|
Log-Analyse und Auswertung: PC Performer - Zula Games: Laptop langsamWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
31.10.2013, 14:06 | #1 |
| PC Performer - Zula Games: Laptop langsam hab gerade den Laptop meiner (verzweifelten) Nachbarin unter meinen Fitichen und brauch Euere Hilfe! Sie hat sich anscheinend diverse Malware eingefangen (u.a PC Performer) Hier die ersten Logfiles UND DANKE SCHON MAL Defrogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 11:36 on 31/10/2013 (Gitte) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2013 Ran by Gitte (administrator) on GITTE-HP on 31-10-2013 11:37:36 Running from C:\Users\Gitte\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe (AMD) C:\Windows\system32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe (Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe (AMD) C:\Windows\system32\atieclxx.exe (HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe (HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (PerformerSoft LLC) C:\Program Files (x86)\PC Performer\PCPerformer.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe () C:\Program Files (x86)\USB Sharing\usbshare.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (McAfee, Inc.) C:\Program Files\McAfee.com\Agent\mcagent.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.) C:\Windows\system32\mfevtps.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe (McAfee, Inc.) C:\Program Files\McAfee\MAT\McPvTray.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-03-11] (IDT, Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-17] (Synaptics Incorporated) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKCU\...\Run: [Panda PDF Converter563705.exe] - "C:\Users\Gitte\AppData\Local\Temp\Panda PDF Converter563705.exe" /XML="C:\Users\Gitte\AppData\Local\Temp\9913.tmp" /STP=0:2 <===== ATTENTION HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation) HKCU\...\Run: [HP Officejet Pro 8600 (NET)] - C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.) HKCU\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe HKCU\...\Policies\system: [DisableLockWorkstation] 0 HKCU\...\Policies\system: [DisableChangePassword] 0 HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-02-15] (Hewlett-Packard Development Company L.P.) HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [318520 2011-01-27] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de) HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe HKLM-x32\...\Run: [Iminent] - C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C" HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-03-16] (EasyBits Software AS) AppInit_DLLs-x32: c:\progra~2\optimi~1\optpro~1.dll [ ] () Startup: C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=367120107A0886AC&affID=122706&tsp=5015 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com/?ptr=100&crg=3.1010000.10039&barid={398AD048-E8B4-11E2-BB55-082E5F81A7D5} StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM - {1BFA2E7D-697D-4755-AAB0-D63F34301B3E} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&ptr=100&q={searchTerms}&crg=3.1010000.10039&barid={398AD048-E8B4-11E2-BB55-082E5F81A7D5} SearchScopes: HKLM-x32 - {1BFA2E7D-697D-4755-AAB0-D63F34301B3E} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&ptr=100&q={searchTerms}&crg=3.1010000.10039&barid={398AD048-E8B4-11E2-BB55-082E5F81A7D5} SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=367120107A0886AC&affID=122706&tsp=5015 SearchScopes: HKCU - {1BFA2E7D-697D-4755-AAB0-D63F34301B3E} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = SearchScopes: HKCU - {8C06BF53-B69B-4789-B90E-1817067902D4} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=35BD237F-9E54-4AFC-A4A3-B605235DDBF2&apn_sauid=C35F2E85-CA70-4CC9-A110-8A7ADAD57F81 SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/?a=6PRdljBo3V&loc=skw&search={searchTerms} SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&ptr=100&q={searchTerms}&crg=3.1010000.10039&barid={398AD048-E8B4-11E2-BB55-082E5F81A7D5} SearchScopes: HKCU - ÛŸÆîZ§’2¹Þpv¨IÍá*X(Ž2s(ÛÎÀJºÔÓµ± vË°!×—(ä¼48иpatm6êo^Mp`Ëõ÷_i£w˜¾!„Áû†x¢8€ÙjÀÿþ*´Ñ;áa´[¦†8*º~RÙxœòÜ8'£-)x*ä* URL = BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: DealPly Shopping - {ae48ed75-5a56-4c5f-bbce-6f1ac3875f66} - C:\Program Files (x86)\DealPly\DealPlyIE.dll No File BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: PricePeep - {FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} - C:\Program Files (x86)\PricePeep\pricepeep.dll No File Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.) Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.) ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-09-02] (EasyBits Software Corp.) ShellExecuteHooks-x32: - UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No File [ ] Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968 FF user.js: detected! => C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\user.js FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll () FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL () FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=3 - C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd) FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=9 - C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll () FF SearchPlugin: C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\searchplugins\askcom.xml FF SearchPlugin: C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\searchplugins\MyStart Search.xml FF SearchPlugin: C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\searchplugins\SweetIM Search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: No Name - C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\Extensions\zulagames@ZulaGames.com FF Extension: DealPly Shopping - C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\Extensions\{906000a4-88d9-4d52-b209-7a772970d91f} FF Extension: FoxyDeal - C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\Extensions\{F58A62EB-38DC-43C4-A539-DC52E135208D} FF Extension: speedanalysis02 - C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\Extensions\speedanalysis02@SpeedAnalysis.com.xpi FF Extension: zulagames - C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\Extensions\zulagames@ZulaGames.com.xpi FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK Chrome: ======= CHR RestoreOnStartup: "hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=367120107A0886AC&affID=122706&tsp=5015" CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll No File CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Simple Pass 2011) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe\1.0_0\npwebsitelogon.dll (HP) CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File CHR Plugin: (WildTangent Games App Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll No File CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File CHR Plugin: (Default Plug-in) - default_plugin No File CHR Extension: () - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo\7.15.9.29524_0 CHR Extension: (Website Logon) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe\1.0_0 CHR Extension: (FoxyDeal) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiennapmieppnpfhhogglccgepbdajan\6.2.0_0 CHR Extension: (YouTube) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 CHR Extension: (Google Search) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: () - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_0 CHR Extension: () - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\gflandjopdloblmlcoiidmncpinmmacn\1.0.0.5 CHR Extension: (PricePeep) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb\2.2.0.2_0 CHR Extension: (Minibar ) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpcknfcdcgpffjddjeceioobdelceffo\2.0.1_0 CHR Extension: (DealPly Shopping) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf\3.5.0.0_0 CHR Extension: (Chrome In-App Payments service) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0 CHR Extension: (SweetPacks Chrome Extension) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj\1.4.0.4_0 CHR Extension: (Gmail) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 CHR Extension: (Lyrics-Pal) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnbbffeddnekkhjmokkhdebbfbibbflc\1.133_0 CHR HKLM-x32\...\Chrome\Extension: [aepeildmfnnehghlknddebgjghlompfe] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx CHR HKLM-x32\...\Chrome\Extension: [gflandjopdloblmlcoiidmncpinmmacn] - C:\Users\Gitte\AppData\Roaming\zulagames\zulagames.crx CHR HKLM-x32\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files (x86)\LyricsPal\125.crx ==================== Services (Whitelisted) ================= S2 dealplylive; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe [148000 2013-07-09] (DealPly Technologies Ltd) S3 dealplylivem; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe [148000 2013-07-09] (DealPly Technologies Ltd) R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 mcmscsvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 McNASvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.) R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [x] ==================== Drivers (Whitelisted) ==================== R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.) R0 McPvDrv; C:\Windows\System32\drivers\McPvDrv.sys [73096 2012-09-14] (McAfee, Inc.) