| |
| |||||||
Log-Analyse und Auswertung: Postbank Online Banking TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
16.09.2013, 12:07
| #1 |
 |  Postbank Online Banking Trojaner Sehr geehrtes Trojaner-Board-Team, Infizierung des Computers, ein Schadprogramm versucht, nach der Eingabe von Kontonummer und Passwort im Postbank Online Banking, die Mobilfunknummer für das Mobil-Tan Verfahren zwecks der Zusendung eines Programms zur Authentifizierung auszuspähen. Ich versuchte nun mit Malwarebytes Anti-Malware das Problem zu lösen, nach der Entfernung von gefundenen 116 Objekten war der Fehler immer noch vorhanden. Anschließend habe ich nach der Board-Anleitung die notwendigen Aufgaben erledigt (siehe Anhang). Ich hoffe auf Hilfe durch das Board-Team und bedanke mich im voraus herzlichst. Mit freundlichen Grüßen axel64 |
|
16.09.2013, 12:35
| #2 |
| /// TB-Ausbilder   | Postbank Online Banking Trojaner Hallo,
__________________hänge die Logfiles bitte nicht an (das erschwert mir das Auswerten massiv), sondern füge deren Inhalt direkt innerhalb von Codetags ein: [code]Inhalt Logfile[/code]. (Anleitung)) Wenn es zu viele Zeichen sind, dann teile die Logs auf mehrere Posts auf. Danke.
__________________ |
|
16.09.2013, 12:45
| #3 |
| | Postbank Online Banking TrojanerCode:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Stefan :: STEFAN-MSI [Administrator] Schutz: Aktiviert 16.09.2013 11:33:44 mbam-log-2013-09-16 (11-33-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 593956 Laufzeit: 34 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
16.09.2013, 12:54
| #4 |
| /// TB-Ausbilder | Postbank Online Banking Trojaner Ok, dann bitte noch die Logs von FRST und Gmer. 
__________________ cheers, Leo |
|
16.09.2013, 12:56
| #5 |
| | Postbank Online Banking Trojaner GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-16 11:03:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.DXM0 238,47GB
Running: nt3dd2h2.exe; Driver: C:\Users\Stefan\AppData\Local\Temp\ugrcqpob.sys
---- Threads - GMER 2.1 ----
Thread [760:3408] 0000000077602e65
Thread [760:3576] 00000000742dc59c
Thread [760:2056] 00000000742dc59c
Thread [760:4256] 00000000742dc59c
Thread [760:4444] 00000000742dc59c
Thread [760:4448] 00000000742dc59c
Thread [760:4452] 00000000742dc59c
Thread [760:4636] 00000000742dc59c
Thread [760:4928] 0000000077603e85
Thread [760:4932] 00000000742dc59c
Thread [760:2696] 00000000742dc59c
Thread [760:4280] 00000000742dc59c
Thread [760:5104] 00000000742dc59c
Thread [760:5096] 00000000742dc59c
Thread [760:5112] 00000000742dc59c
Thread [760:4200] 00000000742dc59c
Thread [760:4492] 00000000742dc59c
Thread [760:5024] 00000000742dc59c
Thread [760:7528] 0000000077603e85
Thread [760:3608] 0000000077603e85
Thread [760:3360] 0000000077603e85
Thread [760:3860] 0000000077603e85
Thread [760:7432] 0000000077603e85
Thread [760:7972] 0000000077603e85
Thread [760:5504] 0000000077603e85
Thread C:\windows\SysWOW64\explorer.exe [4472:5600] 0000000000226384
Thread C:\windows\SysWOW64\explorer.exe [4472:6068] 00000000002261d4
Thread C:\windows\SysWOW64\explorer.exe [4472:6080] 0000000000218420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6748:6808] 0000000002d18420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5576:6712] 0000000003328420
Thread C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [6688:6624] 0000000002988420
---- EOF - GMER 2.1 ----
|
|
16.09.2013, 13:04
| #6 |
| /// TB-Ausbilder | Postbank Online Banking Trojaner Jetzt nur noch die FRST.txt und die Addition.txt und dann können wir loslegen.
__________________ --> Postbank Online Banking Trojaner |
|
16.09.2013, 17:56
| #7 |
| | Postbank Online Banking TrojanerCode:
ATTFilter can result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 01
Ran by Stefan (administrator) on STEFAN-MSI on 16-09-2013 10:54:22
Running from C:\Users\Stefan\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(B.H.A Corporation) C:\Windows\SysWOW64\bgsvcgen.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(SafeNet Inc.) C:\windows\system32\hasplms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
() C:\Program Files (x86)\QNAP\Qfinder\iSCSIAgent.exe
(Expert System S.p.A.) C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Funkwerk Enterprise Communications GmbH) C:\Program Files (x86)\funkwerk WIN-Tools\Eumex 401 WIN-Tools V1.00\ControlCenter.exe
(Grass Valley K.K.) C:\Program Files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe
(Alexander Miehlke Softwareentwicklung) C:\Program Files (x86)\TraXEx\TraXEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
(Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe
(Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
(msi) C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe
(MSI) C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe
(msi) C:\Program Files (x86)\MSI\msi LED Manager\SLM.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD11\PDVD11Serv.exe
(Flexera Software LLC) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Bibliographisches Institut GmbH) C:\Program Files (x86)\Duden\Duden-Bibliothek\dudenbib.exe
(Microsoft Corporation) C:\windows\splwow64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(T-Systems Enterprise Services GmbH) C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_8_800_174_ActiveX.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11777128 2011-02-14] (Realtek Semiconductor)
HKLM\...\Run: [fspuip] - C:\Program Files\FSP\fspuip.exe [3650048 2010-06-07] (Sentelic Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [THXCfg64] - C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [Ocs_SM] - C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-12-13] (OCS)
HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
MountPoints2: {228c794e-8f07-11e1-bfee-806e6f6e6963} - E:\start.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [MGSysCtrl] - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2010-11-05] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII AP] - C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe [200192 2011-01-25] (Micro-Star Int'l Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII Controler] - C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe [1689600 2010-06-25] (msi)
HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1351680 2010-11-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [NVIDIAOCAP] - C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe [83456 2010-10-20] (MSI)
HKLM-x32\...\Run: [msi LED Manager] - C:\Program Files (x86)\msi\msi LED Manager\SLM.exe [2795008 2010-07-29] (msi)
HKLM-x32\...\Run: [Contour Shuttle Device Helper] - C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe [118784 2011-02-14] (Contour Design, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [x]
HKLM-x32\...\Run: [UpdatePPShortCut] - "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [x]
HKLM-x32\...\Run: [UCam_Menu] - "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [x]
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [222504 2010-12-08] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [RemoteControl11] - C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe [234792 2011-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] ()
HKU\Default\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKU\Default User\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
IMEO\cdlabelprint.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\hdtach.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\keyfinder.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\mediashow.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\olrsubmission.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\power2go.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\power2goexpress.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\powerstarter.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\producer.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\startapplication.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\uninstal.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\waveeditor.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\youcam.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://msi.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKLM - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSI2DF&pc=MAM2&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=ef14dcd2-9a4c-2d73-24db-3649f51ed688&searchtype=ds&q={searchTerms}&installDate=11/09/2013
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKCU - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}&crg=3.5000006.10053&st=23
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=ef14dcd2-9a4c-2d73-24db-3649f51ed688&searchtype=ds&q={searchTerms}&installDate=11/09/2013
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://isearch.babylon.com/?q={searchTerms}&babsrc=SP_ss_Btisdt4&mntrId=E818DCA97144C06F&affID=120695&tsp=5002
SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}&crg=3.5000006.10053&st=23
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Updater By Sweetpacks - {DEDAF650-12B8-48f5-A843-BBA100716106} - No File
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
BHO-x32: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default
FF user.js: detected! => C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js
FF Homepage: user_pref("browser.startup.homepage", );
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\sweetim.xml
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF Extension: jid0-UVAeBCfd34Kk5usS8A1CBiobvM8 - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi
FF Extension: No Name - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
FF HKLM\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Updater By Sweetpacks\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Updater By Sweetpacks\Firefox
FF HKCU\...\Firefox\Extensions: [{af9433c0-d475-48fd-8223-97aab85432eb}] - C:\Program Files (x86)\TubeSaver\133.xpi
FF Extension: No Name - C:\Program Files (x86)\TubeSaver\133.xpi
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 hasplms; C:\windows\system32\hasplms.exe [4466120 2013-03-15] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-17] (MSI)
R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
S4 SearchAnonymizer; C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-12-13] ()
R2 ShuttleEngine; C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe [86016 2011-02-14] (Contour Design, Inc.)
R3 TDslMgrService; C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-09-09] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.)
S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [63944 2013-03-15] (SafeNet Inc.)
S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 cdrblock; C:\Windows\System32\DRIVERS\cdrblock.sys [37704 2013-04-25] (Grass Valley K.K.)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331144 2013-03-15] (SafeNet Inc.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-07-13] (SafeNet, Inc.)
S3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [58664 2009-07-13] (SafeNet, Inc.)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)
S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [x]
S3 PLTurbh; system32\drivers\plturbh.sys [x]
S3 PLTurbo; system32\drivers\plturbo.sys [x]can result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 01
Ran by Stefan (administrator) on STEFAN-MSI on 16-09-2013 10:54:22
Running from C:\Users\Stefan\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(B.H.A Corporation) C:\Windows\SysWOW64\bgsvcgen.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(SafeNet Inc.) C:\windows\system32\hasplms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
() C:\Program Files (x86)\QNAP\Qfinder\iSCSIAgent.exe
(Expert System S.p.A.) C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Funkwerk Enterprise Communications GmbH) C:\Program Files (x86)\funkwerk WIN-Tools\Eumex 401 WIN-Tools V1.00\ControlCenter.exe
(Grass Valley K.K.) C:\Program Files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe
(Alexander Miehlke Softwareentwicklung) C:\Program Files (x86)\TraXEx\TraXEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
(Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe
(Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
(msi) C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe
(MSI) C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe
(msi) C:\Program Files (x86)\MSI\msi LED Manager\SLM.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD11\PDVD11Serv.exe
(Flexera Software LLC) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Bibliographisches Institut GmbH) C:\Program Files (x86)\Duden\Duden-Bibliothek\dudenbib.exe
(Microsoft Corporation) C:\windows\splwow64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(T-Systems Enterprise Services GmbH) C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_8_800_174_ActiveX.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11777128 2011-02-14] (Realtek Semiconductor)
HKLM\...\Run: [fspuip] - C:\Program Files\FSP\fspuip.exe [3650048 2010-06-07] (Sentelic Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [THXCfg64] - C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [Ocs_SM] - C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-12-13] (OCS)
HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
MountPoints2: {228c794e-8f07-11e1-bfee-806e6f6e6963} - E:\start.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [MGSysCtrl] - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2010-11-05] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII AP] - C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe [200192 2011-01-25] (Micro-Star Int'l Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII Controler] - C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe [1689600 2010-06-25] (msi)
HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1351680 2010-11-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [NVIDIAOCAP] - C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe [83456 2010-10-20] (MSI)
HKLM-x32\...\Run: [msi LED Manager] - C:\Program Files (x86)\msi\msi LED Manager\SLM.exe [2795008 2010-07-29] (msi)
HKLM-x32\...\Run: [Contour Shuttle Device Helper] - C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe [118784 2011-02-14] (Contour Design, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [x]
HKLM-x32\...\Run: [UpdatePPShortCut] - "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [x]
HKLM-x32\...\Run: [UCam_Menu] - "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [x]
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [222504 2010-12-08] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [RemoteControl11] - C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe [234792 2011-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] ()
HKU\Default\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKU\Default User\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
IMEO\cdlabelprint.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\hdtach.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\keyfinder.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\mediashow.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\olrsubmission.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\power2go.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\power2goexpress.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\powerstarter.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\producer.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\startapplication.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\uninstal.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\waveeditor.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\youcam.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://msi.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKLM - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSI2DF&pc=MAM2&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=ef14dcd2-9a4c-2d73-24db-3649f51ed688&searchtype=ds&q={searchTerms}&installDate=11/09/2013
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKCU - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}&crg=3.5000006.10053&st=23
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=ef14dcd2-9a4c-2d73-24db-3649f51ed688&searchtype=ds&q={searchTerms}&installDate=11/09/2013
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://isearch.babylon.com/?q={searchTerms}&babsrc=SP_ss_Btisdt4&mntrId=E818DCA97144C06F&affID=120695&tsp=5002
SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}&crg=3.5000006.10053&st=23
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Updater By Sweetpacks - {DEDAF650-12B8-48f5-A843-BBA100716106} - No File
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
BHO-x32: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default
FF user.js: detected! => C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js
FF Homepage: user_pref("browser.startup.homepage", );
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\sweetim.xml
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF Extension: jid0-UVAeBCfd34Kk5usS8A1CBiobvM8 - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi
FF Extension: No Name - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
FF HKLM\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Updater By Sweetpacks\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Updater By Sweetpacks\Firefox
FF HKCU\...\Firefox\Extensions: [{af9433c0-d475-48fd-8223-97aab85432eb}] - C:\Program Files (x86)\TubeSaver\133.xpi
FF Extension: No Name - C:\Program Files (x86)\TubeSaver\133.xpi
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 hasplms; C:\windows\system32\hasplms.exe [4466120 2013-03-15] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-17] (MSI)
R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
S4 SearchAnonymizer; C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-12-13] ()
R2 ShuttleEngine; C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe [86016 2011-02-14] (Contour Design, Inc.)
R3 TDslMgrService; C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-09-09] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.)
S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [63944 2013-03-15] (SafeNet Inc.)
S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 cdrblock; C:\Windows\System32\DRIVERS\cdrblock.sys [37704 2013-04-25] (Grass Valley K.K.)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331144 2013-03-15] (SafeNet Inc.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-07-13] (SafeNet, Inc.)
S3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [58664 2009-07-13] (SafeNet, Inc.)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)
S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [x]
S3 PLTurbh; system32\drivers\plturbh.sys [x]
S3 PLTurbo; system32\drivers\plturbo.sys [x]can result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 01
Ran by Stefan (administrator) on STEFAN-MSI on 16-09-2013 10:54:22
Running from C:\Users\Stefan\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(B.H.A Corporation) C:\Windows\SysWOW64\bgsvcgen.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(SafeNet Inc.) C:\windows\system32\hasplms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
() C:\Program Files (x86)\QNAP\Qfinder\iSCSIAgent.exe
(Expert System S.p.A.) C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Funkwerk Enterprise Communications GmbH) C:\Program Files (x86)\funkwerk WIN-Tools\Eumex 401 WIN-Tools V1.00\ControlCenter.exe
(Grass Valley K.K.) C:\Program Files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe
(Alexander Miehlke Softwareentwicklung) C:\Program Files (x86)\TraXEx\TraXEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
(Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe
(Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
(msi) C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe
(MSI) C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe
(msi) C:\Program Files (x86)\MSI\msi LED Manager\SLM.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD11\PDVD11Serv.exe
(Flexera Software LLC) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Bibliographisches Institut GmbH) C:\Program Files (x86)\Duden\Duden-Bibliothek\dudenbib.exe
(Microsoft Corporation) C:\windows\splwow64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(T-Systems Enterprise Services GmbH) C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_8_800_174_ActiveX.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11777128 2011-02-14] (Realtek Semiconductor)
HKLM\...\Run: [fspuip] - C:\Program Files\FSP\fspuip.exe [3650048 2010-06-07] (Sentelic Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [THXCfg64] - C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [Ocs_SM] - C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-12-13] (OCS)
HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
MountPoints2: {228c794e-8f07-11e1-bfee-806e6f6e6963} - E:\start.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [MGSysCtrl] - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2010-11-05] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII AP] - C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe [200192 2011-01-25] (Micro-Star Int'l Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII Controler] - C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe [1689600 2010-06-25] (msi)
HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1351680 2010-11-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [NVIDIAOCAP] - C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe [83456 2010-10-20] (MSI)
HKLM-x32\...\Run: [msi LED Manager] - C:\Program Files (x86)\msi\msi LED Manager\SLM.exe [2795008 2010-07-29] (msi)
HKLM-x32\...\Run: [Contour Shuttle Device Helper] - C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe [118784 2011-02-14] (Contour Design, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [x]
HKLM-x32\...\Run: [UpdatePPShortCut] - "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [x]
HKLM-x32\...\Run: [UCam_Menu] - "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [x]
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [222504 2010-12-08] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [RemoteControl11] - C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe [234792 2011-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] ()
HKU\Default\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKU\Default User\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
IMEO\cdlabelprint.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\hdtach.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\keyfinder.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\mediashow.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\olrsubmission.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\power2go.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\power2goexpress.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\powerstarter.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\producer.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\startapplication.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\uninstal.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\waveeditor.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\youcam.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://msi.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKLM - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSI2DF&pc=MAM2&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=ef14dcd2-9a4c-2d73-24db-3649f51ed688&searchtype=ds&q={searchTerms}&installDate=11/09/2013
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKCU - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}&crg=3.5000006.10053&st=23
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=ef14dcd2-9a4c-2d73-24db-3649f51ed688&searchtype=ds&q={searchTerms}&installDate=11/09/2013
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://isearch.babylon.com/?q={searchTerms}&babsrc=SP_ss_Btisdt4&mntrId=E818DCA97144C06F&affID=120695&tsp=5002
SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}&crg=3.5000006.10053&st=23
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Updater By Sweetpacks - {DEDAF650-12B8-48f5-A843-BBA100716106} - No File
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
BHO-x32: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default
FF user.js: detected! => C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js
FF Homepage: user_pref("browser.startup.homepage", );
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\sweetim.xml
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF Extension: jid0-UVAeBCfd34Kk5usS8A1CBiobvM8 - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi
FF Extension: No Name - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
FF HKLM\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Updater By Sweetpacks\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Updater By Sweetpacks\Firefox
FF HKCU\...\Firefox\Extensions: [{af9433c0-d475-48fd-8223-97aab85432eb}] - C:\Program Files (x86)\TubeSaver\133.xpi
FF Extension: No Name - C:\Program Files (x86)\TubeSaver\133.xpi
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 hasplms; C:\windows\system32\hasplms.exe [4466120 2013-03-15] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-17] (MSI)
R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
S4 SearchAnonymizer; C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-12-13] ()
R2 ShuttleEngine; C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe [86016 2011-02-14] (Contour Design, Inc.)
R3 TDslMgrService; C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-09-09] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.)
S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [63944 2013-03-15] (SafeNet Inc.)
S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 cdrblock; C:\Windows\System32\DRIVERS\cdrblock.sys [37704 2013-04-25] (Grass Valley K.K.)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331144 2013-03-15] (SafeNet Inc.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-07-13] (SafeNet, Inc.)
S3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [58664 2009-07-13] (SafeNet, Inc.)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)
S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [x]
S3 PLTurbh; system32\drivers\plturbh.sys [x]
S3 PLTurbo; system32\drivers\plturbo.sys [x]can result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 01
Ran by Stefan (administrator) on STEFAN-MSI on 16-09-2013 10:54:22
Running from C:\Users\Stefan\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(B.H.A Corporation) C:\Windows\SysWOW64\bgsvcgen.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(SafeNet Inc.) C:\windows\system32\hasplms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
() C:\Program Files (x86)\QNAP\Qfinder\iSCSIAgent.exe
(Expert System S.p.A.) C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Funkwerk Enterprise Communications GmbH) C:\Program Files (x86)\funkwerk WIN-Tools\Eumex 401 WIN-Tools V1.00\ControlCenter.exe
(Grass Valley K.K.) C:\Program Files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe
(Alexander Miehlke Softwareentwicklung) C:\Program Files (x86)\TraXEx\TraXEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
(Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe
(Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
(msi) C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe
(MSI) C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe
(msi) C:\Program Files (x86)\MSI\msi LED Manager\SLM.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD11\PDVD11Serv.exe
(Flexera Software LLC) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Bibliographisches Institut GmbH) C:\Program Files (x86)\Duden\Duden-Bibliothek\dudenbib.exe
(Microsoft Corporation) C:\windows\splwow64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(T-Systems Enterprise Services GmbH) C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_8_800_174_ActiveX.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11777128 2011-02-14] (Realtek Semiconductor)
HKLM\...\Run: [fspuip] - C:\Program Files\FSP\fspuip.exe [3650048 2010-06-07] (Sentelic Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [THXCfg64] - C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [Ocs_SM] - C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-12-13] (OCS)
HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
MountPoints2: {228c794e-8f07-11e1-bfee-806e6f6e6963} - E:\start.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [MGSysCtrl] - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2010-11-05] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII AP] - C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe [200192 2011-01-25] (Micro-Star Int'l Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII Controler] - C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe [1689600 2010-06-25] (msi)
HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1351680 2010-11-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [NVIDIAOCAP] - C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe [83456 2010-10-20] (MSI)
HKLM-x32\...\Run: [msi LED Manager] - C:\Program Files (x86)\msi\msi LED Manager\SLM.exe [2795008 2010-07-29] (msi)
HKLM-x32\...\Run: [Contour Shuttle Device Helper] - C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe [118784 2011-02-14] (Contour Design, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [x]
HKLM-x32\...\Run: [UpdatePPShortCut] - "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [x]
HKLM-x32\...\Run: [UCam_Menu] - "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [x]
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [222504 2010-12-08] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [RemoteControl11] - C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe [234792 2011-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] ()
HKU\Default\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKU\Default User\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
IMEO\cdlabelprint.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\hdtach.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\keyfinder.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\mediashow.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\olrsubmission.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\power2go.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\power2goexpress.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\powerstarter.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\producer.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\startapplication.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\uninstal.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\waveeditor.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
IMEO\youcam.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://msi.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKLM - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSI2DF&pc=MAM2&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=ef14dcd2-9a4c-2d73-24db-3649f51ed688&searchtype=ds&q={searchTerms}&installDate=11/09/2013
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}
SearchScopes: HKCU - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}&crg=3.5000006.10053&st=23
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=DE&userid=ef14dcd2-9a4c-2d73-24db-3649f51ed688&searchtype=ds&q={searchTerms}&installDate=11/09/2013
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://isearch.babylon.com/?q={searchTerms}&babsrc=SP_ss_Btisdt4&mntrId=E818DCA97144C06F&affID=120695&tsp=5002
SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}&crg=3.5000006.10053&st=23
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Updater By Sweetpacks - {DEDAF650-12B8-48f5-A843-BBA100716106} - No File
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
BHO-x32: QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - QuickStores-Toolbar - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default
FF user.js: detected! => C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js
FF Homepage: user_pref("browser.startup.homepage", );
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\sweetim.xml
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml
FF SearchPlugin: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF Extension: jid0-UVAeBCfd34Kk5usS8A1CBiobvM8 - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi
FF Extension: No Name - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
FF HKLM\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Updater By Sweetpacks\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Updater By Sweetpacks\Firefox
FF HKCU\...\Firefox\Extensions: [{af9433c0-d475-48fd-8223-97aab85432eb}] - C:\Program Files (x86)\TubeSaver\133.xpi
FF Extension: No Name - C:\Program Files (x86)\TubeSaver\133.xpi
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 hasplms; C:\windows\system32\hasplms.exe [4466120 2013-03-15] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-17] (MSI)
R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
S4 SearchAnonymizer; C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-12-13] ()
R2 ShuttleEngine; C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe [86016 2011-02-14] (Contour Design, Inc.)
R3 TDslMgrService; C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-09-09] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.)
S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [63944 2013-03-15] (SafeNet Inc.)
S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 cdrblock; C:\Windows\System32\DRIVERS\cdrblock.sys [37704 2013-04-25] (Grass Valley K.K.)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331144 2013-03-15] (SafeNet Inc.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.006\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-07-13] (SafeNet, Inc.)
