| |
| |||||||
Log-Analyse und Auswertung: Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
27.09.2013, 16:57
| #1 |
| |  Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen Hallo, hab keine Ahnung, bin nur User, aber es ist ein Trojaner drauf, der ständig Programme versucht zu öffnen... Hab jetzt auf Anraten eines Spezies aus der Ferne euer Forum besucht und genutzt- d.h. die Programme defogger u.s.w ausgeführt und die log-files gespeichert anbei also diese hier, bitte findet heraus, wie man das wieder losbekommt tausend Dank Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:24 on 27/09/2013 (Petra)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
SPTD -> Disabled
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013
Ran by Petra (administrator) on PETRAPC on 27-09-2013 17:25:41
Running from C:\Users\Petra\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Safe Mode (with Networking)
==================== Processes (Whitelisted) =================
(QIP) C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8067616 2013-05-18] (Realtek Semiconductor)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
HKCU\...\Run: [Infium] - C:\Program Files (x86)\QIP 2012 Jeak-Edition\qip.exe [7318992 2011-12-28] (QIP)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SSDMonitor] - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [105120 2012-08-21] (PC Tools)
HKLM-x32\...\Run: [Iminent] - C:\Program Files (x86)\Iminent\Iminent.exe [1074736 2013-09-10] (Iminent)
HKLM-x32\...\Run: [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe [884784 2013-09-10] (Iminent)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [1300256 2013-09-17] (Conduit)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll c:\progra~3\bitguard\261673~1.238\{c16c1~1\bitguard.dll [2700768 2013-09-10] ()
Startup: C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.golsearch.com/?babsrc=HP_ss_Btisdt6&mntrId=5053BC5FF413E132&affID=119357&tsp=5017
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282270
URLSearchHook: (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197641
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197644&type=default&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197644&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197644&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197644&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=3E4C8CCD-C0E5-4EA8-8D2E-0969BD4E1AE2&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B&q={searchTerms}
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.golsearch.com/?q={searchTerms}&babsrc=SP_ss_Btisdt6&mntrId=5053BC5FF413E132&affID=119357&tsp=5017
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380282271&type=default&q={searchTerms}
SearchScopes: HKCU - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=3E4C8CCD-C0E5-4EA8-8D2E-0969BD4E1AE2&ref=toolbox&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Plus-HD-2.3 - {11111111-1111-1111-1111-110311341126} - C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-bho.dll (Plus HD)
BHO-x32: iminent Helper Object - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - C:\Program Files (x86)\IminentToolbar\1.8.25.0\bh\iminent.dll (Iminent)
BHO-x32: WebConnect - {2316c625-b487-4410-a1a5-ff040b65245f} - C:\Program Files (x86)\WebConnect\WebConnectbho.dll (Web Connect)
BHO-x32: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Iminent.WebBooster.InternetExplorer.dll (Iminent)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll (Delta-search.com)
BHO-x32: BonanzaDeals - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll (BonanzaDeals)
Toolbar: HKLM-x32 - Iminent Toolbar - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminentTlbr.dll (Iminent)
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll (Delta-search.com)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default
FF user.js: detected! => C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\user.js
FF NewTab: hxxp://start.iminent.com/?ref=NewTab&appId=3E4C8CCD-C0E5-4EA8-8D2E-0969BD4E1AE2
FF DefaultSearchEngine: delta-homes
FF SearchEngineOrder.1: qvo6
FF SelectedSearchEngine: delta-homes
FF Homepage: hxxp://search.conduit.com/?ctid=CT3314932&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP7836C6A9-B298-4FE3-9AEE-AE38E3EB475B
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\searchplugins\iminent.xml
FF Extension: No Name - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\7125a285-7e68-47aa-9d72-e81874f4d47e@d3fcdb92-135d-4a8a-8cf6-11e3b57c5fda.com
FF Extension: Delta Toolbar - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\ffxtlbr@delta.com
FF Extension: Iminent Toolbar - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\ffxtlbr@iminent.com
FF Extension: WebConnect - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox@webconnect.co
FF Extension: BonanzaDeals - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
FF Extension: firefox-hotfix - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox-hotfix@mozilla.org.xpi
FF Extension: firefox - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\firefox@webconnect.co.xpi
FF Extension: webbooster - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\1pumh4hu.default\Extensions\webbooster@iminent.com.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Programme\Mozilla Firefox\firefox.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=SamsungXSSDX840XSeries_S19HNEAD308713J&ts=1380197641
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: () - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo\1.1.5.2
CHR Extension: (Plus-HD-2.3) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Petra\AppData\Roaming\BabSolution\CR\Delta.crx
CHR HKLM-x32\...\Chrome\Extension: [ieadcoanfjloocmfafkebdnfefmohngj] - C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - \User Data\Default\Extensions\newtab.crx
CHR HKLM-x32\...\Chrome\Extension: [pkhojieggfgllhllcegoffdcnmdeojgb] - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminent.crx
==================== Services (Whitelisted) =================
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-20] (Just Develop It)
S2 BitGuard; C:\ProgramData\BitGuard\2.6.1673.238\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [2845152 2013-09-10] ()
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-09-26] (BonanzaDeals)
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-09-26] (BonanzaDeals)
S2 Brother XP spl Service; C:\Windows\SysWOW64\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
S2 CltMngSvc; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [1752352 2013-09-17] (Conduit)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
S2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [794272 2012-08-21] (PC Tools)
S2 SProtection; C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe [2868544 2013-08-07] (Iminent)
S2 Update WebConnect; C:\Program Files (x86)\WebConnect\updateWebConnect.exe [206632 2013-08-30] (WebConnect)
S2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [480376 2013-09-26] (Wsys Co., Ltd.)