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.) U3 mfeavfk01; No ImagePath R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.) S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-31 11:37 - 2013-10-31 11:37 - 01956614 _____ (Farbar) C:\Users\Gitte\Downloads\FRST64(1).exe 2013-10-31 11:36 - 2013-10-31 11:36 - 00000472 _____ C:\Users\Gitte\Downloads\defogger_disable.log 2013-10-31 11:36 - 2013-10-31 11:36 - 00000000 _____ C:\Users\Gitte\defogger_reenable 2013-10-31 11:35 - 2013-10-31 11:35 - 00050477 _____ C:\Users\Gitte\Downloads\Defogger.exe 2013-10-31 09:49 - 2013-10-31 09:49 - 00002793 _____ C:\Users\Gitte\Desktop\gmer.txt 2013-10-31 09:08 - 2013-10-31 09:08 - 00442624 _____ C:\Windows\Minidump\103113-20139-01.dmp 2013-10-30 20:03 - 2013-10-30 20:03 - 00377856 _____ C:\Users\Gitte\Downloads\08o5oq3g.exe 2013-10-30 20:00 - 2013-10-30 20:01 - 00026160 _____ C:\Users\Gitte\Downloads\Addition.txt 2013-10-30 19:58 - 2013-10-31 19:52 - 00000000 ____D C:\FRST 2013-10-30 19:58 - 2013-10-30 19:58 - 01956614 _____ (Farbar) C:\Users\Gitte\Downloads\FRST64.exe 2013-10-30 19:56 - 2013-10-30 19:56 - 00752096 _____ C:\Users\Gitte\Downloads\ZipExtractorSetup.exe 2013-10-30 19:54 - 2013-10-31 20:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-10-30 19:52 - 2013-10-31 20:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-10-30 19:52 - 2013-10-30 19:52 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-10-30 19:52 - 2013-10-30 19:52 - 00001147 _____ C:\ProgramData\Desktop\Mozilla Firefox.lnk 2013-10-30 19:52 - 2013-10-30 19:52 - 00000000 ____D C:\ProgramData\Mozilla 2013-10-30 13:52 - 2013-10-30 13:52 - 50053120 _____ C:\Program Files (x86)\GUTABC9.tmp 2013-10-30 13:52 - 2013-10-30 13:52 - 00000000 ____D C:\Program Files (x86)\GUMABC8.tmp 2013-10-02 09:48 - 2013-10-30 12:20 - 00000000 ____D C:\Program Files (x86)\Minibar 2013-10-02 09:48 - 2013-10-30 12:18 - 00000000 ____D C:\Users\Gitte\AppData\Local\WebPlayer 2013-10-02 09:48 - 2013-10-30 12:18 - 00000000 ____D C:\Users\Gitte\AppData\Local\Minibar 2013-10-02 09:48 - 2013-10-02 09:48 - 00002135 _____ C:\Users\Gitte\Desktop\FLV Player.lnk 2013-10-02 09:44 - 2013-10-30 11:31 - 00000000 ____D C:\ProgramData\Oracle 2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\ProgramData\Synaptics ==================== One Month Modified Files and Folders ======= 2013-10-31 20:11 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-10-31 20:11 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker 2013-10-31 20:11 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-10-31 20:11 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2013-10-31 20:11 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System 2013-10-31 20:09 - 2012-02-22 17:49 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform 2013-10-31 20:09 - 2011-12-09 11:35 - 00000000 ____D C:\Windows\system32\SRSLabs 2013-10-31 20:09 - 2011-09-03 00:00 - 00000000 ____D C:\Windows\System32\Tasks\Hewlett-Packard 2013-10-31 20:09 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore 2013-10-31 20:09 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD 2013-10-31 20:09 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\spp 2013-10-31 20:08 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz 2013-10-31 20:07 - 2012-09-11 21:52 - 00000000 ____D C:\Windows\Minidump 2013-10-31 20:07 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\Offline Web Pages 2013-10-31 20:07 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media 2013-10-31 20:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing 2013-10-31 20:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME 2013-10-31 20:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Cursors 2013-10-31 20:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Branding 2013-10-31 20:05 - 2013-09-24 23:00 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\zulagames 2013-10-31 20:05 - 2013-09-24 23:00 - 00000000 ____D C:\ProgramData\DSearchLink 2013-10-31 20:05 - 2013-07-11 19:54 - 00000000 ___SD C:\Users\Gitte\Documents\Meine Datenquellen 2013-10-31 20:05 - 2013-03-14 17:49 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-31 20:05 - 2013-02-21 16:16 - 00000000 __RSD C:\Users\Gitte\Documents\McAfee-Tresore 2013-10-31 20:05 - 2013-02-21 16:00 - 00000000 ____D C:\ProgramData\McAfee 2013-10-31 20:05 - 2012-03-01 17:47 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-31 20:05 - 2012-02-22 14:31 - 00000000 ___RD C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-10-31 20:05 - 2012-02-22 14:31 - 00000000 ___RD C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-10-31 20:05 - 2012-02-22 14:13 - 00000000 ___RD C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2013-10-31 20:05 - 2012-02-22 14:13 - 00000000 ___RD C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2013-10-31 20:05 - 2011-12-09 11:48 - 00000000 ____D C:\Program Files\Common Files\AuthenTec 2013-10-31 20:05 - 2011-12-09 11:34 - 00000000 ____D C:\Program Files\IDT 2013-10-31 20:05 - 2011-09-02 23:53 - 00000000 ____D C:\Program Files (x86)\Windows Live 2013-10-31 20:05 - 2011-03-16 20:10 - 00000000 ____D C:\Program Files\Hewlett-Packard 2013-10-31 20:05 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar 2013-10-31 20:05 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer 2013-10-31 20:05 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar 2013-10-31 20:05 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer 2013-10-31 20:05 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries 2013-10-31 20:05 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2013-10-31 20:04 - 2013-10-30 19:54 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-10-31 20:04 - 2013-10-30 19:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-10-31 20:04 - 2013-09-24 23:01 - 00000000 ____D C:\Program Files (x86)\PC Performer 2013-10-31 20:04 - 2013-07-10 13:56 - 00000000 ____D C:\Program Files (x86)\FOTOParadies 2013-10-31 20:04 - 2013-03-14 17:49 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-10-31 20:04 - 2013-02-21 16:16 - 00000000 ____D C:\Program Files (x86)\McAfee.com 2013-10-31 20:04 - 2013-01-31 15:03 - 00000000 ____D C:\Program Files (x86)\FreePDF_XP 2013-10-31 20:04 - 2012-03-04 14:55 - 00000000 ____D C:\Program Files (x86)\USB Sharing 2013-10-31 20:04 - 2012-02-22 17:49 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client 2013-10-31 20:04 - 2011-12-09 11:48 - 00000000 ____D C:\Program Files (x86)\HP SimplePass 2011 2013-10-31 20:04 - 2011-09-02 23:57 - 00000000 ____D C:\Program Files (x86)\EasyBits For Kids 2013-10-31 20:04 - 2011-09-02 23:46 - 00000000 ___RD C:\Program Files (x86)\Online Services 2013-10-31 20:04 - 2011-09-02 23:46 - 00000000 ____D C:\Program Files (x86)\HP Games 2013-10-31 20:04 - 2011-09-02 23:44 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard 2013-10-31 20:03 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration 2013-10-31 19:53 - 2013-02-21 16:15 - 00000000 ____D C:\Program Files (x86)\McAfee 2013-10-31 19:52 - 2013-10-30 19:58 - 00000000 ____D C:\FRST 2013-10-31 19:52 - 2011-09-02 23:56 - 00000000 ____D C:\Program Files (x86)\Adobe 2013-10-31 11:37 - 2013-10-31 11:37 - 01956614 _____ (Farbar) C:\Users\Gitte\Downloads\FRST64(1).exe 2013-10-31 11:37 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-31 11:37 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-31 11:36 - 2013-10-31 11:36 - 00000472 _____ C:\Users\Gitte\Downloads\defogger_disable.log 2013-10-31 11:36 - 2013-10-31 11:36 - 00000000 _____ C:\Users\Gitte\defogger_reenable 2013-10-31 11:36 - 2012-02-22 14:13 - 00000000 ____D C:\Users\Gitte 2013-10-31 11:35 - 2013-10-31 11:35 - 00050477 _____ C:\Users\Gitte\Downloads\Defogger.exe 2013-10-31 11:35 - 2011-09-03 09:22 - 00654852 _____ C:\Windows\system32\perfh007.dat 2013-10-31 11:35 - 2011-09-03 09:22 - 00130434 _____ C:\Windows\system32\perfc007.dat 2013-10-31 11:35 - 2009-07-14 06:13 - 01500294 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-31 11:29 - 2013-07-09 18:17 - 00000900 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job 2013-10-31 11:29 - 2012-03-06 15:24 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-10-31 11:28 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-31 11:28 - 2009-07-14 05:51 - 00089651 _____ C:\Windows\setupact.log 2013-10-31 09:49 - 2013-10-31 09:49 - 00002793 _____ C:\Users\Gitte\Desktop\gmer.txt 2013-10-31 09:18 - 2013-08-17 10:02 - 00000000 ____D C:\Windows\system32\MRT 2013-10-31 09:13 - 2011-12-09 11:35 - 01584326 _____ C:\Windows\WindowsUpdate.log 2013-10-31 09:08 - 2013-10-31 09:08 - 00442624 _____ C:\Windows\Minidump\103113-20139-01.dmp 2013-10-31 09:08 - 2012-09-11 21:52 - 708416620 _____ C:\Windows\MEMORY.DMP 2013-10-31 09:08 - 2010-11-21 04:47 - 00386760 _____ C:\Windows\PFRO.log 2013-10-30 20:22 - 2013-07-09 18:17 - 00000904 _____ C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job 2013-10-30 20:03 - 2013-10-30 20:03 - 00377856 _____ C:\Users\Gitte\Downloads\08o5oq3g.exe 2013-10-30 20:01 - 2013-10-30 20:00 - 00026160 _____ C:\Users\Gitte\Downloads\Addition.txt 2013-10-30 20:00 - 2012-03-30 16:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-10-30 19:58 - 2013-10-30 19:58 - 01956614 _____ (Farbar) C:\Users\Gitte\Downloads\FRST64.exe 2013-10-30 19:56 - 2013-10-30 19:56 - 00752096 _____ C:\Users\Gitte\Downloads\ZipExtractorSetup.exe 2013-10-30 19:55 - 2012-03-06 15:24 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-10-30 19:52 - 2013-10-30 19:52 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-10-30 19:52 - 2013-10-30 19:52 - 00001147 _____ C:\ProgramData\Desktop\Mozilla Firefox.lnk 2013-10-30 19:52 - 2013-10-30 19:52 - 00000000 ____D C:\ProgramData\Mozilla 2013-10-30 19:46 - 2013-07-23 14:01 - 00003118 _____ C:\Windows\System32\Tasks\PC Performer 2013-10-30 19:43 - 2013-07-09 17:58 - 00000284 _____ C:\Windows\Tasks\PC Performer_UPDATES.job 2013-10-30 19:43 - 2013-07-09 17:58 - 00000276 _____ C:\Windows\Tasks\PC Performer_DEFAULT.job 2013-10-30 19:42 - 2013-07-09 17:58 - 00003026 _____ C:\Windows\System32\Tasks\PC Performer_UPDATES 2013-10-30 19:42 - 2013-07-09 17:58 - 00002870 _____ C:\Windows\System32\Tasks\PC Performer_DEFAULT 2013-10-30 19:31 - 2011-09-02 23:56 - 00000000 ____D C:\ProgramData\Adobe 2013-10-30 18:50 - 2012-03-06 15:24 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-10-30 18:50 - 2012-03-06 15:24 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-10-30 17:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-10-30 17:35 - 2011-09-02 23:51 - 00000000 ____D C:\ProgramData\Hewlett-Packard 2013-10-30 14:16 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\WinBioPlugIns 2013-10-30 14:12 - 2013-07-09 18:17 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog 2013-10-30 14:12 - 2013-07-09 18:17 - 00000000 ____D C:\Program Files (x86)\Iminent 2013-10-30 14:07 - 2011-09-02 23:59 - 00000000 ____D C:\Program Files (x86)\Java 2013-10-30 14:04 - 2013-08-13 19:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-10-30 14:04 - 