| |
| |||||||
Log-Analyse und Auswertung: Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu behebenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
24.09.2013, 22:12
| #1 |
 |  Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Hallo und guten Abend, ich habe mir vor einigen Tagen leider den HDvid Codec herunter geladen. Zunächst ist mir aufgefallen, dass ich ständig Werbemeldungen von Navi-Links bekam. Diese habe ich versucht durch den Spyhunter4 los zu werden. Als ich zur Registrierung und zur Zahlung eines Betrages aufgefordert wurde, habe ich mich vorher informiert und bin auf diese Seite hier aufmerksam geworden. Ich habe mich bei Spyhunter nicht registriert, er bringt aber trotzdem ständig Meldungen. Zwischenzeitlich hat auch Avira einige Funde gemeldet. Der Rechner arbeitet langsamer als üblich und es kommen ständig Meldungen über Windows-Fehler oder es werden irgendwelche Downloads empfohlen. Auch öffnet sich ständig unliebsame Werbung. Hier nun das Ergebnis meiner Vorarbeit: Avira: Code:
ATTFilter Exportierte Ereignisse:
24.09.2013 21:32 [System-Scanner] Malware gefunden
Die Datei
'C:\Users\Andrea\AppData\Local\Temp\is357113909\169659863_stp\uninstaller.exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen'
[adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '54c17622.qua'
verschoben!
24.09.2013 21:31 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\Users\Andrea\AppData\Local\Temp\is357113909\169659863_stp\uninstaller.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen' [adware]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
24.09.2013 21:31 [Echtzeit-Scanner] Malware gefunden
In der Datei
'C:\Users\Andrea\AppData\Local\Temp\is357113909\169659863_stp\uninstaller.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/InstallCore.Gen' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
24.09.2013 21:14 [System-Scanner] Malware gefunden
Die Datei 'C:\Program Files (x86)\HDvid Codec V1\utils.exe'
enthielt einen Virus oder unerwünschtes Programm 'Adware/Agent.LB' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '54bb7481.qua'
verschoben!
24.09.2013 20:38 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Program Files (x86)\HDvid Codec V1\utils.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Agent.LB' [adware] gefunden.
Ausgeführte Aktion: Zugriff verweigern
24.09.2013 20:37 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Program Files (x86)\HDvid Codec V1\utils.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Agent.LB' [adware] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:50 on 24/09/2013 (Andrea)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-09-2013
Ran by Andrea (administrator) on ANDREA-HP on 24-09-2013 21:53:17
Running from C:\Users\Andrea\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
() C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
() C:\Program Files\Avira Secure Backup\Avira Secure Backup.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(MAGIX®) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Runonce: [Del169717247] - cmd.exe /Q /D /c del "C:\Users\Andrea\AppData\Local\Temp\0.del" [x]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
HKCU\...\Run: [Wisdom-soft ScreenHunter 6.0 Free] - 0
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2013-08-10] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Avira Secure Backup] - C:\Program Files\Avira Secure Backup\Avira Secure Backup.exe [1438056 2013-06-24] ()
HKCU\...\Runonce: [Del169717247] - cmd.exe /Q /D /c del "C:\Users\Andrea\AppData\Local\Temp\0.del"
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [ACPW05DE] - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe [822384 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\qttask.exe [77824 2013-03-14] (Apple Computer, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=88B260D8190C0116&affID=119357&tsp=5015
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=88B260D8190C0116&affID=119357&tsp=5015
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKCU - {32446FC1-A2DC-4C84-B83E-A123D597688B} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=4EA34A10-E511-4F98-AF11-43B1DB81CA27&apn_sauid=636360C6-7D5A-4913-BB5C-D944E1A352EE
SearchScopes: HKCU - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: Plus-HD-2.2 - {11111111-1111-1111-1111-110311301136} - C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-bho64.dll (Plus HD)
BHO: LyriXeeker-1 - {11111111-1111-1111-1111-110411181156} - C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-bho64.dll (Lyrics)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Plus-HD-2.2 - {11111111-1111-1111-1111-110311301136} - C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-bho.dll (Plus HD)
BHO-x32: HDvid Codec V1 - {11111111-1111-1111-1111-110311431162} - C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-bho.dll (installdaddy)
BHO-x32: LyriXeeker-1 - {11111111-1111-1111-1111-110411181156} - C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-bho.dll (Lyrics)
BHO-x32: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll (Delta-search.com)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll (Delta-search.com)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default
FF user.js: detected! => C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\user.js
FF NewTab: hxxp://www.searchgol.com/?babsrc=NT_ss&mntrId=88B260D8190C0116&affID=119357&tsp=5015
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\searchplugins\iminent.xml
FF SearchPlugin: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com
FF Extension: Delta Toolbar - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\ffxtlbr@delta.com
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\ich@maltegoetz.de
FF Extension: Andasa iCat - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\plugin@andasa.de
FF Extension: hdvc3 - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\hdvc3@hdvidcodec.com.xpi
FF Extension: toolbar_AVIRA-V7 - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: No Name - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Plus-HD-2.2) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfakeonomonapccoamcmdgpoaicnpnoo\1.24.71_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Andrea\AppData\Roaming\BabSolution\CR\Delta.crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Andrea\AppData\Local\Wajam\Chrome\wajam.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Avira Secure Backup Crawler; C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe [4121960 2013-06-24] ()
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-09-24] (BonanzaDeals)
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-09-24] (BonanzaDeals)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-07-17] (Enigma Software Group USA, LLC.)
==================== Drivers (Whitelisted) ====================
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-08-06] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-08-06] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
S1 cdrbsdrv; No ImagePath
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:51 - 2013-09-24 21:51 - 01955802 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:41 - 2013-09-24 21:43 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:32 - 2013-09-24 21:32 - 00003394 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-24 21:32 - 2013-09-24 21:32 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\BabSolution
2013-09-24 21:32 - 2013-09-24 21:32 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-24 21:31 - 2013-09-24 21:36 - 00000926 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-24 21:31 - 2013-09-24 21:36 - 00000922 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-24 21:31 - 2013-09-24 21:36 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004232 _____ C:\Windows\System32\Tasks\LyriXeeker-1-codedownloader
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00003922 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-24 21:31 - 2013-09-24 21:31 - 00003670 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-24 21:31 - 2013-09-24 21:31 - 00003240 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-24 21:31 - 2013-09-24 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00001202 _____ C:\Windows\Tasks\LyriXeeker-1-codedownloader.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00000296 _____ C:\Windows\Tasks\DigitalSite.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\DigitalSite
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Babylon
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Users\Andrea\AppData\Local\BonanzaDealsLive
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\ProgramData\Babylon
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-23 11:29 - 2013-09-24 19:46 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00003332 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-09-22 22:28 - 2013-09-22 22:29 - 00000000 ____D C:\Windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-21 18:53 - 2013-09-24 19:45 - 00001904 _____ C:\Windows\Tasks\Plus-HD-2.2-chromeinstaller.job
2013-09-21 18:53 - 2013-09-24 19:45 - 00001292 _____ C:\Windows\Tasks\Plus-HD-2.2-updater.job
2013-09-21 18:53 - 2013-09-24 19:45 - 00001096 _____ C:\Windows\Tasks\Plus-HD-2.2-enabler.job
2013-09-21 18:53 - 2013-09-21 18:53 - 00004322 _____ C:\Windows\System32\Tasks\Plus-HD-2.2-updater
2013-09-21 18:53 - 2013-09-21 18:53 - 00004126 _____ C:\Windows\System32\Tasks\Plus-HD-2.2-enabler
2013-09-21 18:52 - 2013-09-24 19:50 - 00001828 _____ C:\Windows\Tasks\Plus-HD-2.2-firefoxinstaller.job
2013-09-21 18:52 - 2013-09-24 19:45 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-09-21 18:52 - 2013-09-24 19:45 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-09-21 18:52 - 2013-09-24 19:45 - 00001196 _____ C:\Windows\Tasks\Plus-HD-2.2-codedownloader.job
2013-09-21 18:52 - 2013-09-24 19:45 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-09-21 18:52 - 2013-09-22 22:13 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2013-09-22 22:12 - 00000000 ____D C:\Program Files (x86)\IminentToolbar
2013-09-21 18:52 - 2013-09-21 18:53 - 00004226 _____ C:\Windows\System32\Tasks\Plus-HD-2.2-codedownloader
2013-09-21 18:52 - 2013-09-21 18:53 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.2
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:51 - 2013-09-24 21:14 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-21 18:51 - 2013-09-21 18:51 - 00000842 _____ C:\Users\Andrea\Desktop\HDVidCodec.lnk
2013-09-21 18:51 - 2013-09-21 18:51 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com
2013-09-21 18:51 - 2013-09-21 18:51 - 00000000 ____D C:\Program Files (x86)\hdvidcodec.com
2013-09-21 18:40 - 2013-09-21 18:40 - 00000000 ____D C:\Users\Andrea\AppData\Local\Wajam
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-13 21:44 - 2013-07-31 16:17 - 17833472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 21:44 - 2013-07-31 15:42 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 21:44 - 2013-07-31 15:29 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 21:44 - 2013-07-31 15:20 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 21:44 - 2013-07-31 15:19 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 21:44 - 2013-07-31 15:18 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 15:17 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-13 21:44 - 2013-07-31 15:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 15:14 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 15:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 21:44 - 2013-07-31 15:13 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 15:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 15:08 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 15:05 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 21:44 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 21:44 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 21:44 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 21:44 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-09-13 21:44 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 21:44 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 10:55 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 10:55 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 10:55 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 10:55 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 10:55 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 10:55 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-08 18:12 - 2013-09-12 10:49 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
2013-08-27 23:55 - 2013-08-27 23:55 - 00565352 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2013-08-27 23:55 - 2013-08-27 23:55 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll
==================== One Month Modified Files and Folders =======
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:51 - 2013-09-24 21:51 - 01955802 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:49 - 2011-12-24 18:04 - 00000000 ____D C:\Users\Andrea
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:43 - 2013-09-24 21:41 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:38 - 2012-01-17 22:53 - 00000000 ____D C:\Users\Andrea\Documents\Outlook-Dateien
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:36 - 2013-09-24 21:31 - 00000926 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-24 21:36 - 2013-09-24 21:31 - 00000922 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-24 21:36 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:32 - 2013-09-24 21:32 - 00003394 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-24 21:32 - 2013-09-24 21:32 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\BabSolution
2013-09-24 21:32 - 2013-09-24 21:32 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004232 _____ C:\Windows\System32\Tasks\LyriXeeker-1-codedownloader
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00003922 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-24 21:31 - 2013-09-24 21:31 - 00003670 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-24 21:31 - 2013-09-24 21:31 - 00003240 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-24 21:31 - 2013-09-24 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00001202 _____ C:\Windows\Tasks\LyriXeeker-1-codedownloader.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00000296 _____ C:\Windows\Tasks\DigitalSite.job
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\DigitalSite
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Babylon
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Users\Andrea\AppData\Local\BonanzaDealsLive
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\ProgramData\Babylon
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-24 21:31 - 2012-04-09 19:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-24 21:24 - 2011-07-16 07:32 - 00654852 _____ C:\Windows\system32\perfh007.dat
2013-09-24 21:24 - 2011-07-16 07:32 - 00130434 _____ C:\Windows\system32\perfc007.dat
2013-09-24 21:24 - 2009-07-14 07:13 - 01500294 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-24 21:22 - 2012-01-28 13:06 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\MAGIX
2013-09-24 21:22 - 2012-01-28 13:04 - 00000000 ____D C:\ProgramData\MAGIX
2013-09-24 21:14 - 2013-09-21 18:51 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-24 21:05 - 2012-05-02 20:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-24 20:57 - 2011-09-23 01:41 - 01776185 _____ C:\Windows\WindowsUpdate.log
2013-09-24 19:50 - 2013-09-21 18:52 - 00001828 _____ C:\Windows\Tasks\Plus-HD-2.2-firefoxinstaller.job
2013-09-24 19:46 - 2013-09-23 11:29 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-24 19:45 - 2013-09-21 18:53 - 00001904 _____ C:\Windows\Tasks\Plus-HD-2.2-chromeinstaller.job