S3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [58664 2009-07-13] (SafeNet, Inc.)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)
S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [x]
S3 PLTurbh; system32\drivers\plturbh.sys [x]
S3 PLTurbo; system32\drivers\plturbo.sys [x]
|
|
16.09.2013, 18:04
| #8 |
| | Postbank Online Banking Trojaner ==================== One Month Created Files and Folders ======== 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-15 21:46 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2013-09-13 18:59 - 2013-09-14 06:19 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:59 - 2013-08-22 18:36 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-09-13 18:47 - 2013-09-14 02:04 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-13 18:47 - 2013-09-14 02:04 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 11:54 - 2013-09-13 13:55 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-12 21:19 - 2013-09-12 21:20 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:30 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2013-09-12 18:30 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe 2013-09-12 18:30 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe 2013-09-12 18:28 - 2013-09-12 18:30 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2013-09-01 17:08 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-09-12 18:17 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys 2013-09-12 18:17 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys 2013-09-12 18:17 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe 2013-09-12 18:17 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe 2013-09-12 18:17 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe 2013-09-12 18:17 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:30 - 2013-09-13 07:41 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-07-17 18:20 - 01648432 _____ C:\windows\system32\dmwu.exe 2013-09-12 17:30 - 2013-07-17 18:17 - 00033792 _____ (IncrediMail, Ltd.) C:\windows\system32\ImHttpComm.dll 2013-09-12 15:22 - 2013-03-23 12:51 - 00375832 _____ (proDAD GmbH) C:\windows\system32\proDAD-PA-Support.dll 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:47 - 2013-09-12 12:48 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-11 17:33 - 2013-09-11 17:34 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:46 - 2013-09-11 14:47 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 09:51 - 2013-09-16 07:21 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-11 09:51 - 2013-09-15 22:07 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-09 15:29 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-11 06:59 - 2013-09-09 15:29 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 12:24 - 2013-09-09 18:40 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 10:51 - 2013-09-09 15:29 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-05 10:51 - 2013-09-09 15:29 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-05 10:51 - 2013-09-09 15:29 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-05 10:50 - 2013-09-11 06:59 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-05 10:49 - 2013-09-05 10:55 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-04 12:24 - 2013-09-04 12:27 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 18:33 - 2013-09-11 17:31 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-24 21:59 - 2013-09-09 18:55 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:24 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox ==================== One Month Created Files and Folders ======== 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-15 21:46 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2013-09-13 18:59 - 2013-09-14 06:19 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:59 - 2013-08-22 18:36 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-09-13 18:47 - 2013-09-14 02:04 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-13 18:47 - 2013-09-14 02:04 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 11:54 - 2013-09-13 13:55 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-12 21:19 - 2013-09-12 21:20 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:30 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2013-09-12 18:30 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe 2013-09-12 18:30 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe 2013-09-12 18:28 - 2013-09-12 18:30 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2013-09-01 17:08 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-09-12 18:17 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys 2013-09-12 18:17 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys 2013-09-12 18:17 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe 2013-09-12 18:17 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe 2013-09-12 18:17 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe 2013-09-12 18:17 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:30 - 2013-09-13 07:41 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-07-17 18:20 - 01648432 _____ C:\windows\system32\dmwu.exe 2013-09-12 17:30 - 2013-07-17 18:17 - 00033792 _____ (IncrediMail, Ltd.) C:\windows\system32\ImHttpComm.dll 2013-09-12 15:22 - 2013-03-23 12:51 - 00375832 _____ (proDAD GmbH) C:\windows\system32\proDAD-PA-Support.dll 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:47 - 2013-09-12 12:48 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-11 17:33 - 2013-09-11 17:34 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:46 - 2013-09-11 14:47 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 09:51 - 2013-09-16 07:21 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-11 09:51 - 2013-09-15 22:07 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-09 15:29 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-11 06:59 - 2013-09-09 15:29 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 12:24 - 2013-09-09 18:40 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 10:51 - 2013-09-09 15:29 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-05 10:51 - 2013-09-09 15:29 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-05 10:51 - 2013-09-09 15:29 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-05 10:50 - 2013-09-11 06:59 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-05 10:49 - 2013-09-05 10:55 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-04 12:24 - 2013-09-04 12:27 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 18:33 - 2013-09-11 17:31 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-24 21:59 - 2013-09-09 18:55 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:24 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox HTML-Code: ==================== One Month Created Files and Folders ======== 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-15 21:46 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2013-09-13 18:59 - 2013-09-14 06:19 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:59 - 2013-08-22 18:36 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-09-13 18:47 - 2013-09-14 02:04 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-13 18:47 - 2013-09-14 02:04 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 11:54 - 2013-09-13 13:55 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-12 21:19 - 2013-09-12 21:20 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:30 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2013-09-12 18:30 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe 2013-09-12 18:30 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe 2013-09-12 18:28 - 2013-09-12 18:30 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2013-09-01 17:08 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-09-12 18:17 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys 2013-09-12 18:17 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys 2013-09-12 18:17 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe 2013-09-12 18:17 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe 2013-09-12 18:17 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe 2013-09-12 18:17 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:30 - 2013-09-13 07:41 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-07-17 18:20 - 01648432 _____ C:\windows\system32\dmwu.exe 2013-09-12 17:30 - 2013-07-17 18:17 - 00033792 _____ (IncrediMail, Ltd.) C:\windows\system32\ImHttpComm.dll 2013-09-12 15:22 - 2013-03-23 12:51 - 00375832 _____ (proDAD GmbH) C:\windows\system32\proDAD-PA-Support.dll 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:47 - 2013-09-12 12:48 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-11 17:33 - 2013-09-11 17:34 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:46 - 2013-09-11 14:47 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 09:51 - 2013-09-16 07:21 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-11 09:51 - 2013-09-15 22:07 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-09 15:29 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-11 06:59 - 2013-09-09 15:29 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 12:24 - 2013-09-09 18:40 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 10:51 - 2013-09-09 15:29 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-05 10:51 - 2013-09-09 15:29 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-05 10:51 - 2013-09-09 15:29 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-05 10:50 - 2013-09-11 06:59 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-05 10:49 - 2013-09-05 10:55 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-04 12:24 - 2013-09-04 12:27 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 18:33 - 2013-09-11 17:31 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-24 21:59 - 2013-09-09 18:55 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:24 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox ==================== One Month Created Files and Folders ======== 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-15 21:46 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2013-09-13 18:59 - 2013-09-14 06:19 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:59 - 2013-08-22 18:36 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-09-13 18:47 - 2013-09-14 02:04 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-13 18:47 - 2013-09-14 02:04 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 11:54 - 2013-09-13 13:55 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-12 21:19 - 2013-09-12 21:20 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:30 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2013-09-12 18:30 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe 2013-09-12 18:30 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe 2013-09-12 18:28 - 2013-09-12 18:30 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2013-09-01 17:08 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-09-12 18:17 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys 2013-09-12 18:17 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys 2013-09-12 18:17 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe 2013-09-12 18:17 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe 2013-09-12 18:17 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe 2013-09-12 18:17 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:30 - 2013-09-13 07:41 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-07-17 18:20 - 01648432 _____ C:\windows\system32\dmwu.exe 2013-09-12 17:30 - 2013-07-17 18:17 - 00033792 _____ (IncrediMail, Ltd.) C:\windows\system32\ImHttpComm.dll 2013-09-12 15:22 - 2013-03-23 12:51 - 00375832 _____ (proDAD GmbH) C:\windows\system32\proDAD-PA-Support.dll 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:47 - 2013-09-12 12:48 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-11 17:33 - 2013-09-11 17:34 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:46 - 2013-09-11 14:47 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 09:51 - 2013-09-16 07:21 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-11 09:51 - 2013-09-15 22:07 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-09 15:29 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-11 06:59 - 2013-09-09 15:29 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 12:24 - 2013-09-09 18:40 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 10:51 - 2013-09-09 15:29 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-05 10:51 - 2013-09-09 15:29 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-05 10:51 - 2013-09-09 15:29 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-05 10:50 - 2013-09-11 06:59 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-05 10:49 - 2013-09-05 10:55 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-04 12:24 - 2013-09-04 12:27 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 18:33 - 2013-09-11 17:31 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-24 21:59 - 2013-09-09 18:55 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:24 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox |
|
16.09.2013, 18:09
| #9 |
| /// TB-Ausbilder | Postbank Online Banking Trojaner Schritt 1 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 2 Scan mit Combofix
Schritt 3 Starte noch einmal FRST.
__________________ cheers, Leo |
|
16.09.2013, 18:20
| #10 |
| | Postbank Online Banking Trojaner ==================== One Month Modified Files and Folders ======= 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:52 - 2012-04-25 17:23 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:41 - 2012-04-25 11:51 - 00000000 ____D C:\Users\Stefan 2013-09-16 10:36 - 2012-04-26 19:34 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Skype 2013-09-16 10:27 - 2012-04-25 11:51 - 01423936 _____ C:\windows\WindowsUpdate.log 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:27 - 2011-09-27 01:54 - 00703192 _____ C:\windows\system32\perfh007.dat 2013-09-16 07:27 - 2011-09-27 01:54 - 00150800 _____ C:\windows\system32\perfc007.dat 2013-09-16 07:27 - 2009-07-14 07:13 - 01629284 _____ C:\windows\system32\PerfStringBackup.INI 2013-09-16 07:23 - 2012-04-25 17:23 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-09-16 07:22 - 2010-11-21 05:47 - 01386000 _____ C:\windows\PFRO.log 2013-09-16 07:22 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-09-16 07:22 - 2009-07-14 06:51 - 00098866 _____ C:\windows\setupact.log 2013-09-16 07:21 - 2013-09-11 09:51 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-15 22:07 - 2013-09-11 09:51 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-14 08:10 - 2009-07-14 07:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-09-14 07:12 - 2012-04-25 17:23 - 00000000 ____D C:\Program Files\Google 2013-09-14 07:12 - 2012-04-25 17:22 - 00000000 ____D C:\Program Files (x86)\Google 2013-09-14 07:02 - 2012-04-25 17:23 - 00000000 ____D C:\Users\Stefan\AppData\Local\Google 2013-09-14 07:02 - 2012-04-25 17:22 - 00000000 ____D C:\ProgramData\Google 2013-09-14 06:19 - 2013-09-13 18:59 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-14 05:56 - 2012-05-17 07:49 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-09-14 02:04 - 2013-09-13 18:47 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-14 02:04 - 2013-09-13 18:47 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 19:18 - 2012-06-14 14:57 - 01603564 _____ C:\windows\SysWOW64\PerfStringBackup.INI 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 13:55 - 2013-09-13 11:54 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-13 11:55 - 2011-09-27 03:16 - 00000000 ____D C:\ProgramData\Norton 2013-09-13 07:41 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 21:20 - 2013-09-12 21:19 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-09-12 18:31 - 2009-07-14 06:45 - 02459848 _____ C:\windows\system32\FNTCACHE.DAT 2013-09-12 18:30 - 2013-09-12 18:28 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2012-04-25 14:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:35 - 2012-05-03 19:13 - 00003694 _____ C:\windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-08-20 10:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-12 15:27 - 2012-04-25 12:44 - 00000000 ____D C:\Users\Stefan\Desktop\Video 2013-09-12 15:24 - 2012-06-15 10:51 - 00000000 ____D C:\Program Files\proDAD 2013-09-12 15:24 - 2012-04-25 17:58 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\proDAD 2013-09-12 15:22 - 2012-04-25 17:59 - 00000000 ____D C:\ProgramData\proDAD 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 13:41 - 2012-07-03 11:36 - 00000000 ____D C:\VisTitle 2013-09-12 13:38 - 2011-09-27 02:48 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-09-12 13:17 - 2012-04-25 17:35 - 00000000 ____D C:\Program Files (x86)\Grass Valley 2013-09-12 13:17 - 2012-04-25 17:34 - 00000000 ____D C:\Program Files\Common Files\Canopus Shared 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-12 12:40 - 2012-04-25 11:56 - 00000000 ____D C:\ProgramData\FLEXnet 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ___RD C:\Users\Stefan\Desktop\PC_Wartung 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ____D C:\Users\Stefan\Desktop\ELV_Software 2013-09-11 17:34 - 2013-09-11 17:33 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 17:31 - 2013-08-29 18:33 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:47 - 2013-09-11 14:46 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 14:47 - 2012-05-24 10:44 - 00000000 ____D C:\ProgramData\Apple Computer 2013-09-11 09:50 - 2012-09-10 09:02 - 00000000 ____D C:\Program Files (x86)\PicPick 2013-09-11 09:06 - 2012-09-10 08:36 - 00000000 ____D C:\Users\Stefan\Desktop\Zubehör Audio_Video 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-05 10:50 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-10 19:34 - 2012-09-12 18:29 - 00000000 ____D C:\Users\Stefan\AppData\Local\Downloaded Installations 2013-09-10 11:53 - 2012-10-07 09:36 - 00000000 ____D C:\Users\Stefan\Desktop\Navigation 2013-09-10 11:14 - 2012-04-25 14:19 - 00000400 _____ C:\windows\ODBC.INI 2013-09-10 09:56 - 2013-07-31 20:00 - 00000000 ____D C:\Users\Stefan\AppData\Local\CrashDumps 2013-09-10 09:18 - 2012-07-18 16:17 - 00000000 ____D C:\Program Files (x86)\TomTom HOME 2 2013-09-09 18:55 - 2013-08-24 21:59 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-09-09 18:40 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 15:29 - 2013-09-11 06:59 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-09 15:29 - 2013-09-11 06:59 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-09 15:29 - 2013-09-05 10:51 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 08:46 - 2012-06-01 14:35 - 00000000 ____D C:\HDW21_TMP 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-09 06:51 - 2012-05-17 07:49 - 00000000 ____D C:\Users\Stefan\AppData\Local\Microsoft Help 2013-09-07 17:44 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 12:34 - 2012-06-05 08:12 - 00000000 ____D C:\ProgramData\install_clap 2013-09-05 12:31 - 2012-04-26 18:42 - 00000000 ____D C:\ProgramData\CyberLink 2013-09-05 12:15 - 2013-07-27 18:06 - 00002970 _____ C:\windows\System32\Tasks\{D06ECEB9-4970-4B5D-A4DD-2DA24E0A3234} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{23F79AE3-DF5A-478D-A550-1D8278EE1228} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0AD664DE-2AE6-49FD-9A6D-762C10B0DF8C} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0A30D7CE-8DAD-4E6F-8B5A-E5F41D93044C} 2013-09-05 12:14 - 2012-05-24 11:03 - 00002992 _____ C:\windows\System32\Tasks\{AB2D36E9-F19F-4FF0-95F2-9D28AF878E3F} 2013-09-05 12:14 - 2012-05-24 07:32 - 00002980 _____ C:\windows\System32\Tasks\{D143519B-15B7-42D4-BF95-12144FF99D40} 2013-09-05 11:47 - 2012-04-25 17:23 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-09-05 11:47 - 2012-04-25 17:23 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-09-05 10:55 - 2013-09-05 10:49 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\TuneUp Software 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\ProgramData\TuneUp Software 2013-09-04 18:00 - 2012-04-29 17:13 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\vlc 2013-09-04 12:27 - 2013-09-04 12:24 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-09-03 16:22 - 2009-07-14 07:32 - 00000000 ____D C:\windows\system32\FxsTmp 2013-09-01 17:08 - 2013-09-12 18:28 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-22 18:36 - 2013-09-13 18:59 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-08-20 19:01 - 2012-09-10 08:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:35 - 2012-04-26 11:48 - 00000000 ____D C:\Users\Stefan\AppData\Local\Adobe 2013-08-17 11:09 - 2012-09-14 12:52 - 00607256 _____ (proDAD GmbH) C:\windows\system32\prodad-codec.dll ==================== One Month Modified Files and Folders ======= 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:52 - 2012-04-25 17:23 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:41 - 2012-04-25 11:51 - 00000000 ____D C:\Users\Stefan 2013-09-16 10:36 - 2012-04-26 19:34 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Skype 2013-09-16 10:27 - 2012-04-25 11:51 - 01423936 _____ C:\windows\WindowsUpdate.log 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:27 - 2011-09-27 01:54 - 00703192 _____ C:\windows\system32\perfh007.dat 2013-09-16 07:27 - 2011-09-27 01:54 - 00150800 _____ C:\windows\system32\perfc007.dat 2013-09-16 07:27 - 2009-07-14 07:13 - 01629284 _____ C:\windows\system32\PerfStringBackup.INI 2013-09-16 07:23 - 2012-04-25 17:23 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-09-16 07:22 - 2010-11-21 05:47 - 01386000 _____ C:\windows\PFRO.log 2013-09-16 07:22 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-09-16 07:22 - 2009-07-14 06:51 - 00098866 _____ C:\windows\setupact.log 2013-09-16 07:21 - 2013-09-11 09:51 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-15 22:07 - 2013-09-11 09:51 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-14 08:10 - 2009-07-14 07:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-09-14 07:12 - 2012-04-25 17:23 - 00000000 ____D C:\Program Files\Google 2013-09-14 07:12 - 2012-04-25 17:22 - 00000000 ____D C:\Program Files (x86)\Google 2013-09-14 07:02 - 2012-04-25 17:23 - 00000000 ____D C:\Users\Stefan\AppData\Local\Google 2013-09-14 07:02 - 2012-04-25 17:22 - 00000000 ____D C:\ProgramData\Google 2013-09-14 06:19 - 2013-09-13 18:59 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-14 05:56 - 2012-05-17 07:49 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-09-14 02:04 - 2013-09-13 18:47 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-14 02:04 - 2013-09-13 18:47 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 19:18 - 2012-06-14 14:57 - 01603564 _____ C:\windows\SysWOW64\PerfStringBackup.INI 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 13:55 - 2013-09-13 11:54 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-13 11:55 - 2011-09-27 03:16 - 00000000 ____D C:\ProgramData\Norton 2013-09-13 07:41 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 21:20 - 2013-09-12 21:19 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-09-12 18:31 - 2009-07-14 06:45 - 02459848 _____ C:\windows\system32\FNTCACHE.DAT 2013-09-12 18:30 - 2013-09-12 18:28 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2012-04-25 14:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:35 - 2012-05-03 19:13 - 00003694 _____ C:\windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-08-20 10:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-12 15:27 - 2012-04-25 12:44 - 00000000 ____D C:\Users\Stefan\Desktop\Video 2013-09-12 15:24 - 2012-06-15 10:51 - 00000000 ____D C:\Program Files\proDAD 2013-09-12 15:24 - 2012-04-25 17:58 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\proDAD 2013-09-12 15:22 - 2012-04-25 17:59 - 00000000 ____D C:\ProgramData\proDAD 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 13:41 - 2012-07-03 11:36 - 00000000 ____D C:\VisTitle 2013-09-12 13:38 - 2011-09-27 02:48 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-09-12 13:17 - 2012-04-25 17:35 - 00000000 ____D C:\Program Files (x86)\Grass Valley 2013-09-12 13:17 - 2012-04-25 17:34 - 00000000 ____D C:\Program Files\Common Files\Canopus Shared 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-12 12:40 - 2012-04-25 11:56 - 00000000 ____D C:\ProgramData\FLEXnet 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ___RD C:\Users\Stefan\Desktop\PC_Wartung 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ____D C:\Users\Stefan\Desktop\ELV_Software 2013-09-11 17:34 - 2013-09-11 17:33 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 17:31 - 2013-08-29 18:33 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:47 - 2013-09-11 14:46 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 14:47 - 2012-05-24 10:44 - 00000000 ____D C:\ProgramData\Apple Computer 2013-09-11 09:50 - 2012-09-10 09:02 - 00000000 ____D C:\Program Files (x86)\PicPick 2013-09-11 09:06 - 2012-09-10 08:36 - 00000000 ____D C:\Users\Stefan\Desktop\Zubehör Audio_Video 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-05 10:50 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-10 19:34 - 2012-09-12 18:29 - 00000000 ____D C:\Users\Stefan\AppData\Local\Downloaded Installations 2013-09-10 11:53 - 2012-10-07 09:36 - 00000000 ____D C:\Users\Stefan\Desktop\Navigation 2013-09-10 11:14 - 2012-04-25 14:19 - 00000400 _____ C:\windows\ODBC.INI 2013-09-10 09:56 - 2013-07-31 20:00 - 00000000 ____D C:\Users\Stefan\AppData\Local\CrashDumps 2013-09-10 09:18 - 2012-07-18 16:17 - 00000000 ____D C:\Program Files (x86)\TomTom HOME 2 2013-09-09 18:55 - 2013-08-24 21:59 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-09-09 18:40 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 15:29 - 2013-09-11 06:59 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-09 15:29 - 2013-09-11 06:59 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-09 15:29 - 2013-09-05 10:51 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 08:46 - 2012-06-01 14:35 - 00000000 ____D C:\HDW21_TMP 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-09 06:51 - 2012-05-17 07:49 - 00000000 ____D C:\Users\Stefan\AppData\Local\Microsoft Help 2013-09-07 17:44 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 12:34 - 2012-06-05 08:12 - 00000000 ____D C:\ProgramData\install_clap 2013-09-05 12:31 - 2012-04-26 18:42 - 00000000 ____D C:\ProgramData\CyberLink 2013-09-05 12:15 - 2013-07-27 18:06 - 00002970 _____ C:\windows\System32\Tasks\{D06ECEB9-4970-4B5D-A4DD-2DA24E0A3234} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{23F79AE3-DF5A-478D-A550-1D8278EE1228} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0AD664DE-2AE6-49FD-9A6D-762C10B0DF8C} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0A30D7CE-8DAD-4E6F-8B5A-E5F41D93044C} 2013-09-05 12:14 - 2012-05-24 11:03 - 00002992 _____ C:\windows\System32\Tasks\{AB2D36E9-F19F-4FF0-95F2-9D28AF878E3F} 2013-09-05 12:14 - 2012-05-24 07:32 - 00002980 _____ C:\windows\System32\Tasks\{D143519B-15B7-42D4-BF95-12144FF99D40} 2013-09-05 11:47 - 2012-04-25 17:23 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-09-05 11:47 - 2012-04-25 17:23 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-09-05 10:55 - 2013-09-05 10:49 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\TuneUp Software 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\ProgramData\TuneUp Software 2013-09-04 18:00 - 2012-04-29 17:13 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\vlc 2013-09-04 12:27 - 2013-09-04 12:24 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-09-03 16:22 - 2009-07-14 07:32 - 00000000 ____D C:\windows\system32\FxsTmp 2013-09-01 17:08 - 2013-09-12 18:28 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-22 18:36 - 2013-09-13 18:59 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-08-20 19:01 - 2012-09-10 08:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:35 - 2012-04-26 11:48 - 00000000 ____D C:\Users\Stefan\AppData\Local\Adobe 2013-08-17 11:09 - 2012-09-14 12:52 - 00607256 _____ (proDAD GmbH) C:\windows\system32\prodad-codec.dll ==================== One Month Modified Files and Folders ======= 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:52 - 2012-04-25 17:23 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:41 - 2012-04-25 11:51 - 00000000 ____D C:\Users\Stefan 2013-09-16 10:36 - 2012-04-26 19:34 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Skype 2013-09-16 10:27 - 2012-04-25 11:51 - 01423936 _____ C:\windows\WindowsUpdate.log 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:27 - 2011-09-27 01:54 - 00703192 _____ C:\windows\system32\perfh007.dat 2013-09-16 07:27 - 2011-09-27 01:54 - 00150800 _____ C:\windows\system32\perfc007.dat 2013-09-16 07:27 - 2009-07-14 07:13 - 01629284 _____ C:\windows\system32\PerfStringBackup.INI 2013-09-16 07:23 - 2012-04-25 17:23 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-09-16 07:22 - 2010-11-21 05:47 - 01386000 _____ C:\windows\PFRO.log 2013-09-16 07:22 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-09-16 07:22 - 2009-07-14 06:51 - 00098866 _____ C:\windows\setupact.log 2013-09-16 07:21 - 2013-09-11 09:51 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-15 22:07 - 2013-09-11 09:51 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-14 08:10 - 2009-07-14 07:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-09-14 07:12 - 2012-04-25 17:23 - 00000000 ____D C:\Program Files\Google 2013-09-14 07:12 - 2012-04-25 17:22 - 00000000 ____D C:\Program Files (x86)\Google 2013-09-14 07:02 - 2012-04-25 17:23 - 00000000 ____D C:\Users\Stefan\AppData\Local\Google 2013-09-14 07:02 - 2012-04-25 17:22 - 00000000 ____D C:\ProgramData\Google 2013-09-14 06:19 - 2013-09-13 18:59 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-14 05:56 - 2012-05-17 07:49 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-09-14 02:04 - 2013-09-13 18:47 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-14 02:04 - 2013-09-13 18:47 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 19:18 - 2012-06-14 14:57 - 01603564 _____ C:\windows\SysWOW64\PerfStringBackup.INI 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 13:55 - 2013-09-13 11:54 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-13 11:55 - 2011-09-27 03:16 - 00000000 ____D C:\ProgramData\Norton 2013-09-13 07:41 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 21:20 - 2013-09-12 21:19 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-09-12 18:31 - 2009-07-14 06:45 - 02459848 _____ C:\windows\system32\FNTCACHE.DAT 2013-09-12 18:30 - 2013-09-12 18:28 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2012-04-25 14:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:35 - 2012-05-03 19:13 - 00003694 _____ C:\windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-08-20 10:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-12 15:27 - 2012-04-25 12:44 - 00000000 ____D C:\Users\Stefan\Desktop\Video 2013-09-12 15:24 - 2012-06-15 10:51 - 00000000 ____D C:\Program Files\proDAD 2013-09-12 15:24 - 2012-04-25 17:58 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\proDAD 2013-09-12 15:22 - 2012-04-25 17:59 - 00000000 ____D C:\ProgramData\proDAD 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 13:41 - 2012-07-03 11:36 - 00000000 ____D C:\VisTitle 2013-09-12 13:38 - 2011-09-27 02:48 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-09-12 13:17 - 2012-04-25 17:35 - 00000000 ____D C:\Program Files (x86)\Grass Valley 2013-09-12 13:17 - 2012-04-25 17:34 - 00000000 ____D C:\Program Files\Common Files\Canopus Shared 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-12 12:40 - 2012-04-25 11:56 - 00000000 ____D C:\ProgramData\FLEXnet 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ___RD C:\Users\Stefan\Desktop\PC_Wartung 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ____D C:\Users\Stefan\Desktop\ELV_Software 2013-09-11 17:34 - 2013-09-11 17:33 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 17:31 - 2013-08-29 18:33 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:47 - 2013-09-11 14:46 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 14:47 - 2012-05-24 10:44 - 00000000 ____D C:\ProgramData\Apple Computer 2013-09-11 09:50 - 2012-09-10 09:02 - 00000000 ____D C:\Program Files (x86)\PicPick 2013-09-11 09:06 - 2012-09-10 08:36 - 00000000 ____D C:\Users\Stefan\Desktop\Zubehör Audio_Video 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-05 10:50 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-10 19:34 - 2012-09-12 18:29 - 00000000 ____D C:\Users\Stefan\AppData\Local\Downloaded Installations 2013-09-10 11:53 - 2012-10-07 09:36 - 00000000 ____D C:\Users\Stefan\Desktop\Navigation 2013-09-10 11:14 - 2012-04-25 14:19 - 00000400 _____ C:\windows\ODBC.INI 2013-09-10 09:56 - 2013-07-31 20:00 - 00000000 ____D C:\Users\Stefan\AppData\Local\CrashDumps 2013-09-10 09:18 - 2012-07-18 16:17 - 00000000 ____D C:\Program Files (x86)\TomTom HOME 2 2013-09-09 18:55 - 2013-08-24 21:59 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-09-09 18:40 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 15:29 - 2013-09-11 06:59 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-09 15:29 - 2013-09-11 06:59 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-09 15:29 - 2013-09-05 10:51 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 08:46 - 2012-06-01 14:35 - 00000000 ____D C:\HDW21_TMP 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-09 06:51 - 2012-05-17 07:49 - 00000000 ____D C:\Users\Stefan\AppData\Local\Microsoft Help 2013-09-07 17:44 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 12:34 - 2012-06-05 08:12 - 00000000 ____D C:\ProgramData\install_clap 2013-09-05 12:31 - 2012-04-26 18:42 - 00000000 ____D C:\ProgramData\CyberLink 2013-09-05 12:15 - 2013-07-27 18:06 - 00002970 _____ C:\windows\System32\Tasks\{D06ECEB9-4970-4B5D-A4DD-2DA24E0A3234} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{23F79AE3-DF5A-478D-A550-1D8278EE1228} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0AD664DE-2AE6-49FD-9A6D-762C10B0DF8C} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0A30D7CE-8DAD-4E6F-8B5A-E5F41D93044C} 2013-09-05 12:14 - 2012-05-24 11:03 - 00002992 _____ C:\windows\System32\Tasks\{AB2D36E9-F19F-4FF0-95F2-9D28AF878E3F} 2013-09-05 12:14 - 2012-05-24 07:32 - 00002980 _____ C:\windows\System32\Tasks\{D143519B-15B7-42D4-BF95-12144FF99D40} 2013-09-05 11:47 - 2012-04-25 17:23 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-09-05 11:47 - 2012-04-25 17:23 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-09-05 10:55 - 2013-09-05 10:49 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\TuneUp Software 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\ProgramData\TuneUp Software 2013-09-04 18:00 - 2012-04-29 17:13 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\vlc 2013-09-04 12:27 - 2013-09-04 12:24 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-09-03 16:22 - 2009-07-14 07:32 - 00000000 ____D C:\windows\system32\FxsTmp 2013-09-01 17:08 - 2013-09-12 18:28 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-22 18:36 - 2013-09-13 18:59 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-08-20 19:01 - 2012-09-10 08:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:35 - 2012-04-26 11:48 - 00000000 ____D C:\Users\Stefan\AppData\Local\Adobe 2013-08-17 11:09 - 2012-09-14 12:52 - 00607256 _____ (proDAD GmbH) C:\windows\system32\prodad-codec.dll Code:
ATTFilter ==================== One Month Modified Files and Folders ======= 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:52 - 2012-04-25 17:23 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:41 - 2012-04-25 11:51 - 00000000 ____D C:\Users\Stefan 2013-09-16 10:36 - 2012-04-26 19:34 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Skype 2013-09-16 10:27 - 2012-04-25 11:51 - 01423936 _____ C:\windows\WindowsUpdate.log 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:27 - 2011-09-27 01:54 - 00703192 _____ C:\windows\system32\perfh007.dat 2013-09-16 07:27 - 2011-09-27 01:54 - 00150800 _____ C:\windows\system32\perfc007.dat 2013-09-16 07:27 - 2009-07-14 07:13 - 01629284 _____ C:\windows\system32\PerfStringBackup.INI 2013-09-16 07:23 - 2012-04-25 17:23 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-09-16 07:22 - 2010-11-21 05:47 - 01386000 _____ C:\windows\PFRO.log 2013-09-16 07:22 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-09-16 07:22 - 2009-07-14 06:51 - 00098866 _____ C:\windows\setupact.log 2013-09-16 07:21 - 2013-09-11 09:51 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-15 22:07 - 2013-09-11 09:51 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-14 08:10 - 2009-07-14 07:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-09-14 07:12 - 2012-04-25 17:23 - 00000000 ____D C:\Program Files\Google 2013-09-14 07:12 - 2012-04-25 17:22 - 00000000 ____D C:\Program Files (x86)\Google 2013-09-14 07:02 - 2012-04-25 17:23 - 00000000 ____D C:\Users\Stefan\AppData\Local\Google 2013-09-14 07:02 - 2012-04-25 17:22 - 00000000 ____D C:\ProgramData\Google 2013-09-14 06:19 - 2013-09-13 18:59 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-14 05:56 - 2012-05-17 07:49 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-09-14 02:04 - 2013-09-13 18:47 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-14 02:04 - 2013-09-13 18:47 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 19:18 - 2012-06-14 14:57 - 01603564 _____ C:\windows\SysWOW64\PerfStringBackup.INI 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 13:55 - 2013-09-13 11:54 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-13 11:55 - 2011-09-27 03:16 - 00000000 ____D C:\ProgramData\Norton 2013-09-13 07:41 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 21:20 - 2013-09-12 21:19 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-09-12 18:31 - 2009-07-14 06:45 - 02459848 _____ C:\windows\system32\FNTCACHE.DAT 2013-09-12 18:30 - 2013-09-12 18:28 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2012-04-25 14:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:35 - 2012-05-03 19:13 - 00003694 _____ C:\windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-08-20 10:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-12 15:27 - 2012-04-25 12:44 - 00000000 ____D C:\Users\Stefan\Desktop\Video 2013-09-12 15:24 - 2012-06-15 10:51 - 00000000 ____D C:\Program Files\proDAD 2013-09-12 15:24 - 2012-04-25 17:58 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\proDAD 2013-09-12 15:22 - 2012-04-25 17:59 - 00000000 ____D C:\ProgramData\proDAD 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 13:41 - 2012-07-03 11:36 - 00000000 ____D C:\VisTitle 2013-09-12 13:38 - 2011-09-27 02:48 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-09-12 13:17 - 2012-04-25 17:35 - 00000000 ____D C:\Program Files (x86)\Grass Valley 2013-09-12 13:17 - 2012-04-25 17:34 - 00000000 ____D C:\Program Files\Common Files\Canopus Shared 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-12 12:40 - 2012-04-25 11:56 - 00000000 ____D C:\ProgramData\FLEXnet 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ___RD C:\Users\Stefan\Desktop\PC_Wartung 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ____D C:\Users\Stefan\Desktop\ELV_Software 2013-09-11 17:34 - 2013-09-11 17:33 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 17:31 - 2013-08-29 18:33 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:47 - 2013-09-11 14:46 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 14:47 - 2012-05-24 10:44 - 00000000 ____D C:\ProgramData\Apple Computer 2013-09-11 09:50 - 2012-09-10 09:02 - 00000000 ____D C:\Program Files (x86)\PicPick 2013-09-11 09:06 - 2012-09-10 08:36 - 00000000 ____D C:\Users\Stefan\Desktop\Zubehör Audio_Video 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-05 10:50 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-10 19:34 - 2012-09-12 18:29 - 00000000 ____D C:\Users\Stefan\AppData\Local\Downloaded Installations 2013-09-10 11:53 - 2012-10-07 09:36 - 00000000 ____D C:\Users\Stefan\Desktop\Navigation 2013-09-10 11:14 - 2012-04-25 14:19 - 00000400 _____ C:\windows\ODBC.INI 2013-09-10 09:56 - 2013-07-31 20:00 - 00000000 ____D C:\Users\Stefan\AppData\Local\CrashDumps 2013-09-10 09:18 - 2012-07-18 16:17 - 00000000 ____D C:\Program Files (x86)\TomTom HOME 2 2013-09-09 18:55 - 2013-08-24 21:59 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-09-09 18:40 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 15:29 - 2013-09-11 06:59 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-09 15:29 - 2013-09-11 06:59 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-09 15:29 - 2013-09-05 10:51 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 08:46 - 2012-06-01 14:35 - 00000000 ____D C:\HDW21_TMP 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-09 06:51 - 2012-05-17 07:49 - 00000000 ____D C:\Users\Stefan\AppData\Local\Microsoft Help 2013-09-07 17:44 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 12:34 - 2012-06-05 08:12 - 00000000 ____D C:\ProgramData\install_clap 2013-09-05 12:31 - 2012-04-26 18:42 - 00000000 ____D C:\ProgramData\CyberLink 2013-09-05 12:15 - 2013-07-27 18:06 - 00002970 _____ C:\windows\System32\Tasks\{D06ECEB9-4970-4B5D-A4DD-2DA24E0A3234} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{23F79AE3-DF5A-478D-A550-1D8278EE1228} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0AD664DE-2AE6-49FD-9A6D-762C10B0DF8C} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0A30D7CE-8DAD-4E6F-8B5A-E5F41D93044C} 2013-09-05 12:14 - 2012-05-24 11:03 - 00002992 _____ C:\windows\System32\Tasks\{AB2D36E9-F19F-4FF0-95F2-9D28AF878E3F} 2013-09-05 12:14 - 2012-05-24 07:32 - 00002980 _____ C:\windows\System32\Tasks\{D143519B-15B7-42D4-BF95-12144FF99D40} 2013-09-05 11:47 - 2012-04-25 17:23 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-09-05 11:47 - 2012-04-25 17:23 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-09-05 10:55 - 2013-09-05 10:49 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\TuneUp Software 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\ProgramData\TuneUp Software 2013-09-04 18:00 - 2012-04-29 17:13 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\vlc 2013-09-04 12:27 - 2013-09-04 12:24 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-09-03 16:22 - 2009-07-14 07:32 - 00000000 ____D C:\windows\system32\FxsTmp 2013-09-01 17:08 - 2013-09-12 18:28 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-22 18:36 - 2013-09-13 18:59 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-08-20 19:01 - 2012-09-10 08:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:35 - 2012-04-26 11:48 - 00000000 ____D C:\Users\Stefan\AppData\Local\Adobe 2013-08-17 11:09 - 2012-09-14 12:52 - 00607256 _____ (proDAD GmbH) C:\windows\system32\prodad-codec.dll ==================== One Month Modified Files and Folders ======= 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:52 - 2012-04-25 17:23 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:41 - 2012-04-25 11:51 - 00000000 ____D C:\Users\Stefan 2013-09-16 10:36 - 2012-04-26 19:34 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Skype 2013-09-16 10:27 - 2012-04-25 11:51 - 01423936 _____ C:\windows\WindowsUpdate.log 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:27 - 2011-09-27 01:54 - 00703192 _____ C:\windows\system32\perfh007.dat 2013-09-16 07:27 - 2011-09-27 01:54 - 00150800 _____ C:\windows\system32\perfc007.dat 2013-09-16 07:27 - 2009-07-14 07:13 - 01629284 _____ C:\windows\system32\PerfStringBackup.INI 2013-09-16 07:23 - 2012-04-25 17:23 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-09-16 07:22 - 2010-11-21 05:47 - 01386000 _____ C:\windows\PFRO.log 2013-09-16 07:22 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-09-16 07:22 - 2009-07-14 06:51 - 00098866 _____ C:\windows\setupact.log 2013-09-16 07:21 - 2013-09-11 09:51 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-15 22:07 - 2013-09-11 09:51 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-14 08:10 - 2009-07-14 07:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-09-14 07:12 - 2012-04-25 17:23 - 00000000 ____D C:\Program Files\Google 2013-09-14 07:12 - 2012-04-25 17:22 - 00000000 ____D C:\Program Files (x86)\Google 2013-09-14 07:02 - 2012-04-25 17:23 - 00000000 ____D C:\Users\Stefan\AppData\Local\Google 2013-09-14 07:02 - 2012-04-25 17:22 - 00000000 ____D C:\ProgramData\Google 2013-09-14 06:19 - 2013-09-13 18:59 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-14 05:56 - 2012-05-17 07:49 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-09-14 02:04 - 2013-09-13 18:47 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-14 02:04 - 2013-09-13 18:47 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 19:18 - 2012-06-14 14:57 - 01603564 _____ C:\windows\SysWOW64\PerfStringBackup.INI 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 13:55 - 2013-09-13 11:54 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-13 11:55 - 2011-09-27 03:16 - 00000000 ____D C:\ProgramData\Norton 2013-09-13 07:41 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 21:20 - 2013-09-12 21:19 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-09-12 18:31 - 2009-07-14 06:45 - 02459848 _____ C:\windows\system32\FNTCACHE.DAT 2013-09-12 18:30 - 2013-09-12 18:28 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2012-04-25 14:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:35 - 2012-05-03 19:13 - 00003694 _____ C:\windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-08-20 10:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-12 15:27 - 2012-04-25 12:44 - 00000000 ____D C:\Users\Stefan\Desktop\Video 2013-09-12 15:24 - 2012-06-15 10:51 - 00000000 ____D C:\Program Files\proDAD 2013-09-12 15:24 - 2012-04-25 17:58 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\proDAD 2013-09-12 15:22 - 2012-04-25 17:59 - 00000000 ____D C:\ProgramData\proDAD 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 13:41 - 2012-07-03 11:36 - 00000000 ____D C:\VisTitle 2013-09-12 13:38 - 2011-09-27 02:48 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-09-12 13:17 - 2012-04-25 17:35 - 00000000 ____D C:\Program Files (x86)\Grass Valley 2013-09-12 13:17 - 2012-04-25 17:34 - 00000000 ____D C:\Program Files\Common Files\Canopus Shared 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-12 12:40 - 2012-04-25 11:56 - 00000000 ____D C:\ProgramData\FLEXnet 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ___RD C:\Users\Stefan\Desktop\PC_Wartung 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ____D C:\Users\Stefan\Desktop\ELV_Software 2013-09-11 17:34 - 2013-09-11 17:33 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 17:31 - 2013-08-29 18:33 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:47 - 2013-09-11 14:46 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 14:47 - 2012-05-24 10:44 - 00000000 ____D C:\ProgramData\Apple Computer 2013-09-11 09:50 - 2012-09-10 09:02 - 00000000 ____D C:\Program Files (x86)\PicPick 2013-09-11 09:06 - 2012-09-10 08:36 - 00000000 ____D C:\Users\Stefan\Desktop\Zubehör Audio_Video 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-05 10:50 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-10 19:34 - 2012-09-12 18:29 - 00000000 ____D C:\Users\Stefan\AppData\Local\Downloaded Installations 2013-09-10 11:53 - 2012-10-07 09:36 - 00000000 ____D C:\Users\Stefan\Desktop\Navigation 2013-09-10 11:14 - 2012-04-25 14:19 - 00000400 _____ C:\windows\ODBC.INI 2013-09-10 09:56 - 2013-07-31 20:00 - 00000000 ____D C:\Users\Stefan\AppData\Local\CrashDumps 2013-09-10 09:18 - 2012-07-18 16:17 - 00000000 ____D C:\Program Files (x86)\TomTom HOME 2 2013-09-09 18:55 - 2013-08-24 21:59 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-09-09 18:40 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 15:29 - 2013-09-11 06:59 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-09 15:29 - 2013-09-11 06:59 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-09 15:29 - 2013-09-05 10:51 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 08:46 - 2012-06-01 14:35 - 00000000 ____D C:\HDW21_TMP 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-09 06:51 - 2012-05-17 07:49 - 00000000 ____D C:\Users\Stefan\AppData\Local\Microsoft Help 2013-09-07 17:44 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 12:34 - 2012-06-05 08:12 - 00000000 ____D C:\ProgramData\install_clap 2013-09-05 12:31 - 2012-04-26 18:42 - 00000000 ____D C:\ProgramData\CyberLink 2013-09-05 12:15 - 2013-07-27 18:06 - 00002970 _____ C:\windows\System32\Tasks\{D06ECEB9-4970-4B5D-A4DD-2DA24E0A3234} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{23F79AE3-DF5A-478D-A550-1D8278EE1228} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0AD664DE-2AE6-49FD-9A6D-762C10B0DF8C} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0A30D7CE-8DAD-4E6F-8B5A-E5F41D93044C} 2013-09-05 12:14 - 2012-05-24 11:03 - 00002992 _____ C:\windows\System32\Tasks\{AB2D36E9-F19F-4FF0-95F2-9D28AF878E3F} 2013-09-05 12:14 - 2012-05-24 07:32 - 00002980 _____ C:\windows\System32\Tasks\{D143519B-15B7-42D4-BF95-12144FF99D40} 2013-09-05 11:47 - 2012-04-25 17:23 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-09-05 11:47 - 2012-04-25 17:23 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-09-05 10:55 - 2013-09-05 10:49 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\TuneUp Software 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\ProgramData\TuneUp Software 2013-09-04 18:00 - 2012-04-29 17:13 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\vlc 2013-09-04 12:27 - 2013-09-04 12:24 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-09-03 16:22 - 2009-07-14 07:32 - 00000000 ____D C:\windows\system32\FxsTmp 2013-09-01 17:08 - 2013-09-12 18:28 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-22 18:36 - 2013-09-13 18:59 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-08-20 19:01 - 2012-09-10 08:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:35 - 2012-04-26 11:48 - 00000000 ____D C:\Users\Stefan\AppData\Local\Adobe 2013-08-17 11:09 - 2012-09-14 12:52 - 00607256 _____ (proDAD GmbH) C:\windows\system32\prodad-codec.dll ==================== One Month Modified Files and Folders ======= 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:52 - 2012-04-25 17:23 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:41 - 2012-04-25 11:51 - 00000000 ____D C:\Users\Stefan 2013-09-16 10:36 - 2012-04-26 19:34 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Skype 2013-09-16 10:27 - 2012-04-25 11:51 - 01423936 _____ C:\windows\WindowsUpdate.log 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:29 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-16 07:27 - 2011-09-27 01:54 - 00703192 _____ C:\windows\system32\perfh007.dat 2013-09-16 07:27 - 2011-09-27 01:54 - 00150800 _____ C:\windows\system32\perfc007.dat 2013-09-16 07:27 - 2009-07-14 07:13 - 01629284 _____ C:\windows\system32\PerfStringBackup.INI 2013-09-16 07:23 - 2012-04-25 17:23 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-09-16 07:22 - 2010-11-21 05:47 - 01386000 _____ C:\windows\PFRO.log 2013-09-16 07:22 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-09-16 07:22 - 2009-07-14 06:51 - 00098866 _____ C:\windows\setupact.log 2013-09-16 07:21 - 2013-09-11 09:51 - 00000000 ____D C:\Program Files (x86)\TubeSaver 2013-09-15 22:07 - 2013-09-11 09:51 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-14 08:10 - 2009-07-14 07:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-09-14 07:12 - 2012-04-25 17:23 - 00000000 ____D C:\Program Files\Google 2013-09-14 07:12 - 2012-04-25 17:22 - 00000000 ____D C:\Program Files (x86)\Google 2013-09-14 07:02 - 2012-04-25 17:23 - 00000000 ____D C:\Users\Stefan\AppData\Local\Google 2013-09-14 07:02 - 2012-04-25 17:22 - 00000000 ____D C:\ProgramData\Google 2013-09-14 06:19 - 2013-09-13 18:59 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Systweak 2013-09-14 05:56 - 2012-05-17 07:49 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-09-14 02:04 - 2013-09-13 18:47 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-14 02:04 - 2013-09-13 18:47 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 19:18 - 2012-06-14 14:57 - 01603564 _____ C:\windows\SysWOW64\PerfStringBackup.INI 2013-09-13 18:59 - 2013-09-13 18:59 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7300.dll 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 13:55 - 2013-09-13 11:54 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-13 11:55 - 2011-09-27 03:16 - 00000000 ____D C:\ProgramData\Norton 2013-09-13 07:41 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\jmdp 2013-09-12 21:20 - 2013-09-12 21:19 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-09-12 18:31 - 2009-07-14 06:45 - 02459848 _____ C:\windows\system32\FNTCACHE.DAT 2013-09-12 18:30 - 2013-09-12 18:28 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2012-04-25 14:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:35 - 2012-05-03 19:13 - 00003694 _____ C:\windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\WNLT 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\windows\SysWOW64\ARFC 2013-09-12 17:30 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-09-12 17:30 - 2013-08-20 10:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-12 15:27 - 2012-04-25 12:44 - 00000000 ____D C:\Users\Stefan\Desktop\Video 2013-09-12 15:24 - 2012-06-15 10:51 - 00000000 ____D C:\Program Files\proDAD 2013-09-12 15:24 - 2012-04-25 17:58 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\proDAD 2013-09-12 15:22 - 2012-04-25 17:59 - 00000000 ____D C:\ProgramData\proDAD 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 13:41 - 2012-07-03 11:36 - 00000000 ____D C:\VisTitle 2013-09-12 13:38 - 2011-09-27 02:48 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-09-12 13:17 - 2012-04-25 17:35 - 00000000 ____D C:\Program Files (x86)\Grass Valley 2013-09-12 13:17 - 2012-04-25 17:34 - 00000000 ____D C:\Program Files\Common Files\Canopus Shared 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-12 12:40 - 2012-04-25 11:56 - 00000000 ____D C:\ProgramData\FLEXnet 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ___RD C:\Users\Stefan\Desktop\PC_Wartung 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ____D C:\Users\Stefan\Desktop\ELV_Software 2013-09-11 17:34 - 2013-09-11 17:33 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 17:31 - 2013-08-29 18:33 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:47 - 2013-09-11 14:46 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 14:47 - 2012-05-24 10:44 - 00000000 ____D C:\ProgramData\Apple Computer 2013-09-11 09:50 - 2012-09-10 09:02 - 00000000 ____D C:\Program Files (x86)\PicPick 2013-09-11 09:06 - 2012-09-10 08:36 - 00000000 ____D C:\Users\Stefan\Desktop\Zubehör Audio_Video 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-05 10:50 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-10 19:34 - 2012-09-12 18:29 - 00000000 ____D C:\Users\Stefan\AppData\Local\Downloaded Installations 2013-09-10 11:53 - 2012-10-07 09:36 - 00000000 ____D C:\Users\Stefan\Desktop\Navigation 2013-09-10 11:14 - 2012-04-25 14:19 - 00000400 _____ C:\windows\ODBC.INI 2013-09-10 09:56 - 2013-07-31 20:00 - 00000000 ____D C:\Users\Stefan\AppData\Local\CrashDumps 2013-09-10 09:18 - 2012-07-18 16:17 - 00000000 ____D C:\Program Files (x86)\TomTom HOME 2 2013-09-09 18:55 - 2013-08-24 21:59 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-09-09 18:40 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 15:29 - 2013-09-11 06:59 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-09 15:29 - 2013-09-11 06:59 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-09 15:29 - 2013-09-05 10:51 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 08:46 - 2012-06-01 14:35 - 00000000 ____D C:\HDW21_TMP 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-09 06:51 - 2012-05-17 07:49 - 00000000 ____D C:\Users\Stefan\AppData\Local\Microsoft Help 2013-09-07 17:44 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 12:34 - 2012-06-05 08:12 - 00000000 ____D C:\ProgramData\install_clap 2013-09-05 12:31 - 2012-04-26 18:42 - 00000000 ____D C:\ProgramData\CyberLink 2013-09-05 12:15 - 2013-07-27 18:06 - 00002970 _____ C:\windows\System32\Tasks\{D06ECEB9-4970-4B5D-A4DD-2DA24E0A3234} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{23F79AE3-DF5A-478D-A550-1D8278EE1228} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0AD664DE-2AE6-49FD-9A6D-762C10B0DF8C} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0A30D7CE-8DAD-4E6F-8B5A-E5F41D93044C} 2013-09-05 12:14 - 2012-05-24 11:03 - 00002992 _____ C:\windows\System32\Tasks\{AB2D36E9-F19F-4FF0-95F2-9D28AF878E3F} 2013-09-05 12:14 - 2012-05-24 07:32 - 00002980 _____ C:\windows\System32\Tasks\{D143519B-15B7-42D4-BF95-12144FF99D40} 2013-09-05 11:47 - 2012-04-25 17:23 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-09-05 11:47 - 2012-04-25 17:23 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-09-05 10:55 - 2013-09-05 10:49 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\TuneUp Software 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\ProgramData\TuneUp Software 2013-09-04 18:00 - 2012-04-29 17:13 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\vlc 2013-09-04 12:27 - 2013-09-04 12:24 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-09-03 16:22 - 2009-07-14 07:32 - 00000000 ____D C:\windows\system32\FxsTmp 2013-09-01 17:08 - 2013-09-12 18:28 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01159960 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csedvh.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-22 18:36 - 2013-09-13 18:59 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\windows\system32\roboot64.exe 2013-08-20 19:01 - 2012-09-10 08:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:35 - 2012-04-26 11:48 - 00000000 ____D C:\Users\Stefan\AppData\Local\Adobe 2013-08-17 11:09 - 2012-09-14 12:52 - 00607256 _____ (proDAD GmbH) C:\windows\system32\prodad-codec.dll ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================Files to move or delete: ==================== C:\Users\Public\AlexaNSISPlugin.7300.dll Some content of TEMP: ==================== C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe C:\Users\Stefan\AppData\Local\Temp\uninst1.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================ Code:
ATTFilter Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.7300.dll
Some content of TEMP:
====================
C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe
C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe
C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe
C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe
C:\Users\Stefan\AppData\Local\Temp\uninst1.exe
C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe
C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe
C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-12 18:50
==================== End Of Log ============================Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.7300.dll
Some content of TEMP:
====================
C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full32bit.exe
C:\Users\Stefan\AppData\Local\Temp\heroglyph-40-full64bit.exe
C:\Users\Stefan\AppData\Local\Temp\mercalli-20-plugins64bit.exe
C:\Users\Stefan\AppData\Local\Temp\spacksyahoo_717_active.exe
C:\Users\Stefan\AppData\Local\Temp\uninst1.exe
C:\Users\Stefan\AppData\Local\Temp\vitascene-11-edius.exe
C:\Users\Stefan\AppData\Local\Temp\vitascene-20-full64bit.exe
C:\Users\Stefan\AppData\Local\Temp\WSSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-12 18:50
==================== End Of Log ============================
|
|
16.09.2013, 18:39
| #11 |
| | Postbank Online Banking Trojaner # AdwCleaner v3.004 - Bericht erstellt am 16/09/2013 um 19:29:41 # Updated 15/09/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Stefan - STEFAN-MSI # Gestartet von : C:\Users\Stefan\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : SearchAnonymizer ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\boost_interprocess Ordner Gelöscht : C:\ProgramData\DSearchLink Ordner Gelöscht : C:\Program Files (x86)\SweetIM Ordner Gelöscht : C:\Program Files (x86)\tubesaver Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Ordner Gelöscht : C:\windows\assembly\GAC_MSIL\QuickStoresToolbar Ordner Gelöscht : C:\windows\SysWOW64\ARFC Ordner Gelöscht : C:\windows\SysWOW64\jmdp Ordner Gelöscht : C:\windows\SysWOW64\WNLT Ordner Gelöscht : C:\Users\Stefan\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Stefan\AppData\Local\Temp\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\boost_interprocess Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\Conduit Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\PriceGong Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\SweetIM Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\dvdvideosoftiehelpers Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\QuickStoresToolbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Systweak Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\jetpack Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Smartbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C} Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi Datei Gelöscht : C:\Uninstall.exe Datei Gelöscht : C:\windows\System32\dmwu.exe Datei Gelöscht : C:\windows\System32\ImhxxpComm.dll Datei Gelöscht : C:\windows\System32\roboot64.exe Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url Datei Gelöscht : C:\Users\Stefan\Desktop\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\SweetIm.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : HKCU\Software\Alexa Internet Schlüssel Gelöscht : HKCU\Software\distromatic Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\SmartBar Schlüssel Gelöscht : HKCU\Software\WNLT Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\TubeSaver Schlüssel Gelöscht : HKLM\Software\Babylon Schlüssel Gelöscht : HKLM\Software\systweak Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4E33CE5-A7AB-4F68-A7E7-F0AA84EF2D9E} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickStores-Toolbar_is1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer # AdwCleaner v3.004 - Bericht erstellt am 16/09/2013 um 19:29:41 # Updated 15/09/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Stefan - STEFAN-MSI # Gestartet von : C:\Users\Stefan\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : SearchAnonymizer ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\boost_interprocess Ordner Gelöscht : C:\ProgramData\DSearchLink Ordner Gelöscht : C:\Program Files (x86)\SweetIM Ordner Gelöscht : C:\Program Files (x86)\tubesaver Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Ordner Gelöscht : C:\windows\assembly\GAC_MSIL\QuickStoresToolbar Ordner Gelöscht : C:\windows\SysWOW64\ARFC Ordner Gelöscht : C:\windows\SysWOW64\jmdp Ordner Gelöscht : C:\windows\SysWOW64\WNLT Ordner Gelöscht : C:\Users\Stefan\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Stefan\AppData\Local\Temp\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\boost_interprocess Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\Conduit Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\PriceGong Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\SweetIM Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\dvdvideosoftiehelpers Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\QuickStoresToolbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Systweak Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\jetpack Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Smartbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C} Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi Datei Gelöscht : C:\Uninstall.exe Datei Gelöscht : C:\windows\System32\dmwu.exe Datei Gelöscht : C:\windows\System32\ImhxxpComm.dll Datei Gelöscht : C:\windows\System32\roboot64.exe Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url Datei Gelöscht : C:\Users\Stefan\Desktop\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\SweetIm.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : HKCU\Software\Alexa Internet Schlüssel Gelöscht : HKCU\Software\distromatic Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\SmartBar Schlüssel Gelöscht : HKCU\Software\WNLT Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\TubeSaver Schlüssel Gelöscht : HKLM\Software\Babylon Schlüssel Gelöscht : HKLM\Software\systweak Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4E33CE5-A7AB-4F68-A7E7-F0AA84EF2D9E} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickStores-Toolbar_is1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer # AdwCleaner v3.004 - Bericht erstellt am 16/09/2013 um 19:29:41 # Updated 15/09/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Stefan - STEFAN-MSI # Gestartet von : C:\Users\Stefan\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : SearchAnonymizer ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\boost_interprocess Ordner Gelöscht : C:\ProgramData\DSearchLink Ordner Gelöscht : C:\Program Files (x86)\SweetIM Ordner Gelöscht : C:\Program Files (x86)\tubesaver Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Ordner Gelöscht : C:\windows\assembly\GAC_MSIL\QuickStoresToolbar Ordner Gelöscht : C:\windows\SysWOW64\ARFC Ordner Gelöscht : C:\windows\SysWOW64\jmdp Ordner Gelöscht : C:\windows\SysWOW64\WNLT Ordner Gelöscht : C:\Users\Stefan\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Stefan\AppData\Local\Temp\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\boost_interprocess Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\Conduit Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\PriceGong Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\SweetIM Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\dvdvideosoftiehelpers Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\QuickStoresToolbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Systweak Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\jetpack Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Smartbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C} Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi Datei Gelöscht : C:\Uninstall.exe Datei Gelöscht : C:\windows\System32\dmwu.exe Datei Gelöscht : C:\windows\System32\ImhxxpComm.dll Datei Gelöscht : C:\windows\System32\roboot64.exe Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url Datei Gelöscht : C:\Users\Stefan\Desktop\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\SweetIm.