2012-02-22 17:40 - 00000000 ____D C:\Users\Gitte\AppData\Local\Thunderbird 2013-10-30 13:52 - 2013-10-30 13:52 - 50053120 _____ C:\Program Files (x86)\GUTABC9.tmp 2013-10-30 13:52 - 2013-10-30 13:52 - 00000000 ____D C:\Program Files (x86)\GUMABC8.tmp 2013-10-30 12:34 - 2012-03-30 16:51 - 00000000 ____D C:\Windows\system32\Macromed 2013-10-30 12:34 - 2011-09-02 23:45 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2013-10-30 12:34 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\WinBioDatabase 2013-10-30 12:34 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz 2013-10-30 12:33 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Dism 2013-10-30 12:30 - 2013-09-24 23:00 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\File Scout 2013-10-30 12:30 - 2013-07-10 13:57 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FOTOParadies 2013-10-30 12:30 - 2013-07-09 18:17 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly 2013-10-30 12:30 - 2013-07-09 17:58 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\PerformerSoft 2013-10-30 12:30 - 2012-09-06 16:36 - 00000000 ____D C:\Users\Gitte\Desktop\Alte Firefox-Daten 2013-10-30 12:30 - 2012-02-22 17:40 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\Thunderbird 2013-10-30 12:29 - 2013-06-17 22:44 - 00000000 ____D C:\ProgramData\Ashampoo 2013-10-30 12:29 - 2011-09-02 23:46 - 00000000 ____D C:\ProgramData\WildTangent 2013-10-30 12:29 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Portable Devices 2013-10-30 12:29 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2013-10-30 12:29 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2013-10-30 12:29 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2013-10-30 12:29 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2013-10-30 12:28 - 2011-09-02 23:57 - 00000000 ___RD C:\Program Files\Online Services 2013-10-30 12:28 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Services 2013-10-30 12:24 - 2012-03-21 17:59 - 00000000 ____D C:\104e4867ab004922c9 2013-10-30 12:20 - 2013-10-02 09:48 - 00000000 ____D C:\Program Files (x86)\Minibar 2013-10-30 12:20 - 2013-09-25 08:34 - 00000000 ____D C:\Program Files (x86)\MyPC Backup 2013-10-30 12:18 - 2013-10-02 09:48 - 00000000 ____D C:\Users\Gitte\AppData\Local\WebPlayer 2013-10-30 12:18 - 2013-10-02 09:48 - 00000000 ____D C:\Users\Gitte\AppData\Local\Minibar 2013-10-30 12:18 - 2011-12-09 21:24 - 00000000 ___RD C:\Users\Public\Recorded TV 2013-10-30 11:55 - 2012-02-22 17:31 - 00000000 ____D C:\Users\Gitte\AppData\Local\Mozilla 2013-10-30 11:44 - 2012-02-22 22:33 - 00000000 __RHD C:\MSOCache 2013-10-30 11:31 - 2013-10-02 09:44 - 00000000 ____D C:\ProgramData\Oracle 2013-10-29 16:41 - 2013-06-08 16:35 - 00000000 ____D C:\Users\Gitte\AppData\Local\CrashDumps 2013-10-29 16:27 - 2012-10-16 15:06 - 00000000 ____D C:\Users\Gitte\Documents\Alles-Ordner 2013-10-02 09:48 - 2013-10-02 09:48 - 00002135 _____ C:\Users\Gitte\Desktop\FLV Player.lnk 2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\ProgramData\Synaptics Some content of TEMP: ==================== C:\Users\Gitte\AppData\Local\Temp\8epgjtr_.dll C:\Users\Gitte\AppData\Local\Temp\APNStub.exe C:\Users\Gitte\AppData\Local\Temp\AskSLib.dll C:\Users\Gitte\AppData\Local\Temp\bundlesweetimsetup.exe C:\Users\Gitte\AppData\Local\Temp\dp.exe C:\Users\Gitte\AppData\Local\Temp\Extract.exe C:\Users\Gitte\AppData\Local\Temp\FLVPlayerUpdate_downloader_by_FLVPlayerUpdate.exe C:\Users\Gitte\AppData\Local\Temp\FoxyDeal.exe C:\Users\Gitte\AppData\Local\Temp\FoxyDeal_Setup.exe C:\Users\Gitte\AppData\Local\Temp\GenericUninstall.exe C:\Users\Gitte\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Gitte\AppData\Local\Temp\IminentSetup.exe C:\Users\Gitte\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\Gitte\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\Gitte\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\Gitte\AppData\Local\Temp\mgsqlite3.dll C:\Users\Gitte\AppData\Local\Temp\PCPerformerSetup.exe C:\Users\Gitte\AppData\Local\Temp\Resource.exe C:\Users\Gitte\AppData\Local\Temp\run.exe C:\Users\Gitte\AppData\Local\Temp\sk1likgh.dll C:\Users\Gitte\AppData\Local\Temp\sp54620.exe C:\Users\Gitte\AppData\Local\Temp\SP54630.exe C:\Users\Gitte\AppData\Local\Temp\SP54714.exe C:\Users\Gitte\AppData\Local\Temp\SP56221.exe C:\Users\Gitte\AppData\Local\Temp\SP56878.exe C:\Users\Gitte\AppData\Local\Temp\SP57232.exe C:\Users\Gitte\AppData\Local\Temp\sp58915.exe C:\Users\Gitte\AppData\Local\Temp\uninst1.exe C:\Users\Gitte\AppData\Local\Temp\uninstaller.exe C:\Users\Gitte\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Gitte\AppData\Local\Temp\UninstallHPTCA.exe C:\Users\Gitte\AppData\Local\Temp\UpdateCheckerSetup.exe C:\Users\Gitte\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-30 17:32 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-10-2013 Ran by Gitte at 2013-10-30 20:00:52 Running from C:\Users\Gitte\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892} AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9} ==================== Installed Programs ====================== Adobe Digital Editions 2.0 (x32 Version: 2.0) Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.175) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168) Adobe Shockwave Player 11.5 (x32 Version: 11.5.9.620) Agatha Christie - Peril at End House (x32 Version: 2.2.0.95) Ashampoo Photo Commander 9 v.9.4.3 (x32 Version: 9.4.3) ATI Catalyst Install Manager (Version: 3.0.816.0) AuthenTec TrueAPI (Version: 1.2.1.33) Bejeweled 2 Deluxe (x32 Version: 2.2.0.95) Big Rig Europe (x32 Version: 2.2.0.95) Blasterball 3 (x32 Version: 2.2.0.95) Bounce Symphony (x32 Version: 2.2.0.95) Broadcom 802.11 Wireless LAN Adapter (Version: 5.60.48.61) Cake Mania (x32 Version: 2.2.0.95) Catalyst Control Center - Branding (x32 Version: 1.00.0000) Catalyst Control Center (x32 Version: 2011.0508.224.2391) Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0508.224.2391) Catalyst Control Center InstallProxy (x32 Version: 2011.0508.224.2391) Catalyst Control Center Localization All (x32 Version: 2011.0508.224.2391) Catalyst Control Center Profiles Mobile (x32 Version: 2011.0508.224.2391) CCC Help Chinese Standard (x32 Version: 2011.0508.0223.2391) CCC Help Chinese Traditional (x32 Version: 2011.0508.0223.2391) CCC Help Czech (x32 Version: 2011.0508.0223.2391) CCC Help Danish (x32 Version: 2011.0508.0223.2391) CCC Help Dutch (x32 Version: 2011.0508.0223.2391) CCC Help English (x32 Version: 2011.0508.0223.2391) CCC Help Finnish (x32 Version: 2011.0508.0223.2391) CCC Help French (x32 Version: 2011.0508.0223.2391) CCC Help German (x32 Version: 2011.0508.0223.2391) CCC Help Greek (x32 Version: 2011.0508.0223.2391) CCC Help Hungarian (x32 Version: 2011.0508.0223.2391) CCC Help Italian (x32 Version: 2011.0508.0223.2391) CCC Help Japanese (x32 Version: 2011.0508.0223.2391) CCC Help Korean (x32 Version: 2011.0508.0223.2391) CCC Help Norwegian (x32 Version: 2011.0508.0223.2391) CCC Help Polish (x32 Version: 2011.0508.0223.2391) CCC Help Portuguese (x32 Version: 2011.0508.0223.2391) CCC Help Russian (x32 Version: 2011.0508.0223.2391) CCC Help Spanish (x32 Version: 2011.0508.0223.2391) CCC Help Swedish (x32 Version: 2011.0508.0223.2391) CCC Help Thai (x32 Version: 2011.0508.0223.2391) CCC Help Turkish (x32 Version: 2011.0508.0223.2391) ccc-utility64 (Version: 2011.0508.224.2391) Chuzzle Deluxe (x32 Version: 2.2.0.95) Crazy Chicken Kart 2 (x32 Version: 2.2.0.95) CyberLink YouCam (x32 Version: 3.5.1.3922) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95) ElsterFormular (x32 Version: 13.3.0.9066) Energy Star Digital Logo (x32 Version: 1.0.1) ESU for Microsoft Windows 7 (x32 Version: 1.0.0) Evernote v. 4.2.2 (x32 Version: 4.2.2.3979) Farm Frenzy (x32 Version: 2.2.0.95) FATE (x32 Version: 2.2.0.95) Fishdom (x32 Version: 2.2.0.95) FOTOParadies (x32 Version: 3.5.0.3) FreePDF (Remove only) (x32) Google Chrome (x32 Version: 29.0.1547.76) Google Earth (x32 Version: 7.1.1.1888) Google Update Helper (x32 Version: 1.3.21.165) GPL Ghostscript (x32 Version: 9.04) HP 3D DriveGuard (Version: 4.1.16.1) HP Auto (Version: 1.0.12935.3667) HP Client Services (Version: 1.1.12938.3539) HP Connection Manager (x32 Version: 4.0.45.1) HP Customer Experience Enhancements (x32 Version: 6.0.1.7) HP Documentation (x32 Version: 1.1.0.0) HP DVB-T TV Tuner 8.0.64.43 (x32 Version: 8.0.64.43) HP FWUpdateEDO2 (x32 Version: 1.2.0.0) HP Games (x32 Version: 1.0.2.4) HP Officejet Pro 8600 - Grundlegende Software für das Gerät (Version: 25.0.619.0) HP Officejet Pro 8600 Hilfe (x32 Version: 140.0.2.2) HP On Screen Display (x32 Version: 1.1.2) HP Power Manager (x32 Version: 1.2.3) HP Quick Launch (x32 Version: 2.3.6) HP Setup (x32 Version: 8.6.4530.3651) HP Setup Manager (x32 Version: 1.1.13253.3682) HP SimplePass 2011 (x32 Version: 5.1.0.495) HP Software Framework (x32 Version: 4.1.13.1) HP Update (x32 Version: 5.005.000.001) HPDiagnosticAlert (x32 Version: 1.00.0000) I.R.I.S. OCR (x32 Version: 12.3.4.0) IDT Audio (x32 Version: 1.0.6329.0) Intel(R) Display Audio Driver (x32 Version: 6.14.00.3074) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Jewel Quest Solitaire (x32 Version: 2.2.0.95) Junk Mail filter update (x32 Version: 15.4.3502.0922) Magic Desktop (x32 Version: 3.0) Mah Jong Medley (x32 Version: 2.2.0.95) McAfee Total Protection (x32 Version: 11.6.511) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Office 2010 Service Pack 1 (SP1) (x32) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000) Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.5128.5002) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Mozilla Firefox 19.0 (x86 de) (x32 Version: 19.0) Mozilla Firefox 25.0 (x86 de) (HKCU Version: 25.0) Mozilla Maintenance Service (x32 Version: 19.0) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) Mystery P.I. - The London Caper (x32 Version: 2.2.0.95) Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95) PC Performer (x32 Version: 11.10) Penguins! (x32 Version: 2.2.0.95) Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95) Polar Bowler (x32 Version: 2.2.0.95) ProfiSchafkopf (x32 Version: 1.0.10) PX Profile Update (x32 Version: 1.00.1.) Realtek Ethernet Controller Driver (x32 Version: 7.41.216.2011) Realtek PCIE Card Reader (x32 Version: 6.1.7600.74) Recovery Manager (x32 Version: 2.0.0) RedMon - Redirection Port Monitor Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0) Shared C Run-time for x64 (Version: 10.0.0) Slingo Deluxe (x32 Version: 2.2.0.95) Synaptics Pointing Device Driver (Version: 15.2.4.4) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2494150) (x32) Update for Microsoft Office 2010 (KB2553065) (x32) Update for Microsoft Office 2010 (KB2553157) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2566458) (x32) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589370) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760758) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32) Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32) Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32) Update Installer for WildTangent Games App (x32) USB Sharing (x32) Virtual Villagers - The Secret City (x32 Version: 2.2.0.95) Wedding Dash (x32 Version: 2.2.0.95) WildTangent Games App (HP Games) (x32 Version: 4.0.5.36) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3508.1109) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3508.1109) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Zuma Deluxe (x32 Version: 2.2.0.95) ==================== Restore Points ========================= 30-10-2013 18:30:19 Removed Adobe Reader X (10.1.7) MUI. ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {1C23437F-3C2D-49C8-9288-1FB366197106} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06] (Google Inc.) Task: {38E9E883-5D82-4119-841B-B5CB0CB2B11E} - System32\Tasks\PC Performer => C:\Program Files (x86)\PC Performer\PCPerformer.exe [2013-06-19] (PerformerSoft LLC) Task: {5AB7A3F5-C0BA-4170-ACC4-5AC1BDF4504D} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation) Task: {602BD713-5350-42A7-8C66-1DCC03242A4E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06] (Google Inc.) Task: {64A46F3D-30FE-48EF-A230-452CFE1AFCCA} - System32\Tasks\PC Performer_DEFAULT => C:\Program Files (x86)\PC Performer\PCPerformer.exe [2013-06-19] (PerformerSoft LLC) Task: {678CFABD-C896-4DEF-A8EC-7ABE97D00219} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {7936AB34-707A-4729-B1D2-03B4343B1173} - System32\Tasks\DealPlyLiveUpdateTaskMachineCore => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe [2013-07-09] (DealPly Technologies Ltd) Task: {902E1849-CA7F-447A-A69C-7120F99C1FF5} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-03-22] (CyberLink) Task: {93F4DB7A-0715-47AA-B848-FBBC753BE1B9} - System32\Tasks\SetupManager => C:\Program Files (x86)\Hewlett-Packard\Setup Manager\Toaster.exe [2011-03-03] (Microsoft) Task: {A8DA141D-82FA-429B-9A3F-7A9EE33C18A4} - System32\Tasks\DealPlyLiveUpdateTaskMachineUA => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe [2013-07-09] (DealPly Technologies Ltd) Task: {ADE798BE-8EDC-4FA1-AD2C-7301EE5B3455} - System32\Tasks\PC Performer_UPDATES => C:\Program Files (x86)\PC Performer\PCPerformer.exe [2013-06-19] (PerformerSoft LLC) Task: {DDEE29E4-7DDA-415A-9CB9-61C815A4964A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe Task: {E681F894-A68B-4687-B753-2F149828CBCB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-20] (Adobe Systems Incorporated) Task: {E6B2ED12-11F3-478C-BD8B-9400D3BDCEEA} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-01-31] () Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe Task: C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\PC Performer_DEFAULT.job => C:\Program Files (x86)\PC Performer\PCPerformer.exe Task: C:\Windows\Tasks\PC Performer_UPDATES.job => C:\Program Files (x86)\PC Performer\PCPerformer.exe ==================== Loaded Modules (whitelisted) ============= 2013-04-04 00:09 - 2013-04-04 00:09 - 04300432 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF 2011-12-09 11:32 - 2011-04-15 04:16 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2011-05-12 14:13 - 2011-05-12 14:13 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll 2011-05-08 02:23 - 2011-05-08 02:23 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2010-06-24 02:21 - 2010-06-24 02:21 - 01102336 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\System.Data.SQLite.dll 2010-06-24 02:19 - 2010-06-24 02:19 - 00514570 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\sqlite3.dll 2013-08-20 17:56 - 2013-08-20 17:56 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9ab0e818cb3d1b6930eba54179f89300\IsdiInterop.ni.dll 2011-12-09 11:31 - 2011-01-13 02:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll 2013-10-30 19:54 - 2013-10-30 19:54 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2013-04-04 00:09 - 2013-04-04 00:09 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2013-09-11 15:00 - 2013-09-11 15:00 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver" ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/30/2013 07:43:53 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 02:31:13 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 02:01:02 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 01:58:03 PM) (Source: ATIeRecord) (User: ) Description: ATI EEU failed to post message to CCC Error: (10/30/2013 01:48:30 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 01:46:25 PM) (Source: ATIeRecord) (User: ) Description: ATI EEU failed to post message to CCC Error: (10/30/2013 11:51:31 AM) (Source: CVHSVC) (User: ) Description: Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error: (10/30/2013 11:43:40 AM) (Source: McLogEvent) (User: NT-AUTORITÄT) Description: MCSCAN32 Engine Initialisation failed. Engine returned error : 3 Error: (10/30/2013 11:41:46 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 11:41:16 AM) (Source: McLogEvent) (User: NT-AUTORITÄT) Description: MCSCAN32 Engine Initialisation failed. Engine returned error : 3 System errors: ============= Error: (10/30/2013 07:46:02 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/30/2013 07:10:04 PM) (Source: volsnap) (User: ) Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error: (10/30/2013 02:33:23 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/30/2013 02:08:08 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error: (10/30/2013 02:08:07 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error: (10/30/2013 02:08:06 PM) (Source: Disk) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error: (10/30/2013 02:02:56 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/30/2013 01:51:06 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/30/2013 01:35:29 PM) (Source: DCOM) (User: ) Description: {995C996E-D918-4A8C-A302-45719A6F4EA7} Error: (10/30/2013 11:43:38 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Microsoft Office Sessions: ========================= Error: (10/30/2013 07:43:53 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 02:31:13 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 02:01:02 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 01:58:03 PM) (Source: ATIeRecord)(User: ) Description: Error: (10/30/2013 01:48:30 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 01:46:25 PM) (Source: ATIeRecord)(User: ) Description: Error: (10/30/2013 11:51:31 AM) (Source: CVHSVC)(User: ) Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error: (10/30/2013 11:43:40 AM) (Source: McLogEvent)(User: NT-AUTORITÄT) Description: 3 Error: (10/30/2013 11:41:46 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/30/2013 11:41:16 AM) (Source: McLogEvent)(User: NT-AUTORITÄT) Description: 3 ==================== Memory info =========================== Percentage of memory in use: 26% Total physical RAM: 8139.86 MB Available physical RAM: 6002.89 MB Total Pagefile: 16277.9 MB Available Pagefile: 13344.19 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:680.46 GB) (Free:623 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (RECOVERY) (Fixed) (Total:17.88 GB) (Free:1.92 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 527073E8) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=680 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=18 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=103 MB) - (Type=0C) ==================== End Of Log ============================ GMER Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net Rootkit scan 2013-10-31 13:04:31 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JE4O 698,64GB Running: 08o5oq3g.exe; Driver: C:\Users\Gitte\AppData\Local\Temp\ugtiqpow.sys ---- Threads - GMER 2.1 ---- Thread C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2900:1068] 00000000746acf23 Thread C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2900:1260] 00000000746acf23 Thread C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2900:1320] 00000000746acf23 Thread C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2900:1660] 00000000746acf23 Thread C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2900:708] 00000000746acf23 Thread C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2900:712] 00000000746ae697 Thread C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2900:2324] 00000000746acf23 Thread C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2900:3200] 00000000746acf23 Thread C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2900:3204] 00000000746acf23 Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [4016:4028] 00000000779f3e85 Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [4016:4032] 00000000755b7587 Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [4016:4064] 00000000779f2e65 Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [4352:4600] 000000006ed26358 Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [4352:4628] 000000006ea2f71d Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [4352:4636] 000000006ea2f71d Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [4352:4640] 000000006ea25b1a Thread C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [4352:5232] 000000006ecd0b14 ---- EOF - GMER 2.1 ---- Gruß franz |
31.10.2013, 17:14 | #2 |
/// TB-Ausbilder | PC Performer - Zula Games: Laptop langsamMein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Schritt 1 Downloade Dir bitte AdwCleaner auf deinen Desktop.