==================== Drivers (Whitelisted) ====================
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-05-18] (Duplex Secure Ltd.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:19 - 2013-09-27 17:20 - 01953854 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 17:03 - 2013-09-27 17:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\eUpdate
2013-09-27 16:55 - 2013-09-27 16:56 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 21:09 - 2013-09-26 21:09 - 00000000 ____D C:\Windows\SysWOW64\SearchProtect
2013-09-26 15:18 - 2013-09-27 09:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-26 15:18 - 2013-09-27 09:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-27 17:09 - 00000000 ____D C:\ProgramData\eSafe
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:14 - 2013-09-26 14:13 - 00715038 _____ C:\Windows\unins000.exe
2013-09-26 14:14 - 2011-05-30 15:42 - 00255488 _____ C:\Windows\system32\xvidvfw.dll
2013-09-26 14:14 - 2011-05-30 15:42 - 00240640 _____ C:\Windows\SysWOW64\xvidvfw.dll
2013-09-26 14:14 - 2011-05-23 11:52 - 00153088 _____ C:\Windows\SysWOW64\xvid.ax
2013-09-26 14:14 - 2011-05-23 09:49 - 00173568 _____ C:\Windows\system32\xvid.ax
2013-09-26 14:14 - 2011-05-23 09:46 - 00645632 _____ C:\Windows\SysWOW64\xvidcore.dll
2013-09-26 14:14 - 2011-05-23 09:45 - 00696832 _____ C:\Windows\system32\xvidcore.dll
2013-09-26 14:13 - 2013-09-26 14:13 - 00000000 ____D C:\Program Files (x86)\WebConnect
2013-09-26 14:09 - 2013-09-27 17:08 - 00001198 _____ C:\Windows\Tasks\Plus-HD-2.3-codedownloader.job
2013-09-26 14:09 - 2013-09-27 17:08 - 00001194 _____ C:\Windows\Tasks\Plus-HD-2.3-updater.job
2013-09-26 14:09 - 2013-09-27 17:08 - 00001098 _____ C:\Windows\Tasks\Plus-HD-2.3-enabler.job
2013-09-26 14:09 - 2013-09-26 14:09 - 00004228 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-codedownloader
2013-09-26 14:09 - 2013-09-26 14:09 - 00004224 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-updater
2013-09-26 14:09 - 2013-09-26 14:09 - 00004128 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-enabler
2013-09-26 14:08 - 2013-09-27 17:04 - 00003118 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-26 14:08 - 2013-09-26 14:16 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:08 - 2013-09-26 14:08 - 00001201 _____ C:\Users\Public\Desktop\Advanced System Protector.lnk
2013-09-26 14:08 - 2013-09-26 14:08 - 00000000 ____D C:\ProgramData\Systweak
2013-09-26 14:08 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\Advanced System Protector
2013-09-26 14:08 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2013-09-26 14:07 - 2013-09-27 17:08 - 00001906 _____ C:\Windows\Tasks\Plus-HD-2.3-chromeinstaller.job
2013-09-26 14:07 - 2013-09-27 17:08 - 00001830 _____ C:\Windows\Tasks\Plus-HD-2.3-firefoxinstaller.job
2013-09-26 14:07 - 2013-09-27 17:08 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-26 14:07 - 2013-09-27 17:04 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-26 14:07 - 2013-09-27 16:12 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-26 14:07 - 2013-09-27 15:02 - 00000276 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-09-26 14:07 - 2013-09-27 08:28 - 00000284 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-09-26 14:07 - 2013-09-26 14:16 - 00000000 ____D C:\ProgramData\DivX
2013-09-26 14:07 - 2013-09-26 14:14 - 00003434 _____ C:\Windows\unins000.dat
2013-09-26 14:07 - 2013-09-26 14:14 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-26 14:07 - 2013-09-26 14:14 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-26 14:07 - 2013-09-26 14:14 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-26 14:07 - 2013-09-26 14:14 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-26 14:07 - 2013-09-26 14:09 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.3
2013-09-26 14:07 - 2013-09-26 14:08 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Systweak
2013-09-26 14:07 - 2013-09-26 14:07 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-09-26 14:07 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-09-26 14:07 - 00003386 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-26 14:07 - 2013-09-26 14:07 - 00003024 _____ C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2013-09-26 14:07 - 2013-09-26 14:07 - 00002868 _____ C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2013-09-26 14:07 - 2013-09-26 14:07 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-26 14:07 - 2013-09-26 14:07 - 00001050 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\BabSolution
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\BitGuard
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\RegClean Pro
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-26 14:07 - 2013-07-22 16:07 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2013-09-26 14:07 - 2012-02-26 16:47 - 00079360 _____ C:\Windows\SysWOW64\ff_vfw.dll
2013-09-26 14:07 - 2012-01-09 20:45 - 00178688 _____ C:\Windows\SysWOW64\unrar.dll
2013-09-26 14:07 - 2011-12-07 19:37 - 00148992 _____ ( ) C:\Windows\system32\lagarith.dll
2013-09-26 14:07 - 2011-12-07 19:32 - 00216064 _____ ( ) C:\Windows\SysWOW64\lagarith.dll
2013-09-26 14:06 - 2013-09-26 14:06 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Babylon