2013-09-24 19:45 - 2013-09-21 18:53 - 00001292 _____ C:\Windows\Tasks\Plus-HD-2.2-updater.job
2013-09-24 19:45 - 2013-09-21 18:53 - 00001096 _____ C:\Windows\Tasks\Plus-HD-2.2-enabler.job
2013-09-24 19:45 - 2013-09-21 18:52 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-09-24 19:45 - 2013-09-21 18:52 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-09-24 19:45 - 2013-09-21 18:52 - 00001196 _____ C:\Windows\Tasks\Plus-HD-2.2-codedownloader.job
2013-09-24 19:45 - 2013-09-21 18:52 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-09-24 19:45 - 2013-01-08 22:58 - 00000434 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-09-24 13:13 - 2012-01-09 21:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-09-24 13:12 - 2012-01-16 21:58 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-24 13:10 - 2011-12-24 18:13 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5717C4F9-34CC-4C33-A5BA-AE8FA455B99B}
2013-09-24 13:07 - 2012-04-09 19:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-24 13:07 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:30 - 2013-09-22 22:29 - 00000000 ____D C:\sh4ldr
2013-09-22 22:30 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-22 22:30 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-22 22:29 - 2013-09-22 22:29 - 00003332 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2013-09-22 22:28 - 00000000 ____D C:\Windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2013-09-22 22:22 - 2010-11-21 05:47 - 00919806 _____ C:\Windows\PFRO.log
2013-09-22 22:22 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-22 22:22 - 2009-07-14 06:51 - 00100543 _____ C:\Windows\setupact.log
2013-09-22 22:16 - 2013-07-08 22:36 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-22 22:13 - 2013-09-21 18:52 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-22 22:12 - 2013-09-21 18:52 - 00000000 ____D C:\Program Files (x86)\IminentToolbar
2013-09-21 18:53 - 2013-09-21 18:53 - 00004322 _____ C:\Windows\System32\Tasks\Plus-HD-2.2-updater
2013-09-21 18:53 - 2013-09-21 18:53 - 00004126 _____ C:\Windows\System32\Tasks\Plus-HD-2.2-enabler
2013-09-21 18:53 - 2013-09-21 18:52 - 00004226 _____ C:\Windows\System32\Tasks\Plus-HD-2.2-codedownloader
2013-09-21 18:53 - 2013-09-21 18:52 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.2
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:52 - 2011-12-24 18:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Google
2013-09-21 18:51 - 2013-09-21 18:51 - 00000842 _____ C:\Users\Andrea\Desktop\HDVidCodec.lnk
2013-09-21 18:51 - 2013-09-21 18:51 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com
2013-09-21 18:51 - 2013-09-21 18:51 - 00000000 ____D C:\Program Files (x86)\hdvidcodec.com
2013-09-21 18:40 - 2013-09-21 18:40 - 00000000 ____D C:\Users\Andrea\AppData\Local\Wajam
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-17 23:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-21 01:51 - 2012-12-19 20:57 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAndrea
2013-09-21 01:51 - 2012-12-19 20:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForAndrea.job
2013-09-21 01:05 - 2012-05-02 20:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-21 01:05 - 2012-05-02 20:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-21 01:05 - 2011-07-15 22:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 11:46 - 2011-12-31 19:15 - 00018432 _____ C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-20 11:34 - 2013-07-08 23:42 - 00000000 ___RD C:\Users\Andrea\Dropbox
2013-09-16 23:36 - 2012-01-21 20:05 - 00000000 ____D C:\Users\Andrea\AppData\Local\CrashDumps
2013-09-16 23:25 - 2012-01-17 23:14 - 00000000 ____D C:\Users\Andrea\Documents\Kreditkarte
2013-09-16 22:45 - 2012-12-02 21:20 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForANDREA-HP$
2013-09-16 22:45 - 2012-12-02 21:20 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForANDREA-HP$.job
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 13:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 13:19 - 2009-07-14 06:45 - 00430360 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 09:43 - 2011-12-25 17:06 - 01527912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-13 09:43 - 2011-12-25 17:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-13 09:42 - 2013-08-19 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 09:40 - 2012-01-03 20:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 09:40 - 2011-12-31 02:16 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 10:49 - 2013-09-08 18:12 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
2013-09-05 22:44 - 2013-08-08 22:42 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-28 00:27 - 2012-01-03 20:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Microsoft Help
2013-08-28 00:19 - 2011-02-10 21:23 - 00000000 ____D C:\SWSetup
2013-08-27 23:55 - 2013-08-27 23:55 - 00565352 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2013-08-27 23:55 - 2013-08-27 23:55 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll
2013-08-27 23:55 - 2011-09-23 01:40 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2013-08-27 23:55 - 2011-09-23 01:40 - 00000000 ____D C:\Program Files (x86)\Realtek
Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\135oabd3.dll
C:\Users\Andrea\AppData\Local\Temp\APNStub.exe
C:\Users\Andrea\AppData\Local\Temp\app.exe
C:\Users\Andrea\AppData\Local\Temp\AskSLib.dll
C:\Users\Andrea\AppData\Local\Temp\Extract.exe
C:\Users\Andrea\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\Andrea\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Andrea\AppData\Local\Temp\ICReinstall_ImageEditorSetup.exe
C:\Users\Andrea\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\Andrea\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Andrea\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\Andrea\AppData\Local\Temp\Resource.exe
C:\Users\Andrea\AppData\Local\Temp\SHSetup.exe
C:\Users\Andrea\AppData\Local\Temp\sp54620.exe
C:\Users\Andrea\AppData\Local\Temp\SP54714.exe
C:\Users\Andrea\AppData\Local\Temp\SP55025.exe
C:\Users\Andrea\AppData\Local\Temp\SP55031.exe
C:\Users\Andrea\AppData\Local\Temp\SP55152.exe
C:\Users\Andrea\AppData\Local\Temp\SP55746.exe
C:\Users\Andrea\AppData\Local\Temp\SP56221.exe
C:\Users\Andrea\AppData\Local\Temp\SP56878.exe
C:\Users\Andrea\AppData\Local\Temp\SP56929.exe
C:\Users\Andrea\AppData\Local\Temp\SP57538.exe
C:\Users\Andrea\AppData\Local\Temp\SP57698.exe
C:\Users\Andrea\AppData\Local\Temp\sp58915.exe
C:\Users\Andrea\AppData\Local\Temp\SP59202.exe
C:\Users\Andrea\AppData\Local\Temp\SP60864.exe
C:\Users\Andrea\AppData\Local\Temp\UninstallHPSA.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-21 19:34
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-09-2013
Ran by Andrea at 2013-09-24 22:51:23
Running from C:\Users\Andrea\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: FireWall (Enabled) {CE40CCC0-8ADB-6D67-25A0-C5B6438E4B57}
==================== Installed Programs ======================
ACDSee Pro 5 (x32 Version: 5.3.168)
Adobe AIR (x32 Version: 1.5.3.9130)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.175)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Photoshop Elements 2.0 (x32 Version: 2.0)
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)
ATI Catalyst Install Manager (Version: 3.0.816.0)
AuthenTec TrueAPI (Version: 1.3.0.111)
Avira Internet Security (x32 Version: 13.0.0.4052)
Avira SearchFree Toolbar plus Web Protection (x32 Version: 12.2.2.663)
Avira Secure Backup 1.0.0 (Version: 1.0.0)
Bejeweled 3 (x32 Version: 2.2.0.97)
Benutzerhandbuch EPSON BX535WD Series (x32)
Blasterball 3 (x32 Version: 2.2.0.97)
Bounce Symphony (x32 Version: 2.2.0.97)
Cake Mania (x32 Version: 2.2.0.95)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2011.0508.224.2391)
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0508.224.2391)
Catalyst Control Center InstallProxy (x32 Version: 2011.0508.224.2391)
Catalyst Control Center Localization All (x32 Version: 2011.0508.224.2391)
Catalyst Control Center Profiles Mobile (x32 Version: 2011.0508.224.2391)
CCC Help Chinese Standard (x32 Version: 2011.0508.0223.2391)
CCC Help Chinese Traditional (x32 Version: 2011.0508.0223.2391)
CCC Help Czech (x32 Version: 2011.0508.0223.2391)
CCC Help Danish (x32 Version: 2011.0508.0223.2391)
CCC Help Dutch (x32 Version: 2011.0508.0223.2391)
CCC Help English (x32 Version: 2011.0508.0223.2391)
CCC Help Finnish (x32 Version: 2011.0508.0223.2391)
CCC Help French (x32 Version: 2011.0508.0223.2391)
CCC Help German (x32 Version: 2011.0508.0223.2391)
CCC Help Greek (x32 Version: 2011.0508.0223.2391)
CCC Help Hungarian (x32 Version: 2011.0508.0223.2391)
CCC Help Italian (x32 Version: 2011.0508.0223.2391)
CCC Help Japanese (x32 Version: 2011.0508.0223.2391)
CCC Help Korean (x32 Version: 2011.0508.0223.2391)
CCC Help Norwegian (x32 Version: 2011.0508.0223.2391)
CCC Help Polish (x32 Version: 2011.0508.0223.2391)
CCC Help Portuguese (x32 Version: 2011.0508.0223.2391)
CCC Help Russian (x32 Version: 2011.0508.0223.2391)
CCC Help Spanish (x32 Version: 2011.0508.0223.2391)
CCC Help Swedish (x32 Version: 2011.0508.0223.2391)
CCC Help Thai (x32 Version: 2011.0508.0223.2391)
CCC Help Turkish (x32 Version: 2011.0508.0223.2391)
ccc-utility64 (Version: 2011.0508.224.2391)
Chronicles of Albian (x32 Version: 2.2.0.95)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Cradle of Rome 2 (x32 Version: 2.2.0.95)
CyberLink YouCam (x32 Version: 3.5.1.4119)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Delta Chrome Toolbar (x32)
Delta toolbar (x32 Version: 1.8.24.6)
Download Navigator (x32 Version: 1.1.0)
DriverTuner 3.1.0.0 (x32 Version: 3.1.0.0)
EPSON BX535WD Series Printer Uninstall
Epson Easy Photo Print 2 (x32 Version: 2.3.0.0)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000)
Epson Event Manager (x32 Version: 2.50.0001)
EPSON Scan (x32)
EpsonNet Print (x32 Version: 2.4j)
ESU for Microsoft Windows 7 SP1 (x32 Version: 2.1.1)
Evernote v. 4.2.3 (x32 Version: 4.2.3.22)
Farm Frenzy (x32 Version: 2.2.0.95)
FATE (x32 Version: 2.2.0.97)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.31.0)
Free YouTube to MP3 Converter version 3.10.15.1228 (x32)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95)
HDvid Codec V1 (x32 Version: 1.27.153.8)
HDVidCodec (x32 Version: 2.1 Build 26473)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
HP Auto (Version: 1.0.12935.3667)
HP Client Services (Version: 1.1.12938.3539)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7)
HP Documentation (x32 Version: 1.1.0.0)
HP Games (x32 Version: 1.0.2.5)
HP Launch Box (Version: 1.0.11)
HP On Screen Display (x32 Version: 1.3.5)
HP Power Manager (x32 Version: 1.2.3)
HP Quick Launch (x32 Version: 2.7.2)
HP QuickWeb (x32 Version: 3.1.0.9742)
HP Setup (x32 Version: 8.7.4751.3798)
HP Setup Manager (x32 Version: 1.1.13476.3753)
HP SimplePass PE 2011 (x32 Version: 5.3.0.163)
HP Software Framework (x32 Version: 4.6.10.1)
HP Support Assistant (x32 Version: 7.0.39.15)
IDT Audio (x32 Version: 1.0.6341.0)
ImageMixer VCD/DVD2 for OLYMPUS (x32 Version: 2.01.050.1)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Display Audio Driver (x32 Version: 6.14.00.3074)
Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.5.0.1026)
Java 7 Update 13 (x32 Version: 7.0.130)
Java Auto Updater (x32 Version: 2.1.9.0)
Java(TM) 6 Update 30 (x32 Version: 6.0.300)
JavaFX 2.1.0 (x32 Version: 2.1.0)
Jewel Quest Solitaire (x32 Version: 2.2.0.95)
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
LyriXeeker-1 (x32 Version: 1.28.153.3)
MAGIX Foto Manager 10 (x32 Version: 8.0.2.184)
MAGIX Fotos auf CD & DVD 10 Deluxe (Sonderedition) (x32 Version: 10.5.2.5)
MAGIX Online Druck Service (x32 Version: 1.1.0)
MAGIX Online Druck Service (x32 Version: 1.1.0-478)
MAGIX Screenshare (x32 Version: 4.3.6.1987)
MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6)
Mah Jong Medley (x32 Version: 2.2.0.95)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320)
Microsoft Age of Empires (x32)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Home and Business 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
MyFreeCodec (HKCU)
MyPhoneExplorer (x32 Version: 1.8.4)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97)
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95)
Netzwerkhandbuch EPSON BX535WD Series (x32)
OLYMPUS CAMEDIA Master 4.1 (x32)
OLYMPUS Master (x32 Version: 1.00.8000)
Penguins! (x32 Version: 2.2.0.95)
Picasa 3 (x32 Version: 3.9)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
Plus-HD-2.2 (x32 Version: 1.28.153.3)
Polar Bowler (x32 Version: 2.2.0.97)
PX Profile Update (x32 Version: 1.00.1.)
QuickTime (x32)
Ralink RT5390 802.11b/g/n WiFi Adapter (x32 Version: 3.2.13.0)
Realtek Ethernet Controller Driver (x32 Version: 7.48.823.2011)
Realtek PCIE Card Reader (x32 Version: 6.1.7600.77)
Recovery Manager (x32 Version: 2.0.0)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.18.0)
Slingo Deluxe (x32 Version: 2.2.0.95)
SpyHunter (Version: 4.15.1.4270)
Synaptics TouchPad Driver (Version: 15.3.11.0)
Update for Image Editor (HKCU)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553157) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589370) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760758) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update Installer for WildTangent Games App (x32)
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97)
VIP Access SDK (1.0.1.2) (x32 Version: 1.0.1.2)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)
Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0)
VLC media player 2.0.7 (x32 Version: 2.0.7)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.36)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Wisdom-soft ScreenHunter 6.0 Free (x32)
Zuma Deluxe (x32 Version: 2.2.0.95)
==================== Restore Points =========================
03-09-2013 22:01:18 Windows Update
11-09-2013 19:13:08 Windows Update
13-09-2013 07:28:51 Windows Update
13-09-2013 19:44:13 Windows Update
19-09-2013 15:54:46 Windows Update
22-09-2013 20:28:58 Installed SpyHunter
24-09-2013 06:56:05 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {017DA05C-A8BF-4515-A763-78536437CD99} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {04436985-E10F-4A06-9F3A-EC2086A9B84E} - System32\Tasks\User_Feed_Synchronization-{4EF3E89D-9CB0-4976-B726-1E2514DAD58C} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {077CAE50-E4CD-42F7-B0DA-C0039AE5D98D} - System32\Tasks\Plus-HD-2.2-updater => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-updater.exe [2013-09-21] (Plus HD)
Task: {09B98A23-FA5F-4CFC-B0E8-9A38647F3A56} - System32\Tasks\Plus-HD-2.2-chromeinstaller => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-chromeinstaller.exe [2013-09-21] (Plus HD)
Task: {126288E3-A42B-4BC1-BD39-BA914C3EEDA3} - System32\Tasks\User_Feed_Synchronization-{8C86264E-11B5-430E-85CA-0EF7381E4F07} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {16C5706A-741D-4F82-9863-030EE671FF45} - System32\Tasks\User_Feed_Synchronization-{820689EA-1659-4F0F-A652-91A7430301BE} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {1721B403-EBDE-4CCF-84F4-937DF742EF7F} - System32\Tasks\User_Feed_Synchronization-{C3317C46-5472-4527-8E73-B1186BE91B42} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {19AFD06C-69D1-44BE-9EA4-9E6DAFEC66B3} - System32\Tasks\HDvid Codec V1-codedownloader => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-codedownloader.exe [2013-09-21] (installdaddy)
Task: {1E08DE5B-A6D4-4DDA-ACA8-BA9A1B2AF96A} - System32\Tasks\User_Feed_Synchronization-{22030854-91E5-4A3E-BE6F-98C01464FBAD} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {229D2A23-2643-4731-AF53-A2AB7B597D1F} - System32\Tasks\User_Feed_Synchronization-{1A4659D4-BC1A-4C3F-9E29-9964998305AF} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {2520D55B-B27C-4857-A2C5-8296378793F3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-09] (Google Inc.)