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : HKCU\Software\Alexa Internet Schlüssel Gelöscht : HKCU\Software\distromatic Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\SmartBar Schlüssel Gelöscht : HKCU\Software\WNLT Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\TubeSaver Schlüssel Gelöscht : HKLM\Software\Babylon Schlüssel Gelöscht : HKLM\Software\systweak Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4E33CE5-A7AB-4F68-A7E7-F0AA84EF2D9E} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickStores-Toolbar_is1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer # AdwCleaner v3.004 - Bericht erstellt am 16/09/2013 um 19:29:41 # Updated 15/09/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Stefan - STEFAN-MSI # Gestartet von : C:\Users\Stefan\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : SearchAnonymizer ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\boost_interprocess Ordner Gelöscht : C:\ProgramData\DSearchLink Ordner Gelöscht : C:\Program Files (x86)\SweetIM Ordner Gelöscht : C:\Program Files (x86)\tubesaver Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Ordner Gelöscht : C:\windows\assembly\GAC_MSIL\QuickStoresToolbar Ordner Gelöscht : C:\windows\SysWOW64\ARFC Ordner Gelöscht : C:\windows\SysWOW64\jmdp Ordner Gelöscht : C:\windows\SysWOW64\WNLT Ordner Gelöscht : C:\Users\Stefan\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Stefan\AppData\Local\Temp\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\boost_interprocess Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\Conduit Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\PriceGong Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\SweetIM Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\dvdvideosoftiehelpers Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\QuickStoresToolbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Systweak Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\jetpack Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Smartbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C} Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi Datei Gelöscht : C:\Uninstall.exe Datei Gelöscht : C:\windows\System32\dmwu.exe Datei Gelöscht : C:\windows\System32\ImhxxpComm.dll Datei Gelöscht : C:\windows\System32\roboot64.exe Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url Datei Gelöscht : C:\Users\Stefan\Desktop\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\SweetIm.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : HKCU\Software\Alexa Internet Schlüssel Gelöscht : HKCU\Software\distromatic Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\SmartBar Schlüssel Gelöscht : HKCU\Software\WNLT Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\TubeSaver Schlüssel Gelöscht : HKLM\Software\Babylon Schlüssel Gelöscht : HKLM\Software\systweak Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4E33CE5-A7AB-4F68-A7E7-F0AA84EF2D9E} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickStores-Toolbar_is1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer # AdwCleaner v3.004 - Bericht erstellt am 16/09/2013 um 19:29:41 # Updated 15/09/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Stefan - STEFAN-MSI # Gestartet von : C:\Users\Stefan\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : SearchAnonymizer ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\boost_interprocess Ordner Gelöscht : C:\ProgramData\DSearchLink Ordner Gelöscht : C:\Program Files (x86)\SweetIM Ordner Gelöscht : C:\Program Files (x86)\tubesaver Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Ordner Gelöscht : C:\windows\assembly\GAC_MSIL\QuickStoresToolbar Ordner Gelöscht : C:\windows\SysWOW64\ARFC Ordner Gelöscht : C:\windows\SysWOW64\jmdp Ordner Gelöscht : C:\windows\SysWOW64\WNLT Ordner Gelöscht : C:\Users\Stefan\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Stefan\AppData\Local\Temp\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\boost_interprocess Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\Conduit Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\PriceGong Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\SweetIM Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\dvdvideosoftiehelpers Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\QuickStoresToolbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Systweak Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\jetpack Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Smartbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C} Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi Datei Gelöscht : C:\Uninstall.exe Datei Gelöscht : C:\windows\System32\dmwu.exe Datei Gelöscht : C:\windows\System32\ImhxxpComm.dll Datei Gelöscht : C:\windows\System32\roboot64.exe Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url Datei Gelöscht : C:\Users\Stefan\Desktop\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\SweetIm.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : HKCU\Software\Alexa Internet Schlüssel Gelöscht : HKCU\Software\distromatic Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\SmartBar Schlüssel Gelöscht : HKCU\Software\WNLT Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\TubeSaver Schlüssel Gelöscht : HKLM\Software\Babylon Schlüssel Gelöscht : HKLM\Software\systweak Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4E33CE5-A7AB-4F68-A7E7-F0AA84EF2D9E} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickStores-Toolbar_is1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer # AdwCleaner v3.004 - Bericht erstellt am 16/09/2013 um 19:29:41 # Updated 15/09/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Stefan - STEFAN-MSI # Gestartet von : C:\Users\Stefan\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : SearchAnonymizer ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\boost_interprocess Ordner Gelöscht : C:\ProgramData\DSearchLink Ordner Gelöscht : C:\Program Files (x86)\SweetIM Ordner Gelöscht : C:\Program Files (x86)\tubesaver Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Ordner Gelöscht : C:\windows\assembly\GAC_MSIL\QuickStoresToolbar Ordner Gelöscht : C:\windows\SysWOW64\ARFC Ordner Gelöscht : C:\windows\SysWOW64\jmdp Ordner Gelöscht : C:\windows\SysWOW64\WNLT Ordner Gelöscht : C:\Users\Stefan\AppData\Local\PackageAware Ordner Gelöscht : C:\Users\Stefan\AppData\Local\Temp\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\boost_interprocess Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\Conduit Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\PriceGong Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\SweetIM Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\dvdvideosoftiehelpers Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\OCS Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\QuickStoresToolbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Systweak Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\jetpack Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Smartbar Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C} Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi Datei Gelöscht : C:\Uninstall.exe Datei Gelöscht : C:\windows\System32\dmwu.exe Datei Gelöscht : C:\windows\System32\ImhxxpComm.dll Datei Gelöscht : C:\windows\System32\roboot64.exe Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url Datei Gelöscht : C:\Users\Stefan\Desktop\QuickStores.url Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\SweetIm.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}] Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : HKCU\Software\Alexa Internet Schlüssel Gelöscht : HKCU\Software\distromatic Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\SmartBar Schlüssel Gelöscht : HKCU\Software\WNLT Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\TubeSaver Schlüssel Gelöscht : HKLM\Software\Babylon Schlüssel Gelöscht : HKLM\Software\systweak Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4E33CE5-A7AB-4F68-A7E7-F0AA84EF2D9E} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickStores-Toolbar_is1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WNLT Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer Code:
ATTFilter # AdwCleaner v3.004 - Bericht erstellt am 16/09/2013 um 19:29:41
# Updated 15/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Stefan - STEFAN-MSI
# Gestartet von : C:\Users\Stefan\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : SearchAnonymizer
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\DSearchLink
Ordner Gelöscht : C:\Program Files (x86)\SweetIM
Ordner Gelöscht : C:\Program Files (x86)\tubesaver
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\windows\assembly\GAC_MSIL\QuickStoresToolbar
Ordner Gelöscht : C:\windows\SysWOW64\ARFC
Ordner Gelöscht : C:\windows\SysWOW64\jmdp
Ordner Gelöscht : C:\windows\SysWOW64\WNLT
Ordner Gelöscht : C:\Users\Stefan\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Stefan\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Stefan\AppData\LocalLow\SweetIM
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\QuickStoresToolbar
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\jetpack
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Smartbar
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
Datei Gelöscht : C:\Uninstall.exe
Datei Gelöscht : C:\windows\System32\dmwu.exe
Datei Gelöscht : C:\windows\System32\ImhxxpComm.dll
Datei Gelöscht : C:\windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.url
Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\QuickStores.url
Datei Gelöscht : C:\Users\Stefan\Desktop\QuickStores.url
Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\SweetIm.xml
Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Sweetpacks Search.xml
Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\user.js
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}]
Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{8E9E3331-D360-4f87-8803-52DE43566502}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\Alexa Internet
Schlüssel Gelöscht : HKCU\Software\distromatic
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\WNLT
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\TubeSaver
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F4E33CE5-A7AB-4F68-A7E7-F0AA84EF2D9E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickStores-Toolbar_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\WNLT
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer
|
|
16.09.2013, 18:41
| #12 |
| | Postbank Online Banking TrojanerCode:
ATTFilter ***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\prefs.js ]
Zeile gelöscht : user_pref("CT2625848.1000082.isDisplayHidden", "true");
Zeile gelöscht : user_pref("CT2625848.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
Zeile gelöscht : user_pref("CT2625848.2625848a129894023611240511000000paramsGK1.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzc2OTg2OTE1MTk4LCJ1cGRhdGVSZXNwVGltZSI6MTM3Njk4NjkxNjI3OCwiZGF0YSI6eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3[...]
Zeile gelöscht : user_pref("CT2625848.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.FirstTime", "true");
Zeile gelöscht : user_pref("CT2625848.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT2625848.SF_JUST_INSTALLED.enc", "RkFMU0U=");
Zeile gelöscht : user_pref("CT2625848.SF_STATUS.enc", "RU5BQkxFRA==");
Zeile gelöscht : user_pref("CT2625848.SF_USER_ID.enc", "Y2lkXzEyNTIwMTMxNTExNzc0NDQyMjI=");
Zeile gelöscht : user_pref("CT2625848.SearchAppState.enc", "Mg==");
Zeile gelöscht : user_pref("CT2625848.SearchAppTracking.enc", "c2VudA==");
Zeile gelöscht : user_pref("CT2625848.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("CT2625848.UserID", "UN89771525767054553");
Zeile gelöscht : user_pref("CT2625848.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.browser.search.defaultthis.engineName", true);
Zeile gelöscht : user_pref("CT2625848.cb_experience_000.enc", "Mw==");
Zeile gelöscht : user_pref("CT2625848.cb_firstuse0100.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.cb_user_id_000.enc", "Q0IzMTk2OTc2ODE2NTVfMTM2ODM2NTMxMDMwMV9GaXJlZm94");
Zeile gelöscht : user_pref("CT2625848.cbfirsttime.enc", "U3VuIE1heSAxMiAyMDEzIDE1OjI4OjMwIEdNVCswMjAw");
Zeile gelöscht : user_pref("CT2625848.defaultSearch", "true");
Zeile gelöscht : user_pref("CT2625848.embeddedsData", "[{\"appId\":\"129181467799155027\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
Zeile gelöscht : user_pref("CT2625848.enableAlerts", "false");
Zeile gelöscht : user_pref("CT2625848.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT2625848.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.fixUrls", true);
Zeile gelöscht : user_pref("CT2625848.installId", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.installType", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT2625848.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT2625848.isNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2625848.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT2625848.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT2625848.keyword", true);
Zeile gelöscht : user_pref("CT2625848.mam_gk_appStateReportTime.enc", "MTM3Njk4NjkyMDY0Ng==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_CouponBuddy.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook_targeted.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_PriceGong.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_WindowShopper.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsInNjcmlwdFVybCI6bnVsbCwib3B0aW9uc0Rp[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_calledSetupService.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkVhc3l0b2Jvb2tfdGFyZ2V0ZWQiLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiJiZTEyZjA5Yi1mNTgxLTQ0OWItYjk2ZC01MDMwYzI2NzkwNDMiLCJ[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_currentVersion.enc", "MS4xMC4yLjU=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_eventsCache.enc", "eyIwNjdiODc4NS0xMDFjLTQxNWMtOGU5Mi0zZmJmN2I5NjUxZDciOnsidG9waWMiOiJzZW5kVXNhZ2UiLCJkYXRhIjp7ImNhdGVnb3J5IjoiV2VsY29tZSIsImFjdGlvbiI6IlZpZXcifSwidW5pcXVlS[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_existingUsersRecoveryDone.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_first_time.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_gadgetOpen.enc", "d2VsY29tZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_lastLoginTime.enc", "MTM3Njk4NjkxNjg5Nw==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50LVJpY2h0bGluaWUifSwiZ2FkZ2V0RGVzY3JpcHRpb25QcmltYXJ5Ijp7IlRleHQiOiJWYWx1ZSBBcHBzIGJlcmVpY2hlcnQgSWhy[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.10.2.5.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBl[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNjFfLTEiLCJpc1Rlc3QiOmZhbHNlLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsd[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.8.0.4.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBlc[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_showCloseButton.enc", "dHJ1ZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_userId.enc", "NDVlODE4MzYtMDg5NS00MmNjLTk0OTktOTZjMmYxNDlhN2Rj");
Zeile gelöscht : user_pref("CT2625848.mam_gk_user_approval_interacted.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_welcomeDialogMode.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT2625848.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT2625848%26SearchSource%3D13\",\"EB_MAIN_FRAME_TITLE\":\"Suc[...]
Zeile gelöscht : user_pref("CT2625848.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT2625848.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT2625848.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"08\\\\/20\\\\/2013 11\\\"}\"}");
Zeile gelöscht : user_pref("CT2625848.price-gong.isManagedApp", "true");
Zeile gelöscht : user_pref("CT2625848.search.searchAppId", "129181467799155027");
Zeile gelöscht : user_pref("CT2625848.search.searchCount", "0");
Zeile gelöscht : user_pref("CT2625848.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2625848\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"DVDVideoSoftTB DE\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1372412392885");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appsMetadata_lastUpdate", "1372431027459");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1372412392727");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.13.1.89_lastUpdate", "1372431025872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_optimizer_lastUpdate", "1372431027798");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1372412392755");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_searchAPI_lastUpdate", "1372412272789");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_serviceMap_lastUpdate", "1372412272612");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarContextMenu_lastUpdate", "1372412392701");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarSettings_lastUpdate", "1372431027401");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_translation_lastUpdate", "1372412272872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_userApps_lastUpdate", "1376986920658");
Zeile gelöscht : user_pref("CT2625848.settingsINI", true);
Zeile gelöscht : user_pref("CT2625848.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT2625848.smartbar.CTID", "CT2625848");
Zeile gelöscht : user_pref("CT2625848.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT2625848.smartbar.homepage", true);
Zeile gelöscht : user_pref("CT2625848.smartbar.toolbarName", "DVDVideoSoftTB DE ");
Zeile gelöscht : user_pref("CT2625848.startPage", "userChanged");
Zeile gelöscht : user_pref("CT2625848.toolbarBornServerTime", "29-4-2013");
Zeile gelöscht : user_pref("CT2625848.toolbarCurrentServerTime", "28-6-2013");
Zeile gelöscht : user_pref("CT2625848.url_history0001.enc", "aHR0cDovL3d3dy5nb29nbGUuZGUvdXJsP3NhPXQmcmN0PWomcT13ZW1ibGV5JTIwY2FsbGluZyUyMHQtc2hpcnQmc291cmNlPXdlYiZjZD0xNSZjYWQ9cmphJnZlZD0wQ0g0UUZqQU8mdXJsPWh0dHAlM0El[...]
Zeile gelöscht : user_pref("CT2625848_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1376988514735,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=13");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "DVDVideoSoftTB DE Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT2625848");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "1411a9a6d896f5aafcd0400316cfe022");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "e818799a000000000000dca97144c06f");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15959");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.69:51:29");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=120695&tsp=5002");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.enabledAddons", "%7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.10,6c937ed6-be66-4f72-9a60-ce5789cc7f09%4053ba6712-2cae-46e2-b821-95baea44e049.com:0.92.69,abb%40amazon.com:3.0.20[...]
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=E818DCA97144C06F&affID=120695&tsp=5002");
Zeile gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}");
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocationType=tb50-ff-aolsoftonic[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"searc[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_product_name", "Updater By Sweetpacks");
*************************
AdwCleaner[R0].txt - [24151 octets] - [16/09/2013 19:28:26]
AdwCleaner[S0].txt - [23264 octets] - [16/09/2013 19:29:41]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [23325 octets] ##########
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\prefs.js ]
Zeile gelöscht : user_pref("CT2625848.1000082.isDisplayHidden", "true");
Zeile gelöscht : user_pref("CT2625848.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
Zeile gelöscht : user_pref("CT2625848.2625848a129894023611240511000000paramsGK1.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzc2OTg2OTE1MTk4LCJ1cGRhdGVSZXNwVGltZSI6MTM3Njk4NjkxNjI3OCwiZGF0YSI6eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3[...]
Zeile gelöscht : user_pref("CT2625848.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.FirstTime", "true");
Zeile gelöscht : user_pref("CT2625848.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT2625848.SF_JUST_INSTALLED.enc", "RkFMU0U=");
Zeile gelöscht : user_pref("CT2625848.SF_STATUS.enc", "RU5BQkxFRA==");
Zeile gelöscht : user_pref("CT2625848.SF_USER_ID.enc", "Y2lkXzEyNTIwMTMxNTExNzc0NDQyMjI=");
Zeile gelöscht : user_pref("CT2625848.SearchAppState.enc", "Mg==");
Zeile gelöscht : user_pref("CT2625848.SearchAppTracking.enc", "c2VudA==");
Zeile gelöscht : user_pref("CT2625848.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("CT2625848.UserID", "UN89771525767054553");
Zeile gelöscht : user_pref("CT2625848.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.browser.search.defaultthis.engineName", true);
Zeile gelöscht : user_pref("CT2625848.cb_experience_000.enc", "Mw==");
Zeile gelöscht : user_pref("CT2625848.cb_firstuse0100.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.cb_user_id_000.enc", "Q0IzMTk2OTc2ODE2NTVfMTM2ODM2NTMxMDMwMV9GaXJlZm94");
Zeile gelöscht : user_pref("CT2625848.cbfirsttime.enc", "U3VuIE1heSAxMiAyMDEzIDE1OjI4OjMwIEdNVCswMjAw");
Zeile gelöscht : user_pref("CT2625848.defaultSearch", "true");
Zeile gelöscht : user_pref("CT2625848.embeddedsData", "[{\"appId\":\"129181467799155027\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
Zeile gelöscht : user_pref("CT2625848.enableAlerts", "false");
Zeile gelöscht : user_pref("CT2625848.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT2625848.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.fixUrls", true);
Zeile gelöscht : user_pref("CT2625848.installId", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.installType", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT2625848.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT2625848.isNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2625848.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT2625848.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT2625848.keyword", true);
Zeile gelöscht : user_pref("CT2625848.mam_gk_appStateReportTime.enc", "MTM3Njk4NjkyMDY0Ng==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_CouponBuddy.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook_targeted.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_PriceGong.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_WindowShopper.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsInNjcmlwdFVybCI6bnVsbCwib3B0aW9uc0Rp[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_calledSetupService.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkVhc3l0b2Jvb2tfdGFyZ2V0ZWQiLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiJiZTEyZjA5Yi1mNTgxLTQ0OWItYjk2ZC01MDMwYzI2NzkwNDMiLCJ[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_currentVersion.enc", "MS4xMC4yLjU=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_eventsCache.enc", "eyIwNjdiODc4NS0xMDFjLTQxNWMtOGU5Mi0zZmJmN2I5NjUxZDciOnsidG9waWMiOiJzZW5kVXNhZ2UiLCJkYXRhIjp7ImNhdGVnb3J5IjoiV2VsY29tZSIsImFjdGlvbiI6IlZpZXcifSwidW5pcXVlS[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_existingUsersRecoveryDone.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_first_time.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_gadgetOpen.enc", "d2VsY29tZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_lastLoginTime.enc", "MTM3Njk4NjkxNjg5Nw==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50LVJpY2h0bGluaWUifSwiZ2FkZ2V0RGVzY3JpcHRpb25QcmltYXJ5Ijp7IlRleHQiOiJWYWx1ZSBBcHBzIGJlcmVpY2hlcnQgSWhy[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.10.2.5.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBl[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNjFfLTEiLCJpc1Rlc3QiOmZhbHNlLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsd[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.8.0.4.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBlc[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_showCloseButton.enc", "dHJ1ZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_userId.enc", "NDVlODE4MzYtMDg5NS00MmNjLTk0OTktOTZjMmYxNDlhN2Rj");
Zeile gelöscht : user_pref("CT2625848.mam_gk_user_approval_interacted.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_welcomeDialogMode.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT2625848.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT2625848%26SearchSource%3D13\",\"EB_MAIN_FRAME_TITLE\":\"Suc[...]
Zeile gelöscht : user_pref("CT2625848.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT2625848.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT2625848.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"08\\\\/20\\\\/2013 11\\\"}\"}");
Zeile gelöscht : user_pref("CT2625848.price-gong.isManagedApp", "true");
Zeile gelöscht : user_pref("CT2625848.search.searchAppId", "129181467799155027");
Zeile gelöscht : user_pref("CT2625848.search.searchCount", "0");
Zeile gelöscht : user_pref("CT2625848.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2625848\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"DVDVideoSoftTB DE\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1372412392885");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appsMetadata_lastUpdate", "1372431027459");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1372412392727");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.13.1.89_lastUpdate", "1372431025872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_optimizer_lastUpdate", "1372431027798");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1372412392755");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_searchAPI_lastUpdate", "1372412272789");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_serviceMap_lastUpdate", "1372412272612");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarContextMenu_lastUpdate", "1372412392701");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarSettings_lastUpdate", "1372431027401");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_translation_lastUpdate", "1372412272872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_userApps_lastUpdate", "1376986920658");
Zeile gelöscht : user_pref("CT2625848.settingsINI", true);
Zeile gelöscht : user_pref("CT2625848.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT2625848.smartbar.CTID", "CT2625848");
Zeile gelöscht : user_pref("CT2625848.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT2625848.smartbar.homepage", true);
Zeile gelöscht : user_pref("CT2625848.smartbar.toolbarName", "DVDVideoSoftTB DE ");
Zeile gelöscht : user_pref("CT2625848.startPage", "userChanged");
Zeile gelöscht : user_pref("CT2625848.toolbarBornServerTime", "29-4-2013");
Zeile gelöscht : user_pref("CT2625848.toolbarCurrentServerTime", "28-6-2013");
Zeile gelöscht : user_pref("CT2625848.url_history0001.enc", "aHR0cDovL3d3dy5nb29nbGUuZGUvdXJsP3NhPXQmcmN0PWomcT13ZW1ibGV5JTIwY2FsbGluZyUyMHQtc2hpcnQmc291cmNlPXdlYiZjZD0xNSZjYWQ9cmphJnZlZD0wQ0g0UUZqQU8mdXJsPWh0dHAlM0El[...]
Zeile gelöscht : user_pref("CT2625848_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1376988514735,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=13");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "DVDVideoSoftTB DE Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT2625848");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "1411a9a6d896f5aafcd0400316cfe022");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "e818799a000000000000dca97144c06f");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15959");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.69:51:29");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=120695&tsp=5002");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.enabledAddons", "%7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.10,6c937ed6-be66-4f72-9a60-ce5789cc7f09%4053ba6712-2cae-46e2-b821-95baea44e049.com:0.92.69,abb%40amazon.com:3.0.20[...]
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=E818DCA97144C06F&affID=120695&tsp=5002");
Zeile gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}");
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocationType=tb50-ff-aolsoftonic[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"searc[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_product_name", "Updater By Sweetpacks");
*************************
AdwCleaner[R0].txt - [24151 octets] - [16/09/2013 19:28:26]
AdwCleaner[S0].txt - [23264 octets] - [16/09/2013 19:29:41]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [23325 octets] ##########
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\prefs.js ]
Zeile gelöscht : user_pref("CT2625848.1000082.isDisplayHidden", "true");
Zeile gelöscht : user_pref("CT2625848.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
Zeile gelöscht : user_pref("CT2625848.2625848a129894023611240511000000paramsGK1.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzc2OTg2OTE1MTk4LCJ1cGRhdGVSZXNwVGltZSI6MTM3Njk4NjkxNjI3OCwiZGF0YSI6eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3[...]
Zeile gelöscht : user_pref("CT2625848.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.FirstTime", "true");
Zeile gelöscht : user_pref("CT2625848.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT2625848.SF_JUST_INSTALLED.enc", "RkFMU0U=");
Zeile gelöscht : user_pref("CT2625848.SF_STATUS.enc", "RU5BQkxFRA==");
Zeile gelöscht : user_pref("CT2625848.SF_USER_ID.enc", "Y2lkXzEyNTIwMTMxNTExNzc0NDQyMjI=");
Zeile gelöscht : user_pref("CT2625848.SearchAppState.enc", "Mg==");
Zeile gelöscht : user_pref("CT2625848.SearchAppTracking.enc", "c2VudA==");
Zeile gelöscht : user_pref("CT2625848.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("CT2625848.UserID", "UN89771525767054553");
Zeile gelöscht : user_pref("CT2625848.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.browser.search.defaultthis.engineName", true);
Zeile gelöscht : user_pref("CT2625848.cb_experience_000.enc", "Mw==");
Zeile gelöscht : user_pref("CT2625848.cb_firstuse0100.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.cb_user_id_000.enc", "Q0IzMTk2OTc2ODE2NTVfMTM2ODM2NTMxMDMwMV9GaXJlZm94");
Zeile gelöscht : user_pref("CT2625848.cbfirsttime.enc", "U3VuIE1heSAxMiAyMDEzIDE1OjI4OjMwIEdNVCswMjAw");
Zeile gelöscht : user_pref("CT2625848.defaultSearch", "true");
Zeile gelöscht : user_pref("CT2625848.embeddedsData", "[{\"appId\":\"129181467799155027\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
Zeile gelöscht : user_pref("CT2625848.enableAlerts", "false");
Zeile gelöscht : user_pref("CT2625848.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT2625848.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.fixUrls", true);
Zeile gelöscht : user_pref("CT2625848.installId", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.installType", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT2625848.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT2625848.isNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2625848.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT2625848.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT2625848.keyword", true);
Zeile gelöscht : user_pref("CT2625848.mam_gk_appStateReportTime.enc", "MTM3Njk4NjkyMDY0Ng==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_CouponBuddy.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook_targeted.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_PriceGong.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_WindowShopper.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsInNjcmlwdFVybCI6bnVsbCwib3B0aW9uc0Rp[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_calledSetupService.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkVhc3l0b2Jvb2tfdGFyZ2V0ZWQiLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiJiZTEyZjA5Yi1mNTgxLTQ0OWItYjk2ZC01MDMwYzI2NzkwNDMiLCJ[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_currentVersion.enc", "MS4xMC4yLjU=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_eventsCache.enc", "eyIwNjdiODc4NS0xMDFjLTQxNWMtOGU5Mi0zZmJmN2I5NjUxZDciOnsidG9waWMiOiJzZW5kVXNhZ2UiLCJkYXRhIjp7ImNhdGVnb3J5IjoiV2VsY29tZSIsImFjdGlvbiI6IlZpZXcifSwidW5pcXVlS[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_existingUsersRecoveryDone.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_first_time.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_gadgetOpen.enc", "d2VsY29tZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_lastLoginTime.enc", "MTM3Njk4NjkxNjg5Nw==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50LVJpY2h0bGluaWUifSwiZ2FkZ2V0RGVzY3JpcHRpb25QcmltYXJ5Ijp7IlRleHQiOiJWYWx1ZSBBcHBzIGJlcmVpY2hlcnQgSWhy[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.10.2.5.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBl[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNjFfLTEiLCJpc1Rlc3QiOmZhbHNlLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsd[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.8.0.4.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBlc[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_showCloseButton.enc", "dHJ1ZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_userId.enc", "NDVlODE4MzYtMDg5NS00MmNjLTk0OTktOTZjMmYxNDlhN2Rj");
Zeile gelöscht : user_pref("CT2625848.mam_gk_user_approval_interacted.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_welcomeDialogMode.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT2625848.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT2625848%26SearchSource%3D13\",\"EB_MAIN_FRAME_TITLE\":\"Suc[...]
