08-28 05:15 - 00003432 _____ C:\Windows\System32\Tasks\BrowserProtect
2013-09-05 20:51 - 2013-07-28 09:09 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-09-05 20:51 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-05 08:39 - 2013-09-05 08:38 - 00006526 _____ C:\Users\g780\Desktop\6O4EZJ.txt
2013-09-03 20:17 - 2012-08-26 20:45 - 00000000 ____D C:\Users\g780\AppData\Roaming\PlayCatanClient
2013-09-02 17:42 - 2012-08-10 14:35 - 00067504 _____ C:\Users\g780\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-02 14:39 - 2012-08-17 15:52 - 00000000 ____D C:\Users\g780\AppData\Roaming\SoftGrid Client
2013-09-02 14:30 - 2013-05-02 11:39 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-02 14:30 - 2013-03-31 10:26 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-02 14:30 - 2013-03-31 10:26 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-31 21:06 - 2013-08-31 21:06 - 00000000 ____D C:\Users\g780\AppData\Local\{F8FE575E-E5F5-4967-B4FA-D9E95310428D}
2013-08-31 21:04 - 2013-08-31 21:04 - 00000000 ____D C:\Users\g780\Desktop\Neuer Ordner
2013-08-28 21:02 - 2012-09-29 22:29 - 00580096 ___SH C:\Users\g780\Desktop\Thumbs.db
2013-08-28 16:55 - 2013-06-28 10:56 - 00000000 ____D C:\Program Files (x86)\Connect Manager
2013-08-27 05:08 - 2012-08-25 22:04 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-27 05:08 - 2012-08-25 22:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-26 14:02 - 2012-08-26 21:47 - 00000000 ____D C:\ldiag
2013-08-25 20:55 - 2013-03-09 09:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-25 20:54 - 2013-08-25 20:53 - 00309248 _____ (Microsoft Corporation) C:\Users\g780\Downloads\wmpfirefoxplugin.exe
2013-08-25 06:32 - 2013-08-25 06:29 - 87154461 _____ C:\Users\g780\Downloads\Glenn Hughes- Underground Nuclear Kitchen.zip
2013-08-25 06:30 - 2013-08-25 06:30 - 13503963 _____ C:\Users\g780\Downloads\Supersoma.zip
2013-08-21 17:01 - 2012-10-19 21:15 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-08-21 11:07 - 2013-08-21 11:07 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-08-20 22:06 - 2013-08-20 22:06 - 00001299 _____ C:\Users\Public\Desktop\Paint.NET.lnk
2013-08-20 22:06 - 2012-08-28 11:21 - 00000000 ____D C:\Program Files\Paint.NET
2013-08-19 08:24 - 2012-08-25 18:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-14 04:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-14 03:03 - 2013-07-23 05:41 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 03:02 - 2012-08-31 21:56 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\Users\g780\AppData\Local\Temp\detectionapi_rd.dll
C:\Users\g780\AppData\Local\Temp\detectionui_r.exe
C:\Users\g780\AppData\Local\Temp\directx9tests_rd.dll
C:\Users\g780\AppData\Local\Temp\drm_dialogs.dll
C:\Users\g780\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\g780\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\g780\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\g780\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\g780\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\g780\AppData\Local\Temp\local.dll
C:\Users\g780\AppData\Local\Temp\mfc80.dll
C:\Users\g780\AppData\Local\Temp\mfc80u.dll
C:\Users\g780\AppData\Local\Temp\MSETUP4.EXE
C:\Users\g780\AppData\Local\Temp\msvcp80.dll
C:\Users\g780\AppData\Local\Temp\msvcr80.dll
C:\Users\g780\AppData\Local\Temp\setup_fsu_cid.exe
C:\Users\g780\AppData\Local\Temp\Shockwave_Installer_FF.exe
C:\Users\g780\AppData\Local\Temp\SIInvoker.exe
C:\Users\g780\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-02 00:13
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-09-2013 01
Ran by g780 at 2013-09-09 20:51:08
Running from C:\Users\g780\Downloads
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
7-Zip 9.20 (x32)
Adobe AIR (x32 Version: 3.7.0.1530)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.3.133)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.14.15)
Audacity 2.0.2 (x32 Version: 2.0.2)
Avira Free Antivirus (x32 Version: 13.0.0.4052)
Benutzerhandbuch (x32 Version: 1.0.0.6)
BrowserProtect (x32)
Canon MP Navigator EX 3.0 (x32)
Canon MP550 series Benutzerregistrierung (x32)
Canon MP550 series MP Drivers
Canon Utilities Easy-PhotoPrint EX (x32)
Canon Utilities My Printer (x32)
Canon Utilities Solution Menu (x32)
Cole2k Media - Codec Pack (Advanced) 7.9.5 (x32)
Conexant HD Audio (Version: 8.54.32.50)
Creative Systeminformationen (x32 Version: 1.10)
Crysis(R) (x32 Version: 1.00.0000)
D3DX10 (x32 Version: 15.4.2368.0902)
Default (x32 Version: 1.0.0.1)
Delta Chrome Toolbar (x32)
Delta toolbar (x32 Version: 1.8.10.0)
DiRT 3 (x32 Version: 1.0.0000.130)
Dishonored (x32 Version: 1.0)
Dolby Advanced Audio v2 (x32 Version: 7.2.7000.11)
dows-Treiberpaket - Lenovo (ACPIVPC) System (12/15/2011 7.1.0.1) (Version: 12/15/2011 7.1.0.1)
Êîííåêò Ìåíåäæåð (x32 Version: 1.0.0.1)
Energy Management (x32 Version: 7.0.4.1)
ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0)
Google Chrome (x32 Version: 12.0.742.112)
Google Update Helper (x32 Version: 1.3.21.115)
HDVidCodec (x32 Version: 2.1 Build 26473)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 8.0.3.1427)
Intel(R) OpenCL CPU Runtime (x32)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2656)
Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.220)
Intel® Trusted Connect Service Client (Version: 1.23.605.1)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Lenovo Bluetooth with Enhanced Data Rate Software (Version: 6.5.1.2300)
Lenovo EasyCamera (x32 Version: 1.12.204.1)
Lenovo EE Boot Optimizer (Version: 0.0.1.9)
Lenovo OneKey Recovery (Version: 7.0.0.3712)
Lenovo OneKey Recovery (x32 Version: 7.0.0.3712)
Lenovo pointing device (Version: 10.4.2.8)
Lenovo Registration (x32 Version: 1.0.4)
Lenovo Solution Center (Version: 2.1.003.00)
Lenovo Welcome (x32 Version: 3.1.0011.00)
Lenovo YouCam (x32 Version: 3.1.3728)
Lenovo_Wireless_Driver (x32 Version: 1.02.01)
LockKey (x32 Version: 1.38.1.2)
Mesh Runtime (x32 Version: 15.4.5722.2)
Metro 2033 (x32)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.5139.5005)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Xbox 360 Accessories 1.2 (Version: 1.20.146.0)
Microsoft-Maus- und Tastatur-Center (Version: 1.1.500.0)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MyEmoticons (HKCU Version: 1.6.1.0)
NVIDIA Grafiktreiber 296.73 (Version: 296.73)
NVIDIA Install Application (Version: 2.1002.62.312)
NVIDIA Optimus 1.7.13 (Version: 1.7.13)
NVIDIA PhysX (x32 Version: 9.12.0213)
NVIDIA PhysX-Systemsoftware 9.12.0213 (Version: 9.12.0213)
NVIDIA Systemsteuerung 296.73 (Version: 296.73)
NVIDIA Update 1.7.13 (Version: 1.7.13)
NVIDIA Update Components (Version: 1.7.13)
OpenAL (x32)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Paint.NET v3.5.11 (Version: 3.61.0)
PlayCatan Zugangssoftware (x32 Version: 3.986)
Power2Go (x32 Version: 5.6.0.7303)
PunkBuster Services (x32 Version: 0.986)
Rapture3D 2.4.8 Game (x32)
Realtek USB 2.0 Reader Driver (x32 Version: 6.1.7601.39016)
Skype™ 6.6 (x32 Version: 6.6.106)
Sound Blaster Tactic(3D) (x32 Version: 1.0)
Steam (x32 Version: 1.0.0.0)
SugarSync Manager (x32 Version: 1.9.49.86082)
swMSM (x32 Version: 12.0.0.1)
The Walking Dead (x32 Version: 1.0.0.15)
Tom Clancy's H.A.W.X (x32 Version: 1.02.00000)
Trials 2 Second Edition (x32)
Trine 1.08 (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
UserGuide (x32 Version: 1.0.0.6)
VeriFace (x32 Version: 4.0.1.1230)
VLC media player 2.0.5 (x32 Version: 2.0.5)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Family Safety (Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
==================== Restore Points =========================
20-08-2013 16:23:17 Windows Update
20-08-2013 20:05:43 Paint.NET v3.5.11
25-08-2013 18:54:52 Installed Windows Media Player Firefox Plugin
27-08-2013 20:48:53 Windows Update
03-09-2013 18:14:01 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {42F7A825-F686-4038-BC6E-00A6A11E5196} - System32\Tasks\EPUpdater => C:\Users\g780\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-06-06] ()
Task: {4473C5FF-170B-4411-9352-CFA9E082C7DD} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2102161896-4051846735-262110208-1001
Task: {47191513-17F6-4F18-9F2D-1F733B0C2CFD} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2011-01-28] (CyberLink)
Task: {51BECAB5-1E23-4544-AED3-2050294FCB8B} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => c:\Program Files\Microsoft Device Center\devicecenter.exe [2012-06-26] (Microsoft)
Task: {57552C8B-70F6-4DA6-A16D-B77665088720} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe [2013-05-28] (Adobe Systems Incorporated)
Task: {6505A7E4-62AB-48E7-9A2A-96722C0E59A1} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {68F27B76-5914-4335-AF9D-FD2B0CA343D6} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe [2013-05-28] (Adobe Systems Incorporated)
Task: {77CF39DC-21C8-4C8E-B715-91076D6DEDE5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-03] (Google Inc.)