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Local\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\ProgramData\Babylon
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-26 14:05 - 2013-09-27 16:18 - 00000292 _____ C:\Windows\Tasks\DigitalSite.job
2013-09-26 14:05 - 2013-09-26 14:18 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-26 14:05 - 2013-09-26 14:05 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DigitalSite
2013-09-26 14:04 - 2013-09-26 14:04 - 00678968 _____ C:\Users\Petra\Desktop\UltimateCodec.exe
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Iminent
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\ProgramData\Iminent
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Program Files (x86)\IminentToolbar
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Program Files (x86)\Iminent
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:01 - 2013-09-26 14:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-26 14:00 - 2013-09-26 14:00 - 00400736 _____ (Softonic ) C:\Users\Petra\Desktop\SoftonicDownloader_fuer_nw-docx-converter.exe
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 13:55 - 2013-09-27 16:56 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-23 10:20 - 2013-09-23 10:28 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-19 19:00 - 2013-09-26 20:18 - 00000418 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-19 17:04 - 2013-09-27 17:08 - 00000284 _____ C:\Windows\Tasks\RMAutoUpdate.job
2013-09-19 17:04 - 2013-09-26 20:18 - 00000284 _____ C:\Windows\Tasks\RMSchedule.job
2013-09-19 17:04 - 2013-09-19 17:04 - 00002860 _____ C:\Windows\System32\Tasks\RMSchedule
2013-09-19 17:04 - 2013-09-19 17:04 - 00002520 _____ C:\Windows\System32\Tasks\RMAutoUpdate
2013-09-19 17:04 - 2013-09-19 17:04 - 00001194 _____ C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
2013-09-19 17:04 - 2012-08-21 14:44 - 00513696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml.dll
2013-09-19 17:04 - 2012-08-21 14:44 - 00041632 _____ C:\Windows\system32\CleanMFT64.exe
2013-09-19 17:04 - 2008-09-17 21:17 - 00658432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2013-09-19 17:04 - 2008-04-02 15:54 - 01101824 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBox210.ocx
2013-09-19 17:04 - 2008-04-02 15:53 - 00880640 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBox10.ocx
2013-09-19 17:04 - 2008-04-02 15:53 - 00212992 _____ (Woodbury Associates Limited) C:\Windows\SysWOW64\UniBoxVB12.ocx
2013-09-19 17:03 - 2013-09-27 17:08 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-09-19 17:02 - 2013-09-26 21:09 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2013-09-19 17:02 - 2013-09-19 17:02 - 00000000 ____D C:\Users\Petra\AppData\Roaming\OpenCandy
2013-09-19 17:02 - 2013-09-19 17:02 - 00000000 ____D C:\Users\Petra\AppData\Local\SearchProtect
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-19 17:00 - 2013-09-26 14:08 - 00001087 _____ C:\Users\Petra\Desktop\MyPC Backup.lnk
2013-09-19 17:00 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-09-19 17:00 - 2013-09-19 17:00 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-09-19 17:00 - 2013-09-19 17:00 - 00000000 _____ C:\END
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-16 00:57 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-16 00:57 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-16 00:57 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-16 00:57 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-16 00:57 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-16 00:57 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-16 00:57 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-16 00:57 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-14 12:28 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-14 12:28 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-14 12:28 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-14 12:28 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-14 12:28 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-14 12:28 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-14 12:28 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-14 12:28 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-14 12:28 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-14 12:28 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-14 12:28 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-14 12:28 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-14 12:28 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-14 12:28 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-14 12:28 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-14 12:28 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
==================== One Month Modified Files and Folders =======
2013-09-27 17:25 - 2013-09-27 17:25 - 00000000 ____D C:\FRST
2013-09-27 17:24 - 2013-09-27 17:24 - 00000504 _____ C:\Users\Petra\Desktop\defogger_disable.log
2013-09-27 17:24 - 2013-09-27 17:24 - 00000020 _____ C:\Users\Petra\defogger_reenable
2013-09-27 17:24 - 2013-05-18 21:42 - 00000000 ____D C:\Users\Petra
2013-09-27 17:20 - 2013-09-27 17:20 - 00377856 _____ C:\Users\Petra\Desktop\gmer_2.1.19163.exe
2013-09-27 17:20 - 2013-09-27 17:19 - 01953854 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2013-09-27 17:17 - 2013-09-27 17:17 - 00050477 _____ C:\Users\Petra\Desktop\Defogger.exe