Zeile gelöscht : user_pref("CT2625848.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT2625848.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT2625848.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"08\\\\/20\\\\/2013 11\\\"}\"}");
Zeile gelöscht : user_pref("CT2625848.price-gong.isManagedApp", "true");
Zeile gelöscht : user_pref("CT2625848.search.searchAppId", "129181467799155027");
Zeile gelöscht : user_pref("CT2625848.search.searchCount", "0");
Zeile gelöscht : user_pref("CT2625848.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2625848\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"DVDVideoSoftTB DE\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1372412392885");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appsMetadata_lastUpdate", "1372431027459");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1372412392727");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.13.1.89_lastUpdate", "1372431025872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_optimizer_lastUpdate", "1372431027798");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1372412392755");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_searchAPI_lastUpdate", "1372412272789");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_serviceMap_lastUpdate", "1372412272612");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarContextMenu_lastUpdate", "1372412392701");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarSettings_lastUpdate", "1372431027401");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_translation_lastUpdate", "1372412272872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_userApps_lastUpdate", "1376986920658");
Zeile gelöscht : user_pref("CT2625848.settingsINI", true);
Zeile gelöscht : user_pref("CT2625848.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT2625848.smartbar.CTID", "CT2625848");
Zeile gelöscht : user_pref("CT2625848.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT2625848.smartbar.homepage", true);
Zeile gelöscht : user_pref("CT2625848.smartbar.toolbarName", "DVDVideoSoftTB DE ");
Zeile gelöscht : user_pref("CT2625848.startPage", "userChanged");
Zeile gelöscht : user_pref("CT2625848.toolbarBornServerTime", "29-4-2013");
Zeile gelöscht : user_pref("CT2625848.toolbarCurrentServerTime", "28-6-2013");
Zeile gelöscht : user_pref("CT2625848.url_history0001.enc", "aHR0cDovL3d3dy5nb29nbGUuZGUvdXJsP3NhPXQmcmN0PWomcT13ZW1ibGV5JTIwY2FsbGluZyUyMHQtc2hpcnQmc291cmNlPXdlYiZjZD0xNSZjYWQ9cmphJnZlZD0wQ0g0UUZqQU8mdXJsPWh0dHAlM0El[...]
Zeile gelöscht : user_pref("CT2625848_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1376988514735,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=13");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "DVDVideoSoftTB DE Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT2625848");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "1411a9a6d896f5aafcd0400316cfe022");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "e818799a000000000000dca97144c06f");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15959");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.69:51:29");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=120695&tsp=5002");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.enabledAddons", "%7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.10,6c937ed6-be66-4f72-9a60-ce5789cc7f09%4053ba6712-2cae-46e2-b821-95baea44e049.com:0.92.69,abb%40amazon.com:3.0.20[...]
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=E818DCA97144C06F&affID=120695&tsp=5002");
Zeile gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}");
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocationType=tb50-ff-aolsoftonic[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"searc[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_product_name", "Updater By Sweetpacks");
*************************
AdwCleaner[R0].txt - [24151 octets] - [16/09/2013 19:28:26]
AdwCleaner[S0].txt - [23264 octets] - [16/09/2013 19:29:41]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [23325 octets] ##########
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\prefs.js ]
Zeile gelöscht : user_pref("CT2625848.1000082.isDisplayHidden", "true");
Zeile gelöscht : user_pref("CT2625848.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
Zeile gelöscht : user_pref("CT2625848.2625848a129894023611240511000000paramsGK1.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzc2OTg2OTE1MTk4LCJ1cGRhdGVSZXNwVGltZSI6MTM3Njk4NjkxNjI3OCwiZGF0YSI6eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3[...]
Zeile gelöscht : user_pref("CT2625848.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.FirstTime", "true");
Zeile gelöscht : user_pref("CT2625848.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT2625848.SF_JUST_INSTALLED.enc", "RkFMU0U=");
Zeile gelöscht : user_pref("CT2625848.SF_STATUS.enc", "RU5BQkxFRA==");
Zeile gelöscht : user_pref("CT2625848.SF_USER_ID.enc", "Y2lkXzEyNTIwMTMxNTExNzc0NDQyMjI=");
Zeile gelöscht : user_pref("CT2625848.SearchAppState.enc", "Mg==");
Zeile gelöscht : user_pref("CT2625848.SearchAppTracking.enc", "c2VudA==");
Zeile gelöscht : user_pref("CT2625848.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("CT2625848.UserID", "UN89771525767054553");
Zeile gelöscht : user_pref("CT2625848.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.browser.search.defaultthis.engineName", true);
Zeile gelöscht : user_pref("CT2625848.cb_experience_000.enc", "Mw==");
Zeile gelöscht : user_pref("CT2625848.cb_firstuse0100.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.cb_user_id_000.enc", "Q0IzMTk2OTc2ODE2NTVfMTM2ODM2NTMxMDMwMV9GaXJlZm94");
Zeile gelöscht : user_pref("CT2625848.cbfirsttime.enc", "U3VuIE1heSAxMiAyMDEzIDE1OjI4OjMwIEdNVCswMjAw");
Zeile gelöscht : user_pref("CT2625848.defaultSearch", "true");
Zeile gelöscht : user_pref("CT2625848.embeddedsData", "[{\"appId\":\"129181467799155027\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
Zeile gelöscht : user_pref("CT2625848.enableAlerts", "false");
Zeile gelöscht : user_pref("CT2625848.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT2625848.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.fixUrls", true);
Zeile gelöscht : user_pref("CT2625848.installId", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.installType", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT2625848.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT2625848.isNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2625848.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT2625848.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT2625848.keyword", true);
Zeile gelöscht : user_pref("CT2625848.mam_gk_appStateReportTime.enc", "MTM3Njk4NjkyMDY0Ng==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_CouponBuddy.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook_targeted.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_PriceGong.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_WindowShopper.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsInNjcmlwdFVybCI6bnVsbCwib3B0aW9uc0Rp[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_calledSetupService.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkVhc3l0b2Jvb2tfdGFyZ2V0ZWQiLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiJiZTEyZjA5Yi1mNTgxLTQ0OWItYjk2ZC01MDMwYzI2NzkwNDMiLCJ[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_currentVersion.enc", "MS4xMC4yLjU=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_eventsCache.enc", "eyIwNjdiODc4NS0xMDFjLTQxNWMtOGU5Mi0zZmJmN2I5NjUxZDciOnsidG9waWMiOiJzZW5kVXNhZ2UiLCJkYXRhIjp7ImNhdGVnb3J5IjoiV2VsY29tZSIsImFjdGlvbiI6IlZpZXcifSwidW5pcXVlS[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_existingUsersRecoveryDone.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_first_time.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_gadgetOpen.enc", "d2VsY29tZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_lastLoginTime.enc", "MTM3Njk4NjkxNjg5Nw==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50LVJpY2h0bGluaWUifSwiZ2FkZ2V0RGVzY3JpcHRpb25QcmltYXJ5Ijp7IlRleHQiOiJWYWx1ZSBBcHBzIGJlcmVpY2hlcnQgSWhy[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.10.2.5.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBl[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNjFfLTEiLCJpc1Rlc3QiOmZhbHNlLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsd[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.8.0.4.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBlc[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_showCloseButton.enc", "dHJ1ZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_userId.enc", "NDVlODE4MzYtMDg5NS00MmNjLTk0OTktOTZjMmYxNDlhN2Rj");
Zeile gelöscht : user_pref("CT2625848.mam_gk_user_approval_interacted.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_welcomeDialogMode.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT2625848.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT2625848%26SearchSource%3D13\",\"EB_MAIN_FRAME_TITLE\":\"Suc[...]
Zeile gelöscht : user_pref("CT2625848.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT2625848.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT2625848.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"08\\\\/20\\\\/2013 11\\\"}\"}");
Zeile gelöscht : user_pref("CT2625848.price-gong.isManagedApp", "true");
Zeile gelöscht : user_pref("CT2625848.search.searchAppId", "129181467799155027");
Zeile gelöscht : user_pref("CT2625848.search.searchCount", "0");
Zeile gelöscht : user_pref("CT2625848.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2625848\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"DVDVideoSoftTB DE\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1372412392885");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appsMetadata_lastUpdate", "1372431027459");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1372412392727");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.13.1.89_lastUpdate", "1372431025872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_optimizer_lastUpdate", "1372431027798");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1372412392755");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_searchAPI_lastUpdate", "1372412272789");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_serviceMap_lastUpdate", "1372412272612");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarContextMenu_lastUpdate", "1372412392701");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarSettings_lastUpdate", "1372431027401");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_translation_lastUpdate", "1372412272872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_userApps_lastUpdate", "1376986920658");
Zeile gelöscht : user_pref("CT2625848.settingsINI", true);
Zeile gelöscht : user_pref("CT2625848.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT2625848.smartbar.CTID", "CT2625848");
Zeile gelöscht : user_pref("CT2625848.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT2625848.smartbar.homepage", true);
Zeile gelöscht : user_pref("CT2625848.smartbar.toolbarName", "DVDVideoSoftTB DE ");
Zeile gelöscht : user_pref("CT2625848.startPage", "userChanged");
Zeile gelöscht : user_pref("CT2625848.toolbarBornServerTime", "29-4-2013");
Zeile gelöscht : user_pref("CT2625848.toolbarCurrentServerTime", "28-6-2013");
Zeile gelöscht : user_pref("CT2625848.url_history0001.enc", "aHR0cDovL3d3dy5nb29nbGUuZGUvdXJsP3NhPXQmcmN0PWomcT13ZW1ibGV5JTIwY2FsbGluZyUyMHQtc2hpcnQmc291cmNlPXdlYiZjZD0xNSZjYWQ9cmphJnZlZD0wQ0g0UUZqQU8mdXJsPWh0dHAlM0El[...]
Zeile gelöscht : user_pref("CT2625848_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1376988514735,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=13");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "DVDVideoSoftTB DE Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT2625848");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "1411a9a6d896f5aafcd0400316cfe022");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "e818799a000000000000dca97144c06f");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15959");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.69:51:29");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=120695&tsp=5002");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.enabledAddons", "%7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.10,6c937ed6-be66-4f72-9a60-ce5789cc7f09%4053ba6712-2cae-46e2-b821-95baea44e049.com:0.92.69,abb%40amazon.com:3.0.20[...]
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=E818DCA97144C06F&affID=120695&tsp=5002");
Zeile gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}");
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocationType=tb50-ff-aolsoftonic[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"searc[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_product_name", "Updater By Sweetpacks");
*************************
AdwCleaner[R0].txt - [24151 octets] - [16/09/2013 19:28:26]
AdwCleaner[S0].txt - [23264 octets] - [16/09/2013 19:29:41]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [23325 octets] ##########
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\prefs.js ]
Zeile gelöscht : user_pref("CT2625848.1000082.isDisplayHidden", "true");
Zeile gelöscht : user_pref("CT2625848.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
Zeile gelöscht : user_pref("CT2625848.2625848a129894023611240511000000paramsGK1.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzc2OTg2OTE1MTk4LCJ1cGRhdGVSZXNwVGltZSI6MTM3Njk4NjkxNjI3OCwiZGF0YSI6eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3[...]
Zeile gelöscht : user_pref("CT2625848.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.FirstTime", "true");
Zeile gelöscht : user_pref("CT2625848.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT2625848.SF_JUST_INSTALLED.enc", "RkFMU0U=");
Zeile gelöscht : user_pref("CT2625848.SF_STATUS.enc", "RU5BQkxFRA==");
Zeile gelöscht : user_pref("CT2625848.SF_USER_ID.enc", "Y2lkXzEyNTIwMTMxNTExNzc0NDQyMjI=");
Zeile gelöscht : user_pref("CT2625848.SearchAppState.enc", "Mg==");
Zeile gelöscht : user_pref("CT2625848.SearchAppTracking.enc", "c2VudA==");
Zeile gelöscht : user_pref("CT2625848.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("CT2625848.UserID", "UN89771525767054553");
Zeile gelöscht : user_pref("CT2625848.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.browser.search.defaultthis.engineName", true);
Zeile gelöscht : user_pref("CT2625848.cb_experience_000.enc", "Mw==");
Zeile gelöscht : user_pref("CT2625848.cb_firstuse0100.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.cb_user_id_000.enc", "Q0IzMTk2OTc2ODE2NTVfMTM2ODM2NTMxMDMwMV9GaXJlZm94");
Zeile gelöscht : user_pref("CT2625848.cbfirsttime.enc", "U3VuIE1heSAxMiAyMDEzIDE1OjI4OjMwIEdNVCswMjAw");
Zeile gelöscht : user_pref("CT2625848.defaultSearch", "true");
Zeile gelöscht : user_pref("CT2625848.embeddedsData", "[{\"appId\":\"129181467799155027\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
Zeile gelöscht : user_pref("CT2625848.enableAlerts", "false");
Zeile gelöscht : user_pref("CT2625848.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT2625848.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.fixUrls", true);
Zeile gelöscht : user_pref("CT2625848.installId", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.installType", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT2625848.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT2625848.isNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2625848.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT2625848.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT2625848.keyword", true);
Zeile gelöscht : user_pref("CT2625848.mam_gk_appStateReportTime.enc", "MTM3Njk4NjkyMDY0Ng==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_CouponBuddy.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook_targeted.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_PriceGong.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_WindowShopper.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsInNjcmlwdFVybCI6bnVsbCwib3B0aW9uc0Rp[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_calledSetupService.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkVhc3l0b2Jvb2tfdGFyZ2V0ZWQiLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiJiZTEyZjA5Yi1mNTgxLTQ0OWItYjk2ZC01MDMwYzI2NzkwNDMiLCJ[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_currentVersion.enc", "MS4xMC4yLjU=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_eventsCache.enc", "eyIwNjdiODc4NS0xMDFjLTQxNWMtOGU5Mi0zZmJmN2I5NjUxZDciOnsidG9waWMiOiJzZW5kVXNhZ2UiLCJkYXRhIjp7ImNhdGVnb3J5IjoiV2VsY29tZSIsImFjdGlvbiI6IlZpZXcifSwidW5pcXVlS[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_existingUsersRecoveryDone.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_first_time.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_gadgetOpen.enc", "d2VsY29tZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_lastLoginTime.enc", "MTM3Njk4NjkxNjg5Nw==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50LVJpY2h0bGluaWUifSwiZ2FkZ2V0RGVzY3JpcHRpb25QcmltYXJ5Ijp7IlRleHQiOiJWYWx1ZSBBcHBzIGJlcmVpY2hlcnQgSWhy[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.10.2.5.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBl[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNjFfLTEiLCJpc1Rlc3QiOmZhbHNlLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsd[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.8.0.4.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBlc[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_showCloseButton.enc", "dHJ1ZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_userId.enc", "NDVlODE4MzYtMDg5NS00MmNjLTk0OTktOTZjMmYxNDlhN2Rj");
Zeile gelöscht : user_pref("CT2625848.mam_gk_user_approval_interacted.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_welcomeDialogMode.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT2625848.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT2625848%26SearchSource%3D13\",\"EB_MAIN_FRAME_TITLE\":\"Suc[...]
Zeile gelöscht : user_pref("CT2625848.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT2625848.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT2625848.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"08\\\\/20\\\\/2013 11\\\"}\"}");
Zeile gelöscht : user_pref("CT2625848.price-gong.isManagedApp", "true");
Zeile gelöscht : user_pref("CT2625848.search.searchAppId", "129181467799155027");
Zeile gelöscht : user_pref("CT2625848.search.searchCount", "0");
Zeile gelöscht : user_pref("CT2625848.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2625848\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"DVDVideoSoftTB DE\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1372412392885");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appsMetadata_lastUpdate", "1372431027459");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1372412392727");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.13.1.89_lastUpdate", "1372431025872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_optimizer_lastUpdate", "1372431027798");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1372412392755");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_searchAPI_lastUpdate", "1372412272789");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_serviceMap_lastUpdate", "1372412272612");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarContextMenu_lastUpdate", "1372412392701");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarSettings_lastUpdate", "1372431027401");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_translation_lastUpdate", "1372412272872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_userApps_lastUpdate", "1376986920658");
Zeile gelöscht : user_pref("CT2625848.settingsINI", true);
Zeile gelöscht : user_pref("CT2625848.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT2625848.smartbar.CTID", "CT2625848");
Zeile gelöscht : user_pref("CT2625848.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT2625848.smartbar.homepage", true);
Zeile gelöscht : user_pref("CT2625848.smartbar.toolbarName", "DVDVideoSoftTB DE ");
Zeile gelöscht : user_pref("CT2625848.startPage", "userChanged");
Zeile gelöscht : user_pref("CT2625848.toolbarBornServerTime", "29-4-2013");
Zeile gelöscht : user_pref("CT2625848.toolbarCurrentServerTime", "28-6-2013");
Zeile gelöscht : user_pref("CT2625848.url_history0001.enc", "aHR0cDovL3d3dy5nb29nbGUuZGUvdXJsP3NhPXQmcmN0PWomcT13ZW1ibGV5JTIwY2FsbGluZyUyMHQtc2hpcnQmc291cmNlPXdlYiZjZD0xNSZjYWQ9cmphJnZlZD0wQ0g0UUZqQU8mdXJsPWh0dHAlM0El[...]
Zeile gelöscht : user_pref("CT2625848_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1376988514735,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=13");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "DVDVideoSoftTB DE Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT2625848");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "1411a9a6d896f5aafcd0400316cfe022");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "e818799a000000000000dca97144c06f");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15959");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.69:51:29");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=120695&tsp=5002");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.enabledAddons", "%7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.10,6c937ed6-be66-4f72-9a60-ce5789cc7f09%4053ba6712-2cae-46e2-b821-95baea44e049.com:0.92.69,abb%40amazon.com:3.0.20[...]
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=E818DCA97144C06F&affID=120695&tsp=5002");
Zeile gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}");
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocationType=tb50-ff-aolsoftonic[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"searc[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_product_name", "Updater By Sweetpacks");
*************************
AdwCleaner[R0].txt - [24151 octets] - [16/09/2013 19:28:26]
AdwCleaner[S0].txt - [23264 octets] - [16/09/2013 19:29:41]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [23325 octets] ##########
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\prefs.js ]
Zeile gelöscht : user_pref("CT2625848.1000082.isDisplayHidden", "true");
Zeile gelöscht : user_pref("CT2625848.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
Zeile gelöscht : user_pref("CT2625848.2625848a129894023611240511000000paramsGK1.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzc2OTg2OTE1MTk4LCJ1cGRhdGVSZXNwVGltZSI6MTM3Njk4NjkxNjI3OCwiZGF0YSI6eyJzZXR0aW5ncyI6eyJpY29uIjoiaHR0cDovL3[...]
Zeile gelöscht : user_pref("CT2625848.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.FirstTime", "true");
Zeile gelöscht : user_pref("CT2625848.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT2625848.SF_JUST_INSTALLED.enc", "RkFMU0U=");
Zeile gelöscht : user_pref("CT2625848.SF_STATUS.enc", "RU5BQkxFRA==");
Zeile gelöscht : user_pref("CT2625848.SF_USER_ID.enc", "Y2lkXzEyNTIwMTMxNTExNzc0NDQyMjI=");
Zeile gelöscht : user_pref("CT2625848.SearchAppState.enc", "Mg==");
Zeile gelöscht : user_pref("CT2625848.SearchAppTracking.enc", "c2VudA==");
Zeile gelöscht : user_pref("CT2625848.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("CT2625848.UserID", "UN89771525767054553");
Zeile gelöscht : user_pref("CT2625848.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.browser.search.defaultthis.engineName", true);
Zeile gelöscht : user_pref("CT2625848.cb_experience_000.enc", "Mw==");
Zeile gelöscht : user_pref("CT2625848.cb_firstuse0100.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.cb_user_id_000.enc", "Q0IzMTk2OTc2ODE2NTVfMTM2ODM2NTMxMDMwMV9GaXJlZm94");
Zeile gelöscht : user_pref("CT2625848.cbfirsttime.enc", "U3VuIE1heSAxMiAyMDEzIDE1OjI4OjMwIEdNVCswMjAw");
Zeile gelöscht : user_pref("CT2625848.defaultSearch", "true");
Zeile gelöscht : user_pref("CT2625848.embeddedsData", "[{\"appId\":\"129181467799155027\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
Zeile gelöscht : user_pref("CT2625848.enableAlerts", "false");
Zeile gelöscht : user_pref("CT2625848.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT2625848.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT2625848.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.fixUrls", true);
Zeile gelöscht : user_pref("CT2625848.installId", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.installType", "ConduitNSISIntegration");
Zeile gelöscht : user_pref("CT2625848.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT2625848.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT2625848.isNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2625848.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT2625848.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT2625848.keyword", true);
Zeile gelöscht : user_pref("CT2625848.mam_gk_appStateReportTime.enc", "MTM3Njk4NjkyMDY0Ng==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_CouponBuddy.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_Easytobook_targeted.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_PriceGong.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appState_WindowShopper.enc", "b24=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsInNjcmlwdFVybCI6bnVsbCwib3B0aW9uc0Rp[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_calledSetupService.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkVhc3l0b2Jvb2tfdGFyZ2V0ZWQiLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiJiZTEyZjA5Yi1mNTgxLTQ0OWItYjk2ZC01MDMwYzI2NzkwNDMiLCJ[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_currentVersion.enc", "MS4xMC4yLjU=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_eventsCache.enc", "eyIwNjdiODc4NS0xMDFjLTQxNWMtOGU5Mi0zZmJmN2I5NjUxZDciOnsidG9waWMiOiJzZW5kVXNhZ2UiLCJkYXRhIjp7ImNhdGVnb3J5IjoiV2VsY29tZSIsImFjdGlvbiI6IlZpZXcifSwidW5pcXVlS[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_existingUsersRecoveryDone.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_first_time.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_gadgetOpen.enc", "d2VsY29tZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_lastLoginTime.enc", "MTM3Njk4NjkxNjg5Nw==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50LVJpY2h0bGluaWUifSwiZ2FkZ2V0RGVzY3JpcHRpb25QcmltYXJ5Ijp7IlRleHQiOiJWYWx1ZSBBcHBzIGJlcmVpY2hlcnQgSWhy[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.10.2.5.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBl[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNjFfLTEiLCJpc1Rlc3QiOmZhbHNlLCJpc1dlbGNvbWVFeHBlcmllbmNlRW5hYmxlZEJ5RGVmYXVsd[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_settings1.8.0.4.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNDZfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiREUiLCJpc1dlbGNvbWVFeHBlc[...]
Zeile gelöscht : user_pref("CT2625848.mam_gk_showCloseButton.enc", "dHJ1ZQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT2625848.mam_gk_userId.enc", "NDVlODE4MzYtMDg5NS00MmNjLTk0OTktOTZjMmYxNDlhN2Rj");
Zeile gelöscht : user_pref("CT2625848.mam_gk_user_approval_interacted.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.mam_gk_welcomeDialogMode.enc", "MQ==");
Zeile gelöscht : user_pref("CT2625848.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT2625848.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT2625848%26SearchSource%3D13\",\"EB_MAIN_FRAME_TITLE\":\"Suc[...]
Zeile gelöscht : user_pref("CT2625848.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT2625848.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT2625848.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"08\\\\/20\\\\/2013 11\\\"}\"}");
Zeile gelöscht : user_pref("CT2625848.price-gong.isManagedApp", "true");
Zeile gelöscht : user_pref("CT2625848.search.searchAppId", "129181467799155027");
Zeile gelöscht : user_pref("CT2625848.search.searchCount", "0");
Zeile gelöscht : user_pref("CT2625848.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2625848.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2625848\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://DVDVideoSoftTBDE.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"DVDVideoSoftTB DE\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1372412392885");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_appsMetadata_lastUpdate", "1372431027459");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1372412392727");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.13.1.89_lastUpdate", "1372431025872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_optimizer_lastUpdate", "1372431027798");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1372412392755");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_searchAPI_lastUpdate", "1372412272789");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_serviceMap_lastUpdate", "1372412272612");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarContextMenu_lastUpdate", "1372412392701");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarSettings_lastUpdate", "1372431027401");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_translation_lastUpdate", "1372412272872");
Zeile gelöscht : user_pref("CT2625848.serviceLayer_services_userApps_lastUpdate", "1376986920658");
Zeile gelöscht : user_pref("CT2625848.settingsINI", true);
Zeile gelöscht : user_pref("CT2625848.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT2625848.smartbar.CTID", "CT2625848");
Zeile gelöscht : user_pref("CT2625848.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT2625848.smartbar.homepage", true);
Zeile gelöscht : user_pref("CT2625848.smartbar.toolbarName", "DVDVideoSoftTB DE ");
Zeile gelöscht : user_pref("CT2625848.startPage", "userChanged");
Zeile gelöscht : user_pref("CT2625848.toolbarBornServerTime", "29-4-2013");
Zeile gelöscht : user_pref("CT2625848.toolbarCurrentServerTime", "28-6-2013");
Zeile gelöscht : user_pref("CT2625848.url_history0001.enc", "aHR0cDovL3d3dy5nb29nbGUuZGUvdXJsP3NhPXQmcmN0PWomcT13ZW1ibGV5JTIwY2FsbGluZyUyMHQtc2hpcnQmc291cmNlPXdlYiZjZD0xNSZjYWQ9cmphJnZlZD0wQ0g0UUZqQU8mdXJsPWh0dHAlM0El[...]