Task: {30AAE43D-D908-4AC3-BCD8-55EDF7BDEA17} - System32\Tasks\User_Feed_Synchronization-{44BD4096-E413-4BA7-B788-A72C4EEEB37A} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {34500C5B-B5CE-4280-A623-07612B8122A6} - System32\Tasks\User_Feed_Synchronization-{B3B33BFC-605D-43CB-AE98-A87A9BA9E04B} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {396E2C8D-FCB8-4967-8A05-05BA2BEFC14F} - System32\Tasks\DigitalSite => C:\Users\Andrea\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe [2013-04-12] ()
Task: {39848079-D9BC-4287-97C9-5DC7325D218E} - System32\Tasks\User_Feed_Synchronization-{8B53F2D8-89D5-4905-B62E-1B7AB18F6C7F} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {3BFD36DC-4389-4447-B299-8CD45DBA6486} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-06-27] ()
Task: {417020BE-27E7-4DA0-B813-0358271CAE92} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {424F6353-C1AA-4BE5-8A30-3D8B308592D3} - System32\Tasks\User_Feed_Synchronization-{C683A005-7AF4-4C69-B540-C9AC92FDC133} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {4A8D7485-B064-4FDF-8289-A8AC22AFA17B} - System32\Tasks\HDvid Codec V1-enabler => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-enabler.exe [2013-09-21] (installdaddy)
Task: {4AC55F20-CA3A-40FB-BC12-014BF6D2E5ED} - System32\Tasks\HDvid Codec V1-updater => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-updater.exe [2013-09-21] (installdaddy)
Task: {4BF77539-E7F9-47FE-8DD0-F1CD18675B7F} - System32\Tasks\EPUpdater => C:\Users\Andrea\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-08-04] ()
Task: {4C01BE2D-4111-4138-8FDB-2CC9B5816458} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-08-09] (Hewlett-Packard)
Task: {4CD4DB30-5DE5-4379-B1BF-95DB92D3ACB4} - System32\Tasks\LyriXeeker-1-firefoxinstaller => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-firefoxinstaller.exe [2013-09-24] (Lyrics)
Task: {4D3DEACA-6AC2-4ABA-B09B-C6B8A5E4AAC0} - System32\Tasks\User_Feed_Synchronization-{CE04E25F-02A7-4754-96D2-BC1CE4D47C69} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {4F594A59-CE1C-4245-A141-C044482C25BF} - System32\Tasks\Plus-HD-2.2-enabler => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-enabler.exe [2013-09-21] (Plus HD)
Task: {533E38A7-4929-40F2-9BC0-29A7B3C19D19} - System32\Tasks\User_Feed_Synchronization-{A2D208BE-BB28-4AAF-998F-A992BCBAFCF1} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {56E06A88-EC4F-43BB-AB3C-A86121A357E1} - System32\Tasks\Plus-HD-2.2-firefoxinstaller => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-firefoxinstaller.exe [2013-09-21] (Plus HD)
Task: {617B7B37-1E8F-4256-A9BF-9D1C7EED4071} - System32\Tasks\LyriXeeker-1-updater => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-updater.exe [2013-09-24] (Lyrics)
Task: {641D5CE8-307A-4E0C-90B5-F3CBD88F1604} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company)
Task: {68DDB1C1-75B0-4139-BF26-8D1849B9BB1E} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {69704556-0B89-491D-951D-F31BFD06C0ED} - System32\Tasks\User_Feed_Synchronization-{3132F635-AFA5-440F-BB0F-8F7CBF477A5A} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {6A5881B5-A06D-4412-B633-F6EE28C622ED} - System32\Tasks\User_Feed_Synchronization-{BC51F650-E89E-426E-B2CD-EA723D611639} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {75614BF1-FA40-4937-A8AD-E9958DE8B71D} - System32\Tasks\User_Feed_Synchronization-{DC0C3669-F905-40D1-BC2F-F58CBBB7AC6F} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {75ECB4AE-AB21-419C-A988-1FEECC7DFADE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-21] (Adobe Systems Incorporated)
Task: {87823EB5-E957-4C1F-98C2-073933C851CD} - System32\Tasks\User_Feed_Synchronization-{978F915B-801D-4B62-AFF2-1BF3F75BAE18} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {96022B5A-92F7-4AEF-894B-95B50381A821} - System32\Tasks\User_Feed_Synchronization-{E45D825A-C895-4B41-9A64-A296192B87BD} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {984721A8-897D-4B34-8027-E3D075FD8110} - System32\Tasks\Plus-HD-2.2-codedownloader => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-codedownloader.exe [2013-09-21] (Plus HD)
Task: {A0618CA0-CA38-4E71-93CD-0C853716E226} - System32\Tasks\User_Feed_Synchronization-{5E4F0898-362B-4120-B4E8-9CA7BD05646F} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {A06AB591-2380-42F7-B0A9-04784161F99C} - System32\Tasks\User_Feed_Synchronization-{EA99B333-FDE6-4D34-9159-60CBDCC57CCF} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {A84735D9-85CD-4763-8EFC-BCFEEB781573} - System32\Tasks\User_Feed_Synchronization-{5717C4F9-34CC-4C33-A5BA-AE8FA455B99B} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {AA16942A-4620-4628-95FC-60DDCBBF66B4} - System32\Tasks\User_Feed_Synchronization-{D97D986A-F858-4CA3-9D65-73FC1EE42FE2} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {B61C0740-36E6-4AEE-8ABC-FBB6B085D44D} - System32\Tasks\User_Feed_Synchronization-{DC36D739-D867-4D4E-9B58-BFB9A2C47AE7} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {BA5BA5DA-968E-48A8-880F-98F439C371D4} - System32\Tasks\LyriXeeker-1-enabler => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-enabler.exe [2013-09-24] (Lyrics)
Task: {C21E1228-A0A5-45C3-A362-E453C3BDD6B5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-08-09] (Hewlett-Packard)
Task: {C4C67233-7EB6-4780-B65B-475C8D9655D3} - System32\Tasks\User_Feed_Synchronization-{CA42DDDE-3B0E-4538-85D2-BD101690B4D6} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {CD134C8F-AA40-452C-B754-F70319D0B1E7} - System32\Tasks\HPCeeScheduleForAndrea => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {CE526B80-1647-4AE1-8F66-0A94E256B46D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-09] (Google Inc.)
Task: {D4E731D8-13AF-47E5-8C3B-882BB26A6766} - System32\Tasks\User_Feed_Synchronization-{E54B23B7-A9AF-4E8A-AF32-EC9C857067F3} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {DADE9CA8-31D7-4C1D-A4D1-482E6B9F1FDD} - System32\Tasks\LyriXeeker-1-codedownloader => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-codedownloader.exe
Task: {DC719D05-CBF1-47F1-A6D5-9C7FF9AA60D6} - System32\Tasks\User_Feed_Synchronization-{DEDA4847-E75C-4C18-9778-AAC510484D9E} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {E53C97CE-4288-43B8-A044-D8580A5CEDAE} - System32\Tasks\HPCeeScheduleForANDREA-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {E5974511-E518-4251-AAA4-356BA517AAA6} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2013-07-17] (Enigma Software Group USA, LLC.)
Task: {E826DAD1-7E91-44E9-8843-B4002630FBDB} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: {F4A893A1-CCF8-4B62-A31C-855B06C9F3BB} - System32\Tasks\LyriXeeker-1-chromeinstaller => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-chromeinstaller.exe [2013-09-24] (Lyrics)
Task: {F7AE88C7-4643-4232-807E-D70F8C8AF711} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {FAAA0497-BE2C-4D86-9E81-A52E16400FB2} - System32\Tasks\User_Feed_Synchronization-{540B33B2-21A6-4240-9DE8-63489D2F8AFC} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: {FD6102F3-EC34-4AA2-AE04-FC06D9D12608} - System32\Tasks\User_Feed_Synchronization-{F775A731-BAF7-45BD-BF85-CDCCF575D89A} => C:\Windows\system32\msfeedssync.exe [2011-07-15] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\Andrea\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HDvid Codec V1-codedownloader.job => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-codedownloader.exe
Task: C:\Windows\Tasks\HDvid Codec V1-enabler.job => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-enabler.exe
Task: C:\Windows\Tasks\HDvid Codec V1-updater.job => C:\Program Files (x86)\HDvid Codec V1\HDvid Codec V1-updater.exe
Task: C:\Windows\Tasks\HPCeeScheduleForANDREA-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\HPCeeScheduleForAndrea.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-chromeinstaller.exe
Task: C:\Windows\Tasks\LyriXeeker-1-codedownloader.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-codedownloader.exe
Task: C:\Windows\Tasks\LyriXeeker-1-enabler.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-enabler.exe
Task: C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-firefoxinstaller.exe
Task: C:\Windows\Tasks\LyriXeeker-1-updater.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-updater.exe
Task: C:\Windows\Tasks\Plus-HD-2.2-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-chromeinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-2.2-codedownloader.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-codedownloader.exe
Task: C:\Windows\Tasks\Plus-HD-2.2-enabler.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-enabler.exe
Task: C:\Windows\Tasks\Plus-HD-2.2-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-firefoxinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-2.2-updater.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-updater.exe
==================== Loaded Modules (whitelisted) =============
2013-06-24 15:00 - 2013-06-24 15:00 - 01879552 _____ () C:\Program Files\Avira Secure Backup\ShellExtensionx64\ShellExtension.dll
2011-04-15 20:29 - 2011-04-15 20:29 - 00286720 _____ (Intel Corporation) C:\Windows\system32\igfxrDEU.lrc
2012-09-24 22:40 - 2011-01-26 18:29 - 00431104 _____ (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
2011-04-15 20:16 - 2011-04-15 20:16 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-09-23 01:40 - 2011-06-08 00:21 - 00654336 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll
2013-08-10 10:30 - 2013-08-10 10:29 - 00103424 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\spool\DRIVERS\x64\3\E_YAUDHTU.DLL
2009-01-20 13:51 - 2009-01-20 13:51 - 00007168 _____ ( ) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atixclib.dll
2011-05-12 14:13 - 2011-05-12 14:13 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-05-08 02:23 - 2011-05-08 02:23 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-09-12 10:55 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\syswow64\kernel32.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\syswow64\KERNELBASE.dll
2010-11-21 05:23 - 2010-11-21 05:23 - 00350208 _____ (Microsoft Corporation) C:\Windows\syswow64\SHLWAPI.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00311296 _____ (Microsoft Corporation) C:\Windows\syswow64\GDI32.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00833024 _____ (Microsoft Corporation) C:\Windows\syswow64\USER32.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00640512 _____ (Microsoft Corporation) C:\Windows\syswow64\ADVAPI32.dll
2012-02-17 13:33 - 2011-12-16 09:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\syswow64\msvcrt.dll
2009-07-14 01:11 - 2009-07-14 03:16 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2013-08-14 08:12 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\syswow64\RPCRT4.dll
2012-07-10 21:31 - 2012-06-02 06:34 - 00096768 _____ (Microsoft Corporation) C:\Windows\syswow64\SspiCli.dll
2009-07-14 01:12 - 2009-07-14 03:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\syswow64\CRYPTBASE.dll
2009-07-14 01:25 - 2009-07-14 03:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\syswow64\LPK.dll
2013-01-08 23:14 - 2012-11-22 06:45 - 00626688 _____ (Microsoft Corporation) C:\Windows\syswow64\USP10.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\syswow64\SHELL32.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 01414144 _____ (Microsoft Corporation) C:\Windows\syswow64\ole32.dll
2011-12-26 16:58 - 2011-08-27 06:26 - 00571904 _____ (Microsoft Corporation) C:\Windows\syswow64\OLEAUT32.dll
2009-07-14 01:28 - 2009-07-14 03:15 - 00828928 _____ (Microsoft Corporation) C:\Windows\syswow64\MSCTF.dll
2009-07-14 01:44 - 2009-07-14 03:15 - 00522240 _____ (Microsoft Corporation) C:\Windows\syswow64\CLBCatQ.DLL
2009-07-14 02:03 - 2009-07-14 03:15 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devenum.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WINMM.dll
2010-11-21 05:23 - 2010-11-21 05:23 - 01667584 _____ (Microsoft Corporation) C:\Windows\syswow64\setupapi.dll
2011-12-26 16:58 - 2011-05-24 12:39 - 00145920 _____ (Microsoft Corporation) C:\Windows\syswow64\CFGMGR32.dll
2011-12-26 16:58 - 2011-05-24 12:40 - 00064512 _____ (Microsoft Corporation) C:\Windows\syswow64\DEVOBJ.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00269824 _____ (Microsoft Corporation) C:\Windows\syswow64\WLDAP32.dll
2013-08-14 08:13 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\syswow64\WINTRUST.dll
2013-08-14 08:13 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\syswow64\CRYPT32.dll
2010-11-21 05:23 - 2010-11-21 05:23 - 00034304 _____ (Microsoft Corporation) C:\Windows\syswow64\MSASN1.dll
2013-06-24 14:48 - 2013-06-24 14:48 - 00941056 _____ () C:\Program Files\Avira Secure Backup\NativeControls7.dll
2010-11-21 05:23 - 2010-11-21 05:23 - 00485888 _____ (Microsoft Corporation) C:\Windows\syswow64\COMDLG32.dll
2013-06-24 14:56 - 2013-06-24 14:56 - 01751040 _____ () C:\Program Files\Avira Secure Backup\OnlineBackupFacade.dll
2010-11-21 05:23 - 2010-11-21 05:23 - 00206848 _____ (Microsoft Corporation) C:\Windows\syswow64\WS2_32.dll
2009-07-14 01:12 - 2009-07-14 03:16 - 00008704 _____ (Microsoft Corporation) C:\Windows\syswow64\NSI.dll
2009-07-14 01:15 - 2009-07-14 03:16 - 00006144 _____ (Microsoft Corporation) C:\Windows\syswow64\PSAPI.DLL
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\syswow64\KERNEL32.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\syswow64\shell32.dll
2013-08-20 22:44 - 2013-08-20 22:44 - 00492544 _____ (Intel Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\868b835c2e1cc3d300fa4ae89763b00d\IAStorUtil.ni.dll
2013-07-11 22:58 - 2013-07-11 22:58 - 00014336 _____ (Intel Corp.) C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\0700c2f087ac72d9e8aa1874bef26960\IAStorCommon.ni.dll
2012-04-10 22:44 - 2012-03-01 07:33 - 00159232 _____ (Microsoft Corporation) C:\Windows\syswow64\imagehlp.dll
2009-07-14 01:33 - 2009-07-14 03:17 - 00249680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\syswow64\WININET.dll
2009-07-14 01:15 - 2009-07-14 03:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\syswow64\Normaliz.dll
2013-09-13 21:44 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\syswow64\iertutil.dll
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\syswow64\urlmon.dll
2011-11-23 11:40 - 2011-11-23 11:40 - 00015472 _____ (ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\1031\ACDSeeProInTouch2.exe.dll
2009-10-21 17:39 - 2009-10-21 17:39 - 00291328 _____ (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\LcMgr.dll
2010-10-12 09:58 - 2010-10-12 09:58 - 00136704 _____ (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\ScanEngine30.dll
2010-10-12 09:54 - 2010-10-12 09:54 - 00055808 _____ (SEIKO EPSON CORP.) C:\Program Files (x86)\EPSON Software\Event Manager\ScnMgr10.dll
2009-07-14 02:14 - 2009-07-14 03:16 - 00199680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sti.dll
2010-11-21 05:23 - 2010-11-21 05:23 - 01667584 _____ (Microsoft Corporation) C:\Windows\syswow64\SETUPAPI.dll
2010-11-19 11:06 - 2010-11-19 11:06 - 00112640 _____ (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\epnsm.dll
2005-01-13 10:47 - 2005-01-13 10:47 - 00049152 _____ (SEIKO EPSON CORP.) C:\Program Files (x86)\EPSON Software\Event Manager\ESPSUTL.dll
2010-11-21 05:23 - 2010-11-21 05:23 - 00485888 _____ (Microsoft Corporation) C:\Windows\syswow64\comdlg32.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\syswow64\WININET.DLL
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-17 23:31 - 2013-08-17 23:31 - 03551640 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-06-24 15:02 - 2013-06-24 15:02 - 01378816 _____ () C:\Program Files\Avira Secure Backup\ShellExtension\ShellExtension.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00119808 _____ (Microsoft Corporation) C:\Windows\syswow64\IMM32.dll
2011-03-17 01:11 - 2011-03-17 01:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\syswow64\URLMON.DLL
2009-07-14 01:15 - 2009-07-14 03:10 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SFC.DLL
2010-11-21 05:24 - 2010-11-21 05:24 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2010-12-21 02:15 - 2010-12-21 02:15 - 01041248 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2013-09-13 21:44 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 21:44 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 21:44 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-11 15:05 - 2013-09-11 15:05 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll
2012-07-10 21:31 - 2012-06-02 06:40 - 00225280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-08-06 23:12 - 2013-08-06 23:07 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2010-11-21 05:24 - 2010-11-21 05:24 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\thumbcache.dll
2009-07-14 01:22 - 2009-07-14 03:15 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FunDisc.dll
2009-07-14 01:22 - 2009-07-14 03:15 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdproxy.dll
2009-07-14 01:22 - 2009-07-14 03:15 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWNet.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/24/2013 10:19:55 PM) (Source: Application Hang) (User: )
Description: Programm Spyhunter4.exe, Version 4.15.1.4270 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 9ec
Startzeit: 01ceb96329082184
Endzeit: 10
Anwendungspfad: C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
Berichts-ID: a2855117-2556-11e3-8968-ec9a743ead9c
Error: (09/24/2013 10:19:18 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/24/2013 09:31:43 PM) (Source: MsiInstaller) (User: Andrea-HP)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\GoogleUpdateHelper.msi
Error: (09/24/2013 08:38:37 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (09/22/2013 11:46:06 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (09/22/2013 10:23:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/22/2013 10:22:10 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU failed to post message to CCC
Error: (09/22/2013 10:22:10 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU failed to post message to CCC
Error: (09/22/2013 09:29:27 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: umbrella.exe, Version: 3.32.2.1, Zeitstempel: 0x52025a42
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00520075
ID des fehlerhaften Prozesses: 0x958
Startzeit der fehlerhaften Anwendung: 0xumbrella.exe0
Pfad der fehlerhaften Anwendung: umbrella.exe1
Pfad des fehlerhaften Moduls: umbrella.exe2
Berichtskennung: umbrella.exe3
Error: (09/22/2013 09:29:16 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (09/24/2013 10:48:35 PM) (Source: ipnathlp) (User: )
Description:
Error: (09/24/2013 10:36:28 PM) (Source: ipnathlp) (User: )
Description:
Error: (09/24/2013 10:24:28 PM) (Source: ipnathlp) (User: )
Description:
Error: (09/24/2013 10:20:22 PM) (Source: ipnathlp) (User: )
Description: 192.168.2.104192.168.137.0255.255.255.0
Error: (09/24/2013 10:20:22 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (09/24/2013 10:17:38 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\cdrbsdrv.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (09/24/2013 10:04:43 PM) (Source: ipnathlp) (User: )
Description:
Error: (09/24/2013 10:03:52 PM) (Source: ipnathlp) (User: )
Description:
Error: (09/24/2013 07:49:30 PM) (Source: ipnathlp) (User: )
Description:
Error: (09/24/2013 07:47:16 PM) (Source: ipnathlp) (User: )
Description:
Microsoft Office Sessions:
=========================
Error: (09/24/2013 10:19:55 PM) (Source: Application Hang)(User: )
Description: Spyhunter4.exe4.15.1.42709ec01ceb9632908218410C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exea2855117-2556-11e3-8968-ec9a743ead9c
Error: (09/24/2013 10:19:18 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/24/2013 09:31:43 PM) (Source: MsiInstaller)(User: Andrea-HP)
Description: Product: Google Update Helper -- Error 1316. A network error occurred while attempting to read from the file: C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\GoogleUpdateHelper.msi(NULL)(NULL)(NULL)(NULL)(NULL)
Error: (09/24/2013 08:38:37 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
Error: (09/22/2013 11:46:06 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
Error: (09/22/2013 10:23:45 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/22/2013 10:22:10 PM) (Source: ATIeRecord)(User: )
Description:
Error: (09/22/2013 10:22:10 PM) (Source: ATIeRecord)(User: )
Description:
Error: (09/22/2013 09:29:27 PM) (Source: Application Error)(User: )
Description: umbrella.exe3.32.2.152025a42unknown0.0.0.000000000c00000050052007595801ceb7c9cb4c8db5C:\Program Files (x86)\Common Files\Umbrella\umbrella.exeunknown4ab17f31-23bd-11e3-b49d-ec9a743ead9c
Error: (09/22/2013 09:29:16 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 43%
Total physical RAM: 6091.86 MB
Available physical RAM: 3445.1 MB
Total Pagefile: 12181.9 MB
Available Pagefile: 9034.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:678.21 GB) (Free:467.67 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:16.27 GB) (Free:1.76 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.08 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: F36AF300)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=678 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-24 22:14:43
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 rev. 0,00MB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Andrea\AppData\Local\Temp\uwdcqpob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff80002dc0000 52 bytes [FF, FF, FF, FF, FF, FF, FF, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 598 fffff80002dc0036 27 bytes [FF, FF, FF, FF, FF, FF, FF, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe[14696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074f81465 2 bytes [F8, 74]
.text C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe[14696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074f814bb 2 bytes [F8, 74]
.text ... * 2
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 sector 0: rootkit-like behavior
---- EOF - GMER 2.1 ----
Lady1 |
|
25.09.2013, 07:16
| #2 | |
| /// the machine /// TB-Ausbilder    | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
25.09.2013, 22:25
| #3 |
| | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Hallo Schrauber,
__________________hier nun das Ergebnis von ComboFix: Code:
ATTFilter ComboFix 13-09-24.02 - Andrea 25.09.2013 22:50:20.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.6092.4250 [GMT 2:00]
ausgeführt von:: c:\users\Andrea\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
FW: FireWall *Disabled* {CE40CCC0-8ADB-6D67-25A0-C5B6438E4B57}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\program files (x86)\Delta\delta\1.8.24.6\bh\delta.dll
c:\program files (x86)\Delta\delta\1.8.24.6\deltaApp.dll
c:\program files (x86)\Delta\delta\1.8.24.6\deltaEng.dll
c:\program files (x86)\Delta\delta\1.8.24.6\deltasrv.exe
c:\program files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll
c:\program files (x86)\HDvid Codec V1\HDVId codec v1-bho.dll
c:\program files (x86)\LyriXeeker-1\LyRIxeeker-1-bho.dll
c:\program files\Avira Secure Backup\Avira Secure Backup.exe
c:\users\Andrea\AppData\Local\TempDIR
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-08-25 bis 2013-09-25 ))))))))))))))))))))))))))))))
.
.
2013-09-25 20:57 . 2013-09-25 20:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-25 20:00 . 2013-09-25 20:56 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F81FDA19-EA4B-4039-B022-3492198D6C7C}\offreg.dll
2013-09-24 19:53 . 2013-09-24 19:53 -------- d-----w- C:\FRST
2013-09-24 19:32 . 2013-09-24 19:32 -------- d-----w- c:\program files (x86)\Delta
2013-09-24 19:32 . 2013-09-24 19:32 -------- d-----w- c:\users\Andrea\AppData\Roaming\BabSolution
2013-09-24 19:31 . 2013-09-25 20:27 -------- d-----w- c:\program files (x86)\LyriXeeker-1
2013-09-24 19:31 . 2013-09-24 19:31 -------- d-----w- c:\users\Andrea\AppData\Local\BonanzaDealsLive
2013-09-24 19:31 . 2013-09-24 19:31 -------- d-----w- c:\programdata\BonanzaDealsLive
2013-09-24 19:31 . 2013-09-24 19:36 -------- d-----w- c:\program files (x86)\BonanzaDeals
2013-09-24 19:31 . 2013-09-24 19:31 -------- d-----w- c:\programdata\Babylon
2013-09-24 19:31 . 2013-09-24 19:31 -------- d-----w- c:\users\Andrea\AppData\Roaming\DigitalSite
2013-09-24 19:31 . 2013-09-24 19:31 -------- d-----w- c:\users\Andrea\AppData\Roaming\Babylon
2013-09-24 19:31 . 2013-09-24 19:31 -------- d-----w- c:\program files (x86)\Image Converter
2013-09-24 06:56 . 2013-09-05 05:32 9694160 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F81FDA19-EA4B-4039-B022-3492198D6C7C}\mpengine.dll
2013-09-22 20:29 . 2012-06-22 10:01 22704 ----a-w- c:\windows\system32\drivers\EsgScanner.sys
2013-09-22 20:29 . 2013-09-22 20:29 110080 ----a-r- c:\users\Andrea\AppData\Roaming\Microsoft\Installer\{86CA3695-A412-4BAE-92B6-49A60C2AC663}\IconF7A21AF7.exe
2013-09-22 20:29 . 2013-09-22 20:29 110080 ----a-r- c:\users\Andrea\AppData\Roaming\Microsoft\Installer\{86CA3695-A412-4BAE-92B6-49A60C2AC663}\IconD7F16134.exe
2013-09-22 20:29 . 2013-09-22 20:29 110080 ----a-r- c:\users\Andrea\AppData\Roaming\Microsoft\Installer\{86CA3695-A412-4BAE-92B6-49A60C2AC663}\Icon1226A4C5.exe
2013-09-22 20:29 . 2013-09-22 20:30 -------- d-----w- C:\sh4ldr
2013-09-22 20:29 . 2013-09-22 20:29 -------- d-----w- c:\program files\Enigma Software Group
2013-09-22 20:28 . 2013-09-22 20:29 -------- d-----w- c:\windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2013-09-22 20:28 . 2013-09-22 20:28 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2013-09-22 20:15 . 2013-09-22 20:15 -------- d-----w- c:\users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-21 16:52 . 2013-09-22 20:12 -------- d-----w- c:\program files (x86)\IminentToolbar
2013-09-21 16:52 . 2013-09-21 16:53 -------- d-----w- c:\program files (x86)\Plus-HD-2.2
2013-09-21 16:51 . 2013-09-25 20:27 -------- d-----w- c:\program files (x86)\HDvid Codec V1
2013-09-21 16:51 . 2013-09-21 16:51 -------- d-----w- c:\program files (x86)\hdvidcodec.com
2013-09-21 16:40 . 2013-09-21 16:40 -------- d-----w- c:\users\Andrea\AppData\Local\Wajam
2013-09-21 16:39 . 2013-08-13 06:38 32328 ----a-w- c:\windows\Launcher.exe
2013-09-21 16:38 . 2013-09-21 16:38 -------- d-----w- c:\program files (x86)\VideoLAN
2013-09-12 08:55 . 2013-08-05 02:25 155584 ----a-w- c:\windows\system32\drivers\ataport.sys
2013-08-27 21:55 . 2013-08-27 21:55 74272 ----a-w- c:\windows\system32\RtNicProp64.dll
2013-08-27 21:55 . 2013-08-27 21:55 565352 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-20 23:05 . 2012-05-02 18:07 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-20 23:05 . 2011-07-15 20:03 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-13 07:40 . 2011-12-31 00:16 79143768 ----a-w- c:\windows\system32\MRT.exe
2013-09-05 20:44 . 2013-08-08 20:42 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-09-05 20:44 . 2013-08-06 21:12 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-05 20:44 . 2013-08-06 21:12 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-08-27 21:55 . 2011-09-22 23:40 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2013-08-19 20:24 . 2013-08-19 20:24 0 ----a-w- c:\windows\SysWow64\shoEEE4.tmp
2013-08-10 08:29 . 2013-08-10 08:30 10752 ----a-w- c:\windows\system32\E_GCINST.DLL
2013-08-10 08:29 . 2013-08-10 08:30 83968 ----a-w- c:\windows\system32\E_YD4BHTU.DLL
2013-08-10 08:29 . 2013-08-10 08:30 120320 ----a-w- c:\windows\system32\E_YLMHTU.DLL
2013-08-07 02:22 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-08-06 21:07 . 2013-08-06 21:12 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-08-06 21:07 . 2013-08-06 21:12 141376 ----a-w- c:\windows\system32\drivers\avfwot.sys
2013-08-06 21:07 . 2013-08-06 21:12 114608 ----a-w- c:\windows\system32\drivers\avfwim.sys
2013-08-02 01:48 . 2013-09-12 08:55 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-25 09:25 . 2013-08-14 06:13 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-14 06:13 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58 . 2013-08-14 06:13 2048 ----a-w- c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-14 06:13 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-07-09 05:52 . 2013-08-14 06:13 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-07-09 05:51 . 2013-08-14 06:12 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2013-07-09 05:46 . 2013-08-14 06:13 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-07-09 05:46 . 2013-08-14 06:13 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-07-09 05:46 . 2013-08-14 06:13 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-07-09 04:52 . 2013-08-14 06:12 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52 . 2013-08-14 06:13 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-07-09 04:46 . 2013-08-14 06:13 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-07-09 04:46 . 2013-08-14 06:13 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46 . 2013-08-14 06:13 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-07-06 06:03 . 2013-08-14 06:12 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110311301136}]
2013-09-21 16:53 602984 ----a-w- c:\program files (x86)\Plus-HD-2.2\Plus-HD-2.2-bho.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110311431162}]
c:\program files (x86)\HDvid Codec V1\HDvid Codec V1-bho.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110411181156}]
c:\program files (x86)\LyriXeeker-1\LyriXeeker-1-bho.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2013-07-26 20:30 12240 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}]
c:\program files (x86)\Delta\delta\1.8.24.6\bh\delta.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2013-07-26 12240]
"{82E1477C-B154-48D3-9891-33D83C26BCD3}"= "c:\program files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_CLASSES_ROOT\clsid\{82e1477c-b154-48d3-9891-33d83c26bcd3}]
[HKEY_CLASSES_ROOT\delta.deltadskBnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[HKEY_CLASSES_ROOT\delta.deltadskBnd]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalBackedUp]
@="{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}"
[HKEY_CLASSES_ROOT\CLSID\{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}]
2013-06-24 13:02 1378816 ----a-w- c:\program files\Avira Secure Backup\ShellExtension\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalError]
@="{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}"
[HKEY_CLASSES_ROOT\CLSID\{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}]
2013-06-24 13:02 1378816 ----a-w- c:\program files\Avira Secure Backup\ShellExtension\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalPartiallyBackedUp]
@="{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}"
[HKEY_CLASSES_ROOT\CLSID\{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}]
2013-06-24 13:02 1378816 ----a-w- c:\program files\Avira Secure Backup\ShellExtension\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalToBackup]
@="{2CDD871E-60EB-40BD-9721-A1CB57042F75}"
[HKEY_CLASSES_ROOT\CLSID\{2CDD871E-60EB-40BD-9721-A1CB57042F75}]
2013-06-24 13:02 1378816 ----a-w- c:\program files\Avira Secure Backup\ShellExtension\ShellExtension.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wisdom-soft ScreenHunter 6.0 Free"="0" [X]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE" [2013-08-10 241280]
"Avira Secure Backup"="c:\program files\Avira Secure Backup\Avira Secure Backup.exe" [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-05-08 336384]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-04-29 284440]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-06-28 168504]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-05-10 37960]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [BU]
"ACPW05DE"="c:\program files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe" [2011-11-16 822384]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
"QuickTime Task"="c:\program files (x86)\QuickTime\qttask.exe" [2013-03-14 77824]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-09-05 347192]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-07-26 1558480]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-12-25 110592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 EsgScanner;EsgScanner;c:\windows\system32\DRIVERS\EsgScanner.sys;c:\windows\SYSNATIVE\DRIVERS\EsgScanner.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys;c:\windows\SYSNATIVE\DRIVERS\avfwot.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirFirewallService;Avira FireWall;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [x]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
S2 Avira Secure Backup Crawler;Avira Secure Backup Crawler;c:\program files\Avira Secure Backup\Avira Secure BackupCrawler.exe;c:\program files\Avira Secure Backup\Avira Secure BackupCrawler.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys;c:\windows\SYSNATIVE\DRIVERS\avfwim.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-02 23:05]
.