2013-09-27 17:16 - 2011-04-12 09:43 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-09-27 17:16 - 2011-04-12 09:43 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-09-27 17:16 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-27 17:09 - 2013-09-26 14:14 - 00000000 ____D C:\ProgramData\eSafe
2013-09-27 17:08 - 2013-09-26 14:09 - 00001198 _____ C:\Windows\Tasks\Plus-HD-2.3-codedownloader.job
2013-09-27 17:08 - 2013-09-26 14:09 - 00001194 _____ C:\Windows\Tasks\Plus-HD-2.3-updater.job
2013-09-27 17:08 - 2013-09-26 14:09 - 00001098 _____ C:\Windows\Tasks\Plus-HD-2.3-enabler.job
2013-09-27 17:08 - 2013-09-26 14:07 - 00001906 _____ C:\Windows\Tasks\Plus-HD-2.3-chromeinstaller.job
2013-09-27 17:08 - 2013-09-26 14:07 - 00001830 _____ C:\Windows\Tasks\Plus-HD-2.3-firefoxinstaller.job
2013-09-27 17:08 - 2013-09-26 14:07 - 00000920 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2013-09-27 17:08 - 2013-09-19 17:04 - 00000284 _____ C:\Windows\Tasks\RMAutoUpdate.job
2013-09-27 17:08 - 2013-09-19 17:03 - 00000000 ____D C:\Program Files (x86)\PC Tools Registry Mechanic
2013-09-27 17:08 - 2013-05-21 15:22 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-27 17:08 - 2013-05-18 23:44 - 00000380 _____ C:\Windows\Tasks\QIPdater 2012.job
2013-09-27 17:08 - 2013-05-18 21:57 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-27 17:08 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-27 17:08 - 2009-07-14 06:51 - 00036594 _____ C:\Windows\setupact.log
2013-09-27 17:05 - 2013-05-18 23:37 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Skype
2013-09-27 17:04 - 2013-09-26 14:08 - 00003118 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-09-27 17:04 - 2013-09-26 14:07 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-09-27 17:03 - 2013-09-27 17:03 - 00000000 ____D C:\Users\Petra\AppData\Roaming\eUpdate
2013-09-27 16:57 - 2013-05-18 21:41 - 01618519 _____ C:\Windows\WindowsUpdate.log
2013-09-27 16:56 - 2013-09-27 16:55 - 00000000 ____D C:\Users\Petra\Desktop\studiveitsarah
2013-09-27 16:56 - 2013-09-23 13:55 - 00000000 ____D C:\Users\Petra\Desktop\Bachelorordner
2013-09-27 16:38 - 2013-05-18 22:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-27 16:33 - 2013-05-21 15:22 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-27 16:18 - 2013-09-26 14:05 - 00000292 _____ C:\Windows\Tasks\DigitalSite.job
2013-09-27 16:12 - 2013-09-26 14:07 - 00000924 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2013-09-27 15:02 - 2013-09-26 14:07 - 00000276 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-09-27 14:00 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-27 14:00 - 2009-07-14 06:45 - 00021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-27 09:39 - 2013-05-18 22:16 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8FB5B23C-B447-421A-B575-2FEED7F03542}
2013-09-27 09:18 - 2013-09-26 15:18 - 00000092 _____ C:\Users\Petra\AppData\Roaming\WB.CFG
2013-09-27 09:18 - 2013-09-26 15:18 - 00000005 _____ C:\Users\Petra\AppData\Roaming\WBPU-TTL.DAT
2013-09-27 08:37 - 2009-07-14 06:45 - 00307312 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-27 08:28 - 2013-09-26 14:07 - 00000284 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-09-27 08:28 - 2010-11-21 05:47 - 00007664 _____ C:\Windows\PFRO.log
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-27 00:32 - 2013-09-27 00:32 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-26 21:09 - 2013-09-26 21:09 - 00000000 ____D C:\Windows\SysWOW64\SearchProtect
2013-09-26 21:09 - 2013-09-19 17:02 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2013-09-26 20:18 - 2013-09-19 19:00 - 00000418 _____ C:\Windows\SysWOW64\AppLog.log
2013-09-26 20:18 - 2013-09-19 17:04 - 00000284 _____ C:\Windows\Tasks\RMSchedule.job
2013-09-26 14:55 - 2013-09-26 14:55 - 00004096 ____H C:\Users\Petra\AppData\Local\keyfile3.drm
2013-09-26 14:28 - 2013-05-18 22:02 - 00065552 _____ C:\Users\Petra\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-26 14:18 - 2013-09-26 14:05 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-09-26 14:16 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\DivX
2013-09-26 14:16 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\DivX
2013-09-26 14:16 - 2013-05-18 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-09-26 14:16 - 2013-05-18 22:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-26 14:15 - 2013-09-26 14:15 - 00000000 ____D C:\Program Files\DivX
2013-09-26 14:14 - 2013-09-26 14:14 - 00000000 ____D C:\User Data
2013-09-26 14:14 - 2013-09-26 14:07 - 00003434 _____ C:\Windows\unins000.dat
2013-09-26 14:14 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Xvid
2013-09-26 14:14 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-26 14:14 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\ffdshow
2013-09-26 14:14 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DirectVobSub
2013-09-26 14:14 - 2013-05-18 22:06 - 00001156 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-26 14:14 - 2013-05-18 21:42 - 00001727 _____ C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-26 14:13 - 2013-09-26 14:14 - 00715038 _____ C:\Windows\unins000.exe
2013-09-26 14:13 - 2013-09-26 14:13 - 00000000 ____D C:\Program Files (x86)\WebConnect