Schritt 2 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 3 Downloade Dir bitte Malwarebytes Anti-Malware
Bitte poste mit deiner nächsten Antwort
|
31.10.2013, 17:59 | #3 |
| PC Performer - Zula Games: Laptop langsam Danke Matthias für Deine Hilfe!!!!
__________________hier die Logfiles ADWCleaner Code:
ATTFilter # AdwCleaner v3.010 - Bericht erstellt am 31/10/2013 um 16:23:17 # Updated 20/10/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Gitte - GITTE-HP # Gestartet von : C:\Users\Gitte\Downloads\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** [#] Dienst Gelöscht : dealplylive [#] Dienst Gelöscht : dealplylivem ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\Ask Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\ProgramData\DealPlyLive Ordner Gelöscht : C:\ProgramData\DSearchLink Ordner Gelöscht : C:\ProgramData\IBUpdaterService Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Performer Ordner Gelöscht : C:\Program Files (x86)\DealPlyLive Ordner Gelöscht : C:\Program Files (x86)\Iminent Ordner Gelöscht : C:\Program Files (x86)\Minibar Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup Ordner Gelöscht : C:\Program Files (x86)\PC Performer Ordner Gelöscht : C:\Users\Gitte\AppData\Local\DealPlyLive Ordner Gelöscht : C:\Users\Gitte\AppData\Local\Minibar Ordner Gelöscht : C:\Users\Gitte\AppData\Local\Temp\Iminent Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\Babylon Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\DealPly Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\file scout Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\optimizer pro Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\PerformerSoft Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\SpeedAnalysis2 Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\Systweak Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\zulagames Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly Ordner Gelöscht : C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\Extensions\{906000A4-88D9-4D52-B209-7A772970D91F} Ordner Gelöscht : C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo Ordner Gelöscht : C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiennapmieppnpfhhogglccgepbdajan Ordner Gelöscht : C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\gflandjopdloblmlcoiidmncpinmmacn Ordner Gelöscht : C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb Ordner Gelöscht : C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf Ordner Gelöscht : C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj Ordner Gelöscht : C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnbbffeddnekkhjmokkhdebbfbibbflc Datei Gelöscht : C:\Users\Public\Desktop\PC Performer.lnk Datei Gelöscht : C:\Windows\System32\roboot64.exe Datei Gelöscht : C:\Users\Gitte\AppData\Roaming\speedanalysis.ico Datei Gelöscht : C:\Users\Gitte\Desktop\SpeedAnalysis.lnk Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\defaults\pref\all-iminent.js Datei Gelöscht : C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\foxydeal.sqlite Datei Gelöscht : C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\invalidprefs.js Datei Gelöscht : C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\searchplugins\Askcom.xml Datei Gelöscht : C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\searchplugins\MyStart Search.xml Datei Gelöscht : C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\searchplugins\SweetIM Search.xml Datei Gelöscht : C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\user.js Datei Gelöscht : C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage Datei Gelöscht : C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore Datei Gelöscht : C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA Datei Gelöscht : C:\Windows\Tasks\PC Performer_DEFAULT.job Datei Gelöscht : C:\Windows\System32\Tasks\PC Performer_DEFAULT Datei Gelöscht : C:\Windows\Tasks\PC Performer_UPDATES.job Datei Gelöscht : C:\Windows\System32\Tasks\PC Performer_UPDATES ***** [ Verknüpfungen ] ***** Verknüpfung Desinfiziert : C:\Users\Gitte\Desktop\Search.lnk ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\gflandjopdloblmlcoiidmncpinmmacn Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Optimizer Pro] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\dealplylive.exe Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\PricePeep.DLL Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickCtrl.9 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.Update3WebControl.3 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.coreclass Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachine Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclasssvc.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc.1.0 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PricePeep.PricePeepBho Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PricePeep.PricePeepBho.1 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Lyrics_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Lyrics_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dealplylive.exe Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Iminent] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [IminentMessenger] Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3 Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9 Schlüssel Gelöscht : HKLM\SOFTWARE\580d9d8b03ce541 Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0D89DE71-3D99-4288-84DC-F18F1047A7D8} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7F1796B2-BEC6-427B-B734-F9C75ED94A80} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8B218A5F-1A3D-4347-94EF-A79575EB8094} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{18DBB6CE-3148-4FEC-B481-103CB3290427} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A9337080-7CBF-4E3E-80C1-3867BEDD88E0} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Schlüssel Gelöscht : HKCU\Software\BabSolution Schlüssel Gelöscht : HKCU\Software\BI Schlüssel Gelöscht : HKCU\Software\DataMngr [#] Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar Schlüssel Gelöscht : HKCU\Software\DealPly Schlüssel Gelöscht : HKCU\Software\DealPlyLive Schlüssel Gelöscht : HKCU\Software\Delta Schlüssel Gelöscht : HKCU\Software\FoxyDeal Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\Iminent Schlüssel Gelöscht : HKCU\Software\ImInstaller Schlüssel Gelöscht : HKCU\Software\Optimizer Pro Schlüssel Gelöscht : HKCU\Software\PerformerSoft Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F} Schlüssel Gelöscht : HKCU\Software\AppDataLow\FoxyDeal Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\lyricspal Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\smartbar Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F} Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C} Schlüssel Gelöscht : HKLM\Software\DataMngr Schlüssel Gelöscht : HKLM\Software\DealPly Schlüssel Gelöscht : HKLM\Software\DealPlyLive Schlüssel Gelöscht : HKLM\Software\Delta Schlüssel Gelöscht : HKLM\Software\Iminent Schlüssel Gelöscht : HKLM\Software\PerformerSoft Schlüssel Gelöscht : HKLM\Software\systweak Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Performer_is1 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP ***** [ Browser ] ***** -\\ Internet Explorer v9.0.8112.16506 Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] -\\ Mozilla Firefox v19.0 (de) [ Datei : C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\prefs.js ] Zeile gelöscht : user_pref("extensions.delta.admin", false); Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst"); Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}"); Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false"); Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de"); Zeile gelöscht : user_pref("extensions.delta.excTlbr", false); Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true); Zeile gelöscht : user_pref("extensions.delta.id", "3671409000000000000020107a0886ac"); Zeile gelöscht : user_pref("extensions.delta.instlDay", "15972"); Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst"); Zeile gelöscht : user_pref("extensions.delta.newTab", false); Zeile gelöscht : user_pref("extensions.delta.prdct", "delta"); Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta"); Zeile gelöscht : user_pref("extensions.delta.rvrt", "false"); Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none"); Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base"); Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", ""); Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6"); Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.60:01:01"); Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6"); Zeile gelöscht : user_pref("extensions.delta_i.babExt", ""); Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=122706&tsp=5015"); Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss"); Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.SOFTONICREFRESHRATE", "140000"); Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.SOFTONICREFRESHRATE", "140000"); -\\ Google Chrome v30.0.1599.101 [ Datei : C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\preferences ] Gelöscht : urls_to_restore_on_startup ************************* AdwCleaner[R0].txt - [29428 octets] - [31/10/2013 16:21:11] AdwCleaner[S0].txt - [27319 octets] - [31/10/2013 16:23:17] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [27380 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.7 (10.15.2013:3) OS: Windows 7 Home Premium x64 Ran by Gitte on 31.10.2013 at 16:30:59,84 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-606896283-656086263-2595788825-1000\Software\SweetIM Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\optimizerpro_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\optimizerpro_rasmancs Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\optprostart_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\optprostart_rasmancs Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_130001_0101_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\pricepeep_130001_0101_RASMANCS Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_130001_0101_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\pricepeep_130001_0101_RASMANCS Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{1BFA2E7D-697D-4755-AAB0-D63F34301B3E} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{8C06BF53-B69B-4789-B90E-1817067902D4} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{1BFA2E7D-697D-4755-AAB0-D63F34301B3E} ~~~ Files Successfully deleted: [File] "C:\Users\Gitte\appdata\local\google\chrome\user data\default\local storage\http_de.iminent.com_0.localstorage" Successfully deleted: [File] "C:\Users\Gitte\appdata\local\google\chrome\user data\default\local storage\http_de.iminent.com_0.localstorage-journal" Successfully deleted: [File] "C:\Users\Gitte\appdata\locallow\SkwConfig.bin" Successfully deleted: [File] C:\Windows\syswow64\sho20C9.tmp Successfully deleted: [File] C:\Windows\syswow64\shoF372.tmp ~~~ Folders Successfully deleted: [Folder] "C:\Users\Gitte\appdata\local\webplayer" Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{0135116F-5774-4473-ACD8-3656D7AD6630} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{0AFCD915-357C-4F61-BD3E-3384324B441E} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{156D4717-951C-4A67-B5C3-24AD98A17EBA} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{1A4DB22A-AED1-44BC-9F33-B179675142FF} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{2099390F-A1C9-4BE9-B577-3504404A429D} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{2609C1E5-A697-4C7B-86CB-7F847726484B} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{2CF81157-FD3E-4452-A520-81F43BD3EB0D} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{2EE374A5-0C56-4930-9E13-39F49ED603A3} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{3173547F-C79A-4319-BEF5-4F9BFAF44C58} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{3F7DF24C-5ACE-4D5F-BE28-18BD054ACA7D} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{4C8B05B9-25EF-42D0-AB40-7F3AAC50AD82} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{6A6B2B4E-A8C3-470C-87B1-AC01B3A643E2} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{757BD4A7-EA11-4480-8B42-81200D30C431} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{7E4A248C-E9FB-40BD-A5EC-F48ECDEE2AF3} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{8A8CABB3-5FC8-4AD2-968C-5457F955E689} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{8F99EFCD-B6A5-4134-81FA-AB02C2AC906E} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{9109F028-D487-423B-98AC-9DA30930BE3E} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{967E2AB7-89E3-423D-914F-7B9FD13AE598} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{9B41A3E8-6661-41D9-83B2-0D66E0763995} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{9E77B5BB-70FA-4C27-872F-F6CFAA84ECC8} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{B0C1C9C5-67F1-435A-A492-E8921182BB75} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{CBA4E336-2BFD-4605-BF80-4FFE3DDC2350} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{D4479594-E5EA-4200-91DF-1BD65E3A882F} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{D5D80546-BAF6-4E99-A54C-776E2F55C2D2} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{D7C011D3-BE6A-45BC-82D6-82358C0BAC76} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{DB61A7E7-807A-4F22-B36D-BCFEA3E92623} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{ED9E605C-F423-4E82-BFAC-35AC7A596B36} Successfully deleted: [Empty Folder] C:\Users\Gitte\appdata\local\{F8221E3F-9B8F-4E8A-80B8-1C9D1AF3DD28} ~~~ FireFox Successfully deleted: [Folder] C:\Users\Gitte\AppData\Roaming\mozilla\firefox\profiles\kmdq1sb8.default-1346945777968\extensions\zulagames@zulagames.com Successfully deleted the following from C:\Users\Gitte\AppData\Roaming\mozilla\firefox\profiles\kmdq1sb8.default-1346945777968\prefs.js user_pref("iminent.LayoutId", "1"); user_pref("iminent.ShowThankyouPixel", "0"); user_pref("iminent.displayFavLinks", "1"); user_pref("iminent.registerToolbarEvent102", "1380033173785"); user_pref("iminent.registerToolbarEvent140", "1377781863191"); user_pref("iminent.version", "7.36.1.1"); user_pref("iminent.versioning", "{\"CurrentVersion\":\"6.27.3.1\",\"InstallEventCTime\":1376932209584,\"InstallEvent\":\"True\",\"UpdateEventCTime\":1380060055361}"); user_pref("iminent.webbooster.scripts.minibar.FavLinkSplitTestingClass", "v2"); user_pref("iminent.webbooster.scripts.minibar.LayoutId", "1"); user_pref("iminent.webbooster.scripts.minibar.ROOTEXTENSION", "chrome://iminentwebbooster/content/minibar"); user_pref("iminent.webbooster.scripts.minibar.Services.BHPCode", "01"); user_pref("iminent.webbooster.scripts.minibar.Services.DefaultEvent", "000"); user_pref("iminent.webbooster.scripts.minibar.Services.DefaultWebSite", "000"); user_pref("iminent.webbooster.scripts.minibar.Services.IminentClientCode", "11"); user_pref("iminent.webbooster.scripts.minibar.Services.SmartFavCode", "02"); user_pref("iminent.webbooster.scripts.minibar.ShowThankyouPixel", "0"); user_pref("iminent.webbooster.scripts.minibar.displayFavLinks", "1"); user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent101", "1374951684875"); user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent102", "1376557747726"); user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent134", "1376033112423"); user_pref("iminent.webbooster.scripts.sslminibar.LayoutId", "1"); user_pref("iminent.webbooster.scripts.sslminibar.ROOTEXTENSION", "chrome://iminentwebbooster/content/minibar"); user_pref("iminent.webbooster.scripts.sslminibar.Services.BHPCode", "01"); user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultEvent", "000"); user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultWebSite", "000"); user_pref("iminent.webbooster.scripts.sslminibar.Services.IminentClientCode", "11"); user_pref("iminent.webbooster.scripts.sslminibar.Services.SmartFavCode", "02"); user_pref("iminent.webbooster.scripts.sslminibar.ShowThankyouPixel", "0"); user_pref("iminent.webbooster.scripts.sslminibar.displayFavLinks", "1"); user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent102", "1376559152170"); user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent109", "1376033550993"); user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent111", "1376033551001"); user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent112", "1376033552895"); user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent122", "1376033551007"); Emptied folder: C:\Users\Gitte\AppData\Roaming\mozilla\firefox\profiles\kmdq1sb8.default-1346945777968\minidumps [80 files] ~~~ Chrome Successfully deleted: [Folder] C:\Users\Gitte\appdata\local\Google\Chrome\User Data\Default\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo Successfully deleted: [Folder] C:\Users\Gitte\appdata\local\Google\Chrome\User Data\Default\Extensions\licjnkifamhpbaefhdpacpmihicfbomb Successfully deleted: [Folder] C:\Users\Gitte\appdata\local\Google\Chrome\User Data\Default\Extensions\mpcknfcdcgpffjddjeceioobdelceffo Successfully deleted: [Folder] C:\Users\Gitte\appdata\local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf Successfully deleted: [Folder] C:\Users\Gitte\appdata\local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 31.10.2013 at 16:37:19,17 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.10.31.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Gitte :: GITTE-HP [Administrator] Schutz: Aktiviert 31.10.2013 16:41:21 mbam-log-2013-10-31 (16-41-21).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 204111 Laufzeit: 3 Minute(n), 23 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 8 HKCR\Zula Games.BackgroundHostObject (PUP.Optional.Zulagames.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Zula Games.BackgroundHostObject.1 (PUP.Optional.Zulagames.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Zula Games.Navbar (PUP.Optional.Zulagames.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Zula Games.Navbar.1 (PUP.Optional.Zulagames.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Zula Games.ScriptHostObject (PUP.Optional.Zulagames.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Zula Games.ScriptHostObject.1 (PUP.Optional.Zulagames.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Zula Games.Tool (PUP.Optional.Zulagames.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Zula Games.Tool.1 (PUP.Optional.Zulagames.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 35 C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$R0ZYMIV.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$R218M7C.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$R33N9H1.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$RE5OXML.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$RIWIILC.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$RMMXLRZ.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$RO5Y7S2.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$RQHBHT2.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$RR141UD.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$RUP2YZH.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\$RECYCLE.BIN\S-1-5-21-606896283-656086263-2595788825-1000\$RWYUUHN.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\aoUghSgM.exe.part (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\bundlesweetimsetup.exe (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\dp.exe (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\FLVPlayerUpdate_downloader_by_FLVPlayerUpdate.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\ik5sjA8z.exe.part (PUP.Optional.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\IminentSetup.exe (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\mgsqlite3.7z (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\mgsqlite3.dll (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\NpVm+vQ1.exe.part (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\NpvVYnHV.exe.part (PUP.Adware.Domalq) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\OptimizerPro.exe.VIRUS (PUP.Optional.OptimizePro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\PCPerformerSetup.exe (Adware.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\rh2lYYUS.exe.part (PUP.Optional.RegCleanerPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\run.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\UpdateCheckerSetup.exe (PUP.Optional.Somoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\WSSetup.exe (PUP.Optional.InstallBrain.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\XqTIyzvV.exe.part (PUP.Optional.Solimba) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\DE723739-BAB0-7891-900D-816A3B1706D5\Setup.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\DE723739-BAB0-7891-900D-816A3B1706D5\Latest\MntrDLLInstall.dll (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\DE723739-BAB0-7891-900D-816A3B1706D5\Latest\MyDeltaTB.exe (PUP.Optional.Delta) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\DE723739-BAB0-7891-900D-816A3B1706D5\Latest\Setup.exe (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\AppData\Local\Temp\ibtmpaa19529\component_527 (PUP.CrossRider.SSK) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\Downloads\UPDFSetup.exe (Adware.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Gitte\Downloads\ZipExtractorSetup.exe (PUP.Optional.JumpyApps) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) franz |