2013-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-09 17:24]
.
2013-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-09 17:24]
.
2013-09-25 c:\windows\Tasks\HDvid Codec V1-codedownloader.job
- c:\program files (x86)\HDvid Codec V1\HDvid Codec V1-codedownloader.exe [2013-09-21 16:51]
.
2013-09-25 c:\windows\Tasks\HDvid Codec V1-enabler.job
- c:\program files (x86)\HDvid Codec V1\HDvid Codec V1-enabler.exe [2013-09-21 16:52]
.
2013-09-25 c:\windows\Tasks\HDvid Codec V1-updater.job
- c:\program files (x86)\HDvid Codec V1\HDvid Codec V1-updater.exe [2013-09-21 16:52]
.
2013-09-16 c:\windows\Tasks\HPCeeScheduleForANDREA-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
2013-09-20 c:\windows\Tasks\HPCeeScheduleForAndrea.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 20:15]
.
2013-09-25 c:\windows\Tasks\LyriXeeker-1-chromeinstaller.job
- c:\program files (x86)\LyriXeeker-1\LyriXeeker-1-chromeinstaller.exe [2013-09-24 19:31]
.
2013-09-25 c:\windows\Tasks\LyriXeeker-1-enabler.job
- c:\program files (x86)\LyriXeeker-1\LyriXeeker-1-enabler.exe [2013-09-24 19:31]
.
2013-09-25 c:\windows\Tasks\LyriXeeker-1-firefoxinstaller.job
- c:\program files (x86)\LyriXeeker-1\LyriXeeker-1-firefoxinstaller.exe [2013-09-24 19:31]
.
2013-09-25 c:\windows\Tasks\LyriXeeker-1-updater.job
- c:\program files (x86)\LyriXeeker-1\LyriXeeker-1-updater.exe [2013-09-24 19:31]
.
2013-09-25 c:\windows\Tasks\Plus-HD-2.2-chromeinstaller.job
- c:\program files (x86)\Plus-HD-2.2\Plus-HD-2.2-chromeinstaller.exe [2013-09-21 16:53]
.
2013-09-25 c:\windows\Tasks\Plus-HD-2.2-codedownloader.job
- c:\program files (x86)\Plus-HD-2.2\Plus-HD-2.2-codedownloader.exe [2013-09-21 16:53]
.
2013-09-25 c:\windows\Tasks\Plus-HD-2.2-enabler.job
- c:\program files (x86)\Plus-HD-2.2\Plus-HD-2.2-enabler.exe [2013-09-21 16:53]
.
2013-09-25 c:\windows\Tasks\Plus-HD-2.2-firefoxinstaller.job
- c:\program files (x86)\Plus-HD-2.2\Plus-HD-2.2-firefoxinstaller.exe [2013-09-21 16:53]
.
2013-09-25 c:\windows\Tasks\Plus-HD-2.2-updater.job
- c:\program files (x86)\Plus-HD-2.2\Plus-HD-2.2-updater.exe [2013-09-21 16:53]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalBackedUp]
@="{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}"
[HKEY_CLASSES_ROOT\CLSID\{8ED3CC2D-6BC2-43AD-8C43-F51FBB413AE6}]
2013-06-24 13:00 1879552 ----a-w- c:\program files\Avira Secure Backup\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalError]
@="{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}"
[HKEY_CLASSES_ROOT\CLSID\{B9CA6E12-7975-4997-B5BD-CA12ECE0FEAD}]
2013-06-24 13:00 1879552 ----a-w- c:\program files\Avira Secure Backup\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalPartiallyBackedUp]
@="{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}"
[HKEY_CLASSES_ROOT\CLSID\{95DDC869-FC98-4D47-BD34-2EDC9AA09C01}]
2013-06-24 13:00 1879552 ----a-w- c:\program files\Avira Secure Backup\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\MemopalToBackup]
@="{2CDD871E-60EB-40BD-9721-A1CB57042F75}"
[HKEY_CLASSES_ROOT\CLSID\{2CDD871E-60EB-40BD-9721-A1CB57042F75}]
2013-06-24 13:00 1879552 ----a-w- c:\program files\Avira Secure Backup\ShellExtensionx64\ShellExtension.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-15 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-15 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-15 416024]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-06-07 1128448]
"SetDefault"="c:\program files\Hewlett-Packard\HP LaunchBox\SetDefault.exe" [2011-06-27 42808]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Free YouTube to MP3 Converter - c:\users\Andrea\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - prefs.js: network.proxy.type - 2
FF - ExtSQL: 2013-08-06 23:46; toolbar_AVIRA-V7@apn.ask.com; c:\users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF - ExtSQL: 2013-09-21 18:52; 4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com; c:\users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\extensions\4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com
FF - ExtSQL: 2013-09-24 21:32; ffxtlbr@delta.com; c:\users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\extensions\ffxtlbr@delta.com
FF - user.js: extensions.iminent.tlbrSrchUrl - hxxp://start.iminent.com/?ref=toolbarm#q=
FF - user.js: extensions.iminent.id - 88b2be8300000000000060d8190c0116
FF - user.js: extensions.iminent.appId - {0E4B2CAB-B859-4C57-B96E-63DDEC692BC4}
FF - user.js: extensions.iminent.instlDay - 15969
FF - user.js: extensions.iminent.vrsn - 1.8.25.0
FF - user.js: extensions.iminent.vrsni - 1.8.25.0
FF - user.js: extensions.iminent.vrsnTs - 1.8.25.018:52
FF - user.js: extensions.iminent.prtnrId - iminent
FF - user.js: extensions.iminent.prdct - iminent
FF - user.js: extensions.iminent.aflt - orgnl
FF - user.js: extensions.iminent.smplGrp - none
FF - user.js: extensions.iminent.tlbrId - base
FF - user.js: extensions.iminent.instlRef -
FF - user.js: extensions.iminent.dfltLng -
FF - user.js: extensions.iminent.excTlbr - false
FF - user.js: extensions.iminent.ffxUnstlRst - false
FF - user.js: extensions.iminent.admin - false
FF - user.js: extensions.iminent.autoRvrt - false
FF - user.js: extensions.iminent.rvrt - false
FF - user.js: extensions.iminent.newTab - false
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 88b2be8300000000000060d8190c0116
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15972
FF - user.js: extensions.delta.vrsn - 1.8.24.6
FF - user.js: extensions.delta.vrsni - 1.8.24.6
FF - user.js: extensions.delta.vrsnTs - 1.8.24.621:32
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - de
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=119357&tsp=5015
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
AddRemove-Adobe Photoshop Elements 2.0 - c:\windows\ISUN0407.EXE
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.alb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FotoManager10Deluxe.8.alb"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.032"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.abr"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ani"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.apd"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.arw"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.bay"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.bmp"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.bw"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.cr2"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.crw"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.cs1"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.cur"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.dcr"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.dcx"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.dib"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.djv"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.djvu"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.dng"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.emf"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.eps"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.erf"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.fff"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.fpx"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.gif"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.hdr"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.icl"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.icn"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ico"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.iff"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ilbm"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.int"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.inta"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.iw4"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.j2c"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.j2k"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jbr"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jfif"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jif"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jp2"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jpc"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.jpe"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.jpeg"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.jpg"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jpk"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.jpx"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.kdc"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.lbm"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.mef"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.mos"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.mrw"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.nef"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.nrw"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.orf"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pbm"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pbr"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pcd"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pct"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pcx"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.pef"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pgm"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pic"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pict"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pix"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.png"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ppm"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.psd"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.psp"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pspbrush"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.pspimage"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.raf"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ras"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.raw"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rgb"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rgba"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rle"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rsb"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.rw2"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.rwl"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.sgi"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.sr2"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.srf"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.srw"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.tga"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.thm"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.tif"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-3074875666-1110233767-17136860-1000)
"Progid"="ACDSee Pro 5.tiff"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ttc"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.ttf"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v50po\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.v50po"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v50pp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.v50pp"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v50ppf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.v50ppf"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.wbm"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.wbmp"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.wmf"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.xbm"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.xif"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.xmp"
.
[HKEY_USERS\S-1-5-21-3074875666-1110233767-17136860-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 5.xpm"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-09-25 23:11:32
ComboFix-quarantined-files.txt 2013-09-25 21:11
.
Vor Suchlauf: 19 Verzeichnis(se), 505.403.523.072 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 505.092.759.552 Bytes frei
.
- - End Of File - - 1C54FC63750839C0E2293CE329B69206
 Grüße Lady |
|
26.09.2013, 09:11
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.09.2013, 20:23
| #5 |
| | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Hallo Schrauber, hier nun das Ergebnis: Anti-Malware: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.26.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Andrea :: ANDREA-HP [Administrator] Schutz: Aktiviert 26.09.2013 20:42:16 mbam-log-2013-09-26 (20-42-16).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUM Deaktivierte Suchlaufeinstellungen: PUP | P2P Durchsuchte Objekte: 204426 Laufzeit: 5 Minute(n), 32 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.005 - Bericht erstellt am 26/09/2013 um 20:57:03
# Updated 22/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Andrea - ANDREA-HP
# Gestartet von : C:\Users\Andrea\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BonanzaDealsLive
Ordner Gelöscht : C:\Program Files (x86)\BonanzaDealsLive
Ordner Gelöscht : C:\Program Files (x86)\delta
Ordner Gelöscht : C:\Program Files (x86)\HDvidCodec.com
Ordner Gelöscht : C:\Program Files (x86)\IminentToolbar
Ordner Gelöscht : C:\Program Files (x86)\Plus-HD-2.2
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\Andrea\AppData\Local\BonanzaDealsLive
Ordner Gelöscht : C:\Users\Andrea\AppData\Local\Wajam
Ordner Gelöscht : C:\Users\Andrea\AppData\Roaming\BabSolution
Ordner Gelöscht : C:\Users\Andrea\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Andrea\AppData\Roaming\digitalsite
Ordner Gelöscht : C:\Users\Andrea\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDvidCodec.com
Ordner Gelöscht : C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\jetpack
Ordner Gelöscht : C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com
Ordner Gelöscht : C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\ffxtlbr@delta.com
Ordner Gelöscht : C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfakeonomonapccoamcmdgpoaicnpnoo
Datei Gelöscht : C:\Users\Andrea\Desktop\HDVidCodec.lnk
Datei Gelöscht : C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\user.js
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.2-chromeinstaller.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.2-chromeinstaller
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.2-codedownloader.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.2-codedownloader
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.2-enabler.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.2-enabler
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.2-firefoxinstaller.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.2-firefoxinstaller
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-2.2-updater.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-2.2-updater
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaappCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\delta.deltaappCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\tracing\askpartnercobrandingtool_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033036.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033036.Sandbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0033036.Sandbox.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0034362.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0034362.Sandbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0034362.Sandbox.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0041856.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0041856.Sandbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0041856.Sandbox.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_screenhunter_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_screenhunter_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311301136}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322302236}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311431162}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322432262}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110411181156}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355305536}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366306636}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355435562}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366436662}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311301136}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311431162}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411181156}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311301136}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311431162}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110411181156}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{82E1477C-B154-48D3-9891-33D83C26BCD3}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322302236}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Wert Gelöscht : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]
Schlüssel Gelöscht : HKCU\Software\1ClickDownload
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\simplytech
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Plus-HD-2.2
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\Software\Plus-HD-2.2
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-2.2
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16506
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.a4fdacf00e9c44ad5b4cfbf9800f184f63685711674e04973936f860cd2a102a9com33036.33036.internaldb.cache/2a71b3b28494cf1854d333288ccc18ba_DE.value", "%22var%20cat_2a71b3b28494cf1854d3332[...]
Zeile gelöscht : user_pref("extensions.a4fdacf00e9c44ad5b4cfbf9800f184f63685711674e04973936f860cd2a102a9com33036.33036.internaldb.cache/3518e1eac042730aa1274618984462b3_DE.value", "%22var%20cat_3518e1eac042730aa127461[...]
Zeile gelöscht : user_pref("extensions.a4fdacf00e9c44ad5b4cfbf9800f184f63685711674e04973936f860cd2a102a9com33036.33036.internaldb.cache/5cdf8a7ef2ec84abac286c67587b78d9.value", "%22function%20tcmMarkWindow%28a%29%7Bva[...]
Zeile gelöscht : user_pref("extensions.a4fdacf00e9c44ad5b4cfbf9800f184f63685711674e04973936f860cd2a102a9com33036.33036.internaldb.cache/d5baae4ef839769f8eb7e9f9d82d8a40_DE.value", "%22var%20cat_d5baae4ef839769f8eb7e9f[...]