Zeile gelöscht : user_pref("CT2625848_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1376988514735,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2625848&SearchSource=13");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "DVDVideoSoftTB DE Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&q=");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT2625848");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "1411a9a6d896f5aafcd0400316cfe022");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "e818799a000000000000dca97144c06f");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15959");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.69:51:29");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=120695&tsp=5002");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.enabledAddons", "%7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:1.0.10,6c937ed6-be66-4f72-9a60-ce5789cc7f09%4053ba6712-2cae-46e2-b821-95baea44e049.com:0.92.69,abb%40amazon.com:3.0.20[...]
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=E818DCA97144C06F&affID=120695&tsp=5002");
Zeile gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://mysearch.sweetpacks.com/?src=10&st=12&crg=3.5000006.10053&barid={2DE77AD0-1BC0-11E3-8B96-6C626D340195}");
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocationType=tb50-ff-aolsoftonic[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.mywebsearch.com\":\"searc[...]
Zeile gelöscht : user_pref("{8E9E3331-D360-4f87-8803-52DE43566502}.ScriptData_product_name", "Updater By Sweetpacks");
*************************
AdwCleaner[R0].txt - [24151 octets] - [16/09/2013 19:28:26]
AdwCleaner[S0].txt - [23264 octets] - [16/09/2013 19:29:41]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [23325 octets] ##########
|
|
16.09.2013, 19:11
| #13 |
| | Postbank Online Banking Trojaner Combofix Logfile: Code:
ATTFilter ComboFix 13-09-16.01 - Stefan 16.09.2013 19:59:21.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.16361.13776 [GMT 2:00]
ausgeführt von:: c:\users\Stefan\Desktop\ComboFix.exe
AV: Norton Internet Security CBE *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security CBE *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security CBE *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\AlexaNSISPlugin.7300.dll
c:\users\Stefan\AppData\Local\assembly\tmp
c:\windows\SysWow64\cseDVH.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-08-16 bis 2013-09-16 ))))))))))))))))))))))))))))))
.
.
2013-09-16 18:03 . 2013-09-16 18:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-16 17:27 . 2013-09-16 17:29 -------- d-----w- C:\AdwCleaner
2013-09-16 08:54 . 2013-09-16 08:54 -------- d-----w- C:\FRST
2013-09-15 19:46 . 2013-09-15 19:46 -------- d-----w- c:\users\Stefan\AppData\Roaming\Malwarebytes
2013-09-15 19:46 . 2013-09-15 19:46 -------- d-----w- c:\programdata\Malwarebytes
2013-09-15 19:46 . 2013-09-15 19:46 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-09-15 19:46 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-09-13 16:21 . 2013-09-13 16:21 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-13 16:21 . 2013-09-13 16:21 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-13 09:54 . 2013-09-13 11:55 -------- d-----w- c:\users\Stefan\AppData\Local\NPE
2013-09-12 19:19 . 2013-09-12 19:20 -------- d-----w- c:\program files (x86)\Voxformer VST
2013-09-12 16:17 . 2013-08-02 02:23 5550528 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-09-12 13:22 . 2013-03-23 10:51 375832 ----a-w- c:\windows\system32\proDAD-PA-Support.dll
2013-09-12 13:07 . 2013-09-12 13:07 -------- d-----w- c:\program files\Common Files\OFX
2013-09-12 10:48 . 2013-09-12 10:48 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2013-09-12 10:47 . 2013-09-12 10:48 -------- d-----w- c:\programdata\Package Cache
2013-09-12 10:40 . 2013-09-12 10:40 -------- d-----w- c:\program files\Grass Valley
2013-09-11 12:47 . 2013-09-11 12:47 -------- d-----w- c:\program files\iTunes
2013-09-11 12:47 . 2013-09-11 12:47 -------- d-----w- c:\program files\iPod
2013-09-11 12:47 . 2013-09-11 12:47 -------- d-----w- c:\program files (x86)\iTunes
2013-09-11 12:46 . 2013-09-11 12:47 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 04:59 . 2013-09-09 13:29 43320 ----a-w- c:\windows\system32\uxtuneup.dll
2013-09-11 04:59 . 2013-09-09 13:29 36152 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2013-09-09 10:24 . 2013-09-09 10:24 -------- d-----w- c:\program files (x86)\apemap
2013-09-09 04:57 . 2013-09-09 04:57 -------- d-----w- c:\users\Stefan\AppData\Local\Avg2014
2013-09-05 08:51 . 2013-09-09 13:29 40760 ----a-w- c:\windows\system32\TURegOpt.exe
2013-09-05 08:51 . 2013-09-09 13:29 29496 ----a-w- c:\windows\system32\authuitu.dll
2013-09-05 08:51 . 2013-09-09 13:29 25400 ----a-w- c:\windows\SysWow64\authuitu.dll
2013-09-05 08:50 . 2013-09-11 04:59 -------- d-----w- c:\program files (x86)\TuneUp Utilities 2014
2013-09-05 08:49 . 2013-09-05 08:55 -------- d-sh--w- c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2013-08-30 08:39 . 2013-08-30 08:39 14104 ----a-w- c:\windows\system32\CtsEventRes.dll
2013-08-30 08:39 . 2013-08-30 08:39 825112 ------w- c:\windows\system32\cseuvec.dll
2013-08-30 08:39 . 2013-08-30 08:39 918808 ------w- c:\windows\system32\csem2vi01.dll
2013-08-30 08:39 . 2013-08-30 08:39 166168 ------w- c:\windows\system32\csellc.dll
2013-08-30 08:39 . 2013-08-30 08:39 701720 ------w- c:\windows\system32\csehqa.dll
2013-08-30 08:39 . 2013-08-30 08:39 1116952 ------w- c:\windows\system32\csehq2.dll
2013-08-30 08:39 . 2013-08-30 08:39 1089816 ------w- c:\windows\system32\csedvh.dll
2013-08-30 08:32 . 2013-08-30 08:32 13080 ----a-w- c:\windows\system32\GVLMEventRes.dll
2013-08-30 08:31 . 2013-08-30 08:31 852760 ----a-w- c:\windows\SysWow64\cseuvec.dll
2013-08-30 08:31 . 2013-08-30 08:31 911640 ----a-w- c:\windows\SysWow64\csem2vi01.dll
2013-08-30 08:31 . 2013-08-30 08:31 164632 ----a-w- c:\windows\SysWow64\csellc.dll
2013-08-30 08:31 . 2013-08-30 08:31 717592 ----a-w- c:\windows\SysWow64\csehqa.dll
2013-08-30 08:31 . 2013-08-30 08:31 1061656 ----a-w- c:\windows\SysWow64\csehq2.dll
2013-08-30 07:28 . 2013-08-30 07:28 48920 ----a-w- c:\windows\system32\drivers\pnxakrnl.sys
2013-08-30 07:28 . 2013-08-30 07:28 54040 ----a-w- c:\windows\system32\drivers\clpkrnl.sys
2013-08-30 07:28 . 2013-08-30 07:28 3172632 ----a-w- c:\windows\system32\drivers\gvzkrnl.sys
2013-08-30 06:29 . 2013-08-30 06:29 1812992 ----a-w- c:\windows\SysWow64\c210codc.dll
2013-08-30 06:29 . 2013-08-30 06:29 58880 ----a-w- c:\windows\SysWow64\cuvccodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 89088 ----a-w- c:\windows\SysWow64\chqxcodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 50176 ----a-w- c:\windows\SysWow64\cdvhcodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 1777664 ----a-w- c:\windows\SysWow64\cllccodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 598016 ----a-w- c:\windows\SysWow64\cmiccodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 50176 ----a-w- c:\windows\SysWow64\cdv5codc.dll
2013-08-30 06:29 . 2013-08-30 06:29 55808 ----a-w- c:\windows\SysWow64\cdvccodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 65536 ----a-w- c:\windows\system32\cuvccodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 51200 ----a-w- c:\windows\system32\cdv5codc.dll
2013-08-30 06:25 . 2013-08-30 06:25 1391616 ----a-w- c:\windows\system32\c210codc.dll
2013-08-30 06:25 . 2013-08-30 06:25 57856 ----a-w- c:\windows\system32\cdvccodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 1384448 ----a-w- c:\windows\system32\cllccodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 95744 ----a-w- c:\windows\system32\chqxcodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 51200 ----a-w- c:\windows\system32\cdvhcodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 486912 ----a-w- c:\windows\system32\cmiccodc.dll
2013-08-30 06:15 . 2013-08-30 06:15 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2013-08-29 12:11 . 2013-08-29 12:11 -------- d-----w- c:\users\Stefan\AppData\Local\funkwerk
2013-08-29 12:03 . 2013-08-29 12:03 -------- d-----w- c:\program files (x86)\funkwerk WIN-Tools
2013-08-29 10:41 . 2013-08-29 10:41 -------- d-----w- c:\program files\DIFX
2013-08-29 10:41 . 2013-08-29 10:41 69912 ----a-r- c:\users\Stefan\AppData\Roaming\Microsoft\Installer\{293C4FDD-FB80-48F8-8B40-F085392FDAA1}\ARPPRODUCTICON.exe
2013-08-29 10:41 . 2013-08-29 10:41 -------- d-----w- c:\program files (x86)\T-Home
2013-08-24 19:59 . 2013-09-09 16:55 -------- d--h--w- c:\users\Stefan\AppData\Roaming\Grgopxwylg
2013-08-20 08:41 . 2013-08-20 08:41 -------- d-----w- c:\windows\SysWow64\Adobe
2013-08-20 08:36 . 2013-08-20 08:36 -------- d-----w- c:\users\Stefan\AppData\Local\Macromedia
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-17 09:09 . 2012-09-14 10:52 607256 ----a-w- c:\windows\system32\prodad-codec.dll
2013-08-05 17:45 . 2013-08-05 17:45 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-08-05 17:45 . 2012-10-06 14:47 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-08-05 17:45 . 2012-10-06 14:47 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-08-02 01:48 . 2013-09-12 16:17 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-27 15:43 . 2007-04-27 08:43 120200 ----a-w- c:\windows\SysWow64\DLLDEV32i.dll
2013-07-25 09:25 . 2013-08-14 05:40 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-14 05:40 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58 . 2013-08-14 05:40 2048 ----a-w- c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-14 05:40 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-07-17 04:45 . 2013-07-17 04:45 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-07-17 04:45 . 2013-07-17 04:45 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-07-17 04:45 . 2013-07-17 04:45 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-07-17 04:45 . 2013-07-17 04:45 81408 ----a-w- c:\windows\system32\icardie.dll
2013-07-17 04:45 . 2013-07-17 04:45 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-07-17 04:45 . 2013-07-17 04:45 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-07-17 04:45 . 2013-07-17 04:45 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-07-17 04:45 . 2013-07-17 04:45 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-07-17 04:45 . 2013-07-17 04:45 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-07-17 04:45 . 2013-07-17 04:45 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-07-17 04:45 . 2013-07-17 04:45 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-07-17 04:45 . 2013-07-17 04:45 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-07-17 04:45 . 2013-07-17 04:45 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-07-17 04:45 . 2013-07-17 04:45 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-07-17 04:45 . 2013-07-17 04:45 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-07-17 04:45 . 2013-07-17 04:45 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-07-17 04:45 . 2013-07-17 04:45 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-07-17 04:45 . 2013-07-17 04:45 441856 ----a-w- c:\windows\system32\html.iec
2013-07-17 04:45 . 2013-07-17 04:45 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-07-17 04:45 . 2013-07-17 04:45 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-07-17 04:45 . 2013-07-17 04:45 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-07-17 04:45 . 2013-07-17 04:45 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-07-17 04:45 . 2013-07-17 04:45 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-07-17 04:45 . 2013-07-17 04:45 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-07-17 04:45 . 2013-07-17 04:45 235008 ----a-w- c:\windows\system32\url.dll
2013-07-17 04:45 . 2013-07-17 04:45 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-07-17 04:45 . 2013-07-17 04:45 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-07-17 04:45 . 2013-07-17 04:45 216064 ----a-w- c:\windows\system32\msls31.dll
2013-07-17 04:45 . 2013-07-17 04:45 197120 ----a-w- c:\windows\system32\msrating.dll
2013-07-17 04:45 . 2013-07-17 04:45 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-07-17 04:45 . 2013-07-17 04:45 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-07-17 04:45 . 2013-07-17 04:45 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-07-17 04:45 . 2013-07-17 04:45 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-07-17 04:45 . 2013-07-17 04:45 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-07-17 04:45 . 2013-07-17 04:45 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-07-17 04:45 . 2013-07-17 04:45 149504 ----a-w- c:\windows\system32\occache.dll
2013-07-17 04:45 . 2013-07-17 04:45 144896 ----a-w- c:\windows\system32\wextract.exe
2013-07-17 04:45 . 2013-07-17 04:45 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-07-17 04:45 . 2013-07-17 04:45 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-07-17 04:45 . 2013-07-17 04:45 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-07-17 04:45 . 2013-07-17 04:45 13824 ----a-w- c:\windows\system32\mshta.exe
2013-07-17 04:45 . 2013-07-17 04:45 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-07-17 04:45 . 2013-07-17 04:45 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-07-17 04:45 . 2013-07-17 04:45 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-07-17 04:45 . 2013-07-17 04:45 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-07-17 04:45 . 2013-07-17 04:45 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-07-17 04:45 . 2013-07-17 04:45 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-07-17 04:45 . 2013-07-17 04:45 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-07-17 04:45 . 2013-07-17 04:45 102912 ----a-w- c:\windows\system32\inseng.dll
2013-07-09 05:52 . 2013-08-14 05:40 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-07-09 05:51 . 2013-08-14 05:40 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2013-07-09 05:46 . 2013-08-14 05:40 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-07-09 05:46 . 2013-08-14 05:40 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-07-09 05:46 . 2013-08-14 05:40 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-07-09 04:52 . 2013-08-14 05:40 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52 . 2013-08-14 05:40 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-07-09 04:46 . 2013-08-14 05:40 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46 . 2013-08-14 05:40 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-07-09 04:46 . 2013-08-14 05:40 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-07-06 06:03 . 2013-08-14 05:40 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-06-19 13:16 . 2013-05-17 12:59 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Duden Korrektor SysTray"="c:\program files (x86)\Duden\Duden Korrektor\DKTray.exe" [2010-10-04 336560]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-21 19875944]
"TomTomHOME.exe"="c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2013-07-02 248208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2010-11-05 2482176]
"Cinema ProII AP"="c:\program files (x86)\MSI\Cinema ProII\CinemaProII.exe" [2011-01-25 200192]
"Cinema ProII Controler"="c:\program files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe" [2010-06-25 1689600]
"THX Audio Control Panel"="c:\program files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" [2010-11-18 1351680]
"NVIDIAOCAP"="c:\program files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe" [2010-10-20 83456]
"msi LED Manager"="c:\program files (x86)\msi\msi LED Manager\SLM.exe" [2010-07-29 2795008]
"Contour Shuttle Device Helper"="c:\program files (x86)\Contour Shuttle\ShuttleHelper.exe" [2011-02-14 118784]
"CLMLServer"="c:\program files (x86)\Cyberlink\Power2Go\CLMLSvc.exe" [2009-12-15 103720]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePPShortCut"="c:\program files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" [2010-12-08 222504]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"RemoteControl11"="c:\program files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe" [2011-05-19 234792]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2012-11-13 450560]
.
c:\users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Control Center.lnk - c:\program files (x86)\funkwerk WIN-Tools\Eumex 401 WIN-Tools V1.00\ControlCenter.exe [2008-8-25 225280]
GV LicenseManager.lnk - c:\program files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe [2013-8-30 8832888]
HD Writer.lnk - c:\program files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe [2012-4-25 308640]
TMMonitor.lnk - c:\program files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe [2012-4-25 258048]
TraXEx 3.3.lnk - c:\program files (x86)\TraXEx\TraXEx.exe [2012-4-26 4033360]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files (x86)\DSL-Manager\DslMgr.exe [2012-4-25 1085440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"UpdReg"=c:\windows\UpdReg.EXE
"ArcSoft Connection Service"=c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
R3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe [x]
R3 fspad_xp64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_xp64;c:\windows\system32\drivers\fspad_xp64.sys;c:\windows\SYSNATIVE\drivers\fspad_xp64.sys [x]
R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
R3 MGHwCtrl;MGHwCtrl;c:\program files\MSI\MSI Software Install\MGHwCtrl.sys;c:\program files\MSI\MSI Software Install\MGHwCtrl.sys [x]
R3 PLTurbh;Prolific turbo filter driver for hdd;c:\windows\system32\drivers\plturbh.sys;c:\windows\SYSNATIVE\drivers\plturbh.sys [x]
R3 PLTurbo;Prolific turbo filter driver for odd;c:\windows\system32\drivers\plturbo.sys;c:\windows\SYSNATIVE\drivers\plturbo.sys [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys;c:\windows\SYSNATIVE\drivers\RTL2832UBDA.sys [x]
R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys;c:\windows\SYSNATIVE\Drivers\RTL2832UUSB.sys [x]
R3 SNTUSB64;SafeNet USB SuperPro/UltraPro/HardwareKey;c:\windows\system32\DRIVERS\SNTUSB64.SYS;c:\windows\SYSNATIVE\DRIVERS\SNTUSB64.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys;c:\windows\SYSNATIVE\DRIVERS\NBVol.sys [x]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys;c:\windows\SYSNATIVE\DRIVERS\NBVolUp.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [x]
S1 ccSet_NIS;Norton Internet Security CBE Settings Manager;c:\windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\ccSetx64.sys [x]
S1 cdrblock;cdrblock;c:\windows\system32\DRIVERS\cdrblock.sys;c:\windows\SYSNATIVE\DRIVERS\cdrblock.sys [x]
S1 DslMNLwf;DSL-Manager NDIS LightWeight Filter;c:\windows\system32\DRIVERS\dslmnlwf.sys;c:\windows\SYSNATIVE\DRIVERS\dslmnlwf.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1404000.028\SYMNETS.SYS [x]
S2 aksdf;aksdf;c:\windows\system32\drivers\aksdf.sys;c:\windows\SYSNATIVE\drivers\aksdf.sys [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 hasplms;Sentinel HASP License Manager;c:\windows\system32\hasplms.exe -run;c:\windows\SYSNATIVE\hasplms.exe -run [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe;c:\program files (x86)\System Control Manager\MSIService.exe [x]
S2 MSI Foundation Service;MSI Foundation Service;c:\program files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe;c:\program files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 NIS;Norton Internet Security CBE;c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x]
S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys;c:\windows\SYSNATIVE\Drivers\Sentinel64.sys [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64;c:\windows\system32\drivers\fspad_wlh64.sys;c:\windows\SYSNATIVE\drivers\fspad_wlh64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 TDslMgrService;DSL-Manager;c:\program files (x86)\DSL-Manager\DslMgrSvc.exe;c:\program files (x86)\DSL-Manager\DslMgrSvc.exe [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-25 15:23]
.
2013-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-25 15:23]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-14 11777128]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-03-30 10372368]
"THXCfg64"="c:\windows\system32\THXCfg64.dll" [2009-10-15 17920]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com
IE: Free YouTube to MP3 Converter - c:\users\Stefan\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{6C7C0C9A-B51D-4ADB-A74D-C4E33744F866} - c:\program files (x86)\TraXEx\Integration\TraXEx Internet Explorer.lnk
IE: {{8DA7743F-9274-4BE8-899E-C0FF6ED61B00} - c:\program files (x86)\TraXEx\Integration\TraXEx Löschautomat.lnk
Trusted Zone: apemap.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.startup.homepage -
FF - ExtSQL: 2013-09-11 09:51; {af9433c0-d475-48fd-8223-97aab85432eb}; c:\program files (x86)\TubeSaver\133.xpi
FF - ExtSQL: 2013-09-11 09:51; ffxtlbr@delta.com; c:\users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\extensions\ffxtlbr@delta.com
FF - ExtSQL: 2013-09-12 17:30; {EEE6C361-6118-11DC-9C72-001320C79847}; c:\users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
FF - ExtSQL: 2013-09-12 17:31; {8E9E3331-D360-4f87-8803-52DE43566502}; c:\program files\Updater By Sweetpacks\Firefox
FF - ExtSQL: 2013-09-13 18:59; abb@amazon.com; c:\users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\extensions\abb@amazon.com
.
.
------- Dateityp-Verknüpfung -------
.
JSEFile=%SystemRoot%\SysWow64\CScript.exe "%1" %*
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{DEDAF650-12B8-48f5-A843-BBA100716106} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - (no file)
HKLM-Run-fspuip - c:\program files (x86)\FSP\fspuip.exe
HKLM-Run-Ocs_SM - c:\users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe
AddRemove-{86b921d3-29b2-4d01-aaa2-91bd329fce97} - c:\program files (x86)\TubeSaver\Uninstall.exe
AddRemove-{9B038FEE-D7DF-4C59-A2B1-8B4FA7AB8F52} - c:\programdata\{19BADE35-E142-4584-9C1D-4E2F5E4EBA9F}\Setup_FS20IRP2.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
"ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z
[\]^_ª\00\00ª\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~ª\00\00ª\00\00\00\00m\00\00\00\00\00\00\00\00‘’“"
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_174_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_174_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_174_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_174_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-09-16 20:04:49
ComboFix-quarantined-files.txt 2013-09-16 18:04
.
Vor Suchlauf: 23 Verzeichnis(se), 143.002.357.760 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 146.880.864.256 Bytes frei
.
- - End Of File - - FA27EB9BFC724A9CC5E2577C51FEC241
Combofix Logfile: Code:
ATTFilter ComboFix 13-09-16.01 - Stefan 16.09.2013 19:59:21.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.16361.13776 [GMT 2:00]
ausgeführt von:: c:\users\Stefan\Desktop\ComboFix.exe
AV: Norton Internet Security CBE *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security CBE *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security CBE *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\AlexaNSISPlugin.7300.dll
c:\users\Stefan\AppData\Local\assembly\tmp
c:\windows\SysWow64\cseDVH.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-08-16 bis 2013-09-16 ))))))))))))))))))))))))))))))
.
.