Task: {7FA26EDE-3E21-48C0-9F99-237BD64AE9A4} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect
Task: {954B25C8-1431-44C7-B94B-F973BF7B6739} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-28] (Adobe Systems Incorporated)
Task: {974C2CEF-FCFD-4740-AF01-88884530DA27} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {A3140D98-8C35-4013-A20F-AB7F90AE20BD} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {B2EEF8A8-035D-470D-A41A-598623CFD684} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Device Center\ipoint.exe [2012-06-26] (Microsoft Corporation)
Task: {B4AD9958-EEB9-4BB9-BA07-5B237B03ED56} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {CDF018CC-69B7-4C0A-873A-DC1EF055E8EE} - System32\Tasks\OFFICE2010ACT => C:\Windows\system32\OFFICEICON.vbs [2012-02-23] ()
Task: {D1E1C806-C71C-48D2-B28A-A5397D4F2BFD} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Device Center\itype.exe [2012-06-26] (Microsoft Corporation)
Task: {D834057B-68B5-4A85-9B3D-AAED186A5715} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {F5F9AF4D-5906-4741-B939-75EAA4C6318A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-03] (Google Inc.)
Task: {FED401C9-CAD1-4C78-8CB6-280A7B5F15E5} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-05-17] ()
Task: {FFDB2353-3C83-4DDD-8A8A-9C76F660AD73} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-05-17] (Lenovo)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-07-03 16:47 - 2012-05-01 16:00 - 00260928 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2012-02-15 00:52 - 2012-02-15 00:52 - 00463952 _____ (SugarSync, Inc.) C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll
2012-07-03 17:15 - 2012-07-03 17:15 - 01508192 _____ () C:\Windows\system32\IcnOvrly.dll
2008-12-20 03:20 - 2012-07-03 17:16 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-04-19 16:22 - 2012-07-03 17:16 - 01516592 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 16:31 - 2012-07-03 17:16 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 03:20 - 2012-07-03 17:16 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2012-03-19 22:18 - 2012-03-19 22:18 - 00439296 _____ (Intel Corporation) C:\Windows\system32\igfxrRUS.lrc
2012-05-16 07:26 - 2012-02-17 18:21 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2009-07-14 02:09 - 2009-07-14 03:38 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\irprops.cpl
2011-12-20 17:01 - 2011-12-20 17:01 - 01079648 _____ (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4c.dll
2011-12-20 17:01 - 2011-12-20 17:01 - 00034656 _____ (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\Dolby.Interop.dll
2012-03-15 02:33 - 2011-12-15 07:16 - 00120160 _____ (Dolby Laboratories) C:\Windows\system32\EEA64A.dll
2011-12-20 17:00 - 2011-12-20 17:00 - 00030560 _____ (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\de\pcee4c.resources.dll
2013-08-01 17:26 - 2013-07-26 12:10 - 02691536 _____ () C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll
2013-08-14 03:36 - 2013-08-14 03:36 - 00487424 _____ (Intel Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\d4493b0e5a5c6faf89cfeaa5f2a21034\IAStorUtil.ni.dll
2013-07-11 08:11 - 2013-07-11 08:11 - 00014336 _____ (Intel Corp.) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\6e3778958a8bfd03bf0f2f60c4e25623\IAStorCommon.ni.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\Ksproxy.ax
2012-07-03 17:15 - 2012-07-03 17:15 - 00013664 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2012-11-05 10:59 - 2013-09-02 14:29 - 00055352 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cfglib.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00349752 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccguard.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00029240 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgrdrc.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00229432 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgrdw.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00419384 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccwgrd.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00807992 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgen.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00049720 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccgenrc.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00220216 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccupdate.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00028728 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccupdrc.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00083000 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cclic.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00009784 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\cclicrc.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00237624 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmsg.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00010296 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmsgrc.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00014392 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\ccmainrc.dll
2012-11-05 10:59 - 2013-09-02 14:30 - 00218168 _____ (Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\gpipc.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00320000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WINSPOOL.DRV
2013-03-09 09:34 - 2013-08-18 08:49 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-06-21 10:44 - 2013-06-21 10:44 - 00088680 ____R (Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax
2010-11-21 05:24 - 2010-11-21 05:24 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kswdmcap.ax
2009-07-14 01:51 - 2009-07-14 03:14 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vidcap.ax
2013-08-27 05:08 - 2013-08-27 05:08 - 16166280 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll
==================== Alternate Data Streams (whitelisted) ==========
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/09/2013 08:11:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x13d8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
Error: (09/09/2013 07:12:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x1b84
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
Error: (09/09/2013 01:11:02 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x18f8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
Error: (09/09/2013 00:11:02 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x1018
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
Error: (09/08/2013 11:11:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x1ffc
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
Error: (09/08/2013 10:11:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x1f8c
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
Error: (09/08/2013 09:11:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x1810
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
Error: (09/08/2013 08:15:12 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x1dd8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
Error: (09/06/2013 11:11:00 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x494
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
Error: (09/06/2013 10:11:01 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerUpdateService.exe, Version: 11.6.602.180, Zeitstempel: 0x51a4ab8c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db9710
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e243
ID des fehlerhaften Prozesses: 0x600
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerUpdateService.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerUpdateService.exe1
Pfad des fehlerhaften Moduls: FlashPlayerUpdateService.exe2
Berichtskennung: FlashPlayerUpdateService.exe3
System errors:
=============
Error: (09/05/2013 08:56:08 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/05/2013 08:56:08 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Google Update-Dienst (gupdate) erreicht.
Error: (09/05/2013 08:54:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (09/05/2013 08:54:04 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (09/05/2013 08:54:03 PM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (09/04/2013 03:04:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/04/2013 03:04:11 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Google Update-Dienst (gupdate) erreicht.
Error: (09/03/2013 08:11:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/03/2013 08:11:25 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Google Update-Dienst (gupdate) erreicht.