Zeile gelöscht : user_pref("extensions.crossrider.bic", "14141707fbe24a0976edf91edd350f73");
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "88b2be8300000000000060d8190c0116");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15972");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.621:32:10");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=119357&tsp=5015");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
Zeile gelöscht : user_pref("wtb8031.homepage", "hxxp://isearch.nation.com/ofa1/");
Zeile gelöscht : user_pref("wtb8031.newtab", "hxxp://isearch.nation.com/ofa1/");
*************************
AdwCleaner[R0].txt - [22162 octets] - [26/09/2013 20:54:55]
AdwCleaner[S0].txt - [21135 octets] - [26/09/2013 20:57:03]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [21196 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.2 (09.22.2013:1)
OS: Windows 7 Home Premium x64
Ran by Andrea on 26.09.2013 at 21:04:34,20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422182256}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550455185556}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466186656}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220422182256}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{55555555-5555-5555-5555-550455185556}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660466186656}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{55555555-5555-5555-5555-550455185556}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660466186656}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550455185556}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660466186656}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{32446FC1-A2DC-4C84-B83E-A123D597688B}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{42218EA0-A1A3-4FAE-BBF7-7482498E8022}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{42218EA0-A1A3-4FAE-BBF7-7482498E8022}
~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\shoE8A4.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoEEE4.tmp
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Empty Folder] C:\Users\Andrea\appdata\local\{1EF8C88F-D50B-4971-B717-56BFB7A6B918}
Successfully deleted: [Empty Folder] C:\Users\Andrea\appdata\local\{551E93A7-FDFE-478E-BC4B-FAF7160A8BE2}
Successfully deleted: [Empty Folder] C:\Users\Andrea\appdata\local\{EC3BD571-141C-47F8-84BB-F86D2E5410CF}
~~~ FireFox
Successfully deleted: [File] C:\Users\Andrea\AppData\Roaming\mozilla\firefox\profiles\zkoleref.default\extensions\toolbar_avira-v7@apn.ask.com.xpi
Successfully deleted: [Folder] C:\Users\Andrea\AppData\Roaming\mozilla\firefox\profiles\zkoleref.default\extensions\763ab44b-71df-436c-906e-2ee8e1d7b302@af951efb-381e-47b2-ac45-80df41e44bc7.com
Successfully deleted the following from C:\Users\Andrea\AppData\Roaming\mozilla\firefox\profiles\zkoleref.default\prefs.js
user_pref("extensions.a4fdacf00e9c44ad5b4cfbf9800f184f63685711674e04973936f860cd2a102a9com33036.33036.internaldb.cache/530e52021dc20843b1aa62957edeb9f8.value", "%22var%20adsDe
user_pref("extensions.a4fdacf00e9c44ad5b4cfbf9800f184f63685711674e04973936f860cd2a102a9com33036.33036.internaldb.cache/833447eaff04548ccb80787286a7cad9_DE.value", "%22var%20ca
user_pref("extensions.iminent.admin", false);
user_pref("extensions.iminent.aflt", "orgnl");
user_pref("extensions.iminent.appId", "{0E4B2CAB-B859-4C57-B96E-63DDEC692BC4}");
user_pref("extensions.iminent.autoRvrt", "false");
user_pref("extensions.iminent.dfltLng", "");
user_pref("extensions.iminent.excTlbr", false);
user_pref("extensions.iminent.ffxUnstlRst", false);
user_pref("extensions.iminent.id", "88b2be8300000000000060d8190c0116");
user_pref("extensions.iminent.instlDay", "15969");
user_pref("extensions.iminent.instlRef", "");
user_pref("extensions.iminent.newTab", false);
user_pref("extensions.iminent.prdct", "iminent");
user_pref("extensions.iminent.prtnrId", "iminent");
user_pref("extensions.iminent.rvrt", "false");
user_pref("extensions.iminent.smplGrp", "none");
user_pref("extensions.iminent.tlbrId", "base");
user_pref("extensions.iminent.tlbrSrchUrl", "hxxp://start.iminent.com/?ref=toolbarm#q=");
user_pref("extensions.iminent.vrsn", "1.8.25.0");
user_pref("extensions.iminent.vrsnTs", "1.8.25.018:52:46");
user_pref("extensions.iminent.vrsni", "1.8.25.0");
user_pref("iminent.LayoutId", "1");
user_pref("iminent.ShowThankyouPixel", "0");
user_pref("iminent.registerToolbarEvent102", "1379878283586");
user_pref("iminent.registerToolbarEvent105", "1379786930712");
user_pref("iminent.registerToolbarEvent109", "1379878457386");
user_pref("iminent.registerToolbarEvent111", "1379878457400");
user_pref("iminent.registerToolbarEvent112", "1379806970527");
user_pref("iminent.registerToolbarEvent122", "1379878457404");
user_pref("iminent.version", "7.36.1.1");
user_pref("iminent.versioning", "{\"CurrentVersion\":\"7.36.1.1\",\"InstallEventCTime\":1379878236362,\"InstallEvent\":\"True\"}");
Emptied folder: C:\Users\Andrea\AppData\Roaming\mozilla\firefox\profiles\zkoleref.default\minidumps [136 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.09.2013 at 21:10:30,80
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-09-2013
Ran by Andrea (administrator) on ANDREA-HP on 26-09-2013 21:18:17
Running from C:\Users\Andrea\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
() C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\usrreq.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [Wisdom-soft ScreenHunter 6.0 Free] - 0
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2013-08-10] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Avira Secure Backup] - "C:\Program Files\Avira Secure Backup\Avira Secure Backup.exe" /delayed
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [ACPW05DE] - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe [822384 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\qttask.exe [77824 2013-03-14] (Apple Computer, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default
FF NewTab: hxxp://www.searchgol.com/?babsrc=NT_ss&mntrId=88B260D8190C0116&affID=119357&tsp=5015
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\searchplugins\iminent.xml
FF SearchPlugin: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\ich@maltegoetz.de
FF Extension: Andasa iCat - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\plugin@andasa.de
FF Extension: hdvc3 - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\hdvc3@hdvidcodec.com.xpi
FF Extension: No Name - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (LyriXeeker-1) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig\1.24.10_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Avira Secure Backup Crawler; C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe [4121960 2013-06-24] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-07-17] (Enigma Software Group USA, LLC.)
==================== Drivers (Whitelisted) ====================
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-08-06] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-08-06] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 cdrbsdrv; No ImagePath
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:10 - 2013-09-26 21:10 - 00005661 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:54 - 2013-09-26 20:57 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:54 - 2013-09-26 20:54 - 01042066 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-26 20:35 - 2013-09-26 20:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 21:58 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-25 21:58 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-25 21:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-25 21:56 - 2013-09-25 23:11 - 00000000 ____D C:\Qoobox
2013-09-25 21:53 - 2013-09-25 22:28 - 00000000 ____D C:\Windows\erdnt
2013-09-25 21:52 - 2013-09-25 21:50 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:41 - 2013-09-24 21:43 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-09-26 20:59 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-09-26 20:59 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-09-26 20:58 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-09-26 20:58 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:36 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-23 11:29 - 2013-09-24 19:46 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-09-22 22:28 - 2013-09-22 22:29 - 00000000 ____D C:\Windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-21 18:52 - 2013-09-26 20:58 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-09-21 18:52 - 2013-09-26 20:58 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-09-21 18:52 - 2013-09-26 20:58 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-09-21 18:52 - 2013-09-22 22:13 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:51 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-13 21:44 - 2013-07-31 16:17 - 17833472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 21:44 - 2013-07-31 15:42 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 21:44 - 2013-07-31 15:29 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 21:44 - 2013-07-31 15:20 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 21:44 - 2013-07-31 15:19 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 21:44 - 2013-07-31 15:18 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 15:17 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-13 21:44 - 2013-07-31 15:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 15:14 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 15:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 21:44 - 2013-07-31 15:13 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 15:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 15:08 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 15:05 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 21:44 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 21:44 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 21:44 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 21:44 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-09-13 21:44 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 21:44 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 10:55 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 10:55 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 10:55 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 10:55 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 10:55 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 10:55 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-08 18:12 - 2013-09-12 10:49 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
2013-08-27 23:55 - 2013-08-27 23:55 - 00565352 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2013-08-27 23:55 - 2013-08-27 23:55 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll
==================== One Month Modified Files and Folders =======
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:11 - 2013-01-08 22:58 - 00000437 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-09-26 21:10 - 2013-09-26 21:10 - 00005661 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-09-26 21:06 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-26 21:06 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-26 21:05 - 2012-05-02 20:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:59 - 2013-09-24 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-26 20:59 - 2013-09-24 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-26 20:58 - 2013-09-24 21:31 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-26 20:58 - 2013-09-24 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-26 20:58 - 2013-09-21 18:52 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-09-26 20:58 - 2013-09-21 18:52 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-09-26 20:58 - 2013-09-21 18:52 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-09-26 20:58 - 2012-04-09 19:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-26 20:58 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-26 20:58 - 2009-07-14 06:51 - 00100879 _____ C:\Windows\setupact.log
2013-09-26 20:57 - 2013-09-26 20:54 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:57 - 2011-09-23 01:41 - 02033145 _____ C:\Windows\WindowsUpdate.log
2013-09-26 20:54 - 2013-09-26 20:54 - 01042066 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:39 - 2011-07-16 07:32 - 00654852 _____ C:\Windows\system32\perfh007.dat
2013-09-26 20:39 - 2011-07-16 07:32 - 00130434 _____ C:\Windows\system32\perfc007.dat
2013-09-26 20:39 - 2009-07-14 07:13 - 01522286 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-26 20:38 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:36 - 2013-09-26 20:35 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-26 20:33 - 2011-12-24 18:13 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5717C4F9-34CC-4C33-A5BA-AE8FA455B99B}
2013-09-26 20:31 - 2012-04-09 19:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-26 20:29 - 2010-11-21 05:47 - 00921484 _____ C:\Windows\PFRO.log
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 23:11 - 2013-09-25 21:56 - 00000000 ____D C:\Qoobox
2013-09-25 22:57 - 2009-07-14 04:34 - 00000285 _____ C:\Windows\system.ini
2013-09-25 22:28 - 2013-09-25 21:53 - 00000000 ____D C:\Windows\erdnt
2013-09-25 22:27 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-25 22:27 - 2013-09-21 18:51 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-25 22:27 - 2013-08-22 22:18 - 00000000 ____D C:\Program Files\Avira Secure Backup
2013-09-25 22:19 - 2012-01-17 22:53 - 00000000 ____D C:\Users\Andrea\Documents\Outlook-Dateien
2013-09-25 21:50 - 2013-09-25 21:52 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:48 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:52 - 2013-09-24 21:53 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:49 - 2011-12-24 18:04 - 00000000 ____D C:\Users\Andrea
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:43 - 2013-09-24 21:41 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:36 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 21:22 - 2012-01-28 13:06 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\MAGIX
2013-09-24 21:22 - 2012-01-28 13:04 - 00000000 ____D C:\ProgramData\MAGIX
2013-09-24 19:46 - 2013-09-23 11:29 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-24 13:13 - 2012-01-09 21:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-09-24 13:12 - 2012-01-16 21:58 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:30 - 2013-09-22 22:29 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2013-09-22 22:28 - 00000000 ____D C:\Windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2013-09-22 22:16 - 2013-07-08 22:36 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-22 22:13 - 2013-09-21 18:52 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:52 - 2011-12-24 18:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Google
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-17 23:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-21 01:51 - 2012-12-19 20:57 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAndrea
2013-09-21 01:51 - 2012-12-19 20:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForAndrea.job
2013-09-21 01:05 - 2012-05-02 20:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-21 01:05 - 2012-05-02 20:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-21 01:05 - 2011-07-15 22:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 11:46 - 2011-12-31 19:15 - 00018432 _____ C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-20 11:34 - 2013-07-08 23:42 - 00000000 ___RD C:\Users\Andrea\Dropbox
2013-09-16 23:36 - 2012-01-21 20:05 - 00000000 ____D C:\Users\Andrea\AppData\Local\CrashDumps
2013-09-16 23:25 - 2012-01-17 23:14 - 00000000 ____D C:\Users\Andrea\Documents\Kreditkarte
2013-09-16 22:45 - 2012-12-02 21:20 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForANDREA-HP$
2013-09-16 22:45 - 2012-12-02 21:20 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForANDREA-HP$.job
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 13:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 13:19 - 2009-07-14 06:45 - 00430360 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 09:43 - 2011-12-25 17:06 - 01527912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-13 09:43 - 2011-12-25 17:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-13 09:42 - 2013-08-19 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 09:40 - 2012-01-03 20:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 09:40 - 2011-12-31 02:16 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 10:49 - 2013-09-08 18:12 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
2013-09-05 22:44 - 2013-08-08 22:42 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-28 00:27 - 2012-01-03 20:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Microsoft Help
2013-08-28 00:19 - 2011-02-10 21:23 - 00000000 ____D C:\SWSetup
2013-08-27 23:55 - 2013-08-27 23:55 - 00565352 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2013-08-27 23:55 - 2013-08-27 23:55 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll
2013-08-27 23:55 - 2011-09-23 01:40 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2013-08-27 23:55 - 2011-09-23 01:40 - 00000000 ____D C:\Program Files (x86)\Realtek
Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-21 19:34
==================== End Of Log ============================
--- --- --- Vielen Dank auch, dass Du Dich meiner annimmst :-) LG Lady PS: Kurzfristig sah es richtig gut aus. Nav-Links war weg und auch all die sonstigen Werbemeldungen, Aufforderungen dies und jenes runterzuladen, waren weg. Nach einem Neustart des Rechners ist wieder alles beim alten :-( Geändert von Lady1 (26.09.2013 um 21:15 Uhr) |
|
27.09.2013, 08:54
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben In wlechem Browser? ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte.
__________________ --> Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben |
|
27.09.2013, 23:01
| #7 |
| | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Hallo Schrauber, ich bin erst jetzt nach Hause gekommen und muss morgen arbeiten. Anschließend habe ich eine familiäre Verpflichtung. Ich werde deshalb voraussichtlich erst am Sonntag dazu kommen, die einzelnen Punkte abzuarbeiten und melde mich dann wieder. Vorab: Ich arbeite mit Firefox. Auf dem Notebook ist aber auch der Internet Explorer installiert. Noch eine Frage zum Eset Scanner. Soll ich da wirklich meine externe Festplatte anschließen? Auf dieser sind mir sehr wichtige Bilder gesichert und die Festplatte war schon längere Zeit nicht mehr am Notebook angeschlossen. Ein Virenbefall der externen Platte schließe ich daher aus. Ich habe eher die Angst, dass wenn ich sie anschließe, solange das Notebook noch befallen ist, auch die externe Platte befallen wird. Wie sieht es mit dem Smartphone aus? Das war nach dem Download des HDvid-Codes noch mit dem Rechner verbunden. Damals hatte ich den Virenbefall nur noch nicht bemerkt. Das Smartphone zeigt aber bisher keine komischen Sympthome. Soll das Smartphone ebenfalls für den Eset Scan angeschlossen werden? Sorry für die vielen Fragen. Aber ich will nichts falsch machen. Vielen Dank! Gute Nacht Lady |
|
28.09.2013, 15:16
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Smartphone sollte sicher sein. Deine Externe wird nicht infiziert, das ist nur Adware. Du musst sie aber nit anklemmen wenn Du nit willst 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.09.2013, 09:25
| #9 |
| | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Guten Morgen, hier die Ergebnisse: Eset Scan: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f29de060b5e6484d9f63753bae692615
# engine=15293
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-28 10:49:37
# local_time=2013-09-29 12:49:37 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 32649 132038427 0 0
# scanned=222310
# found=0
# cleaned=0
# scan_time=6006
Code:
ATTFilter Results of screen317's Security Check version 0.99.73 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 JavaFX 2.1.0 Java(TM) 6 Update 30 Java 7 Update 13 Java version out of Date! Adobe Flash Player 11.8.800.168 Adobe Reader 10.1.7 Adobe Reader out of Date! Mozilla Firefox (23.0.1) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Andrea (administrator) on ANDREA-HP on 29-09-2013 08:25:13
Running from C:\Users\Andrea\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
() C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\usrreq.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [Wisdom-soft ScreenHunter 6.0 Free] - 0
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2013-08-10] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Avira Secure Backup] - "C:\Program Files\Avira Secure Backup\Avira Secure Backup.exe" /delayed
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [ACPW05DE] - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe [822384 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\qttask.exe [77824 2013-03-14] (Apple Computer, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default
FF NewTab: hxxp://www.searchgol.com/?babsrc=NT_ss&mntrId=88B260D8190C0116&affID=119357&tsp=5015
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\searchplugins\iminent.xml
FF SearchPlugin: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\763ab44b-71df-436c-906e-2ee8e1d7b302@af951efb-381e-47b2-ac45-80df41e44bc7.com
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\ich@maltegoetz.de
FF Extension: Andasa iCat - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\plugin@andasa.de
FF Extension: hdvc3 - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\hdvc3@hdvidcodec.com.xpi
FF Extension: No Name - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\zkoleref.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (LyriXeeker-1) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig\1.24.10_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Avira Secure Backup Crawler; C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe [4121960 2013-06-24] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-07-17] (Enigma Software Group USA, LLC.)