31.10.2013, 19:18 | #4 |
/// TB-Ausbilder | PC Performer - Zula Games: Laptop langsam Servus, Wir spüren die letzten Reste auf, damit wir sie später entfernen können: Schritt 1 Kontrollscan mit FRST Führe wie zuvor beschrieben einen Scan mit FRST aus. Setze dazu eine Haken bei Addition.txt rechts unten und klicke auf Scan. Es werden wieder zwei Logdateien erzeugt. Poste mir diese. Schritt 2 Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit) | SystemLook (64 bit)
Gibt es noch Probleme mit Malware? Wenn ja, welche? Wie läuft der Rechner derzeit? Bitte poste mit deiner nächsten Antwort
|
01.11.2013, 11:33 | #5 |
| PC Performer - Zula Games: Laptop langsam FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013 Ran by Gitte (administrator) on GITTE-HP on 01-11-2013 09:29:39 Running from C:\Users\Gitte\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe (AMD) C:\Windows\system32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe (Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe (AMD) C:\Windows\system32\atieclxx.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.) C:\Windows\system32\mfevtps.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe () C:\Program Files (x86)\USB Sharing\usbshare.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (McAfee, Inc.) C:\Program Files\McAfee.com\Agent\mcagent.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe (McAfee, Inc.) C:\Program Files\McAfee\MAT\McPvTray.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe (HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\bin\HPNetworkCommunicator.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-03-11] (IDT, Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-17] (Synaptics Incorporated) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKCU\...\Run: [Panda PDF Converter563705.exe] - "C:\Users\Gitte\AppData\Local\Temp\Panda PDF Converter563705.exe" /XML="C:\Users\Gitte\AppData\Local\Temp\9913.tmp" /STP=0:2 <===== ATTENTION HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation) HKCU\...\Run: [HP Officejet Pro 8600 (NET)] - C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.) HKCU\...\Policies\system: [DisableLockWorkstation] 0 HKCU\...\Policies\system: [DisableChangePassword] 0 HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation) HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-02-15] (Hewlett-Packard Development Company L.P.) HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [318520 2011-01-27] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de) HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-03-16] (EasyBits Software AS) Startup: C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Officejet Pro 8600 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet Pro 8600\bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM - {1BFA2E7D-697D-4755-AAB0-D63F34301B3E} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKCU - ÛŸÆîZ§’2¹Þpv¨IÍá*X(Ž2s(ÛÎÀJºÔÓµ± vË°!×—(ä¼48иpatm6êo^Mp`Ëõ÷_i£w˜¾!„Áû†x¢8€ÙjÀÿþ*´Ñ;áa´[¦†8*º~RÙxœòÜ8'£-)x*ä* URL = BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.) Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.) ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-09-02] (EasyBits Software Corp.) ShellExecuteHooks-x32: - UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No File [ ] Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll () FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll No File FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL () FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll () FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: FoxyDeal - C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\Extensions\{F58A62EB-38DC-43C4-A539-DC52E135208D} FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK Chrome: ======= CHR RestoreOnStartup: "hxxp://www.google.com" CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Simple Pass 2011) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe\1.0_0\npwebsitelogon.dll (HP) CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File CHR Plugin: (WildTangent Games App Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll No File CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File CHR Plugin: (Default Plug-in) - default_plugin No File CHR Extension: (Website Logon) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\aepeildmfnnehghlknddebgjghlompfe\1.0_0 CHR Extension: (YouTube) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 CHR Extension: (Google Search) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: () - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_0 CHR Extension: (Gmail) - C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 CHR HKLM-x32\...\Chrome\Extension: [aepeildmfnnehghlknddebgjghlompfe] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx CHR HKLM-x32\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files (x86)\LyricsPal\125.crx ==================== Services (Whitelisted) ================= R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 mcmscsvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 McNASvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.) R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.) S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [x] ==================== Drivers (Whitelisted) ==================== R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R0 McPvDrv; C:\Windows\System32\drivers\McPvDrv.sys [73096 2012-09-14] (McAfee, Inc.) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.) U3 mfeavfk01; No ImagePath R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.) S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-01 09:29 - 2013-11-01 09:29 - 01957098 _____ (Farbar) C:\Users\Gitte\Downloads\FRST64.exe 2013-11-01 09:24 - 2013-11-01 09:24 - 00000000 ____D C:\Users\Gitte\Desktop\Malware 2013-10-31 16:39 - 2013-10-31 16:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Gitte\Downloads\mbam-setup-1.75.0.1300.exe 2013-10-31 16:39 - 2013-10-31 16:39 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-31 16:39 - 2013-10-31 16:39 - 00001109 _____ C:\ProgramData\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-31 16:39 - 2013-10-31 16:39 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\Malwarebytes 2013-10-31 16:39 - 2013-10-31 16:39 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-10-31 16:39 - 2013-10-31 16:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-10-31 16:39 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-10-31 16:30 - 2013-10-31 16:30 - 01033335 _____ (Thisisu) C:\Users\Gitte\Downloads\JRT.exe 2013-10-31 16:30 - 2013-10-31 16:30 - 00000000 ____D C:\Windows\ERUNT 2013-10-31 16:21 - 2013-10-31 16:23 - 00000000 ____D C:\AdwCleaner 2013-10-31 16:20 - 2013-10-31 16:20 - 01060070 _____ C:\Users\Gitte\Downloads\adwcleaner.exe 2013-10-31 13:46 - 2013-10-31 13:46 - 00266288 _____ C:\Windows\Minidump\103113-21528-01.dmp 2013-10-31 11:36 - 2013-10-31 11:36 - 00000000 _____ C:\Users\Gitte\defogger_reenable 2013-10-31 11:35 - 2013-10-31 11:35 - 00050477 _____ C:\Users\Gitte\Downloads\Defogger.exe 2013-10-31 09:08 - 2013-10-31 09:08 - 00442624 _____ C:\Windows\Minidump\103113-20139-01.dmp 2013-10-30 20:03 - 2013-10-30 20:03 - 00377856 _____ C:\Users\Gitte\Downloads\08o5oq3g.exe 2013-10-30 19:58 - 2013-10-31 19:52 - 00000000 ____D C:\FRST 2013-10-30 19:54 - 2013-10-31 20:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-10-30 19:52 - 2013-10-31 20:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-10-30 19:52 - 2013-10-30 19:52 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-10-30 19:52 - 2013-10-30 19:52 - 00001147 _____ C:\ProgramData\Desktop\Mozilla Firefox.lnk 2013-10-30 19:52 - 2013-10-30 19:52 - 00000000 ____D C:\ProgramData\Mozilla 2013-10-30 13:52 - 2013-10-30 13:52 - 50053120 _____ C:\Program Files (x86)\GUTABC9.tmp 2013-10-30 13:52 - 2013-10-30 13:52 - 00000000 ____D C:\Program Files (x86)\GUMABC8.tmp 2013-10-02 09:48 - 2013-10-02 09:48 - 00002135 _____ C:\Users\Gitte\Desktop\FLV Player.lnk 2013-10-02 09:44 - 2013-10-30 11:31 - 00000000 ____D C:\ProgramData\Oracle 2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\ProgramData\Synaptics ==================== One Month Modified Files and Folders ======= 2013-11-01 09:29 - 2013-11-01 09:29 - 01957098 _____ (Farbar) C:\Users\Gitte\Downloads\FRST64.exe 2013-11-01 09:24 - 2013-11-01 09:24 - 00000000 ____D C:\Users\Gitte\Desktop\Malware 2013-11-01 09:21 - 2011-12-09 11:35 - 01842930 _____ C:\Windows\WindowsUpdate.log 2013-11-01 09:19 - 2012-03-06 15:24 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-11-01 09:11 - 2012-03-30 16:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-11-01 09:11 - 2012-03-06 15:24 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-10-31 20:11 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-10-31 20:11 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker 2013-10-31 20:11 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-10-31 20:11 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2013-10-31 20:11 