Error: (09/03/2013 08:09:18 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
Error: (09/09/2013 08:11:01 PM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e24313d801cead87f012ad93C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dll2e7eca5a-197b-11e3-9208-c01885d29ca2
Error: (09/09/2013 07:12:10 PM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e2431b8401cead7faa6880b8C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dllf5d7c168-1972-11e3-9208-c01885d29ca2
Error: (09/09/2013 01:11:02 AM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e24318f801ceace8ae96d5ceC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dlled7fe80c-18db-11e3-9208-c01885d29ca2
Error: (09/09/2013 00:11:02 AM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e243101801ceace04cd2ba5dC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dll8bbd533a-18d3-11e3-9208-c01885d29ca2
Error: (09/08/2013 11:11:02 PM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e2431ffc01ceacd7eb0e9eebC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dll29fdcba9-18cb-11e3-9208-c01885d29ca2
Error: (09/08/2013 10:11:01 PM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e2431f8c01ceaccf892f2d4cC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dllc79110bc-18c2-11e3-9208-c01885d29ca2
Error: (09/08/2013 09:11:01 PM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e243181001ceacc7276cb690C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dll65e66523-18ba-11e3-9208-c01885d29ca2
Error: (09/08/2013 08:15:12 PM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e2431dd801ceacbf5be35b2dC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dll9a0f6043-18b2-11e3-9208-c01885d29ca2
Error: (09/06/2013 11:11:00 PM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e24349401ceab45961fb835C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dlld3ee80b8-1738-11e3-9208-c01885d29ca2
Error: (09/06/2013 10:11:01 PM) (Source: Application Error)(User: )
Description: FlashPlayerUpdateService.exe11.6.602.18051a4ab8cntdll.dll6.1.7601.1820551db9710c00000050002e24360001ceab3d345a1623C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeC:\Windows\SysWOW64\ntdll.dll72c78fb5-1730-11e3-9208-c01885d29ca2
==================== Memory info ===========================
Percentage of memory in use: 29%
Total physical RAM: 8092.36 MB
Available physical RAM: 5739.93 MB
Total Pagefile: 16182.9 MB
Available Pagefile: 13189.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Windows7_OS) (Fixed) (Total:420.56 GB) (Free:259.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25.47 GB) (Free:22.24 GB) NTFS
Drive f: (GS1212DVDXL) (CDROM) (Total:7.58 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: E7DB2827)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=421 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=25 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=20 GB) - (Type=12)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-09 22:20:09
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST500LM0 rev.2AR1 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\g780\AppData\Local\Temp\kxldqpob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe[1140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076761465 2 bytes [76, 76]
.text C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe[1140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767614bb 2 bytes [76, 76]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076761465 2 bytes [76, 76]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767614bb 2 bytes [76, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3452] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076b5cfca 5 bytes JMP 00000001747c4760
.text C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe[3584] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076b5cfca 5 bytes JMP 00000001747c4760
.text C:\Windows\SysWOW64\schtasks.exe[2124] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076b5cfca 5 bytes JMP 00000001747c4760
.text C:\Windows\SysWOW64\schtasks.exe[2124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076761465 2 bytes [76, 76]
.text C:\Windows\SysWOW64\schtasks.exe[2124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767614bb 2 bytes [76, 76]
.text ... * 2
.text C:\Users\g780\Downloads\Defogger.exe[8048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076761465 2 bytes [76, 76]
.text C:\Users\g780\Downloads\Defogger.exe[8048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767614bb 2 bytes [76, 76]
.text ... * 2
.text C:\Users\g780\Downloads\Defogger.exe[8048] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076b5cfca 5 bytes JMP 00000001747c4760
.text C:\Users\g780\Downloads\gmer_2.1.19163.exe[4988] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000076b5cfca 5 bytes JMP 00000001747c4760
.text C:\Users\g780\Downloads\gmer_2.1.19163.exe[4988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076761465 2 bytes [76, 76]
.text C:\Users\g780\Downloads\gmer_2.1.19163.exe[4988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000767614bb 2 bytes [76, 76]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@Bluetooth-Ger 1?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@Bluetooth-Ger 1?
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c01885d29ca2
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c01885d29ca2@04a82a22a1e4 0x35 0x20 0x51 0xB8 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c01885d29ca2@10d5427b64b7 0xE6 0xB2 0xBF 0xDE ...
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@Bluetooth-Ger 1?
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@Bluetooth-Ger 1?
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c01885d29ca2 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c01885d29ca2@04a82a22a1e4 0x35 0x20 0x51 0xB8 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c01885d29ca2@10d5427b64b7 0xE6 0xB2 0xBF 0xDE ...
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.09.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 g780 :: G780-PC [Administrator] 09.09.2013 21:30:12 MBAM-log-2013-09-09 (21-38-36).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 259143 Laufzeit: 6 Minute(n), 30 Sekunde(n) Infizierte Speicherprozesse: 2 C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe (PUP.Optional.PerformerSoft.A) -> 1532 -> Keine Aktion durchgeführt. C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe (PUP.Optional.PerformerSoft.A) -> 2400 -> Keine Aktion durchgeführt. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 38 HKCR\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE} (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\escort.escortIEPane.1 (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\escort.escortIEPane (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\delta.deltaHlpr.1 (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\delta.deltaHlpr (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D} (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\esrv.deltaESrvc.1 (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\esrv.deltaESrvc (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCR\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\delta.deltadskBnd.1 (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\delta.deltadskBnd (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\Typelib\{4599D05A-D545-4069-BB42-5895B4EAE05B} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\Interface\{1231839B-064E-4788-B865-465A1B5266FD} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta) -> Keine Aktion durchgeführt. HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Keine Aktion durchgeführt. HKCU\Software\DataMngr (PUP.Optional.DataMngr) -> Keine Aktion durchgeführt. HKCU\Software\delta LTD (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\babylontoolbar (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. HKCR\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\delta.deltaappCore.1 (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\delta.deltaappCore (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\d (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 7 HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Daten: Delta Toolbar -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> Daten: -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta) -> Daten: -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Daten: hxxp://search.babylon.com/?affID=119776&babsrc=HP_ss_din2g&mntrId=CE17C01885D29CA1 -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Daten: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> Keine Aktion durchgeführt. HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Keine Aktion durchgeführt. HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 11 C:\Users\g780\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\CR (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\Shared (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0 (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0\bh (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\File Scout (PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.10.0 (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. Infizierte Dateien: 34 C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe (PUP.Optional.PerformerSoft.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0\bh\delta.dll (PUP.Optional.Delta) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0\deltasrv.exe (PUP.Optional.Delta) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0\deltaTlbr.dll (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\Shared\BabMaint.exe (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\File Scout\filescout.exe (Trojan.PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\2A13.tmp (PUP.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\8F16.tmp (PUP.Optional.PerformerSoft.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\B0E1.tmp (Trojan.PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\setup_fsu_cid.exe (Trojan.PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\24429221-BAB0-7891-A404-D79205AA8430\Latest\MyBabylonTB.exe (PUP.Optional.Delta) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\24429221-BAB0-7891-A404-D79205AA8430\Latest\Setup.exe (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\bus1D73\BUSolution.dll (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\upd39DB\BabMaint.x (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\g780\Downloads\hdplugin_firefox.exe (PUP.BundleInstaller.DW) -> Keine Aktion durchgeführt. C:\Users\g780\Downloads\ntg-7psychos.avi.exe (PUP.BundleInstaller.DW) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com\HDVidCodec.lnk (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com\Uninstall.lnk (PUP.Optional.HDVidCodec.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\CR\Delta.crx (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\Shared\BUSolution.dll (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\Shared\BUSUninstall.exe (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\Shared\chu.js (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\Shared\Delta.ico (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\Shared\GUninstaller.exe (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\Shared\SetupParams.ini (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\BabSolution\Shared\sqlite3.dll (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0\deltaApp.dll (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0\deltaEng.dll (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0\escortShld.dll (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0\GUninstaller.exe (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\Delta\delta\1.8.10.0\uninstall.exe (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\File Scout\filescout.exe (PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Roaming\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. (Ende) Code:
ATTFilter Exportierte Ereignisse:
09.09.2013 22:47 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e
8}\BrowserProtect.dll'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/bProtect.D' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
Als ich gerade dabei war die Logs einzupflegen, ist mein Rechner das erste Mal überhaupt abgestürzt.  Gruss, Carsten |
|
09.09.2013, 22:20
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows 7 Avira Fund: adware/bprotect.d Hallo und
__________________ Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
09.09.2013, 22:50
| #3 |
| | Windows 7 Avira Fund: adware/bprotect.d Erstmal danke fürs Herbeieilen, cosinus.