2013-09-26 14:09 - 2013-09-26 14:09 - 00004228 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-codedownloader
2013-09-26 14:09 - 2013-09-26 14:09 - 00004224 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-updater
2013-09-26 14:09 - 2013-09-26 14:09 - 00004128 _____ C:\Windows\System32\Tasks\Plus-HD-2.3-enabler
2013-09-26 14:09 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Plus-HD-2.3
2013-09-26 14:08 - 2013-09-26 14:08 - 00001201 _____ C:\Users\Public\Desktop\Advanced System Protector.lnk
2013-09-26 14:08 - 2013-09-26 14:08 - 00000000 ____D C:\ProgramData\Systweak
2013-09-26 14:08 - 2013-09-26 14:08 - 00000000 ____D C:\Program Files (x86)\Advanced System Protector
2013-09-26 14:08 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Systweak
2013-09-26 14:08 - 2013-09-19 17:00 - 00001087 _____ C:\Users\Petra\Desktop\MyPC Backup.lnk
2013-09-26 14:08 - 2013-09-19 17:00 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-09-26 14:07 - 2013-09-26 14:07 - 00003920 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA
2013-09-26 14:07 - 2013-09-26 14:07 - 00003668 _____ C:\Windows\System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore
2013-09-26 14:07 - 2013-09-26 14:07 - 00003386 _____ C:\Windows\System32\Tasks\EPUpdater
2013-09-26 14:07 - 2013-09-26 14:07 - 00003024 _____ C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2013-09-26 14:07 - 2013-09-26 14:07 - 00002868 _____ C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2013-09-26 14:07 - 2013-09-26 14:07 - 00001848 _____ C:\Users\Petra\Desktop\Search.lnk
2013-09-26 14:07 - 2013-09-26 14:07 - 00001050 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Haali Media Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\LavFilters
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\CDXReader
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\BabSolution
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Users\Petra\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\ProgramData\BitGuard
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\RegClean Pro
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\OpenSource Flash Video Splitter
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Haali
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\DSP-worx
2013-09-26 14:07 - 2013-09-26 14:07 - 00000000 ____D C:\Program Files (x86)\Delta
2013-09-26 14:06 - 2013-09-26 14:06 - 00003386 _____ C:\Windows\System32\Tasks\BonanzaDealsUpdate
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Babylon
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Users\Petra\AppData\Local\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\ProgramData\Babylon
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-09-26 14:06 - 2013-09-26 14:06 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-26 14:05 - 2013-09-26 14:05 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DigitalSite
2013-09-26 14:04 - 2013-09-26 14:04 - 00678968 _____ C:\Users\Petra\Desktop\UltimateCodec.exe
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\NwDocx
2013-09-26 14:03 - 2013-09-26 14:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Docx2Rtf
2013-09-26 14:02 - 2013-09-26 14:02 - 00000635 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Iminent
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\ProgramData\Iminent
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Program Files (x86)\IminentToolbar
2013-09-26 14:02 - 2013-09-26 14:02 - 00000000 ____D C:\Program Files (x86)\Iminent
2013-09-26 14:02 - 2013-05-21 15:22 - 00000000 ____D C:\Users\Petra\AppData\Local\Google
2013-09-26 14:00 - 2013-09-26 14:00 - 00400736 _____ (Softonic ) C:\Users\Petra\Desktop\SoftonicDownloader_fuer_nw-docx-converter.exe
2013-09-26 09:20 - 2013-05-20 12:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-26 09:20 - 2013-05-18 23:37 - 00000000 ____D C:\ProgramData\Skype
2013-09-25 17:47 - 2013-09-25 17:47 - 00001084 _____ C:\Musik - Verknüpfung.lnk
2013-09-23 10:28 - 2013-09-23 10:20 - 00000000 ____D C:\Users\Petra\Documents\Fax
2013-09-23 10:20 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-09-22 18:38 - 2013-05-18 22:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-22 18:38 - 2013-05-18 22:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-22 18:38 - 2013-05-18 22:20 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-19 17:04 - 2013-09-19 17:04 - 00002860 _____ C:\Windows\System32\Tasks\RMSchedule
2013-09-19 17:04 - 2013-09-19 17:04 - 00002520 _____ C:\Windows\System32\Tasks\RMAutoUpdate
2013-09-19 17:04 - 2013-09-19 17:04 - 00001194 _____ C:\Users\Public\Desktop\PC Tools Registry Mechanic.lnk
2013-09-19 17:02 - 2013-09-19 17:02 - 00000000 ____D C:\Users\Petra\AppData\Roaming\OpenCandy
2013-09-19 17:02 - 2013-09-19 17:02 - 00000000 ____D C:\Users\Petra\AppData\Local\SearchProtect
2013-09-19 17:01 - 2013-09-19 17:01 - 00001103 _____ C:\Users\Petra\Desktop\Screenshot Captor.lnk
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Windows\SysWOW64\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000058 _____ C:\Users\Petra\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\Documents\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Users\Petra\AppData\Roaming\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\ProgramData\DonationCoder