==================== Drivers (Whitelisted) ====================
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-08-06] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-08-06] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 cdrbsdrv; No ImagePath
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-09-29 08:20 - 00001068 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-28 22:12 - 2013-09-28 22:12 - 98442955 _____ C:\Windows\SysWOW64\鑭튐ž
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:10 - 2013-09-26 21:10 - 00005661 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:54 - 2013-09-26 20:57 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:54 - 2013-09-26 20:54 - 01042066 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-26 20:35 - 2013-09-26 20:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 21:58 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-25 21:58 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-25 21:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-25 21:56 - 2013-09-25 23:11 - 00000000 ____D C:\Qoobox
2013-09-25 21:53 - 2013-09-25 22:28 - 00000000 ____D C:\Windows\erdnt
2013-09-25 21:52 - 2013-09-25 21:50 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:41 - 2013-09-24 21:43 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-09-29 03:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-09-29 03:31 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-09-29 03:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-09-29 03:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:36 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-23 11:29 - 2013-09-24 19:46 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-09-22 22:28 - 2013-09-22 22:29 - 00000000 ____D C:\Windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-21 18:52 - 2013-09-29 06:52 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-09-21 18:52 - 2013-09-29 06:52 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-09-21 18:52 - 2013-09-29 06:52 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-09-21 18:52 - 2013-09-22 22:13 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:51 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-13 21:44 - 2013-07-31 16:17 - 17833472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 21:44 - 2013-07-31 15:42 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 21:44 - 2013-07-31 15:29 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 21:44 - 2013-07-31 15:20 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 21:44 - 2013-07-31 15:19 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 21:44 - 2013-07-31 15:18 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 15:17 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-13 21:44 - 2013-07-31 15:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 15:14 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 15:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 21:44 - 2013-07-31 15:13 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 15:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 15:08 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 15:05 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 21:44 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 21:44 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 21:44 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 21:44 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-09-13 21:44 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 21:44 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 10:55 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 10:55 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 10:55 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 10:55 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 10:55 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 10:55 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-08 18:12 - 2013-09-12 10:49 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
==================== One Month Modified Files and Folders =======
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-09-29 08:20 - 00001068 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-29 08:05 - 2012-05-02 20:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-29 07:45 - 2011-09-23 01:41 - 01211467 _____ C:\Windows\WindowsUpdate.log
2013-09-29 07:31 - 2012-04-09 19:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-29 06:52 - 2013-09-21 18:52 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-09-29 06:52 - 2013-09-21 18:52 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-09-29 06:52 - 2013-09-21 18:52 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-09-29 03:31 - 2013-09-24 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-29 03:31 - 2013-09-24 21:31 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-29 03:31 - 2013-09-24 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-29 03:31 - 2013-09-24 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-29 01:51 - 2012-12-19 20:57 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAndrea
2013-09-29 01:51 - 2012-12-19 20:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForAndrea.job
2013-09-29 00:45 - 2011-12-24 18:13 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5717C4F9-34CC-4C33-A5BA-AE8FA455B99B}
2013-09-29 00:15 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-28 23:53 - 2012-01-17 22:53 - 00000000 ____D C:\Users\Andrea\Documents\Outlook-Dateien
2013-09-28 23:15 - 2012-01-21 20:05 - 00000000 ____D C:\Users\Andrea\AppData\Local\CrashDumps
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-28 22:42 - 2011-07-16 07:32 - 00654852 _____ C:\Windows\system32\perfh007.dat
2013-09-28 22:42 - 2011-07-16 07:32 - 00130434 _____ C:\Windows\system32\perfc007.dat
2013-09-28 22:42 - 2009-07-14 07:13 - 01500294 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-28 22:18 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-28 22:18 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-28 22:14 - 2012-04-09 19:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-28 22:12 - 2013-09-28 22:12 - 98442955 _____ C:\Windows\SysWOW64\鑭튐ž
2013-09-28 22:11 - 2013-01-08 22:58 - 00000437 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-09-28 22:10 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-28 22:10 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-28 22:10 - 2009-07-14 06:51 - 00101271 _____ C:\Windows\setupact.log
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:10 - 2013-09-26 21:10 - 00005661 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:57 - 2013-09-26 20:54 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:54 - 2013-09-26 20:54 - 01042066 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:36 - 2013-09-26 20:35 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-26 20:29 - 2010-11-21 05:47 - 00921484 _____ C:\Windows\PFRO.log
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 23:11 - 2013-09-25 21:56 - 00000000 ____D C:\Qoobox
2013-09-25 22:57 - 2009-07-14 04:34 - 00000285 _____ C:\Windows\system.ini
2013-09-25 22:28 - 2013-09-25 21:53 - 00000000 ____D C:\Windows\erdnt
2013-09-25 22:27 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-25 22:27 - 2013-09-21 18:51 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-25 22:27 - 2013-08-22 22:18 - 00000000 ____D C:\Program Files\Avira Secure Backup
2013-09-25 21:50 - 2013-09-25 21:52 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:52 - 2013-09-24 21:53 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:49 - 2011-12-24 18:04 - 00000000 ____D C:\Users\Andrea
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:43 - 2013-09-24 21:41 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:36 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 21:22 - 2012-01-28 13:06 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\MAGIX
2013-09-24 21:22 - 2012-01-28 13:04 - 00000000 ____D C:\ProgramData\MAGIX
2013-09-24 19:46 - 2013-09-23 11:29 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-24 13:13 - 2012-01-09 21:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-09-24 13:12 - 2012-01-16 21:58 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:30 - 2013-09-22 22:29 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2013-09-22 22:28 - 00000000 ____D C:\Windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2013-09-22 22:16 - 2013-07-08 22:36 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-22 22:13 - 2013-09-21 18:52 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:52 - 2011-12-24 18:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Google
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-17 23:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-21 01:05 - 2012-05-02 20:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-21 01:05 - 2012-05-02 20:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-21 01:05 - 2011-07-15 22:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 11:46 - 2011-12-31 19:15 - 00018432 _____ C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-20 11:34 - 2013-07-08 23:42 - 00000000 ___RD C:\Users\Andrea\Dropbox
2013-09-16 23:25 - 2012-01-17 23:14 - 00000000 ____D C:\Users\Andrea\Documents\Kreditkarte
2013-09-16 22:45 - 2012-12-02 21:20 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForANDREA-HP$
2013-09-16 22:45 - 2012-12-02 21:20 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForANDREA-HP$.job
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 13:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 13:19 - 2009-07-14 06:45 - 00430360 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 09:43 - 2011-12-25 17:06 - 01527912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-13 09:43 - 2011-12-25 17:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-13 09:42 - 2013-08-19 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 09:40 - 2012-01-03 20:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 09:40 - 2011-12-31 02:16 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 10:49 - 2013-09-08 18:12 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
2013-09-05 22:44 - 2013-08-08 22:42 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-21 19:34
==================== End Of Log ============================
--- --- --- --- --- --- Grüße Lady Hi, habe gerade eine neue Ereignis-Meldung von Antivir bekommen: Code:
ATTFilter 29.09.2013 10:21 [Browser-Schutz] Malware gefunden
Beim Zugriff auf Daten der URL "hxxp://ib.adnxs.com/tt?id=1466966"
wurde ein Virus oder unerwünschtes Programm 'HTML/Rce.Gen3' [virus] gefunden.
Durchgeführte Aktion: Der Zugriff auf die Datei wurde blockiert
Lady |
|
29.09.2013, 17:58
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben In welchem Browser warst Du unterwegs?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.09.2013, 17:59
| #11 |
| | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Ich arbeite an sich nur mit Firefox. Ich bin mir nicht sicher, es könnte sein, dass sich einige der Downloads hier über den Internet Explorer geöffnet haben. Gruß Lady Ergänzung: Die im letzten Post gemeldete Ereignis-Meldung wiederholt sich ständig, gerade jetzt akuell schon wieder 2mal. Ich bin momentan nur in diesem Forum (über Firefox.) Code:
ATTFilter 29.09.2013 18:48 [Browser-Schutz] Malware gefunden
Beim Zugriff auf Daten der URL "hxxp://ib.adnxs.com/tt?id=1466966"
wurde ein Virus oder unerwünschtes Programm 'HTML/Rce.Gen3' [virus] gefunden.
Durchgeführte Aktion: Der Zugriff auf die Datei wurde blockiert
29.09.2013 19:16 [Browser-Schutz] Malware gefunden
Beim Zugriff auf Daten der URL "hxxp://ib.adnxs.com/tt?id=1466966"
wurde ein Virus oder unerwünschtes Programm 'HTML/Rce.Gen3' [virus] gefunden.
Durchgeführte Aktion: Der Zugriff auf die Datei wurde blockiert
29.09.2013 19:19 [Browser-Schutz] Malware gefunden
Beim Zugriff auf Daten der URL "hxxp://ib.adnxs.com/tt?id=1466966"
wurde ein Virus oder unerwünschtes Programm 'HTML/Rce.Gen3' [virus] gefunden.
Durchgeführte Aktion: Der Zugriff auf die Datei wurde blockiert
Geändert von Lady1 (29.09.2013 um 18:24 Uhr) |
|
30.09.2013, 08:34
| #12 |
| /// the machine /// TB-Ausbilder | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Deinstalliere Firefox, behalten keine Daten. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Firefox neu installieren, frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.09.2013, 19:01
| #13 |
| | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Hi Schrauber, hier das neue FRST: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Andrea (administrator) on ANDREA-HP on 30-09-2013 19:53:47
Running from C:\Users\Andrea\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
() C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\usrreq.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [Wisdom-soft ScreenHunter 6.0 Free] - 0
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2013-08-10] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Avira Secure Backup] - "C:\Program Files\Avira Secure Backup\Avira Secure Backup.exe" /delayed
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [ACPW05DE] - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe [822384 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\qttask.exe [77824 2013-03-14] (Apple Computer, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\vs7tooal.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (LyriXeeker-1) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig\1.24.10_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Avira Secure Backup Crawler; C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe [4121960 2013-06-24] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-07-17] (Enigma Software Group USA, LLC.)