__________________Es sind bestimmt schon eine Menge Leute vor euch auf die Knie gefallen.  Aber jetzt die Logs: Code:
ATTFilter # AdwCleaner v3.003 - Bericht erstellt am 09/09/2013 um 23:30:44
# Updated 07/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : g780 - G780-PC
# Gestartet von : C:\Users\g780\Downloads\adwcleaner.exe
# Option : Loschen
***** [ Dienste ] *****
Dienst Geloscht : BrowserProtect
[#] Dienst Geloscht : Partner Service
***** [ Dateien / Ordner ] *****
Ordner Geloscht : C:\ProgramData\Babylon
[!] Ordner Geloscht : C:\ProgramData\BrowserProtect
Ordner Geloscht : C:\ProgramData\Partner
Ordner Geloscht : C:\Program Files (x86)\delta
Ordner Geloscht : C:\Program Files (x86)\Movie2KDownloader.com
Ordner Geloscht : C:\Users\g780\AppData\Local\PackageAware
Ordner Geloscht : C:\Users\g780\AppData\Local\PutLockerDownloader
Ordner Geloscht : C:\Users\g780\AppData\Roaming\BabSolution
Ordner Geloscht : C:\Users\g780\AppData\Roaming\Babylon
Ordner Geloscht : C:\Users\g780\AppData\Roaming\file scout
Ordner Geloscht : C:\Users\g780\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDvidCodec.com
Ordner Geloscht : C:\Users\g780\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PutLockerDownloader.com
Ordner Geloscht : C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\jetpack
Datei Geloscht : C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\bprotector_extensions.sqlite
Datei Geloscht : C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\bprotector_prefs.js
Datei Geloscht : C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\searchplugins\Babylon.xml
Datei Geloscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml
Datei Geloscht : C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\searchplugins\BrowserProtect.xml
Datei Geloscht : C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\searchplugins\delta.xml
Datei Geloscht : C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\user.js
Datei Geloscht : C:\Windows\System32\Tasks\BrowserProtect
Datei Geloscht : C:\Windows\System32\Tasks\EPUpdater
***** [ Verknupfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlussel Geloscht : HKLM\SOFTWARE\Google\Chrome\Extensions\apfdadfinodckpcehhdhjlgiphgnbfci
Schlussel Geloscht : HKLM\SOFTWARE\Google\Chrome\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf
Schlussel Geloscht : HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde
Wert Geloscht : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]
Wert Geloscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Schlussel Geloscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\kt_bho_dll.dll
Schlussel Geloscht : HKLM\SOFTWARE\Classes\delta.deltaappCore
Schlussel Geloscht : HKLM\SOFTWARE\Classes\delta.deltaappCore.1
Schlussel Geloscht : HKLM\SOFTWARE\Classes\delta.deltadskBnd
Schlussel Geloscht : HKLM\SOFTWARE\Classes\delta.deltadskBnd.1
Schlussel Geloscht : HKLM\SOFTWARE\Classes\delta.deltaHlpr
Schlussel Geloscht : HKLM\SOFTWARE\Classes\delta.deltaHlpr.1
Schlussel Geloscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlussel Geloscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlussel Geloscht : HKLM\SOFTWARE\Classes\esrv.deltaESrvc
Schlussel Geloscht : HKLM\SOFTWARE\Classes\esrv.deltaESrvc.1
Schlussel Geloscht : HKLM\SOFTWARE\Classes\kt_bho.KettleBho
Schlussel Geloscht : HKLM\SOFTWARE\Classes\kt_bho.KettleBho.1
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlussel Geloscht : HKLM\SOFTWARE\Classes\PutLockerDownloader
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Tracing\PutlockerDownloader_RASAPI32
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Tracing\PutlockerDownloader_RASMANCS
Schlussel Geloscht : HKCU\Software\853dfdeb46dea47
Schlussel Geloscht : HKLM\SOFTWARE\853dfdeb46dea47
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\{28A88B70-D874-4F73-BBBA-9B2B222FB7D6}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\CLSID\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\CLSID\{F1AF26F8-1828-4279-ABCE-074EF3235BD7}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\TypeLib\{162E06EC-4E38-4809-AE76-BF2400D34334}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\TypeLib\{86676E13-D6D8-4652-9FCF-F2047F1FB000}
Schlussel Geloscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1AF26F8-1828-4279-ABCE-074EF3235BD7}
Schlussel Geloscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlussel Geloscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlussel Geloscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F1AF26F8-1828-4279-ABCE-074EF3235BD7}
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}
Schlussel Geloscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Wert Geloscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{82E1477C-B154-48D3-9891-33D83C26BCD3}]
Schlussel Geloscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlussel Geloscht : HKCU\Software\1ClickDownload
Schlussel Geloscht : HKCU\Software\BabSolution
Schlussel Geloscht : HKCU\Software\BabylonToolbar
Schlussel Geloscht : HKCU\Software\DataMngr
[#] Schlussel Geloscht : HKCU\Software\DataMngr_Toolbar
Schlussel Geloscht : HKCU\Software\delta LTD
Schlussel Geloscht : HKCU\Software\Delta
Schlussel Geloscht : HKCU\Software\filescout
Schlussel Geloscht : HKLM\Software\Babylon
Schlussel Geloscht : HKLM\Software\BabylonToolbar
Schlussel Geloscht : HKLM\Software\DataMngr
Schlussel Geloscht : HKLM\Software\Delta
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar
Schlussel Geloscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta
Schlussel Geloscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Daten Geloscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\browse~1\261519~1.190\{c16c1~1\browse~1.dll
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16502
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\prefs.js ]
Zeile geloscht : user_pref("avg.install.userHPSettings", "hxxp://www.delta-search.com/?affID=119776&babsrc=HP_ss&mntrId=CE17C01885D29CA1");
Zeile geloscht : user_pref("avg.install.userSPSettings", "Delta Search");
Zeile geloscht : user_pref("browser.search.order.1", "Delta Search");
Zeile geloscht : user_pref("extensions.delta.admin", false);
Zeile geloscht : user_pref("extensions.delta.aflt", "babsst");
Zeile geloscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile geloscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile geloscht : user_pref("extensions.delta.dfltLng", "en");
Zeile geloscht : user_pref("extensions.delta.excTlbr", false);
Zeile geloscht : user_pref("extensions.delta.id", "ce170a66000000000000c01885d29ca1");
Zeile geloscht : user_pref("extensions.delta.instlDay", "15784");
Zeile geloscht : user_pref("extensions.delta.instlRef", "sst");
Zeile geloscht : user_pref("extensions.delta.newTab", false);
Zeile geloscht : user_pref("extensions.delta.prdct", "delta");
Zeile geloscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile geloscht : user_pref("extensions.delta.rvrt", "false");
Zeile geloscht : user_pref("extensions.delta.smplGrp", "none");
Zeile geloscht : user_pref("extensions.delta.tlbrId", "base");
Zeile geloscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile geloscht : user_pref("extensions.delta.vrsn", "1.8.10.0");
Zeile geloscht : user_pref("extensions.delta.vrsnTs", "1.8.10.017:26:19");
Zeile geloscht : user_pref("extensions.delta.vrsni", "1.8.10.0");
Zeile geloscht : user_pref("extensions.enabledAddons", "DivXWebPlayer%40divx.com:2.0.2.039,info%40djzig.com:2.0.8");
*************************
AdwCleaner[R0].txt - [13167 octets] - [09/09/2013 23:29:48]
AdwCleaner[S0].txt - [12400 octets] - [09/09/2013 23:30:44]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [12461 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.9 (09.07.2013:1)
OS: Windows 7 Home Premium x64
Ran by g780 on 09.09.2013 at 23:37:23,29
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2102161896-4051846735-262110208-1001\Software\SweetIM