2013-09-16 18:03 . 2013-09-16 18:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-16 17:27 . 2013-09-16 17:29 -------- d-----w- C:\AdwCleaner
2013-09-16 08:54 . 2013-09-16 08:54 -------- d-----w- C:\FRST
2013-09-15 19:46 . 2013-09-15 19:46 -------- d-----w- c:\users\Stefan\AppData\Roaming\Malwarebytes
2013-09-15 19:46 . 2013-09-15 19:46 -------- d-----w- c:\programdata\Malwarebytes
2013-09-15 19:46 . 2013-09-15 19:46 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-09-15 19:46 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-09-13 16:21 . 2013-09-13 16:21 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-13 16:21 . 2013-09-13 16:21 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-13 09:54 . 2013-09-13 11:55 -------- d-----w- c:\users\Stefan\AppData\Local\NPE
2013-09-12 19:19 . 2013-09-12 19:20 -------- d-----w- c:\program files (x86)\Voxformer VST
2013-09-12 16:17 . 2013-08-02 02:23 5550528 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-09-12 13:22 . 2013-03-23 10:51 375832 ----a-w- c:\windows\system32\proDAD-PA-Support.dll
2013-09-12 13:07 . 2013-09-12 13:07 -------- d-----w- c:\program files\Common Files\OFX
2013-09-12 10:48 . 2013-09-12 10:48 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2013-09-12 10:47 . 2013-09-12 10:48 -------- d-----w- c:\programdata\Package Cache
2013-09-12 10:40 . 2013-09-12 10:40 -------- d-----w- c:\program files\Grass Valley
2013-09-11 12:47 . 2013-09-11 12:47 -------- d-----w- c:\program files\iTunes
2013-09-11 12:47 . 2013-09-11 12:47 -------- d-----w- c:\program files\iPod
2013-09-11 12:47 . 2013-09-11 12:47 -------- d-----w- c:\program files (x86)\iTunes
2013-09-11 12:46 . 2013-09-11 12:47 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-09-11 04:59 . 2013-09-09 13:29 43320 ----a-w- c:\windows\system32\uxtuneup.dll
2013-09-11 04:59 . 2013-09-09 13:29 36152 ----a-w- c:\windows\SysWow64\uxtuneup.dll
2013-09-09 10:24 . 2013-09-09 10:24 -------- d-----w- c:\program files (x86)\apemap
2013-09-09 04:57 . 2013-09-09 04:57 -------- d-----w- c:\users\Stefan\AppData\Local\Avg2014
2013-09-05 08:51 . 2013-09-09 13:29 40760 ----a-w- c:\windows\system32\TURegOpt.exe
2013-09-05 08:51 . 2013-09-09 13:29 29496 ----a-w- c:\windows\system32\authuitu.dll
2013-09-05 08:51 . 2013-09-09 13:29 25400 ----a-w- c:\windows\SysWow64\authuitu.dll
2013-09-05 08:50 . 2013-09-11 04:59 -------- d-----w- c:\program files (x86)\TuneUp Utilities 2014
2013-09-05 08:49 . 2013-09-05 08:55 -------- d-sh--w- c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2013-08-30 08:39 . 2013-08-30 08:39 14104 ----a-w- c:\windows\system32\CtsEventRes.dll
2013-08-30 08:39 . 2013-08-30 08:39 825112 ------w- c:\windows\system32\cseuvec.dll
2013-08-30 08:39 . 2013-08-30 08:39 918808 ------w- c:\windows\system32\csem2vi01.dll
2013-08-30 08:39 . 2013-08-30 08:39 166168 ------w- c:\windows\system32\csellc.dll
2013-08-30 08:39 . 2013-08-30 08:39 701720 ------w- c:\windows\system32\csehqa.dll
2013-08-30 08:39 . 2013-08-30 08:39 1116952 ------w- c:\windows\system32\csehq2.dll
2013-08-30 08:39 . 2013-08-30 08:39 1089816 ------w- c:\windows\system32\csedvh.dll
2013-08-30 08:32 . 2013-08-30 08:32 13080 ----a-w- c:\windows\system32\GVLMEventRes.dll
2013-08-30 08:31 . 2013-08-30 08:31 852760 ----a-w- c:\windows\SysWow64\cseuvec.dll
2013-08-30 08:31 . 2013-08-30 08:31 911640 ----a-w- c:\windows\SysWow64\csem2vi01.dll
2013-08-30 08:31 . 2013-08-30 08:31 164632 ----a-w- c:\windows\SysWow64\csellc.dll
2013-08-30 08:31 . 2013-08-30 08:31 717592 ----a-w- c:\windows\SysWow64\csehqa.dll
2013-08-30 08:31 . 2013-08-30 08:31 1061656 ----a-w- c:\windows\SysWow64\csehq2.dll
2013-08-30 07:28 . 2013-08-30 07:28 48920 ----a-w- c:\windows\system32\drivers\pnxakrnl.sys
2013-08-30 07:28 . 2013-08-30 07:28 54040 ----a-w- c:\windows\system32\drivers\clpkrnl.sys
2013-08-30 07:28 . 2013-08-30 07:28 3172632 ----a-w- c:\windows\system32\drivers\gvzkrnl.sys
2013-08-30 06:29 . 2013-08-30 06:29 1812992 ----a-w- c:\windows\SysWow64\c210codc.dll
2013-08-30 06:29 . 2013-08-30 06:29 58880 ----a-w- c:\windows\SysWow64\cuvccodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 89088 ----a-w- c:\windows\SysWow64\chqxcodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 50176 ----a-w- c:\windows\SysWow64\cdvhcodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 1777664 ----a-w- c:\windows\SysWow64\cllccodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 598016 ----a-w- c:\windows\SysWow64\cmiccodc.dll
2013-08-30 06:29 . 2013-08-30 06:29 50176 ----a-w- c:\windows\SysWow64\cdv5codc.dll
2013-08-30 06:29 . 2013-08-30 06:29 55808 ----a-w- c:\windows\SysWow64\cdvccodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 65536 ----a-w- c:\windows\system32\cuvccodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 51200 ----a-w- c:\windows\system32\cdv5codc.dll
2013-08-30 06:25 . 2013-08-30 06:25 1391616 ----a-w- c:\windows\system32\c210codc.dll
2013-08-30 06:25 . 2013-08-30 06:25 57856 ----a-w- c:\windows\system32\cdvccodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 1384448 ----a-w- c:\windows\system32\cllccodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 95744 ----a-w- c:\windows\system32\chqxcodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 51200 ----a-w- c:\windows\system32\cdvhcodc.dll
2013-08-30 06:25 . 2013-08-30 06:25 486912 ----a-w- c:\windows\system32\cmiccodc.dll
2013-08-30 06:15 . 2013-08-30 06:15 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2013-08-29 12:11 . 2013-08-29 12:11 -------- d-----w- c:\users\Stefan\AppData\Local\funkwerk
2013-08-29 12:03 . 2013-08-29 12:03 -------- d-----w- c:\program files (x86)\funkwerk WIN-Tools
2013-08-29 10:41 . 2013-08-29 10:41 -------- d-----w- c:\program files\DIFX
2013-08-29 10:41 . 2013-08-29 10:41 69912 ----a-r- c:\users\Stefan\AppData\Roaming\Microsoft\Installer\{293C4FDD-FB80-48F8-8B40-F085392FDAA1}\ARPPRODUCTICON.exe
2013-08-29 10:41 . 2013-08-29 10:41 -------- d-----w- c:\program files (x86)\T-Home
2013-08-24 19:59 . 2013-09-09 16:55 -------- d--h--w- c:\users\Stefan\AppData\Roaming\Grgopxwylg
2013-08-20 08:41 . 2013-08-20 08:41 -------- d-----w- c:\windows\SysWow64\Adobe
2013-08-20 08:36 . 2013-08-20 08:36 -------- d-----w- c:\users\Stefan\AppData\Local\Macromedia
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-17 09:09 . 2012-09-14 10:52 607256 ----a-w- c:\windows\system32\prodad-codec.dll
2013-08-05 17:45 . 2013-08-05 17:45 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-08-05 17:45 . 2012-10-06 14:47 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-08-05 17:45 . 2012-10-06 14:47 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-08-02 01:48 . 2013-09-12 16:17 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-27 15:43 . 2007-04-27 08:43 120200 ----a-w- c:\windows\SysWow64\DLLDEV32i.dll
2013-07-25 09:25 . 2013-08-14 05:40 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-14 05:40 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58 . 2013-08-14 05:40 2048 ----a-w- c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-14 05:40 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-07-17 04:45 . 2013-07-17 04:45 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-07-17 04:45 . 2013-07-17 04:45 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-07-17 04:45 . 2013-07-17 04:45 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-07-17 04:45 . 2013-07-17 04:45 81408 ----a-w- c:\windows\system32\icardie.dll
2013-07-17 04:45 . 2013-07-17 04:45 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-07-17 04:45 . 2013-07-17 04:45 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-07-17 04:45 . 2013-07-17 04:45 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-07-17 04:45 . 2013-07-17 04:45 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-07-17 04:45 . 2013-07-17 04:45 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-07-17 04:45 . 2013-07-17 04:45 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-07-17 04:45 . 2013-07-17 04:45 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-07-17 04:45 . 2013-07-17 04:45 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-07-17 04:45 . 2013-07-17 04:45 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-07-17 04:45 . 2013-07-17 04:45 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-07-17 04:45 . 2013-07-17 04:45 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-07-17 04:45 . 2013-07-17 04:45 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-07-17 04:45 . 2013-07-17 04:45 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-07-17 04:45 . 2013-07-17 04:45 441856 ----a-w- c:\windows\system32\html.iec
2013-07-17 04:45 . 2013-07-17 04:45 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-07-17 04:45 . 2013-07-17 04:45 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-07-17 04:45 . 2013-07-17 04:45 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-07-17 04:45 . 2013-07-17 04:45 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-07-17 04:45 . 2013-07-17 04:45 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-07-17 04:45 . 2013-07-17 04:45 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-07-17 04:45 . 2013-07-17 04:45 235008 ----a-w- c:\windows\system32\url.dll
2013-07-17 04:45 . 2013-07-17 04:45 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-07-17 04:45 . 2013-07-17 04:45 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-07-17 04:45 . 2013-07-17 04:45 216064 ----a-w- c:\windows\system32\msls31.dll
2013-07-17 04:45 . 2013-07-17 04:45 197120 ----a-w- c:\windows\system32\msrating.dll
2013-07-17 04:45 . 2013-07-17 04:45 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-07-17 04:45 . 2013-07-17 04:45 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-07-17 04:45 . 2013-07-17 04:45 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-07-17 04:45 . 2013-07-17 04:45 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-07-17 04:45 . 2013-07-17 04:45 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-07-17 04:45 . 2013-07-17 04:45 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-07-17 04:45 . 2013-07-17 04:45 149504 ----a-w- c:\windows\system32\occache.dll
2013-07-17 04:45 . 2013-07-17 04:45 144896 ----a-w- c:\windows\system32\wextract.exe
2013-07-17 04:45 . 2013-07-17 04:45 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-07-17 04:45 . 2013-07-17 04:45 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-07-17 04:45 . 2013-07-17 04:45 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-07-17 04:45 . 2013-07-17 04:45 13824 ----a-w- c:\windows\system32\mshta.exe
2013-07-17 04:45 . 2013-07-17 04:45 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-07-17 04:45 . 2013-07-17 04:45 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-07-17 04:45 . 2013-07-17 04:45 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-07-17 04:45 . 2013-07-17 04:45 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-07-17 04:45 . 2013-07-17 04:45 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-07-17 04:45 . 2013-07-17 04:45 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-07-17 04:45 . 2013-07-17 04:45 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-07-17 04:45 . 2013-07-17 04:45 102912 ----a-w- c:\windows\system32\inseng.dll
2013-07-09 05:52 . 2013-08-14 05:40 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-07-09 05:51 . 2013-08-14 05:40 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2013-07-09 05:46 . 2013-08-14 05:40 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-07-09 05:46 . 2013-08-14 05:40 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-07-09 05:46 . 2013-08-14 05:40 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-07-09 04:52 . 2013-08-14 05:40 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52 . 2013-08-14 05:40 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-07-09 04:46 . 2013-08-14 05:40 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46 . 2013-08-14 05:40 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-07-09 04:46 . 2013-08-14 05:40 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-07-06 06:03 . 2013-08-14 05:40 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-06-19 13:16 . 2013-05-17 12:59 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Duden Korrektor SysTray"="c:\program files (x86)\Duden\Duden Korrektor\DKTray.exe" [2010-10-04 336560]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-21 19875944]
"TomTomHOME.exe"="c:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2013-07-02 248208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"MGSysCtrl"="c:\program files (x86)\System Control Manager\MGSysCtrl.exe" [2010-11-05 2482176]
"Cinema ProII AP"="c:\program files (x86)\MSI\Cinema ProII\CinemaProII.exe" [2011-01-25 200192]
"Cinema ProII Controler"="c:\program files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe" [2010-06-25 1689600]
"THX Audio Control Panel"="c:\program files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" [2010-11-18 1351680]
"NVIDIAOCAP"="c:\program files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe" [2010-10-20 83456]
"msi LED Manager"="c:\program files (x86)\msi\msi LED Manager\SLM.exe" [2010-07-29 2795008]
"Contour Shuttle Device Helper"="c:\program files (x86)\Contour Shuttle\ShuttleHelper.exe" [2011-02-14 118784]
"CLMLServer"="c:\program files (x86)\Cyberlink\Power2Go\CLMLSvc.exe" [2009-12-15 103720]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePPShortCut"="c:\program files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UCam_Menu"="c:\program files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" [2010-12-08 222504]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"RemoteControl11"="c:\program files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe" [2011-05-19 234792]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2012-11-13 450560]
.
c:\users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Control Center.lnk - c:\program files (x86)\funkwerk WIN-Tools\Eumex 401 WIN-Tools V1.00\ControlCenter.exe [2008-8-25 225280]
GV LicenseManager.lnk - c:\program files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe [2013-8-30 8832888]
HD Writer.lnk - c:\program files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe [2012-4-25 308640]
TMMonitor.lnk - c:\program files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe [2012-4-25 258048]
TraXEx 3.3.lnk - c:\program files (x86)\TraXEx\TraXEx.exe [2012-4-26 4033360]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files (x86)\DSL-Manager\DslMgr.exe [2012-4-25 1085440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"UpdReg"=c:\windows\UpdReg.EXE
"ArcSoft Connection Service"=c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
R3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe [x]
R3 fspad_xp64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_xp64;c:\windows\system32\drivers\fspad_xp64.sys;c:\windows\SYSNATIVE\drivers\fspad_xp64.sys [x]
R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
R3 MGHwCtrl;MGHwCtrl;c:\program files\MSI\MSI Software Install\MGHwCtrl.sys;c:\program files\MSI\MSI Software Install\MGHwCtrl.sys [x]
R3 PLTurbh;Prolific turbo filter driver for hdd;c:\windows\system32\drivers\plturbh.sys;c:\windows\SYSNATIVE\drivers\plturbh.sys [x]
R3 PLTurbo;Prolific turbo filter driver for odd;c:\windows\system32\drivers\plturbo.sys;c:\windows\SYSNATIVE\drivers\plturbo.sys [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys;c:\windows\SYSNATIVE\drivers\RTL2832UBDA.sys [x]
R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys;c:\windows\SYSNATIVE\Drivers\RTL2832UUSB.sys [x]
R3 SNTUSB64;SafeNet USB SuperPro/UltraPro/HardwareKey;c:\windows\system32\DRIVERS\SNTUSB64.SYS;c:\windows\SYSNATIVE\DRIVERS\SNTUSB64.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys;c:\windows\SYSNATIVE\DRIVERS\NBVol.sys [x]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys;c:\windows\SYSNATIVE\DRIVERS\NBVolUp.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [x]
S1 ccSet_NIS;Norton Internet Security CBE Settings Manager;c:\windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\ccSetx64.sys [x]
S1 cdrblock;cdrblock;c:\windows\system32\DRIVERS\cdrblock.sys;c:\windows\SYSNATIVE\DRIVERS\cdrblock.sys [x]
S1 DslMNLwf;DSL-Manager NDIS LightWeight Filter;c:\windows\system32\DRIVERS\dslmnlwf.sys;c:\windows\SYSNATIVE\DRIVERS\dslmnlwf.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1404000.028\SYMNETS.SYS [x]
S2 aksdf;aksdf;c:\windows\system32\drivers\aksdf.sys;c:\windows\SYSNATIVE\drivers\aksdf.sys [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 hasplms;Sentinel HASP License Manager;c:\windows\system32\hasplms.exe -run;c:\windows\SYSNATIVE\hasplms.exe -run [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\System Control Manager\MSIService.exe;c:\program files (x86)\System Control Manager\MSIService.exe [x]
S2 MSI Foundation Service;MSI Foundation Service;c:\program files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe;c:\program files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 NIS;Norton Internet Security CBE;c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x]
S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys;c:\windows\SYSNATIVE\Drivers\Sentinel64.sys [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64;c:\windows\system32\drivers\fspad_wlh64.sys;c:\windows\SYSNATIVE\drivers\fspad_wlh64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 TDslMgrService;DSL-Manager;c:\program files (x86)\DSL-Manager\DslMgrSvc.exe;c:\program files (x86)\DSL-Manager\DslMgrSvc.exe [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-25 15:23]
.
2013-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-25 15:23]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-14 11777128]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-03-30 10372368]
"THXCfg64"="c:\windows\system32\THXCfg64.dll" [2009-10-15 17920]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com
IE: Free YouTube to MP3 Converter - c:\users\Stefan\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{6C7C0C9A-B51D-4ADB-A74D-C4E33744F866} - c:\program files (x86)\TraXEx\Integration\TraXEx Internet Explorer.lnk
IE: {{8DA7743F-9274-4BE8-899E-C0FF6ED61B00} - c:\program files (x86)\TraXEx\Integration\TraXEx Löschautomat.lnk
Trusted Zone: apemap.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.startup.homepage -
FF - ExtSQL: 2013-09-11 09:51; {af9433c0-d475-48fd-8223-97aab85432eb}; c:\program files (x86)\TubeSaver\133.xpi
FF - ExtSQL: 2013-09-11 09:51; ffxtlbr@delta.com; c:\users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\extensions\ffxtlbr@delta.com
FF - ExtSQL: 2013-09-12 17:30; {EEE6C361-6118-11DC-9C72-001320C79847}; c:\users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
FF - ExtSQL: 2013-09-12 17:31; {8E9E3331-D360-4f87-8803-52DE43566502}; c:\program files\Updater By Sweetpacks\Firefox
FF - ExtSQL: 2013-09-13 18:59; abb@amazon.com; c:\users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\extensions\abb@amazon.com
.
.
------- Dateityp-Verknüpfung -------
.
JSEFile=%SystemRoot%\SysWow64\CScript.exe "%1" %*
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{DEDAF650-12B8-48f5-A843-BBA100716106} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - (no file)
HKLM-Run-fspuip - c:\program files (x86)\FSP\fspuip.exe
HKLM-Run-Ocs_SM - c:\users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe
AddRemove-{86b921d3-29b2-4d01-aaa2-91bd329fce97} - c:\program files (x86)\TubeSaver\Uninstall.exe
AddRemove-{9B038FEE-D7DF-4C59-A2B1-8B4FA7AB8F52} - c:\programdata\{19BADE35-E142-4584-9C1D-4E2F5E4EBA9F}\Setup_FS20IRP2.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
"ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z
[\]^_ª\00\00ª\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~ª\00\00ª\00\00\00\00m\00\00\00\00\00\00\00\00‘’“"
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_174_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_174_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_174_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_174_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-09-16 20:04:49
ComboFix-quarantined-files.txt 2013-09-16 18:04
.
Vor Suchlauf: 23 Verzeichnis(se), 143.002.357.760 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 146.880.864.256 Bytes frei
.
- - End Of File - - FA27EB9BFC724A9CC5E2577C51FEC241
|
|
16.09.2013, 19:23
| #14 |
| | Postbank Online Banking Trojaner Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 01 Ran by Stefan (administrator) on STEFAN-MSI on 16-09-2013 20:14:40 Running from C:\Users\Stefan\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\windows\system32\nvvsvc.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (B.H.A Corporation) C:\Windows\SysWOW64\bgsvcgen.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (SafeNet Inc.) C:\windows\system32\hasplms.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe (MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe () C:\Program Files\CyberLink\Shared files\RichVideo64.exe (Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\windows\system32\nvvsvc.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Sentelic Corporation) C:\Program Files\FSP\FspUip.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe (Expert System S.p.A.) C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Grass Valley K.K.) C:\Program Files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe (ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe (Alexander Miehlke Softwareentwicklung) C:\Program Files (x86)\TraXEx\TraXEx.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe (Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe (msi) C:\Program Files (x86)\MSI\msi LED Manager\SLM.exe (Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe (CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD11\PDVD11Serv.exe (Flexera Software LLC) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Bibliographisches Institut GmbH) C:\Program Files (x86)\Duden\Duden-Bibliothek\dudenbib.exe (Microsoft Corporation) C:\windows\splwow64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (T-Systems Enterprise Services GmbH) C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_8_800_174_ActiveX.exe (Microsoft Corporation) C:\windows\System32\MsSpellCheckingFacility.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11777128 2011-02-14] (Realtek Semiconductor) HKLM\...\Run: [fspuip] - C:\Program Files\FSP\fspuip.exe [3650048 2010-06-07] (Sentelic Corporation) HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp HKLM\...\Run: [THXCfg64] - C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64 HKLM\...\Run: [Ocs_SM] - C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.) HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.) HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation) HKLM-x32\...\Run: [MGSysCtrl] - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2010-11-05] (Micro-Star International Co., Ltd.) HKLM-x32\...\Run: [Cinema ProII AP] - C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe [200192 2011-01-25] (Micro-Star Int'l Co., Ltd.) HKLM-x32\...\Run: [Cinema ProII Controler] - C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe [1689600 2010-06-25] (msi) HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1351680 2010-11-19] (Creative Technology Ltd) HKLM-x32\...\Run: [NVIDIAOCAP] - C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe [83456 2010-10-20] (MSI) HKLM-x32\...\Run: [msi LED Manager] - C:\Program Files (x86)\msi\msi LED Manager\SLM.exe [2795008 2010-07-29] (msi) HKLM-x32\...\Run: [Contour Shuttle Device Helper] - C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe [118784 2011-02-14] (Contour Design, Inc.) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink) HKLM-x32\...\Run: [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [x] HKLM-x32\...\Run: [UpdatePPShortCut] - "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [x] HKLM-x32\...\Run: [UCam_Menu] - "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [x] HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [222504 2010-12-08] (CyberLink Corp.) HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [RemoteControl11] - C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe [234792 2011-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] () HKU\Default\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.) HKU\Default User\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH) Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSI2DF&pc=MAM2&src=IE-SearchBox SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = SearchScopes: HKCU - {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = BHO: Updater By Sweetpacks - {DEDAF650-12B8-48f5-A843-BBA100716106} - No File BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.) BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default FF Homepage: user_pref("browser.startup.homepage", ); FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: jid0-UVAeBCfd34Kk5usS8A1CBiobvM8 - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ FF HKCU\...\Firefox\Extensions: [{af9433c0-d475-48fd-8223-97aab85432eb}] - C:\Program Files (x86)\TubeSaver\133.xpi ==================== Services (Whitelisted) ================= R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 hasplms; C:\windows\system32\hasplms.exe [4466120 2013-03-15] (SafeNet Inc.) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-17] (MSI) R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation) R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] () R2 ShuttleEngine; C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe [86016 2011-02-14] (Contour Design, Inc.) R3 TDslMgrService; C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-09-09] (TuneUp Software) ==================== Drivers (Whitelisted) ==================== S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.) S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [63944 2013-03-15] (SafeNet Inc.) S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation) R1 cdrblock; C:\Windows\System32\DRIVERS\cdrblock.sys [37704 2013-04-25] (Grass Valley K.K.) R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation) R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331144 2013-03-15] (SafeNet Inc.) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation) R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation) R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-07-13] (SafeNet, Inc.) S3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [58664 2009-07-13] (SafeNet, Inc.) R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation) R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) U3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [x] S3 PLTurbh; system32\drivers\plturbh.sys [x] S3 PLTurbo; system32\drivers\plturbo.sys [x] Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 01 Ran by Stefan (administrator) on STEFAN-MSI on 16-09-2013 20:14:40 Running from C:\Users\Stefan\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\windows\system32\nvvsvc.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (B.H.A Corporation) C:\Windows\SysWOW64\bgsvcgen.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (SafeNet Inc.) C:\windows\system32\hasplms.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe (MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe () C:\Program Files\CyberLink\Shared files\RichVideo64.exe (Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\windows\system32\nvvsvc.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Sentelic Corporation) C:\Program Files\FSP\FspUip.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe (Expert System S.p.A.) C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Grass Valley K.K.) C:\Program Files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe (ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe (Alexander Miehlke Softwareentwicklung) C:\Program Files (x86)\TraXEx\TraXEx.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe (Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe (msi) C:\Program Files (x86)\MSI\msi LED Manager\SLM.exe (Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe (CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD11\PDVD11Serv.exe (Flexera Software LLC) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Bibliographisches Institut GmbH) C:\Program Files (x86)\Duden\Duden-Bibliothek\dudenbib.exe (Microsoft Corporation) C:\windows\splwow64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (T-Systems Enterprise Services GmbH) C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_8_800_174_ActiveX.exe (Microsoft Corporation) C:\windows\System32\MsSpellCheckingFacility.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11777128 2011-02-14] (Realtek Semiconductor) HKLM\...\Run: [fspuip] - C:\Program Files\FSP\fspuip.exe [3650048 2010-06-07] (Sentelic Corporation) HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp HKLM\...\Run: [THXCfg64] - C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64 HKLM\...\Run: [Ocs_SM] - C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.) HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.) HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation) HKLM-x32\...\Run: [MGSysCtrl] - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2010-11-05] (Micro-Star International Co., Ltd.) HKLM-x32\...\Run: [Cinema ProII AP] - C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe [200192 2011-01-25] (Micro-Star Int'l Co., Ltd.) HKLM-x32\...\Run: [Cinema ProII Controler] - C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe [1689600 2010-06-25] (msi) HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1351680 2010-11-19] (Creative Technology Ltd) HKLM-x32\...\Run: [NVIDIAOCAP] - C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe [83456 2010-10-20] (MSI) HKLM-x32\...\Run: [msi LED Manager] - C:\Program Files (x86)\msi\msi LED Manager\SLM.exe [2795008 2010-07-29] (msi) HKLM-x32\...\Run: [Contour Shuttle Device Helper] - C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe [118784 2011-02-14] (Contour Design, Inc.) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink) HKLM-x32\...\Run: [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [x] HKLM-x32\...\Run: [UpdatePPShortCut] - "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [x] HKLM-x32\...\Run: [UCam_Menu] - "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [x] HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [222504 2010-12-08] (CyberLink Corp.) HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [RemoteControl11] - C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe [234792 2011-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] () HKU\Default\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.) HKU\Default User\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH) Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSI2DF&pc=MAM2&src=IE-SearchBox SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = SearchScopes: HKCU - {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = BHO: Updater By Sweetpacks - {DEDAF650-12B8-48f5-A843-BBA100716106} - No File BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.) BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default FF Homepage: user_pref("browser.startup.homepage", ); FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: jid0-UVAeBCfd34Kk5usS8A1CBiobvM8 - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ FF HKCU\...\Firefox\Extensions: [{af9433c0-d475-48fd-8223-97aab85432eb}] - C:\Program Files (x86)\TubeSaver\133.xpi ==================== Services (Whitelisted) ================= R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 hasplms; C:\windows\system32\hasplms.exe [4466120 2013-03-15] (SafeNet Inc.) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-17] (MSI) R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation) R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] () R2 ShuttleEngine; C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe [86016 2011-02-14] (Contour Design, Inc.) R3 TDslMgrService; C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-09-09] (TuneUp Software) ==================== Drivers (Whitelisted) ==================== S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.) S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [63944 2013-03-15] (SafeNet Inc.) S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation) R1 cdrblock; C:\Windows\System32\DRIVERS\cdrblock.sys [37704 2013-04-25] (Grass Valley K.K.) R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation) R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331144 2013-03-15] (SafeNet Inc.) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation) R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation) R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-07-13] (SafeNet, Inc.) S3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [58664 2009-07-13] (SafeNet, Inc.) R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation) R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) U3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [x] S3 PLTurbh; system32\drivers\plturbh.sys [x] S3 PLTurbo; system32\drivers\plturbo.sys [x] Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 01 Ran by Stefan (administrator) on STEFAN-MSI on 16-09-2013 20:14:40 Running from C:\Users\Stefan\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\windows\system32\nvvsvc.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (B.H.A Corporation) C:\Windows\SysWOW64\bgsvcgen.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (SafeNet Inc.) C:\windows\system32\hasplms.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe (MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe () C:\Program Files\CyberLink\Shared files\RichVideo64.exe (Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\windows\system32\nvvsvc.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Sentelic Corporation) C:\Program Files\FSP\FspUip.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe (Expert System S.p.A.) C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Grass Valley K.K.) C:\Program Files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe (ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe (Alexander Miehlke Softwareentwicklung) C:\Program Files (x86)\TraXEx\TraXEx.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe (Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe (msi) C:\Program Files (x86)\MSI\msi LED Manager\SLM.exe (Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe (CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD11\PDVD11Serv.exe (Flexera Software LLC) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Bibliographisches Institut GmbH) C:\Program Files (x86)\Duden\Duden-Bibliothek\dudenbib.exe (Microsoft Corporation) C:\windows\splwow64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (T-Systems Enterprise Services GmbH) C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_8_800_174_ActiveX.exe (Microsoft Corporation) C:\windows\System32\MsSpellCheckingFacility.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11777128 2011-02-14] (Realtek Semiconductor) HKLM\...\Run: [fspuip] - C:\Program Files\FSP\fspuip.exe [3650048 2010-06-07] (Sentelic Corporation) HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp HKLM\...\Run: [THXCfg64] - C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64 HKLM\...\Run: [Ocs_SM] - C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.) HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.) HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation) HKLM-x32\...\Run: [MGSysCtrl] - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2010-11-05] (Micro-Star International Co., Ltd.) HKLM-x32\...\Run: [Cinema ProII AP] - C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe [200192 2011-01-25] (Micro-Star Int'l Co., Ltd.) HKLM-x32\...\Run: [Cinema ProII Controler] - C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe [1689600 2010-06-25] (msi) HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1351680 2010-11-19] (Creative Technology Ltd) HKLM-x32\...\Run: [NVIDIAOCAP] - C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe [83456 2010-10-20] (MSI) HKLM-x32\...\Run: [msi LED Manager] - C:\Program Files (x86)\msi\msi LED Manager\SLM.exe [2795008 2010-07-29] (msi) HKLM-x32\...\Run: [Contour Shuttle Device Helper] - C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe [118784 2011-02-14] (Contour Design, Inc.) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink) HKLM-x32\...\Run: [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [x] HKLM-x32\...\Run: [UpdatePPShortCut] - "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [x] HKLM-x32\...\Run: [UCam_Menu] - "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [x] HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [222504 2010-12-08] (CyberLink Corp.) HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [RemoteControl11] - C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe [234792 2011-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] () HKU\Default\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.) HKU\Default User\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH) Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSI2DF&pc=MAM2&src=IE-SearchBox SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = SearchScopes: HKCU - {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = BHO: Updater By Sweetpacks - {DEDAF650-12B8-48f5-A843-BBA100716106} - No File BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.) BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default FF Homepage: user_pref("browser.startup.homepage", ); FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: jid0-UVAeBCfd34Kk5usS8A1CBiobvM8 - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\ FF HKCU\...\Firefox\Extensions: [{af9433c0-d475-48fd-8223-97aab85432eb}] - C:\Program Files (x86)\TubeSaver\133.xpi ==================== Services (Whitelisted) ================= R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 hasplms; C:\windows\system32\hasplms.exe [4466120 2013-03-15] (SafeNet Inc.) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-17] (MSI) R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation) R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] () R2 ShuttleEngine; C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe [86016 2011-02-14] (Contour Design, Inc.) R3 TDslMgrService; C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-09-09] (TuneUp Software) ==================== Drivers (Whitelisted) ==================== S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.) S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [63944 2013-03-15] (SafeNet Inc.) S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation) R1 cdrblock; C:\Windows\System32\DRIVERS\cdrblock.sys [37704 2013-04-25] (Grass Valley K.K.) R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation) R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331144 2013-03-15] (SafeNet Inc.) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation) R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation) R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-07-13] (SafeNet, Inc.) S3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [58664 2009-07-13] (SafeNet, Inc.) R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation) R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) U3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [x] S3 PLTurbh; system32\drivers\plturbh.sys [x] S3 PLTurbo; system32\drivers\plturbo.sys [x] Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 01
Ran by Stefan (administrator) on STEFAN-MSI on 16-09-2013 20:14:40
Running from C:\Users\Stefan\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(B.H.A Corporation) C:\Windows\SysWOW64\bgsvcgen.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(SafeNet Inc.) C:\windows\system32\hasplms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MSIService.exe
(MSI) C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Sentelic Corporation) C:\Program Files\FSP\FspUip.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(Expert System S.p.A.) C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Grass Valley K.K.) C:\Program Files (x86)\Grass Valley\GV LicenseManager\AppMaintainer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\HD Writer AutoStart\HDWriterAutoStart.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia 3.5\TMMonitor.exe
(Alexander Miehlke Softwareentwicklung) C:\Program Files (x86)\TraXEx\TraXEx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Micro-Star International Co., Ltd.) C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe
(Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe
(msi) C:\Program Files (x86)\MSI\msi LED Manager\SLM.exe
(Contour Design, Inc.) C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD11\PDVD11Serv.exe
(Flexera Software LLC) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Bibliographisches Institut GmbH) C:\Program Files (x86)\Duden\Duden-Bibliothek\dudenbib.exe
(Microsoft Corporation) C:\windows\splwow64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(T-Systems Enterprise Services GmbH) C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_8_800_174_ActiveX.exe
(Microsoft Corporation) C:\windows\System32\MsSpellCheckingFacility.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11777128 2011-02-14] (Realtek Semiconductor)
HKLM\...\Run: [fspuip] - C:\Program Files\FSP\fspuip.exe [3650048 2010-06-07] (Sentelic Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [THXCfg64] - C:\windows\system32\RunDLL32.exe C:\windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [Ocs_SM] - C:\Users\Stefan\AppData\Roaming\OCS\SM\SearchAnonymizer.exe
HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [MGSysCtrl] - C:\Program Files (x86)\System Control Manager\MGSysCtrl.exe [2482176 2010-11-05] (Micro-Star International Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII AP] - C:\Program Files (x86)\MSI\Cinema ProII\CinemaProII.exe [200192 2011-01-25] (Micro-Star Int'l Co., Ltd.)