2013-09-19 17:01 - 2013-09-19 17:01 - 00000000 ____D C:\Program Files (x86)\ScreenshotCaptor
2013-09-19 17:00 - 2013-09-19 17:00 - 00000000 ____D C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-09-19 17:00 - 2013-09-19 17:00 - 00000000 _____ C:\END
2013-09-19 17:00 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-18 22:08 - 2013-09-18 22:08 - 00094208 _____ (DivX, Inc.) C:\Windows\SysWOW64\dpl100.dll
2013-09-15 03:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-15 03:23 - 2013-05-18 21:42 - 00000000 ___RD C:\Users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-15 03:06 - 2013-08-14 18:52 - 00000000 ____D C:\Windows\system32\MRT
2013-09-15 03:05 - 2013-05-18 22:27 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-03 14:10 - 2013-08-04 11:52 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-09-02 09:18 - 2013-09-02 09:18 - 214423597 _____ C:\Windows\MEMORY.DMP
2013-09-02 09:18 - 2013-09-02 09:18 - 00290728 _____ C:\Windows\Minidump\090213-9609-01.dmp
2013-09-02 09:18 - 2013-09-02 09:18 - 00000000 ____D C:\Windows\Minidump
2013-08-29 13:21 - 2013-08-26 12:27 - 00101386 _____ C:\Users\Petra\Desktop\Ausgabe1.spv
2013-08-29 13:20 - 2013-08-26 12:07 - 00000000 ____D C:\Users\Petra\Dokumente
Some content of TEMP:
====================
C:\Users\Petra\AppData\Local\Temp\BackupSetup.exe
C:\Users\Petra\AppData\Local\Temp\Gw2.exe
C:\Users\Petra\AppData\Local\Temp\IminentSetup-1-.exe
C:\Users\Petra\AppData\Local\Temp\nsl888.exe
C:\Users\Petra\AppData\Local\Temp\nspBAA5.exe
C:\Users\Petra\AppData\Local\Temp\nswB38.exe
C:\Users\Petra\AppData\Local\Temp\nsyB823.exe
C:\Users\Petra\AppData\Local\Temp\nvStInst.exe
C:\Users\Petra\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Petra\AppData\Local\Temp\SPSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-22 18:53
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-09-2013
Ran by Petra at 2013-09-27 17:26:17
Running from C:\Users\Petra\Desktop
Boot Mode: Safe Mode (with Networking)
==========================================================
==================== Security Center ========================
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
Adobe AIR (x32 Version: 3.7.0.1860)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.175)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Advanced System Protector (x32 Version: 2.1.1000.10905)
Ashampoo Burning Studio 2010 Advanced (x32 Version: 9.2.4)
BitGuard (x32)
Bonanza Deals (remove only) (x32 Version: 5.0.1.0)
Brother MFL-Pro Suite DCP-315CN (x32 Version: 1.0.1.0)
Cheat Engine 6.3 (x32)
Codec Pack Packages (HKCU)
Content Manager 2 (x32 Version: 2.0.4.59)
DC-Bass Source 1.3.0 (x32)
Delta Chrome Toolbar (x32)
Delta toolbar (x32 Version: 1.8.24.6)
DirectVobSub 2.40.4209 (x32 Version: 2.40.4209)
DivX-Setup (x32 Version: 2.6.1.8)
Dropbox (HKCU Version: 2.0.22)
EasyBCD 2.1 (x32 Version: 2.1)
Europa Universalis IV (x32)
ffdshow v1.1.4399 [2012-03-22] (x32 Version: 1.1.4399.0)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
Guild Wars 2 (x32)
Haali Media Splitter (x32)
Iminent (x32 Version: 6.37.21.0)
Iminent Toolbar on IE and Chrome (x32 Version: 1.8.25.0)
IrfanView (remove only) (x32 Version: 4.32)
Java 7 Update 9 (64-bit) (Version: 7.0.90)
Lagarith Lossless Codec (1.3.27) (x32)
LAME v3.99.3 (for Windows) (x32)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0)
Microsoft Security Client (Version: 4.3.0215.0)
Microsoft Security Essentials (Version: 4.3.215.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (x32 Version: 11.0.51106.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106)
Mozilla Firefox 18.0.1 (x86 de) (x32 Version: 18.0.1)
Mozilla Maintenance Service (x32 Version: 18.0.1)
Mozilla Thunderbird 11.0.1 (x86 de) (x32 Version: 11.0.1)
MyPC Backup (Version: )
Naviextras Toolbox Prerequesities (x32 Version: 1.0.0)
NVIDIA 3D Vision Controller-Treiber 314.07 (Version: 314.07)
NVIDIA 3D Vision Treiber 314.07 (Version: 314.07)
NVIDIA Grafiktreiber 314.07 (Version: 314.07)
NVIDIA Install Application (Version: 2.1002.109.706)
NVIDIA PhysX (x32 Version: 9.12.1031)
NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1407)
NVIDIA Systemsteuerung 314.07 (Version: 314.07)
NVIDIA Update 1.12.12 (Version: 1.12.12)
NVIDIA Update Components (Version: 1.12.12)
OpenSource Flash Video Splitter 1.0.0.5 (x32 Version: 1.0.0.5)
Opera 12.16 (x32 Version: 12.16.1860)
PASW Statistics 18 (x32 Version: 18.0.0)
PC Tools Registry Mechanic 11.1 (x32 Version: 11.1)
Plus-HD-2.3 (x32 Version: 1.27.153.8)
QIP 2012 7058 Jeak-Edition (x32 Version: 4.0.7058)
Realtek Ethernet Controller Driver (x32 Version: 1.00.0008)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5919)
RegClean Pro (x32 Version: 6.21)
Screenshot Captor 3.08.01 (x32)
Search Protect (x32 Version: 2.7.10.19)
Skype™ 6.7 (x32 Version: 6.7.102)
Steam (x32 Version: 1.0.0.0)
TeamSpeak 3 Client (Version: 3.0.11.1)
Update for Codec Pack (HKCU)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
VLC media player 2.0.6 (Version: 2.0.6)
WebConnect 3.0.0 (Version: 3.0.0)
WinRAR 4.00 (64-Bit) (Version: 4.00.0)
Xvid Video Codec (x32 Version: 1.3.2)
==================== Restore Points =========================
26-08-2013 10:01:31 Installed PASW Statistics 18.
26-08-2013 10:22:05 Installed PASW Statistics 18.