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{01BD1B43-566A-45FC-9D4F-8B9434EA7919}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{01C60A02-29BE-4F44-A519-840C216CDBB6}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{021AAC28-B765-47DB-8767-E0E8BD9BDEB5}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{04625BFF-1C87-4EF1-ADEA-A11640528DE1}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{0551FCB3-AE3E-480E-8ECD-CD63E8CADECF}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{09B95CA9-0B41-4A6C-9292-B22340EE64AE}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{0CD805AF-0E58-4618-9ACF-CB9336A6607C}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{0D180078-4423-4602-9B9B-00D9CA316403}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{0DC32C09-1FA7-4DBE-A7DA-C4DDF7DDC13E}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{0E9B61A4-F1D7-45E4-ABCE-A0F487BCFCF5}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{0EA60937-F5DA-4157-9DD8-98A7B4FBC4CF}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{0F3E4BCB-E464-4DCF-86DA-69F0D278AA96}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{0FBDBB3F-AFAC-4F67-843A-B6987283D5E3}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{113C0E3D-3AEA-44F2-814A-FA4B87F37AB0}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{13DE06D4-DD1D-48FC-B092-19799561C5CC}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{141607C9-85AC-4A2F-A03E-752E3C637CF0}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{14BE045E-DDA4-45D2-B930-66A993A56F07}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{155A9ED0-5FF0-4504-8BE2-E4C0AE1AA52A}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{17263B59-2CAC-45D1-9EE1-86005419B433}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{183CC9D9-53A0-4886-AFE6-02D1F6E98104}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{194EC6DE-6A04-4588-8C2A-B4C77B9E0EFE}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{19A103EF-6049-4EDD-B0FA-7AF75FA3E1C9}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{1B1F49E0-FD07-4727-92E1-3922283538A8}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{1BF163A4-687B-4218-A1C3-75A50789D940}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{1CC89478-1B45-4E7A-A19C-7DCFED9B9BD0}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{1E5A2827-F7E5-49A7-B643-F89379513FFB}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{1EFD44A6-851F-4F63-BF7A-9E49C5556153}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{1F70D988-A164-46C9-A9D2-C14854EE94D8}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{206B28B3-AB6B-4781-A93E-8762A9998882}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{2229249B-871D-414B-836E-1039BD5C8713}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{22AC92B2-53BD-4B81-ADC0-14AE8B573C39}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{2448D3E7-27AF-4162-95C8-7AAD88FF1847}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{26685AF1-7C24-4399-8E4D-F8FF59F0D981}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{28251D3A-C282-4F62-B7E6-28C34DDB1F55}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{29F908A7-F912-4304-9CE3-21620E262C7E}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{2C73CFE7-217B-4C08-B7D4-F8C2C46249EA}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{2D57B602-F5FF-4323-BDB3-A530843C0670}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{2EF54CA5-F57C-4466-8E8E-105EAE32B98F}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{2EF6D511-0FCB-4329-8BFA-6CFEB5BFC495}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{2FAA2A83-0FB3-499F-B0D4-72522EB5A72D}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{332DDB54-796F-451F-A03A-56E0701FB32A}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{37F8776D-E002-442E-9CA1-E732749448E9}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{381B66C6-0ED4-4EB0-AD7F-F9D6399B13FF}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{3C28369E-C59C-4993-90DF-D4BE97B12729}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{3CB5DD9A-0481-4E75-A383-AFAD8A274C6C}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{40964EA2-9598-4A29-B4E5-FFADAC28481A}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{41D9D2FC-1700-4E07-9886-7FCAF4112D14}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{4354667A-A66D-4F01-81B2-0F05E655A285}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{46AC9B14-32C8-42C1-BFB3-CFCC23660D9F}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{47AB6A87-88EF-4817-B421-D2CA6B0EEDAC}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{47AB9F29-0A31-490F-8BE6-E03FE86E8F07}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{481576D7-D04A-4A67-87F9-EEFE6AE062CF}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{499E9FD9-7153-40CD-820D-673F758B05A1}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{49D94BE5-BC6E-4D0F-95BA-09C0855C6BFE}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{4A02211C-7B3A-4490-B000-4A2DE2FBF56C}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{4AEC5982-1692-40FA-BB36-27C51667741B}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{4D7F5631-4071-4981-99B8-53759004C0B7}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{4E13B9CD-1288-4DE5-AD8C-EA923FFE1B24}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{4ED7C8BE-59E2-46C3-9C36-6608264BE110}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{504B50B4-60F2-4CF9-9B1A-5E57F298C4CA}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{519BE8A6-6EF7-47C3-A35B-0BF7752BCB85}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{52630A85-5ABE-48D6-9AD5-1B276514A4E6}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{57568DE0-B84D-408E-9D6C-BE728D8BD815}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{57993E59-8BF3-4073-AAA4-B88485E0F08F}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{5A47A16C-D704-4027-BA07-D44E10829CEE}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{5A8536A9-623B-4475-B1BF-8D5E63F03A30}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{5B62ED59-C1FE-40DE-B076-AE9988FA3C95}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{5CC839BC-F3C8-4042-9C47-E7B784FFE534}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{5EB36DD0-A0E9-49EF-B416-037220D83D09}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{5EFD4163-936E-4E71-845D-30A91C24B171}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{5F6AE3B5-CA45-4523-9EAB-607242D2A701}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{5FA948E4-39AF-4EF7-9846-2131B20B45AD}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{5FEF78A1-050C-490A-8F0F-AAFFD0E7D729}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{61845A7C-37B1-461C-95E9-8239823A1997}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{631C27E4-DC2F-4AA6-920C-2A045D6A7769}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{66162C1A-A2F1-4F2C-8ADE-223B94D53C04}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{69D99605-04A7-4BD7-95B3-E8BDEC893BED}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{6A093BE0-3DBC-4431-BD9C-12EA8AA8D4D9}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{6B3E3EFD-0E0F-4A15-81D7-D2AF69081A7D}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{6E40CD29-1A75-4BD7-9AF2-2830DB05A72D}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{6E695E24-D063-492D-84AA-FE13E6FC5C92}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{72F1E94B-99C7-4FCF-81B6-58C93DE8F6EA}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{772FECDA-3242-4699-A3C1-71EA524F3D56}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{7A94F3EC-41AC-4D40-A9F7-EAB79DD1FB7C}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{7C0A38BD-82A5-450C-956C-41FA81F3DDAE}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{7C33C768-4E38-4A1E-A476-2486E204A77B}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{812A13C7-CBCA-492F-ADD5-5C34A09EEBB1}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{8236C666-915C-496F-9952-BE7AB74BD3C5}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{82AB0288-BD67-4B5F-999F-EA0D42EB43E5}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{873F0170-8C2D-4C60-9401-D13FD540C7F0}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{887F9BBD-5794-4E19-99D9-EA4F8D069245}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{8BC2AB9F-98B7-4B24-9E7F-104CD2F94B2F}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{8C88E1C8-9E0D-4E40-8810-525E4C5767F7}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{8CBF7A62-43E4-492D-A8A9-38E95F30075E}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{8D93BB0D-B72B-4045-BBE3-5DAF7090C0E7}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{910F8E85-C2AD-4E48-88AD-EAAE0FC33B07}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{91B83095-D604-435B-AD9A-69D0F60828C0}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{924430B4-6A07-4D48-826A-274120DF4118}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{9368FF36-2E17-4F73-980F-3859D4D2EE8D}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{93A03597-31C3-4257-9827-8380A66639E7}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{97DC858C-D32F-48DC-8685-1AFBE9C37E70}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{9969A5B1-50DD-4D06-ADC5-610C50B20570}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{9A04205A-ED5A-4739-90D0-53F4A81C0078}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{9C625758-9BA4-493