HKLM-x32\...\Run: [Cinema ProII Controler] - C:\Program Files (x86)\MSI\Cinema ProII\Cinema ProII Controler.exe [1689600 2010-06-25] (msi)
HKLM-x32\...\Run: [THX Audio Control Panel] - C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1351680 2010-11-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [NVIDIAOCAP] - C:\Program Files (x86)\MSI\NVIDIA Overclock Tool\NVIDIAOCAP.exe [83456 2010-10-20] (MSI)
HKLM-x32\...\Run: [msi LED Manager] - C:\Program Files (x86)\msi\msi LED Manager\SLM.exe [2795008 2010-07-29] (msi)
HKLM-x32\...\Run: [Contour Shuttle Device Helper] - C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe [118784 2011-02-14] (Contour Design, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [x]
HKLM-x32\...\Run: [UpdatePPShortCut] - "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [x]
HKLM-x32\...\Run: [UCam_Menu] - "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [x]
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [222504 2010-12-08] (CyberLink Corp.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [RemoteControl11] - C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe [234792 2011-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2012-11-13] ()
HKU\Default\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKU\Default User\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk
ShortcutTarget: DSL-Manager.lnk -> C:\Program Files (x86)\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)
Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSI2DF&pc=MAM2&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {64E1C23B-46C9-4911-9102-98E12F4345F8} URL =
SearchScopes: HKCU - {64E1C23B-46C9-4911-9102-98E12F4345F8} URL =
BHO: Updater By Sweetpacks - {DEDAF650-12B8-48f5-A843-BBA100716106} - No File
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll (Adobe Systems Incorporated.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default
FF Homepage: user_pref("browser.startup.homepage", );
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: jid0-UVAeBCfd34Kk5usS8A1CBiobvM8 - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\wz4wyh0x.default\Extensions\jid0-UVAeBCfd34Kk5usS8A1CBiobvM8@jetpack.xpi
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF HKCU\...\Firefox\Extensions: [{af9433c0-d475-48fd-8223-97aab85432eb}] - C:\Program Files (x86)\TubeSaver\133.xpi
==================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 hasplms; C:\windows\system32\hasplms.exe [4466120 2013-03-15] (SafeNet Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSI Foundation Service; C:\Program Files (x86)\MSI\MSI HOUSE\MSIFoundationService.exe [12800 2010-07-17] (MSI)
R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 ShuttleEngine; C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe [86016 2011-02-14] (Contour Design, Inc.)
R3 TDslMgrService; C:\Program Files (x86)\DSL-Manager\DslMgrSvc.exe [307200 2008-10-23] (T-Systems Enterprise Services GmbH)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2100024 2013-09-09] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.)
S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [63944 2013-03-15] (SafeNet Inc.)
S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130903.002\BHDrvx64.sys [1525336 2013-09-04] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 cdrblock; C:\Windows\System32\DRIVERS\cdrblock.sys [37704 2013-04-25] (Grass Valley K.K.)
R1 DslMNLwf; C:\Windows\System32\DRIVERS\dslmnlwf.sys [19008 2007-08-01] (T-Systems Enterprise Services GmbH)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331144 2013-03-15] (SafeNet Inc.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130913.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130915.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-07-13] (SafeNet, Inc.)
S3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [58664 2009-07-13] (SafeNet, Inc.)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 MGHwCtrl; \??\C:\Program Files\MSI\MSI Software Install\MGHwCtrl.sys [x]
S3 PLTurbh; system32\drivers\plturbh.sys [x]
S3 PLTurbo; system32\drivers\plturbo.sys [x]
|
|
16.09.2013, 19:25
| #15 |
| | Postbank Online Banking TrojanerCode:
ATTFilter ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-09-16 20:04 - 2013-09-16 20:04 - 00036048 _____ C:\ComboFix.txt 2013-09-16 19:58 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe 2013-09-16 19:58 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe 2013-09-16 19:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe 2013-09-16 19:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe 2013-09-16 19:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe 2013-09-16 19:58 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe 2013-09-16 19:58 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe 2013-09-16 19:58 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe 2013-09-16 19:55 - 2013-09-16 20:04 - 00000000 ____D C:\Qoobox 2013-09-16 19:55 - 2013-09-16 20:03 - 00000000 ____D C:\windows\erdnt 2013-09-16 19:51 - 2013-09-16 19:51 - 05126417 ____R (Swearware) C:\Users\Stefan\Desktop\ComboFix.exe 2013-09-16 19:32 - 2013-09-16 19:32 - 00023438 _____ C:\Users\Stefan\Desktop\AdwCleaner[S0].txt 2013-09-16 19:27 - 2013-09-16 19:29 - 00000000 ____D C:\AdwCleaner 2013-09-16 19:25 - 2013-09-16 19:25 - 01039554 _____ C:\Users\Stefan\Desktop\adwcleaner.exe 2013-09-16 14:18 - 2013-09-16 14:18 - 00602112 _____ (OldTimer Tools) C:\Users\Stefan\Desktop\OTL.exe 2013-09-16 11:03 - 2013-09-16 11:03 - 00003219 _____ C:\Users\Stefan\Desktop\GMER.log 2013-09-16 10:58 - 2013-09-16 10:58 - 00377856 _____ C:\Users\Stefan\Desktop\nt3dd2h2.exe 2013-09-16 10:54 - 2013-09-16 10:54 - 00047737 _____ C:\Users\Stefan\Desktop\Addition.txt 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-15 21:46 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2013-09-13 18:47 - 2013-09-14 02:04 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-13 18:47 - 2013-09-14 02:04 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 11:54 - 2013-09-13 13:55 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-12 21:19 - 2013-09-12 21:20 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:30 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2013-09-12 18:30 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2013-09-12 18:30 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2013-09-12 18:30 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2013-09-12 18:30 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2013-09-12 18:30 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2013-09-12 18:30 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2013-09-12 18:30 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe 2013-09-12 18:30 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe 2013-09-12 18:28 - 2013-09-12 18:30 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2013-09-01 17:08 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-09-12 18:17 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys 2013-09-12 18:17 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys 2013-09-12 18:17 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll 2013-09-12 18:17 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll 2013-09-12 18:17 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll 2013-09-12 18:17 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe 2013-09-12 18:17 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe 2013-09-12 18:17 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll 2013-09-12 18:17 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe 2013-09-12 18:17 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll 2013-09-12 18:17 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe 2013-09-12 18:17 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe 2013-09-12 18:17 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2013-09-12 18:17 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll 2013-09-12 18:17 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll 2013-09-12 18:17 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 15:22 - 2013-03-23 12:51 - 00375832 _____ (proDAD GmbH) C:\windows\system32\proDAD-PA-Support.dll 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:47 - 2013-09-12 12:48 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-11 17:33 - 2013-09-11 17:34 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:46 - 2013-09-11 14:47 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-09 15:29 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-11 06:59 - 2013-09-09 15:29 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 12:24 - 2013-09-09 18:40 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 10:51 - 2013-09-09 15:29 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-05 10:51 - 2013-09-09 15:29 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-05 10:51 - 2013-09-09 15:29 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-05 10:50 - 2013-09-11 06:59 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-05 10:49 - 2013-09-05 10:55 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-04 12:24 - 2013-09-04 12:27 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 18:33 - 2013-09-11 17:31 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-24 21:59 - 2013-09-09 18:55 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:24 - 2013-09-12 17:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2013-09-16 20:04 - 2013-09-16 20:04 - 00036048 _____ C:\ComboFix.txt 2013-09-16 20:04 - 2013-09-16 19:55 - 00000000 ____D C:\Qoobox 2013-09-16 20:04 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default 2013-09-16 20:03 - 2013-09-16 19:55 - 00000000 ____D C:\windows\erdnt 2013-09-16 20:03 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini 2013-09-16 19:52 - 2012-04-25 17:23 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-09-16 19:52 - 2012-04-25 11:51 - 01461203 _____ C:\windows\WindowsUpdate.log 2013-09-16 19:51 - 2013-09-16 19:51 - 05126417 ____R (Swearware) C:\Users\Stefan\Desktop\ComboFix.exe 2013-09-16 19:37 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-16 19:37 - 2009-07-14 06:45 - 00024656 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-16 19:35 - 2011-09-27 01:54 - 00703192 _____ C:\windows\system32\perfh007.dat 2013-09-16 19:35 - 2011-09-27 01:54 - 00150800 _____ C:\windows\system32\perfc007.dat 2013-09-16 19:35 - 2009-07-14 07:13 - 01629284 _____ C:\windows\system32\PerfStringBackup.INI 2013-09-16 19:32 - 2013-09-16 19:32 - 00023438 _____ C:\Users\Stefan\Desktop\AdwCleaner[S0].txt 2013-09-16 19:31 - 2012-04-26 19:34 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Skype 2013-09-16 19:31 - 2012-04-25 17:23 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-09-16 19:30 - 2010-11-21 05:47 - 01391866 _____ C:\windows\PFRO.log 2013-09-16 19:30 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-09-16 19:30 - 2009-07-14 06:51 - 00098922 _____ C:\windows\setupact.log 2013-09-16 19:29 - 2013-09-16 19:27 - 00000000 ____D C:\AdwCleaner 2013-09-16 19:25 - 2013-09-16 19:25 - 01039554 _____ C:\Users\Stefan\Desktop\adwcleaner.exe 2013-09-16 14:18 - 2013-09-16 14:18 - 00602112 _____ (OldTimer Tools) C:\Users\Stefan\Desktop\OTL.exe 2013-09-16 11:03 - 2013-09-16 11:03 - 00003219 _____ C:\Users\Stefan\Desktop\GMER.log 2013-09-16 10:58 - 2013-09-16 10:58 - 00377856 _____ C:\Users\Stefan\Desktop\nt3dd2h2.exe 2013-09-16 10:54 - 2013-09-16 10:54 - 00047737 _____ C:\Users\Stefan\Desktop\Addition.txt 2013-09-16 10:54 - 2013-09-16 10:54 - 00000000 ____D C:\FRST 2013-09-16 10:46 - 2013-09-16 10:46 - 01951150 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe 2013-09-16 10:41 - 2013-09-16 10:41 - 00000474 _____ C:\Users\Stefan\Desktop\defogger_disable.log 2013-09-16 10:41 - 2013-09-16 10:41 - 00000000 _____ C:\Users\Stefan\defogger_reenable 2013-09-16 10:41 - 2012-04-25 11:51 - 00000000 ____D C:\Users\Stefan 2013-09-16 10:14 - 2013-09-16 10:14 - 00050477 _____ C:\Users\Stefan\Desktop\Defogger.exe 2013-09-15 21:46 - 2013-09-15 21:46 - 00001119 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-15 21:46 - 2013-09-15 21:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-14 08:10 - 2009-07-14 07:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-09-14 07:12 - 2012-04-25 17:23 - 00000000 ____D C:\Program Files\Google 2013-09-14 07:12 - 2012-04-25 17:22 - 00000000 ____D C:\Program Files (x86)\Google 2013-09-14 07:02 - 2012-04-25 17:23 - 00000000 ____D C:\Users\Stefan\AppData\Local\Google 2013-09-14 07:02 - 2012-04-25 17:22 - 00000000 ____D C:\ProgramData\Google 2013-09-14 05:56 - 2012-05-17 07:49 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-09-14 02:04 - 2013-09-13 18:47 - 00293009 _____ C:\Users\Stefan\AppData\Local\census.cache 2013-09-14 02:04 - 2013-09-13 18:47 - 00161120 _____ C:\Users\Stefan\AppData\Local\ars.cache 2013-09-13 19:18 - 2012-06-14 14:57 - 01603564 _____ C:\windows\SysWOW64\PerfStringBackup.INI 2013-09-13 18:28 - 2013-09-13 18:28 - 00000036 _____ C:\Users\Stefan\AppData\Local\housecall.guid.cache 2013-09-13 18:21 - 2013-09-13 18:21 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-13 18:21 - 2013-09-13 18:21 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 13:55 - 2013-09-13 11:54 - 00000000 ____D C:\Users\Stefan\AppData\Local\NPE 2013-09-13 11:55 - 2011-09-27 03:16 - 00000000 ____D C:\ProgramData\Norton 2013-09-12 21:20 - 2013-09-12 21:19 - 00000000 ____D C:\Program Files (x86)\Voxformer VST 2013-09-12 18:57 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-09-12 18:32 - 2012-04-25 11:57 - 00000000 ___RD C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-09-12 18:31 - 2009-07-14 06:45 - 02459848 _____ C:\windows\system32\FNTCACHE.DAT 2013-09-12 18:30 - 2013-09-12 18:28 - 00000000 ____D C:\windows\system32\MRT 2013-09-12 18:28 - 2012-04-25 14:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-09-12 17:37 - 2013-09-12 17:37 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Voxengo 2013-09-12 17:35 - 2012-05-03 19:13 - 00003694 _____ C:\windows\System32\Tasks\Adobe-Online-Aktualisierungsprogramm 2013-09-12 17:30 - 2013-08-20 10:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-12 15:27 - 2012-04-25 12:44 - 00000000 ____D C:\Users\Stefan\Desktop\Video 2013-09-12 15:24 - 2012-06-15 10:51 - 00000000 ____D C:\Program Files\proDAD 2013-09-12 15:24 - 2012-04-25 17:58 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\proDAD 2013-09-12 15:22 - 2012-04-25 17:59 - 00000000 ____D C:\ProgramData\proDAD 2013-09-12 15:07 - 2013-09-12 15:07 - 00000000 ____D C:\Program Files\Common Files\OFX 2013-09-12 13:41 - 2012-07-03 11:36 - 00000000 ____D C:\VisTitle 2013-09-12 13:38 - 2011-09-27 02:48 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-09-12 13:17 - 2012-04-25 17:35 - 00000000 ____D C:\Program Files (x86)\Grass Valley 2013-09-12 13:17 - 2012-04-25 17:34 - 00000000 ____D C:\Program Files\Common Files\Canopus Shared 2013-09-12 12:48 - 2013-09-12 12:48 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared 2013-09-12 12:48 - 2013-09-12 12:47 - 00000000 ____D C:\ProgramData\Package Cache 2013-09-12 12:40 - 2013-09-12 12:40 - 00000000 ____D C:\Program Files\Grass Valley 2013-09-12 12:40 - 2012-04-25 11:56 - 00000000 ____D C:\ProgramData\FLEXnet 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ___RD C:\Users\Stefan\Desktop\PC_Wartung 2013-09-11 20:00 - 2012-09-13 07:00 - 00000000 ____D C:\Users\Stefan\Desktop\ELV_Software 2013-09-11 17:34 - 2013-09-11 17:33 - 00000000 ____D C:\Users\Stefan\Desktop\Telekom 2013-09-11 17:31 - 2013-08-29 18:33 - 00000000 ____D C:\Users\Stefan\Desktop\NAS_Router_ 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iTunes 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files\iPod 2013-09-11 14:47 - 2013-09-11 14:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-11 14:47 - 2013-09-11 14:46 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-11 14:47 - 2012-05-24 10:44 - 00000000 ____D C:\ProgramData\Apple Computer 2013-09-11 09:50 - 2012-09-10 09:02 - 00000000 ____D C:\Program Files (x86)\PicPick 2013-09-11 09:06 - 2012-09-10 08:36 - 00000000 ____D C:\Users\Stefan\Desktop\Zubehör Audio_Video 2013-09-11 09:02 - 2013-09-11 09:02 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PicPick 2013-09-11 06:59 - 2013-09-05 10:50 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014 2013-09-10 19:34 - 2012-09-12 18:29 - 00000000 ____D C:\Users\Stefan\AppData\Local\Downloaded Installations 2013-09-10 11:53 - 2012-10-07 09:36 - 00000000 ____D C:\Users\Stefan\Desktop\Navigation 2013-09-10 11:14 - 2012-04-25 14:19 - 00000400 _____ C:\windows\ODBC.INI 2013-09-10 09:56 - 2013-07-31 20:00 - 00000000 ____D C:\Users\Stefan\AppData\Local\CrashDumps 2013-09-10 09:18 - 2012-07-18 16:17 - 00000000 ____D C:\Program Files (x86)\TomTom HOME 2 2013-09-09 18:55 - 2013-08-24 21:59 - 00000000 ___HD C:\Users\Stefan\AppData\Roaming\Grgopxwylg 2013-09-09 18:40 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\Documents\apemap 2013-09-09 15:29 - 2013-09-11 06:59 - 00043320 _____ (TuneUp Software) C:\windows\system32\uxtuneup.dll 2013-09-09 15:29 - 2013-09-11 06:59 - 00036152 _____ (TuneUp Software) C:\windows\SysWOW64\uxtuneup.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00040760 _____ (TuneUp Software) C:\windows\system32\TURegOpt.exe 2013-09-09 15:29 - 2013-09-05 10:51 - 00029496 _____ (TuneUp Software) C:\windows\system32\authuitu.dll 2013-09-09 15:29 - 2013-09-05 10:51 - 00025400 _____ (TuneUp Software) C:\windows\SysWOW64\authuitu.dll 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\apemap 2013-09-09 12:24 - 2013-09-09 12:24 - 00000000 ____D C:\Program Files (x86)\apemap 2013-09-09 08:46 - 2012-06-01 14:35 - 00000000 ____D C:\HDW21_TMP 2013-09-09 06:57 - 2013-09-09 06:57 - 00000000 ____D C:\Users\Stefan\AppData\Local\Avg2014 2013-09-09 06:51 - 2012-05-17 07:49 - 00000000 ____D C:\Users\Stefan\AppData\Local\Microsoft Help 2013-09-07 17:44 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF 2013-09-06 07:19 - 2013-09-06 07:19 - 00002770 _____ C:\windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 2013-09-05 12:34 - 2012-06-05 08:12 - 00000000 ____D C:\ProgramData\install_clap 2013-09-05 12:31 - 2012-04-26 18:42 - 00000000 ____D C:\ProgramData\CyberLink 2013-09-05 12:15 - 2013-07-27 18:06 - 00002970 _____ C:\windows\System32\Tasks\{D06ECEB9-4970-4B5D-A4DD-2DA24E0A3234} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{23F79AE3-DF5A-478D-A550-1D8278EE1228} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0AD664DE-2AE6-49FD-9A6D-762C10B0DF8C} 2013-09-05 12:14 - 2012-11-28 15:27 - 00002988 _____ C:\windows\System32\Tasks\{0A30D7CE-8DAD-4E6F-8B5A-E5F41D93044C} 2013-09-05 12:14 - 2012-05-24 11:03 - 00002992 _____ C:\windows\System32\Tasks\{AB2D36E9-F19F-4FF0-95F2-9D28AF878E3F} 2013-09-05 12:14 - 2012-05-24 07:32 - 00002980 _____ C:\windows\System32\Tasks\{D143519B-15B7-42D4-BF95-12144FF99D40} 2013-09-05 11:47 - 2012-04-25 17:23 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-09-05 11:47 - 2012-04-25 17:23 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-09-05 10:55 - 2013-09-05 10:49 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\TuneUp Software 2013-09-05 10:51 - 2012-04-28 17:39 - 00000000 ____D C:\ProgramData\TuneUp Software 2013-09-04 18:00 - 2012-04-29 17:13 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\vlc 2013-09-04 12:27 - 2013-09-04 12:24 - 00664235 _____ C:\Users\Stefan\Documents\USB_Drucker 2013-09-03 16:22 - 2009-07-14 07:32 - 00000000 ____D C:\windows\system32\FxsTmp 2013-09-01 17:08 - 2013-09-12 18:28 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-08-30 10:39 - 2013-08-30 10:39 - 01116952 ____N (Grass Valley K.K.) C:\windows\system32\csehq2.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 01089816 ____N (Grass Valley K.K.) C:\windows\system32\csedvh.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00918808 ____N (Grass Valley K.K.) C:\windows\system32\csem2vi01.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00825112 ____N (Grass Valley K.K.) C:\windows\system32\cseuvec.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00701720 ____N (Grass Valley K.K.) C:\windows\system32\csehqa.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00166168 ____N (Grass Valley K.K.) C:\windows\system32\csellc.dll 2013-08-30 10:39 - 2013-08-30 10:39 - 00014104 _____ (Grass Valley K.K.) C:\windows\system32\CtsEventRes.dll 2013-08-30 10:32 - 2013-08-30 10:32 - 00013080 _____ (Grass Valley K.K.) C:\windows\system32\GVLMEventRes.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 01061656 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehq2.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00911640 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csem2vi01.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00852760 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cseuvec.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00717592 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csehqa.dll 2013-08-30 10:31 - 2013-08-30 10:31 - 00164632 _____ (Grass Valley K.K.) C:\windows\SysWOW64\csellc.dll 2013-08-30 09:28 - 2013-08-30 09:28 - 03172632 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\gvzkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00054040 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\clpkrnl.sys 2013-08-30 09:28 - 2013-08-30 09:28 - 00048920 _____ (Grass Valley K.K.) C:\windows\system32\Drivers\pnxakrnl.sys 2013-08-30 08:29 - 2013-08-30 08:29 - 01812992 _____ (Grass Valley K.K.) C:\windows\SysWOW64\c210codc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 01777664 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cllccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00598016 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cmiccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00089088 _____ (Grass Valley K.K.) C:\windows\SysWOW64\chqxcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00058880 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cuvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00055808 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvccodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdvhcodc.dll 2013-08-30 08:29 - 2013-08-30 08:29 - 00050176 _____ (Grass Valley K.K.) C:\windows\SysWOW64\cdv5codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01391616 _____ (Grass Valley K.K.) C:\windows\system32\c210codc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 01384448 _____ (Grass Valley K.K.) C:\windows\system32\cllccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00486912 _____ (Grass Valley K.K.) C:\windows\system32\cmiccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00095744 _____ (Grass Valley K.K.) C:\windows\system32\chqxcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00065536 _____ (Grass Valley K.K.) C:\windows\system32\cuvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00057856 _____ (Grass Valley K.K.) C:\windows\system32\cdvccodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdvhcodc.dll 2013-08-30 08:25 - 2013-08-30 08:25 - 00051200 _____ (Grass Valley K.K.) C:\windows\system32\cdv5codc.dll 2013-08-30 08:16 - 2013-08-30 08:16 - 00013276 _____ C:\windows\system32\CtsEventRes.man 2013-08-30 08:16 - 2013-08-30 08:16 - 00003436 _____ C:\windows\system32\GVLMEventRes.man 2013-08-30 08:15 - 2013-08-30 08:15 - 01721576 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01009.dll 2013-08-29 14:11 - 2013-08-29 14:11 - 00000000 ____D C:\Users\Stefan\AppData\Local\funkwerk 2013-08-29 14:03 - 2013-08-29 14:03 - 00000000 ____D C:\Program Files (x86)\funkwerk WIN-Tools 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files\DIFX 2013-08-29 12:41 - 2013-08-29 12:41 - 00000000 ____D C:\Program Files (x86)\T-Home 2013-08-20 19:01 - 2012-09-10 08:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-20 10:41 - 2013-08-20 10:41 - 00000000 ____D C:\windows\SysWOW64\Adobe 2013-08-20 10:36 - 2013-08-20 10:36 - 00000000 ____D C:\Users\Stefan\AppData\Local\Macromedia 2013-08-20 10:35 - 2012-04-26 11:48 - 00000000 ____D C:\Users\Stefan\AppData\Local\Adobe 2013-08-17 11:09 - 2012-09-14 12:52 - 00607256 _____ (proDAD GmbH) C:\windows\system32\prodad-codec.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-12 18:50 ==================== End Of Log ============================ |
|
| Themen zu Postbank Online Banking Trojaner |
| anhang, anti-malware, aufgabe, aufgaben, authentifizierung, banking, eingabe, entfernung, erledigt, fehler, gefundene, gefundenen, hoffe, konto, leitung, malwarebytes, mobilfunk, online, online banking, passwort, postbank, problem, schließe, troja, trojaner, versucht, zwecks |
WARNUNG an die MITLESER: 
Linear-Darstellung