27-08-2013 08:32:01 Windows Update
27-08-2013 10:53:19 Windows Update
02-09-2013 07:30:16 Windows Update
14-09-2013 10:23:45 Windows Update
15-09-2013 01:00:23 Windows Update
15-09-2013 22:57:32 Windows Update
17-09-2013 08:49:55 Windows Update
22-09-2013 16:35:00 Windows Update
25-09-2013 18:31:26 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {050C6B2C-EF80-4048-A6FC-36DC16CB05BE} - System32\Tasks\Plus-HD-2.3-firefoxinstaller => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-firefoxinstaller.exe [2013-09-26] (Plus HD)
Task: {1B2F0B73-E099-4EC1-BA84-A4D425E67757} - System32\Tasks\Plus-HD-2.3-enabler => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-enabler.exe [2013-09-26] (Plus HD)
Task: {1D02E449-23BC-4B35-93E4-80DA6426F53D} - System32\Tasks\QIPdater 2012 => C:\Program Files (x86)\QIP 2012 Jeak-Edition\qipdater.exe [2012-01-02] (Caphyon LTD)
Task: {1E8AE278-3CF7-4946-9CB0-060EB4B6FD7B} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-09-26] (BonanzaDeals)
Task: {3CAF173B-B976-4A86-B0FA-89080A5249B4} - System32\Tasks\User_Feed_Synchronization-{8FB5B23C-B447-421A-B575-2FEED7F03542} => C:\Windows\system32\msfeedssync.exe [2013-05-18] (Microsoft Corporation)
Task: {46E57ED1-6D31-4291-9905-0EFB823A4332} - System32\Tasks\RMSchedule => C:\Program Files (x86)\PC Tools Registry Mechanic\RegMech.exe [2012-08-21] (PC Tools)
Task: {4DC3F95D-5211-4614-9B2C-C105BEC1F1C7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-22] (Adobe Systems Incorporated)
Task: {5B29DF5E-3284-4D7B-9E37-0FAC216E895A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-21] (Google Inc.)
Task: {6ED464C5-ABF7-4E4F-B2A0-2C4CB4D3F5FF} - System32\Tasks\Plus-HD-2.3-updater => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-updater.exe [2013-09-26] (Plus HD)
Task: {7D945C31-1BC4-4DBB-A320-1E415A50C4E8} - System32\Tasks\Plus-HD-2.3-chromeinstaller => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-chromeinstaller.exe [2013-09-26] (Plus HD)
Task: {801D1F0C-8AF4-41EA-80F8-3E652E50CFDE} - System32\Tasks\EPUpdater => C:\Users\Petra\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-08-04] ()
Task: {864AB93C-027D-4DCF-853B-E0E9DF1ACCF3} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-09-26] (BonanzaDeals)
Task: {91EBA03B-ADF1-4247-890F-D98513F65FEC} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc)
Task: {A3BC11E4-92F1-464B-BB95-40937A6D2A08} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc)
Task: {AA11DCE1-5A66-4E33-B0E4-21133ED57E4F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-21] (Google Inc.)
Task: {C2F01A47-081D-4B38-B21B-FC782537701B} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe [2013-05-24] (Systweak)
Task: {C6873381-AFFB-4B43-88C4-A41B0A3C79DA} - System32\Tasks\BonanzaDealsUpdate => C:\Program
Task: {C7F06C02-37E0-48F8-AC96-5AF8A959C460} - System32\Tasks\Plus-HD-2.3-codedownloader => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-codedownloader.exe [2013-09-26] (Plus HD)
Task: {D1BEBF01-CFFE-4C23-A158-B0D5D0C8F57D} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc)
Task: {DA1D3ADB-EA03-4C5A-A891-5FA8802367BD} - System32\Tasks\RMAutoUpdate => C:\Program Files (x86)\PC Tools Registry Mechanic\SULauncher.exe [2012-08-21] (PC Tools)
Task: {DDCF17BA-309D-4568-9BEB-640674385D63} - System32\Tasks\DigitalSite => C:\Users\Petra\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe [2013-04-12] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe
Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\Petra\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-chromeinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-codedownloader.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-codedownloader.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-enabler.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-enabler.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-firefoxinstaller.exe
Task: C:\Windows\Tasks\Plus-HD-2.3-updater.job => C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-updater.exe
Task: C:\Windows\Tasks\QIPdater 2012.job => C:\Program Files (x86)\QIP 2012 Jeak-Edition\qipdater.exe
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: C:\Windows\Tasks\RMAutoUpdate.job => C:\Program Files (x86)\PC Tools Registry Mechanic\SULauncher.exe
Task: C:\Windows\Tasks\RMSchedule.job => C:\Program Files (x86)\PC Tools Registry Mechanic\RegMech.exe
==================== Loaded Modules (whitelisted) =============
2011-12-28 15:27 - 2011-12-28 15:27 - 02523600 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Protos\InfICQ\InfICQ.dll
2011-12-28 15:27 - 2011-12-28 15:27 - 01641424 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Protos\MRA\MRA.dll
2011-12-28 15:27 - 2011-12-28 15:27 - 00049104 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Protos\MRA\pics.dll
2011-12-28 15:27 - 2011-12-28 15:27 - 00958416 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Protos\Social\Social.dll
2011-12-28 15:27 - 2011-12-28 15:27 - 04659664 _____ () C:\Program Files (x86)\QIP 2012 Jeak-Edition\Core\voip.dll
2013-05-18 22:06 - 2013-01-16 22:09 - 03022232 _____ () C:\Programme\Mozilla Firefox\mozjs.dll
2013-09-14 14:08 - 2013-09-14 14:08 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
==================== Faulty Device Manager Devices =============
Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: sptd
Description: sptd
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: sptd
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/27/2013 05:12:37 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 05:10:54 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (09/27/2013 05:04:29 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 01:43:27 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 01:39:27 PM) (Source: Brother BrLog) (User: )
Description: CTLCN BrtCTLCN: [2013/09/27 13:39:27.268]: [00003308]: brccMCtl.exe: ErrorMessage.cpp (0241) : -------- error code is [0x03031f04].