D-B693-205C2CD1ABD5}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{9C6C58B6-B27F-45B0-BAAD-80112797DB78}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{9D6F9E2C-B962-433D-9C46-094EAF1C0FF2}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{9FAF62BB-C174-4080-A1C0-F7DAC40D1DB9}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{A39F774D-5A25-44F7-8605-5FD5A3598A03}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{A5786D30-216B-4BCB-8C14-73AF16DCCACA}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{A9AEBD55-A0CF-4E8E-8491-4C2890140CFA}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{AB572D92-B4F2-4BF9-831E-4542BDB28320}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{AD93AEFE-482B-476F-9323-0E8B40270BB0}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{AE7BD1A1-6FD4-4576-B580-5B29A262F5F4}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{AE86F8ED-05BA-452E-80F1-50E0F7267521}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{B1D94D93-55C3-4EF8-A74A-75802FC433F1}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{B6EDF43C-AD38-4543-81BF-A34BBC7E6506}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{B757AB89-74E7-4C58-AAD9-20D43E6348F9}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{B7BC8337-7A2C-4767-B8DC-7CBBA949A2F2}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{B8425086-0DCB-494C-AA32-A1FF862DD6FE}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{C2B36449-8671-40CA-8157-AE10626453CE}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{C45BA719-6487-4D37-95C1-1E8FB7B18780}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{C5B8E63A-8DDF-4B36-B8DD-EA029C77AAA4}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{C69654EA-C3BE-48C1-9266-34646E9A8E89}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{C7441D14-A0FB-4ACC-AEED-1D95CC0F2312}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{C7DC6F49-128A-4BE0-9AB5-6AB4BFFA8E02}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{C97CA5B5-A799-4CE1-A107-BB40469611AD}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{C9DE6625-CC0E-49E2-9CBC-6C5AACBEF3A8}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{CA9A53C1-6EFD-4010-AB31-934D714F089A}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{CD2334A1-2702-4788-99CB-BB1CE5906DC3}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{D38630E7-8B60-40D4-8C0B-7CF2902851F4}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{D84F18E9-A870-4E86-A61A-0FFEA80F82C5}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{D8B9318C-6ED9-4AE4-B914-C0A97101B833}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{D90377ED-2A79-47EA-9C05-264A386AB368}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{DC02216F-B43B-4514-9514-CC428A8D49A9}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{DD183322-2902-4590-AE35-BF4C96881E69}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{DD382E9E-FCBB-4CE5-BCC2-592CF5871DE1}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{DEBE35A3-950C-4B09-92A7-CAD787B611D9}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{E36D4C64-A5C9-4F8C-AFA6-7D1C3800DA0B}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{E53D66FF-A8BE-405C-81BA-810BEF0FE9FC}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{E88078C7-F00B-4254-B665-07B5B2E0A890}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{E88417EF-47B1-4C28-B852-F3D91CB27BAB}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{E9016461-8748-43DD-8E07-7A4B3C18B8D6}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{E9275544-8A20-48C9-B3E1-74971FCDF3FE}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{E9C2765B-1545-4F3F-8D21-C1E448074384}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{EB0852BF-3462-4C64-8D97-EEE7539F3D39}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{EF2877FB-782B-4CB0-952F-02A19354B8A5}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{F0AC2403-ECBE-4A8D-85CD-963F43B5D055}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{F6C4109C-3A9B-400B-A965-1D01AFFA789B}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{F6CAABBC-15C6-4679-8D25-0EBC8EF4EFEF}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{F8FE575E-E5F5-4967-B4FA-D9E95310428D}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{FAE8FA89-EF7E-4DE6-8F52-9FEE0A450080}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{FCAB844D-DF3B-4DC2-9FFA-7C416C7C94E8}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{FD5B6145-16BE-40D1-9274-A41F2EC16E70}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{FDABC392-7E74-4298-ACD2-D1F4AE2FEF4E}
Successfully deleted: [Empty Folder] C:\Users\g780\appdata\local\{FFA50FC1-3F5E-422F-A275-BCAFFC1698A1}
~~~ FireFox
Successfully deleted: [Folder] C:\Users\g780\AppData\Roaming\mozilla\firefox\profiles\bd2okbd1.default\extensions\staged
Emptied folder: C:\Users\g780\AppData\Roaming\mozilla\firefox\profiles\bd2okbd1.default\minidumps [211 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.09.2013 at 23:43:15,19
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-09-2013 01
Ran by g780 (administrator) on G780-PC on 09-09-2013 23:45:09
Running from C:\Users\g780\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Device Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [564352 2011-12-15] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2809856 2012-01-16] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-07-03] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6202416 2012-07-03] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo EE Boot Optimizer] - C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2012-07-03] (Lenovo)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [IntelliType Pro] - c:\Program Files\Microsoft Device Center\itype.exe [1464928 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] - c:\Program Files\Microsoft Device Center\ipoint.exe [2004584 2012-06-26] (Microsoft Corporation)
HKLM\...\Run: [XboxStat] - C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
MountPoints2: E - E:\AutoRun.exe
MountPoints2: {47135bd0-c51d-11e1-865c-806e6f6e6963} - F:\Start.exe
MountPoints2: {7b322d3e-5d51-11e2-9895-dc0ea1fa6236} - E:\Startme.exe
MountPoints2: {a50f3e1c-dfcf-11e2-a2c4-c01885d29ca2} - E:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [332BigDog] - C:\Program Files (x86)\USB Camera2\VM332_STI.EXE [548864 2011-12-09] (Vimicro)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Lenovo Registration] - C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2012-01-26] (Lenovo, Inc.)
HKLM-x32\...\Run: [YouCam Mirage] - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2011-01-28] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] - C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [228448 2011-01-28] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.)
HKLM-x32\...\Run: [VeriFaceManager] - C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-07-03] (Lenovo)
HKLM-x32\...\Run: [UpdatePRCShortCut] - C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [LockKey] - C:\Program Files (x86)\LockKey\LockKey.exe [337776 2011-08-25] ( )
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [Lenovo.ShowBand] - C:\Program Files\Lenovo\SimpleTap DeskBand\ShowBand.exe [52584 2013-05-17] (Lenovo)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [260928 2012-05-01] (NVIDIA Corporation)
AppInit_DLLs-x32: [ ] ()
Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MyEmoticons Class - {DCC39ACE-709B-44EA-B062-5F6BE2774644} - C:\Users\g780\AppData\Roaming\MyEmoticons\myemoticons-1.6.1.dll (GreenTree Applications)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4
FireFox:
========
FF ProfilePath: C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default
FF Homepage: https://www.facebook.com/|hxxp://www.funkysnooker.com/forums
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Ghostery - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\firefox@ghostery.com
FF Extension: LavaFox V2 - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\info@djzig.com
FF Extension: DivXWebPlayer - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\DivXWebPlayer@divx.com.xpi
FF Extension: firefox - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\firefox@ghostery.com.xpi
FF Extension: No Name - C:\Users\g780\AppData\Roaming\Mozilla\Firefox\Profiles\bd2okbd1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [myemoticons@myemoticons.com] C:\Users\g780\AppData\Roaming\MyEmoticons\myemoticons@myemoticons.com-1.6.1
FF Extension: MyEmoticons - C:\Users\g780\AppData\Roaming\MyEmoticons\myemoticons@myemoticons.com-1.6.1
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [945440 2012-02-01] (Broadcom Corporation.)