==================== Drivers (Whitelisted) ====================
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-08-06] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-08-06] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 cdrbsdrv; No ImagePath
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:47 - 2013-09-30 19:49 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-09-30 19:47 - 2013-09-30 19:47 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-30 19:47 - 2013-09-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-09-29 08:20 - 00001068 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:10 - 2013-09-26 21:10 - 00005661 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:54 - 2013-09-26 20:57 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:54 - 2013-09-26 20:54 - 01042066 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-26 20:35 - 2013-09-26 20:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 21:58 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-25 21:58 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-25 21:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-25 21:56 - 2013-09-25 23:11 - 00000000 ____D C:\Qoobox
2013-09-25 21:53 - 2013-09-25 22:28 - 00000000 ____D C:\Windows\erdnt
2013-09-25 21:52 - 2013-09-25 21:50 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:41 - 2013-09-24 21:43 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-09-30 19:44 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-09-30 19:44 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-09-30 19:44 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-09-30 19:44 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:36 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-23 11:29 - 2013-09-24 19:46 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-21 18:52 - 2013-09-30 19:44 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-09-21 18:52 - 2013-09-30 19:44 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-09-21 18:52 - 2013-09-30 19:44 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-09-21 18:52 - 2013-09-22 22:13 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:51 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-13 21:44 - 2013-07-31 16:17 - 17833472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 21:44 - 2013-07-31 15:42 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 21:44 - 2013-07-31 15:29 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 21:44 - 2013-07-31 15:20 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 21:44 - 2013-07-31 15:19 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 21:44 - 2013-07-31 15:18 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 15:17 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-13 21:44 - 2013-07-31 15:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 15:14 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 15:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 21:44 - 2013-07-31 15:13 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 15:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 15:08 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 15:05 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 21:44 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 21:44 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 21:44 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 21:44 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-09-13 21:44 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 21:44 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 10:55 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 10:55 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 10:55 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 10:55 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 10:55 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 10:55 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-08 18:12 - 2013-09-12 10:49 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
==================== One Month Modified Files and Folders =======
2013-09-30 19:54 - 2012-01-17 22:53 - 00000000 ____D C:\Users\Andrea\Documents\Outlook-Dateien
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:52 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-30 19:52 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-30 19:49 - 2013-09-30 19:47 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-09-30 19:47 - 2013-09-30 19:47 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-30 19:47 - 2013-09-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 19:47 - 2013-08-17 23:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:45 - 2013-01-08 22:58 - 00000436 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-09-30 19:44 - 2013-09-24 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-30 19:44 - 2013-09-24 21:31 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-30 19:44 - 2013-09-24 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-30 19:44 - 2013-09-24 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-30 19:44 - 2013-09-21 18:52 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-09-30 19:44 - 2013-09-21 18:52 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-09-30 19:44 - 2013-09-21 18:52 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-09-30 19:44 - 2012-04-09 19:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-30 19:43 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-30 19:43 - 2009-07-14 06:51 - 00101551 _____ C:\Windows\setupact.log
2013-09-30 19:41 - 2010-11-21 05:47 - 00923358 _____ C:\Windows\PFRO.log
2013-09-30 19:40 - 2011-09-23 01:41 - 01358161 _____ C:\Windows\WindowsUpdate.log
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-30 19:31 - 2012-04-09 19:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-30 19:28 - 2011-12-24 18:13 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5717C4F9-34CC-4C33-A5BA-AE8FA455B99B}
2013-09-30 19:24 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-29 22:05 - 2012-05-02 20:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-09-29 08:20 - 00001068 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-29 01:51 - 2012-12-19 20:57 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAndrea
2013-09-29 01:51 - 2012-12-19 20:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForAndrea.job
2013-09-28 23:15 - 2012-01-21 20:05 - 00000000 ____D C:\Users\Andrea\AppData\Local\CrashDumps
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-28 22:42 - 2011-07-16 07:32 - 00654852 _____ C:\Windows\system32\perfh007.dat
2013-09-28 22:42 - 2011-07-16 07:32 - 00130434 _____ C:\Windows\system32\perfc007.dat
2013-09-28 22:42 - 2009-07-14 07:13 - 01500294 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-28 22:10 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:10 - 2013-09-26 21:10 - 00005661 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:57 - 2013-09-26 20:54 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:54 - 2013-09-26 20:54 - 01042066 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:36 - 2013-09-26 20:35 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 23:11 - 2013-09-25 21:56 - 00000000 ____D C:\Qoobox
2013-09-25 22:57 - 2009-07-14 04:34 - 00000285 _____ C:\Windows\system.ini
2013-09-25 22:28 - 2013-09-25 21:53 - 00000000 ____D C:\Windows\erdnt
2013-09-25 22:27 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-25 22:27 - 2013-09-21 18:51 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-25 22:27 - 2013-08-22 22:18 - 00000000 ____D C:\Program Files\Avira Secure Backup
2013-09-25 21:50 - 2013-09-25 21:52 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:52 - 2013-09-24 21:53 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:49 - 2011-12-24 18:04 - 00000000 ____D C:\Users\Andrea
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:43 - 2013-09-24 21:41 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:36 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 21:22 - 2012-01-28 13:06 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\MAGIX
2013-09-24 21:22 - 2012-01-28 13:04 - 00000000 ____D C:\ProgramData\MAGIX
2013-09-24 19:46 - 2013-09-23 11:29 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-24 13:13 - 2012-01-09 21:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-09-24 13:12 - 2012-01-16 21:58 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:30 - 2013-09-22 22:29 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:16 - 2013-07-08 22:36 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-22 22:13 - 2013-09-21 18:52 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:52 - 2011-12-24 18:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Google
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-21 01:05 - 2012-05-02 20:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-21 01:05 - 2012-05-02 20:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-21 01:05 - 2011-07-15 22:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 11:46 - 2011-12-31 19:15 - 00018432 _____ C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-20 11:34 - 2013-07-08 23:42 - 00000000 ___RD C:\Users\Andrea\Dropbox
2013-09-16 23:25 - 2012-01-17 23:14 - 00000000 ____D C:\Users\Andrea\Documents\Kreditkarte
2013-09-16 22:45 - 2012-12-02 21:20 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForANDREA-HP$
2013-09-16 22:45 - 2012-12-02 21:20 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForANDREA-HP$.job
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 13:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 13:19 - 2009-07-14 06:45 - 00430360 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 09:43 - 2011-12-25 17:06 - 01527912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-13 09:43 - 2011-12-25 17:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-13 09:42 - 2013-08-19 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 09:40 - 2012-01-03 20:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 09:40 - 2011-12-31 02:16 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 10:49 - 2013-09-08 18:12 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
2013-09-05 22:44 - 2013-08-08 22:42 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-21 19:34
==================== End Of Log ============================
--- --- --- Ich muss sagen, das sieht jetzt alles schon wieder viel besser aus, keine Werbeeinblendungen nichts  Die Neuinstallation von Firefox erfolgte über den Internet Explorer. So richtig rund läuft der aber auch nicht. Ich denke es spricht nichts dagegen, wenn ich den jetzt auch entferne? Ich hatte mir ja auch noch den Spyhunter runtergeladen. Wie bekomme ich den wieder los? Ist es ausreichend ihn ganz normal zu deinstallieren? Ich habe dann in der Systemsteuerung mal nachgeschaut, was sich bei meinen installierten Programmen noch so findet bzw. was alles so mit dem Download des HDvid Codec noch so neu aufgetaucht ist. Der HDvid Codec ist vom Desktop verschwunden, bei den Programmen findet er sich aber noch, genaue Bezeichnung: HDvid Codec V1, Herausgeber installdaddy. Dann finden sich noch folgende Programme mit aktuellem Download-Datum, mit denen ich nichts anfangen kann: LyriXeeker-1 von Lyrics und VCC media-player 2.0.7 von VideoLAN Auf dem Desktop habe ich noch: Continue Image Editor Installation - Auch da weiß ich nicht worum es sich handelt. LG Lady PS: Cooler Typ  Geändert von Lady1 (30.09.2013 um 19:28 Uhr) |
|
01.10.2013, 16:07
| #14 | |
| /// the machine /// TB-Ausbilder | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Software mit Revo Uninstaller deinstallieren Downloade Dir bitte den Revo Uninstaller
Starte den Rechner neu auf. Setze folgendermassen den Internet Explorer zurück:
Dann bitte ein frisches FRST log. Noch Probleme? Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.10.2013, 18:03
| #15 | |
| | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben Hi Schrauber, leider keine guten Nachrichten. Habe gerade eben das Notebook hochgefahren und alle Probleme sind wieder da  Habe jetzt nur ein neues FRST-Log gemacht und wollte Dir erst berichten, bevor ich die anderen Schritte durchführe. Soll ich die trotzdem so machen? FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013 02
Ran by Andrea (administrator) on ANDREA-HP on 01-10-2013 18:58:26
Running from C:\Users\Andrea\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
() C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\sysWow64\SearchProtocolHost.exe
(Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [Wisdom-soft ScreenHunter 6.0 Free] - 0
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2013-08-10] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Avira Secure Backup] - "C:\Program Files\Avira Secure Backup\Avira Secure Backup.exe" /delayed
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [ACPW05DE] - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe [822384 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\qttask.exe [77824 2013-03-14] (Apple Computer, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\vs7tooal.default
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\vs7tooal.default\Extensions\763ab44b-71df-436c-906e-2ee8e1d7b302@af951efb-381e-47b2-ac45-80df41e44bc7.com
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (LyriXeeker-1) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig\1.24.10_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Avira Secure Backup Crawler; C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe [4121960 2013-06-24] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-07-17] (Enigma Software Group USA, LLC.)
==================== Drivers (Whitelisted) ====================
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-08-06] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-08-06] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 cdrbsdrv; No ImagePath
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-01 18:48 - 2013-10-01 18:48 - 98609570 _____ C:\Windows\SysWOW64\Ⓟ줠«
2013-09-30 19:54 - 2013-09-30 19:54 - 00055104 _____ C:\Users\Andrea\Desktop\FRST 30.09.2013.txt
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:47 - 2013-09-30 19:49 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-09-30 19:47 - 2013-09-30 19:47 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-30 19:47 - 2013-09-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-09-29 08:20 - 00001068 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:10 - 2013-09-26 21:10 - 00005661 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:54 - 2013-09-26 20:57 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:54 - 2013-09-26 20:54 - 01042066 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-26 20:35 - 2013-09-26 20:36 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 21:58 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-25 21:58 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-25 21:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-25 21:56 - 2013-09-25 23:11 - 00000000 ____D C:\Qoobox
2013-09-25 21:53 - 2013-09-25 22:28 - 00000000 ____D C:\Windows\erdnt
2013-09-25 21:52 - 2013-09-25 21:50 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:41 - 2013-09-24 21:43 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-10-01 18:47 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-10-01 18:47 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-10-01 18:47 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-10-01 18:47 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:36 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-23 11:29 - 2013-09-24 19:46 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-21 18:52 - 2013-10-01 18:52 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-09-21 18:52 - 2013-10-01 18:52 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-09-21 18:52 - 2013-10-01 18:52 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-09-21 18:52 - 2013-09-22 22:13 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:51 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-13 21:44 - 2013-07-31 16:17 - 17833472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 21:44 - 2013-07-31 15:42 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 21:44 - 2013-07-31 15:29 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 21:44 - 2013-07-31 15:20 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 21:44 - 2013-07-31 15:19 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 21:44 - 2013-07-31 15:18 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 15:17 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-13 21:44 - 2013-07-31 15:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 15:14 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 15:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 21:44 - 2013-07-31 15:13 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 15:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 15:08 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 15:05 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 21:44 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 21:44 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 21:44 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 21:44 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-09-13 21:44 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 21:44 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 10:55 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 10:55 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 10:55 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 10:55 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 10:55 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 10:55 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-08 18:12 - 2013-09-12 10:49 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
==================== One Month Modified Files and Folders =======
2013-10-01 18:58 - 2012-01-17 22:53 - 00000000 ____D C:\Users\Andrea\Documents\Outlook-Dateien
2013-10-01 18:55 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-01 18:55 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-01 18:54 - 2011-09-23 01:41 - 01426926 _____ C:\Windows\WindowsUpdate.log
2013-10-01 18:52 - 2013-09-21 18:52 - 00001214 _____ C:\Windows\Tasks\HDvid Codec V1-updater.job
2013-10-01 18:52 - 2013-09-21 18:52 - 00001208 _____ C:\Windows\Tasks\HDvid Codec V1-codedownloader.job
2013-10-01 18:52 - 2013-09-21 18:52 - 00001118 _____ C:\Windows\Tasks\HDvid Codec V1-enabler.job
2013-10-01 18:50 - 2011-12-24 18:13 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5717C4F9-34CC-4C33-A5BA-AE8FA455B99B}
2013-10-01 18:48 - 2013-10-01 18:48 - 98609570 _____ C:\Windows\SysWOW64\Ⓟ줠«
2013-10-01 18:47 - 2013-09-24 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-10-01 18:47 - 2013-09-24 21:31 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-10-01 18:47 - 2013-09-24 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-10-01 18:47 - 2013-09-24 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-10-01 18:47 - 2013-01-08 22:58 - 00000437 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-01 18:47 - 2012-04-09 19:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-01 18:46 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-01 18:46 - 2009-07-14 06:51 - 00101607 _____ C:\Windows\setupact.log
2013-09-30 20:31 - 2012-04-09 19:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-30 20:05 - 2012-05-02 20:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-30 19:54 - 2013-09-30 19:54 - 00055104 _____ C:\Users\Andrea\Desktop\FRST 30.09.2013.txt
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:49 - 2013-09-30 19:47 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-09-30 19:47 - 2013-09-30 19:47 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-30 19:47 - 2013-09-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 19:47 - 2013-08-17 23:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:41 - 2010-11-21 05:47 - 00923358 _____ C:\Windows\PFRO.log
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-30 19:24 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-09-29 08:20 - 00001068 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-29 01:51 - 2012-12-19 20:57 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAndrea
2013-09-29 01:51 - 2012-12-19 20:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForAndrea.job
2013-09-28 23:15 - 2012-01-21 20:05 - 00000000 ____D C:\Users\Andrea\AppData\Local\CrashDumps
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-28 22:42 - 2011-07-16 07:32 - 00654852 _____ C:\Windows\system32\perfh007.dat
2013-09-28 22:42 - 2011-07-16 07:32 - 00130434 _____ C:\Windows\system32\perfc007.dat
2013-09-28 22:42 - 2009-07-14 07:13 - 01500294 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-28 22:10 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:10 - 2013-09-26 21:10 - 00005661 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:57 - 2013-09-26 20:54 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:54 - 2013-09-26 20:54 - 01042066 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:36 - 2013-09-26 20:35 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 23:11 - 2013-09-25 21:56 - 00000000 ____D C:\Qoobox
2013-09-25 22:57 - 2009-07-14 04:34 - 00000285 _____ C:\Windows\system.ini
2013-09-25 22:28 - 2013-09-25 21:53 - 00000000 ____D C:\Windows\erdnt
2013-09-25 22:27 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-25 22:27 - 2013-09-21 18:51 - 00000000 ____D C:\Program Files (x86)\HDvid Codec V1
2013-09-25 22:27 - 2013-08-22 22:18 - 00000000 ____D C:\Program Files\Avira Secure Backup
2013-09-25 21:50 - 2013-09-25 21:52 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:52 - 2013-09-24 21:53 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:49 - 2011-12-24 18:04 - 00000000 ____D C:\Users\Andrea
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:43 - 2013-09-24 21:41 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:36 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 21:22 - 2012-01-28 13:06 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\MAGIX
2013-09-24 21:22 - 2012-01-28 13:04 - 00000000 ____D C:\ProgramData\MAGIX
2013-09-24 19:46 - 2013-09-23 11:29 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-24 13:13 - 2012-01-09 21:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-09-24 13:12 - 2012-01-16 21:58 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:30 - 2013-09-22 22:29 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:16 - 2013-07-08 22:36 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-22 22:13 - 2013-09-21 18:52 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2013-09-21 18:52 - 00004244 _____ C:\Windows\System32\Tasks\HDvid Codec V1-updater
2013-09-21 18:52 - 2013-09-21 18:52 - 00004238 _____ C:\Windows\System32\Tasks\HDvid Codec V1-codedownloader
2013-09-21 18:52 - 2013-09-21 18:52 - 00004148 _____ C:\Windows\System32\Tasks\HDvid Codec V1-enabler
2013-09-21 18:52 - 2011-12-24 18:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Google
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-21 01:05 - 2012-05-02 20:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-21 01:05 - 2012-05-02 20:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-21 01:05 - 2011-07-15 22:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 11:46 - 2011-12-31 19:15 - 00018432 _____ C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-20 11:34 - 2013-07-08 23:42 - 00000000 ___RD C:\Users\Andrea\Dropbox
2013-09-16 23:25 - 2012-01-17 23:14 - 00000000 ____D C:\Users\Andrea\Documents\Kreditkarte
2013-09-16 22:45 - 2012-12-02 21:20 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForANDREA-HP$
2013-09-16 22:45 - 2012-12-02 21:20 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForANDREA-HP$.job
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 13:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 13:19 - 2009-07-14 06:45 - 00430360 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 09:43 - 2011-12-25 17:06 - 01527912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-13 09:43 - 2011-12-25 17:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-13 09:42 - 2013-08-19 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 09:40 - 2012-01-03 20:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 09:40 - 2011-12-31 02:16 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 10:49 - 2013-09-08 18:12 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
2013-09-05 22:44 - 2013-08-08 22:42 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-21 19:34
==================== End Of Log ============================
LG Lady Zitat:
 Geändert von Lady1 (01.10.2013 um 18:10 Uhr) |
|
| Themen zu Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben |
| adobe, adware/agent.lb, adware/installcore.gen, avira searchfree toolbar, branding, computer, continue, defender, desktop, esgscanner.sys, excel, farbar, farbar recovery scan tool, firefox, flash player, homepage, html/rce.gen3, icreinstall, iexplore.exe, launch, malware, mozilla, mp3, msiinstaller, nach download, newtab, olympus, plug-in, popup, programm, realtek, registry, richtlinie, software, virus, wajam, wildtangent games, windows, zahlung |
Linear-Darstellung