Error: (09/27/2013 01:39:27 PM) (Source: Brother BrLog) (User: )
Description: CTLCN BrtCTLCN: [2013/09/27 13:39:27.234]: [00003308]: brccFCtl.dll: ### ERROR ### Scanning-Image Failed! lErrCode = 0x3031F04
Error: (09/27/2013 01:37:52 PM) (Source: Brother BrLog) (User: )
Description: TWN BrtTWN: [2013/09/27 13:37:52.028]: [00003308]: ##### TIME-OUT occurred! #####
Error: (09/27/2013 09:02:15 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 08:45:27 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: RegCleanPro.exe, Version: 6.21.65.2745, Zeitstempel: 0x51ed0b3b
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0xab0
Startzeit der fehlerhaften Anwendung: 0xRegCleanPro.exe0
Pfad der fehlerhaften Anwendung: RegCleanPro.exe1
Pfad des fehlerhaften Moduls: RegCleanPro.exe2
Berichtskennung: RegCleanPro.exe3
Error: (09/26/2013 03:55:44 PM) (Source: Application Hang) (User: )
Description: Programm WINWORD.EXE, Version 11.0.8406.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1374
Startzeit: 01cebab5d47ccea5
Endzeit: 6
Anwendungspfad: C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE
Berichts-ID: 5281055c-26b3-11e3-8f10-bc5ff413e132
System errors:
=============
Error: (09/27/2013 05:25:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:42 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:25:17 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (09/27/2013 05:22:24 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Microsoft Office Sessions:
=========================
Error: (09/27/2013 05:12:37 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 05:10:54 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Petra\Desktop\SoftonicDownloader_fuer_nw-docx-converter.exe
Error: (09/27/2013 05:04:29 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 01:43:27 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 01:39:27 PM) (Source: Brother BrLog)(User: )
Description: CTLCNBrtCTLCN: [2013/09/27 13:39:27.268]: [00003308]: brccMCtl.exe: ErrorMessage.cpp (0241) : -------- error code is [0x03031f04].
Error: (09/27/2013 01:39:27 PM) (Source: Brother BrLog)(User: )
Description: CTLCNBrtCTLCN: [2013/09/27 13:39:27.234]: [00003308]: brccFCtl.dll: ### ERROR ### Scanning-Image Failed! lErrCode = 0x3031F04
Error: (09/27/2013 01:37:52 PM) (Source: Brother BrLog)(User: )
Description: TWNBrtTWN: [2013/09/27 13:37:52.028]: [00003308]: ##### TIME-OUT occurred! #####
Error: (09/27/2013 09:02:15 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/27/2013 08:45:27 AM) (Source: Application Error)(User: )
Description: RegCleanPro.exe6.21.65.274551ed0b3bunknown0.0.0.000000000c000000500000000ab001cebb4c09611853C:\Program Files (x86)\RegClean Pro\RegCleanPro.exeunknown64121238-2740-11e3-b5ba-bc5ff413e132
Error: (09/26/2013 03:55:44 PM) (Source: Application Hang)(User: )
Description: WINWORD.EXE11.0.8406.0137401cebab5d47ccea56C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE5281055c-26b3-11e3-8f10-bc5ff413e132
==================== Memory info ===========================
Percentage of memory in use: 36%
Total physical RAM: 2047.3 MB
Available physical RAM: 1297.54 MB
Total Pagefile: 4094.61 MB
Available Pagefile: 3397.39 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.69 GB) (Free:41.56 GB) NTFS
Drive d: () (Fixed) (Total:232.88 GB) (Free:53.85 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: B79F6CE0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 233 GB) (Disk ID: 51235122)
Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-27 17:32:21
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T1L0-5 Samsung_SSD_840_Series rev.DXT07B0Q 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Petra\AppData\Local\Temp\uxldapob.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF6 0x31 0xAB 0x0D ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x40 0x01 0x05 0xC6 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xBC 0xB4 0x5E 0x5F ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF6 0x31 0xAB 0x0D ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x40 0x01 0x05 0xC6 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xBC 0xB4 0x5E 0x5F ...
---- EOF - GMER 2.1 ----
|
| Themen zu Windows 7 Trojaner hat "Advanced Systen Protector" installiert und versucht nun auf Webseiten umzuleiten und bietet Scanner zu kaufen |
| advanced system protector, bitguard, bonanzadeals, farbar, farbar recovery scan tool, minidump, newtab, plug-in, pup.bprotector, pup.optional.babsolution.a, pup.optional.babylon.a, pup.optional.bitguard.a, pup.optional.bprotector.a, pup.optional.browsefox.a, pup.optional.browserdefender.a, pup.optional.bundleinstaller.a, pup.optional.datamngr.a, pup.optional.delta, pup.optional.delta.a, pup.optional.digitalsite.a, pup.optional.dprotect.a, pup.optional.elex, pup.optional.elex.a, pup.optional.esafe.a, pup.optional.iminent, pup.optional.iminent.a, pup.optional.installcore.a, pup.optional.performersoft.a, pup.optional.qvo6.a, pup.optional.softonic, regclean, richtlinie, sprotection |
Baum-Darstellung