S4 DamageGuardSvc; C:\Program Files\Lenovo\Instant Reset\DamageGuardSvc.exe [572976 2012-03-26] (Lenovo (Beijing) Limited)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2012-11-07] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-31] (Avira Operations GmbH & Co. KG)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
S4 DamageGuard; C:\Windows\System32\DRIVERS\DamageGuardX64.sys [217392 2012-02-10] (Lenovo)
S4 dgFltr; C:\Windows\System32\drivers\dgFltrX64.sys [23648 2011-12-13] (Lenovo)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104048 2012-03-02] (Qualcomm Atheros Co., Ltd.)
S3 UHSfiltv; C:\Windows\System32\drivers\UHSfiltv.sys [23552 2012-09-28] (Creative Technology Ltd.)
S3 zte_cdc_acm; C:\Windows\System32\DRIVERS\zte_cdc_acm.sys [79872 2011-04-14] (ZTE)
S3 zte_cdc_ecm; C:\Windows\System32\DRIVERS\zte_cdc_ecm.sys [36864 2011-04-14] (ZTE)
S3 zte_cpo; C:\Windows\System32\DRIVERS\zte_cpo.sys [14336 2011-04-14] (ZTE)
S3 zte_ecm_enum; C:\Windows\System32\DRIVERS\zte_ecm_enum.sys [55808 2011-04-14] (ZTE)
S3 zte_ecm_enum_filter; C:\Windows\System32\DRIVERS\zte_ecm_enum_filter.sys [55808 2011-04-14] (ZTE)
U3 BcmSqlStartupSvc;
U2 CLKMSVC10_3A60B698;
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
U2 iATAgentService;
U2 idealife Update Service;
U3 IGRS;
U2 IviRegMgr;
U2 Oasis2Service;
U2 PCCarerService;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SeaPort;
U2 SoftwareService;
U3 SQLWriter;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-09 23:37 - 2013-09-09 23:37 - 00000000 ____D C:\Windows\ERUNT
2013-09-09 23:36 - 2013-09-09 23:36 - 01029490 _____ (Thisisu) C:\Users\g780\Downloads\JRT.exe
2013-09-09 23:33 - 2013-09-09 23:33 - 00000000 ____D C:\Users\g780\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-09 23:29 - 2013-09-09 23:30 - 00000000 ____D C:\AdwCleaner
2013-09-09 23:28 - 2013-09-09 23:28 - 01037278 _____ C:\Users\g780\Downloads\adwcleaner.exe
2013-09-09 22:37 - 2013-09-09 22:37 - 00286096 _____ C:\Windows\Minidump\090913-47876-01.dmp
2013-09-09 22:37 - 2013-09-09 22:37 - 00000000 ____D C:\Windows\Minidump
2013-09-09 22:36 - 2013-09-09 22:36 - 716469483 _____ C:\Windows\MEMORY.DMP
2013-09-09 21:42 - 2013-09-09 23:43 - 00000000 ____D C:\Users\g780\Desktop\Logdateien
2013-09-09 21:11 - 2013-09-09 21:11 - 00000000 ____D C:\Users\g780\AppData\Roaming\Malwarebytes
2013-09-09 21:10 - 2013-09-09 21:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-09 21:10 - 2013-09-09 21:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-09 21:10 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-09 21:06 - 2013-09-09 21:06 - 00377856 _____ C:\Users\g780\Downloads\gmer_2.1.19163.exe
2013-09-09 21:02 - 2013-09-09 21:02 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\g780\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-09 20:50 - 2013-09-09 20:50 - 00000000 ____D C:\FRST
2013-09-09 20:49 - 2013-09-09 20:49 - 01949196 _____ (Farbar) C:\Users\g780\Downloads\FRST64.exe
2013-09-09 20:47 - 2013-09-09 20:47 - 00000000 _____ C:\Users\g780\defogger_reenable
2013-09-09 20:45 - 2013-09-09 20:45 - 00050477 _____ C:\Users\g780\Downloads\Defogger.exe
2013-09-06 18:59 - 2013-09-09 19:12 - 96732368 _____ C:\Windows\SysWOW64\Ŷ崫�‡
2013-09-05 08:38 - 2013-09-05 08:39 - 00006526 _____ C:\Users\g780\Desktop\6O4EZJ.txt
2013-08-31 21:04 - 2013-08-31 21:04 - 00000000 ____D C:\Users\g780\Desktop\Neuer Ordner
2013-08-25 20:53 - 2013-08-25 20:54 - 00309248 _____ (Microsoft Corporation) C:\Users\g780\Downloads\wmpfirefoxplugin.exe
2013-08-25 06:30 - 2013-08-25 06:30 - 13503963 _____ C:\Users\g780\Downloads\Supersoma.zip
2013-08-25 06:29 - 2013-08-25 06:32 - 87154461 _____ C:\Users\g780\Downloads\Glenn Hughes- Underground Nuclear Kitchen.zip
2013-08-21 11:07 - 2013-08-21 11:07 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-08-20 22:06 - 2013-08-20 22:06 - 00001299 _____ C:\Users\Public\Desktop\Paint.NET.lnk
2013-08-14 03:00 - 2013-07-25 05:54 - 17830400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 03:00 - 2013-07-25 05:37 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 03:00 - 2013-07-25 05:35 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 03:00 - 2013-07-25 05:31 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 03:00 - 2013-07-25 05:30 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 03:00 - 2013-07-25 05:29 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-14 03:00 - 2013-07-25 05:29 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-14 03:00 - 2013-07-25 05:29 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-14 03:00 - 2013-07-25 05:28 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-14 03:00 - 2013-07-25 05:27 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 03:00 - 2013-07-25 05:27 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-14 03:00 - 2013-07-25 05:26 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 03:00 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-14 03:00 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-14 03:00 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-14 03:00 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-14 03:00 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-14 03:00 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-08-14 03:00 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-08-14 03:00 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-08-14 03:00 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-08-14 03:00 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-14 03:00 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-14 03:00 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-08-14 02:52 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 02:52 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 02:52 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 02:52 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 02:52 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 02:52 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 02:52 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 02:52 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 02:51 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 02:51 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 02:51 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 02:51 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 02:51 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 02:51 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 02:51 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 02:51 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 02:51 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 02:51 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 02:51 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 02:51 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 02:51 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 02:51 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 02:51 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 02:51 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 02:51 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 02:51 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 02:51 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
==================== One Month Modified Files and Folders =======
2013-09-09 23:43 - 2013-09-09 23:43 - 00017523 _____ C:\Users\g780\Desktop\JRT.txt
2013-09-09 23:43 - 2013-09-09 21:42 - 00000000 ____D C:\Users\g780\Desktop\Logdateien
2013-09-09 23:40 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-09 23:40 - 2009-07-14 06:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-09 23:37 - 2013-09-09 23:37 - 00000000 ____D C:\Windows\ERUNT
2013-09-09 23:36 - 2013-09-09 23:36 - 01029490 _____ (Thisisu) C:\Users\g780\Downloads\JRT.exe
2013-09-09 23:36 - 2012-07-03 16:30 - 01182812 _____ C:\Windows\WindowsUpdate.log
2013-09-09 23:35 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing
2013-09-09 23:33 - 2013-09-09 23:33 - 00000000 ____D C:\Users\g780\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-09-09 23:33 - 2012-08-10 14:31 - 01646627 _____ C:\FaceProv.log
2013-09-09 23:33 - 2012-07-03 17:17 - 00631237 _____ C:\Windows\system32\fastboot.set
2013-09-09 23:33 - 2012-07-03 17:15 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-09 23:33 - 2012-07-03 17:15 - 00000000 ____D C:\ProgramData\VeriFace
2013-09-09 23:32 - 2013-07-28 09:09 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-09-09 23:31 - 2012-11-06 05:07 - 00043758 _____ C:\Windows\setupact.log
2013-09-09 23:31 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-09 23:30 - 2013-09-09 23:29 - 00000000 ____D C:\AdwCleaner
2013-09-09 23:28 - 2013-09-09 23:28 - 01037278 _____ C:\Users\g780\Downloads\adwcleaner.exe
2013-09-09 23:13 - 2012-07-03 17:15 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-09 23:11 - 2012-08-25 22:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-09 22:37 - 2013-09-09 22:37 - 00286096 _____ C:\Windows\Minidump\090913-47876-01.dmp
2013-09-09 22:37 - 2013-09-09 22:37 - 00000000 ____D C:\Windows\Minidump
2013-09-09 22:36 - 2013-09-09 22:36 - 716469483 _____ C:\Windows\MEMORY.DMP
2013-09-09 21:11 - 2013-09-09 21:11 - 00000000 ____D C:\Users\g780\AppData\Roaming\Malwarebytes
2013-09-09 21:10 - 2013-09-09 21:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-09 21:10 - 2013-09-09 21:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-09 21:07 - 2012-08-26 18:41 - 00000000 ____D C:\Users\g780\AppData\Roaming\Skype
2013-09-09 21:06 - 2013-09-09 21:06 - 00377856 _____ C:\Users\g780\Downloads\gmer_2.1.19163.exe
2013-09-09 21:02 - 2013-09-09 21:02 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\g780\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-09 20:50 - 2013-09-09 20:50 - 00000000 ____D C:\FRST
2013-09-09 20:49 - 2013-09-09 20:49 - 01949196 _____ (Farbar) C:\Users\g780\Downloads\FRST64.exe
2013-09-09 20:47 - 2013-09-09 20:47 - 00000000 _____ C:\Users\g780\defogger_reenable
2013-09-09 20:47 - 2012-08-10 14:31 - 00000000 ____D C:\Users\g780
2013-09-09 20:45 - 2013-09-09 20:45 - 00050477 _____ C:\Users\g780\Downloads\Defogger.exe
2013-09-09 19:15 - 2012-07-04 02:14 - 00698078 _____ C:\Windows\system32\perfh007.dat
2013-09-09 19:15 - 2012-07-04 02:14 - 00153138 _____ C:\Windows\system32\perfc007.dat
2013-09-09 19:15 - 2009-07-14 07:13 - 01645110 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-09 19:12 - 2013-09-06 18:59 - 96732368 _____ C:\Windows\SysWOW64\Ŷ崫�‡
2013-09-08 22:21 - 2012-08-28 11:21 - 00000000 ____D C:\Users\g780\AppData\Local\Paint.NET
2013-09-05 08:39 - 2013-09-05 08:38 - 00006526 _____ C:\Users\g780\Desktop\6O4EZJ.txt
2013-09-03 20:17 - 2012-08-26 20:45 - 00000000 ____D C:\Users\g780\AppData\Roaming\PlayCatanClient
2013-09-02 17:42 - 2012-08-10 14:35 - 00067504 _____ C:\Users\g780\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-02 14:39 - 2012-08-17 15:52 - 00000000 ____D C:\Users\g780\AppData\Roaming\SoftGrid Client
2013-09-02 14:30 - 2013-05-02 11:39 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-02 14:30 - 2013-03-31 10:26 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-02 14:30 - 2013-03-31 10:26 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-31 21:04 - 2013-08-31 21:04 - 00000000 ____D C:\Users\g780\Desktop\Neuer Ordner
2013-08-28 21:02 - 2012-09-29 22:29 - 00580096 ___SH C:\Users\g780\Desktop\Thumbs.db
2013-08-28 16:55 - 2013-06-28 10:56 - 00000000 ____D C:\Program Files (x86)\Connect Manager
2013-08-27 05:08 - 2012-08-25 22:04 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-27 05:08 - 2012-08-25 22:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-26 14:02 - 2012-08-26 21:47 - 00000000 ____D C:\ldiag
2013-08-25 20:55 - 2013-03-09 09:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-25 20:54 - 2013-08-25 20:53 - 00309248 _____ (Microsoft Corporation) C:\Users\g780\Downloads\wmpfirefoxplugin.exe
2013-08-25 06:32 - 2013-08-25 06:29 - 87154461 _____ C:\Users\g780\Downloads\Glenn Hughes- Underground Nuclear Kitchen.zip
2013-08-25 06:30 - 2013-08-25 06:30 - 13503963 _____ C:\Users\g780\Downloads\Supersoma.zip
2013-08-21 17:01 - 2012-10-19 21:15 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-08-21 11:07 - 2013-08-21 11:07 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-08-20 22:06 - 2013-08-20 22:06 - 00001299 _____ C:\Users\Public\Desktop\Paint.NET.lnk
2013-08-20 22:06 - 2012-08-28 11:21 - 00000000 ____D C:\Program Files\Paint.NET
2013-08-19 08:24 - 2012-08-25 18:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-14 04:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-14 03:03 - 2013-07-23 05:41 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 03:02 - 2012-08-31 21:56 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\Users\g780\AppData\Local\Temp\detectionapi_rd.dll
C:\Users\g780\AppData\Local\Temp\detectionui_r.exe
C:\Users\g780\AppData\Local\Temp\directx9tests_rd.dll
C:\Users\g780\AppData\Local\Temp\drm_dialogs.dll
C:\Users\g780\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\g780\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\g780\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\g780\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\g780\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\g780\AppData\Local\Temp\local.dll
C:\Users\g780\AppData\Local\Temp\mfc80.dll
C:\Users\g780\AppData\Local\Temp\mfc80u.dll
C:\Users\g780\AppData\Local\Temp\MSETUP4.EXE
C:\Users\g780\AppData\Local\Temp\msvcp80.dll
C:\Users\g780\AppData\Local\Temp\msvcr80.dll
C:\Users\g780\AppData\Local\Temp\Quarantine.exe
C:\Users\g780\AppData\Local\Temp\setup_fsu_cid.exe
C:\Users\g780\AppData\Local\Temp\Shockwave_Installer_FF.exe
C:\Users\g780\AppData\Local\Temp\SIInvoker.exe
C:\Users\g780\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-02 00:13
==================== End Of Log ============================
|
|
09.09.2013, 22:52
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7 Avira Fund: adware/bprotect.d Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM) Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
09.09.2013, 23:02
| #5 |
| | Windows 7 Avira Fund: adware/bprotect.d Jo, die Avira Meldung kommt auch schon nicht mehr.  Dennoch hat MBAM noch ein paar Meldungen für mich bereit: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.09.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 g780 :: G780-PC [Administrator] 09.09.2013 23:55:46 MBAM-log-2013-09-10 (00-00-45).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 258824 Laufzeit: 4 Minute(n), 39 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 3 C:\Users\g780\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.10.0 (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. Infizierte Dateien: 10 C:\Users\g780\AppData\Local\Temp\2A13.tmp (PUP.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\8F16.tmp (PUP.Optional.PerformerSoft.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\B0E1.tmp (Trojan.PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\setup_fsu_cid.exe (Trojan.PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\24429221-BAB0-7891-A404-D79205AA8430\Latest\MyBabylonTB.exe (PUP.Optional.Delta) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\24429221-BAB0-7891-A404-D79205AA8430\Latest\Setup.exe (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\bus1D73\BUSolution.dll (PUP.Optional.BabSolution.A) -> Keine Aktion durchgeführt. C:\Users\g780\AppData\Local\Temp\upd39DB\BabMaint.x (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\g780\Downloads\hdplugin_firefox.exe (PUP.BundleInstaller.DW) -> Keine Aktion durchgeführt. C:\Users\g780\Downloads\ntg-7psychos.avi.exe (PUP.BundleInstaller.DW) -> Keine Aktion durchgeführt. (Ende) |
|
09.09.2013, 23:14
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7 Avira Fund: adware/bprotect.d Die Funde bitte mit Malwarebytes entfernen
__________________ --> Windows 7 Avira Fund: adware/bprotect.d |
|
09.09.2013, 23:24
| #7 |
| | Windows 7 Avira Fund: adware/bprotect.d Super, hat scheinbar alles hervorragend geklappt. Werde ESET über Nacht laufen lassen, sein Scan dauert wohl etwas länger. Aber vorerst ein riesiges  und gute Nacht!Carsten |
|
Linear-Darstellung