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System 2013-10-31 20:09 - 2012-02-22 17:49 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform 2013-10-31 20:09 - 2011-12-09 11:35 - 00000000 ____D C:\Windows\system32\SRSLabs 2013-10-31 20:09 - 2011-09-03 00:00 - 00000000 ____D C:\Windows\System32\Tasks\Hewlett-Packard 2013-10-31 20:09 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore 2013-10-31 20:09 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD 2013-10-31 20:09 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\spp 2013-10-31 20:08 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz 2013-10-31 20:07 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\Offline Web Pages 2013-10-31 20:07 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media 2013-10-31 20:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing 2013-10-31 20:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME 2013-10-31 20:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Cursors 2013-10-31 20:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Branding 2013-10-31 20:05 - 2013-07-11 19:54 - 00000000 ___SD C:\Users\Gitte\Documents\Meine Datenquellen 2013-10-31 20:05 - 2013-03-14 17:49 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-31 20:05 - 2013-02-21 16:16 - 00000000 __RSD C:\Users\Gitte\Documents\McAfee-Tresore 2013-10-31 20:05 - 2013-02-21 16:00 - 00000000 ____D C:\ProgramData\McAfee 2013-10-31 20:05 - 2012-03-01 17:47 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-31 20:05 - 2012-02-22 14:31 - 00000000 ___RD C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-10-31 20:05 - 2012-02-22 14:31 - 00000000 ___RD C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-10-31 20:05 - 2012-02-22 14:13 - 00000000 ___RD C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2013-10-31 20:05 - 2012-02-22 14:13 - 00000000 ___RD C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2013-10-31 20:05 - 2011-12-09 11:48 - 00000000 ____D C:\Program Files\Common Files\AuthenTec 2013-10-31 20:05 - 2011-12-09 11:34 - 00000000 ____D C:\Program Files\IDT 2013-10-31 20:05 - 2011-09-02 23:53 - 00000000 ____D C:\Program Files (x86)\Windows Live 2013-10-31 20:05 - 2011-03-16 20:10 - 00000000 ____D C:\Program Files\Hewlett-Packard 2013-10-31 20:05 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar 2013-10-31 20:05 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer 2013-10-31 20:05 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar 2013-10-31 20:05 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer 2013-10-31 20:05 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries 2013-10-31 20:05 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2013-10-31 20:04 - 2013-10-30 19:54 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-10-31 20:04 - 2013-10-30 19:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-10-31 20:04 - 2013-07-10 13:56 - 00000000 ____D C:\Program Files (x86)\FOTOParadies 2013-10-31 20:04 - 2013-03-14 17:49 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-10-31 20:04 - 2013-02-21 16:16 - 00000000 ____D C:\Program Files (x86)\McAfee.com 2013-10-31 20:04 - 2013-01-31 15:03 - 00000000 ____D C:\Program Files (x86)\FreePDF_XP 2013-10-31 20:04 - 2012-03-04 14:55 - 00000000 ____D C:\Program Files (x86)\USB Sharing 2013-10-31 20:04 - 2012-02-22 17:49 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client 2013-10-31 20:04 - 2011-12-09 11:48 - 00000000 ____D C:\Program Files (x86)\HP SimplePass 2011 2013-10-31 20:04 - 2011-09-02 23:57 - 00000000 ____D C:\Program Files (x86)\EasyBits For Kids 2013-10-31 20:04 - 2011-09-02 23:46 - 00000000 ___RD C:\Program Files (x86)\Online Services 2013-10-31 20:04 - 2011-09-02 23:46 - 00000000 ____D C:\Program Files (x86)\HP Games 2013-10-31 20:04 - 2011-09-02 23:44 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard 2013-10-31 20:03 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration 2013-10-31 19:52 - 2013-10-30 19:58 - 00000000 ____D C:\FRST 2013-10-31 19:52 - 2011-09-02 23:56 - 00000000 ____D C:\Program Files (x86)\Adobe 2013-10-31 16:54 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-31 16:54 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-31 16:51 - 2011-09-03 09:22 - 00654852 _____ C:\Windows\system32\perfh007.dat 2013-10-31 16:51 - 2011-09-03 09:22 - 00130434 _____ C:\Windows\system32\perfc007.dat 2013-10-31 16:51 - 2009-07-14 06:13 - 01500294 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-31 16:47 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-31 16:47 - 2009-07-14 05:51 - 00089819 _____ C:\Windows\setupact.log 2013-10-31 16:46 - 2010-11-21 04:47 - 00396634 _____ C:\Windows\PFRO.log 2013-10-31 16:39 - 2013-10-31 16:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Gitte\Downloads\mbam-setup-1.75.0.1300.exe 2013-10-31 16:39 - 2013-10-31 16:39 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-31 16:39 - 2013-10-31 16:39 - 00001109 _____ C:\ProgramData\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-31 16:39 - 2013-10-31 16:39 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\Malwarebytes 2013-10-31 16:39 - 2013-10-31 16:39 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-10-31 16:39 - 2013-10-31 16:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-10-31 16:30 - 2013-10-31 16:30 - 01033335 _____ (Thisisu) C:\Users\Gitte\Downloads\JRT.exe 2013-10-31 16:30 - 2013-10-31 16:30 - 00000000 ____D C:\Windows\ERUNT 2013-10-31 16:23 - 2013-10-31 16:21 - 00000000 ____D C:\AdwCleaner 2013-10-31 16:23 - 2013-09-24 23:00 - 00000601 _____ C:\Users\Gitte\Desktop\Search.lnk 2013-10-31 16:20 - 2013-10-31 16:20 - 01060070 _____ C:\Users\Gitte\Downloads\adwcleaner.exe 2013-10-31 14:00 - 2012-03-30 16:51 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-10-31 14:00 - 2012-03-30 16:51 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-10-31 14:00 - 2012-02-22 21:23 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-10-31 13:46 - 2013-10-31 13:46 - 00266288 _____ C:\Windows\Minidump\103113-21528-01.dmp 2013-10-31 13:46 - 2013-02-21 16:15 - 00000000 ____D C:\Program Files (x86)\McAfee 2013-10-31 13:46 - 2012-09-11 21:52 - 681075820 _____ C:\Windows\MEMORY.DMP 2013-10-31 13:46 - 2012-09-11 21:52 - 00000000 ____D C:\Windows\Minidump 2013-10-31 11:56 - 2012-03-06 15:27 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2013-10-31 11:56 - 2012-03-06 15:27 - 00002183 _____ C:\ProgramData\Desktop\Google Chrome.lnk 2013-10-31 11:51 - 2012-02-22 14:31 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{0F7CB852-3D92-4B84-99D1-637B0927DBAF} 2013-10-31 11:36 - 2013-10-31 11:36 - 00000000 _____ C:\Users\Gitte\defogger_reenable 2013-10-31 11:36 - 2012-02-22 14:13 - 00000000 ____D C:\Users\Gitte 2013-10-31 11:35 - 2013-10-31 11:35 - 00050477 _____ C:\Users\Gitte\Downloads\Defogger.exe 2013-10-31 09:20 - 2013-08-17 10:02 - 00000000 ____D C:\Windows\system32\MRT 2013-10-31 09:08 - 2013-10-31 09:08 - 00442624 _____ C:\Windows\Minidump\103113-20139-01.dmp 2013-10-30 20:03 - 2013-10-30 20:03 - 00377856 _____ C:\Users\Gitte\Downloads\08o5oq3g.exe 2013-10-30 19:52 - 2013-10-30 19:52 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-10-30 19:52 - 2013-10-30 19:52 - 00001147 _____ C:\ProgramData\Desktop\Mozilla Firefox.lnk 2013-10-30 19:52 - 2013-10-30 19:52 - 00000000 ____D C:\ProgramData\Mozilla 2013-10-30 19:46 - 2013-07-23 14:01 - 00003118 _____ C:\Windows\System32\Tasks\PC Performer 2013-10-30 19:31 - 2011-09-02 23:56 - 00000000 ____D C:\ProgramData\Adobe 2013-10-30 18:50 - 2012-03-06 15:24 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-10-30 18:50 - 2012-03-06 15:24 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-10-30 17:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-10-30 17:35 - 2011-09-02 23:51 - 00000000 ____D C:\ProgramData\Hewlett-Packard 2013-10-30 14:16 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\WinBioPlugIns 2013-10-30 14:12 - 2013-07-09 18:17 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog 2013-10-30 14:07 - 2011-09-02 23:59 - 00000000 ____D C:\Program Files (x86)\Java 2013-10-30 14:04 - 2013-08-13 19:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-10-30 14:04 - 2012-02-22 17:40 - 00000000 ____D C:\Users\Gitte\AppData\Local\Thunderbird 2013-10-30 13:52 - 2013-10-30 13:52 - 50053120 _____ C:\Program Files (x86)\GUTABC9.tmp 2013-10-30 13:52 - 2013-10-30 13:52 - 00000000 ____D C:\Program Files (x86)\GUMABC8.tmp 2013-10-30 12:34 - 2012-03-30 16:51 - 00000000 ____D C:\Windows\system32\Macromed 2013-10-30 12:34 - 2011-09-02 23:45 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2013-10-30 12:34 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\WinBioDatabase 2013-10-30 12:34 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz 2013-10-30 12:33 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Dism 2013-10-30 12:30 - 2013-07-10 13:57 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FOTOParadies 2013-10-30 12:30 - 2012-09-06 16:36 - 00000000 ____D C:\Users\Gitte\Desktop\Alte Firefox-Daten 2013-10-30 12:30 - 2012-02-22 17:40 - 00000000 ____D C:\Users\Gitte\AppData\Roaming\Thunderbird 2013-10-30 12:29 - 2013-06-17 22:44 - 00000000 ____D C:\ProgramData\Ashampoo 2013-10-30 12:29 - 2011-09-02 23:46 - 00000000 ____D C:\ProgramData\WildTangent 2013-10-30 12:29 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Portable Devices 2013-10-30 12:29 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2013-10-30 12:29 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2013-10-30 12:29 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2013-10-30 12:29 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2013-10-30 12:28 - 2011-09-02 23:57 - 00000000 ___RD C:\Program Files\Online Services 2013-10-30 12:28 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Services 2013-10-30 12:24 - 2012-03-21 17:59 - 00000000 ____D C:\104e4867ab004922c9 2013-10-30 12:18 - 2011-12-09 21:24 - 00000000 ___RD C:\Users\Public\Recorded TV 2013-10-30 11:55 - 2012-02-22 17:31 - 00000000 ____D C:\Users\Gitte\AppData\Local\Mozilla 2013-10-30 11:44 - 2012-02-22 22:33 - 00000000 __RHD C:\MSOCache 2013-10-30 11:31 - 2013-10-02 09:44 - 00000000 ____D C:\ProgramData\Oracle 2013-10-29 16:41 - 2013-06-08 16:35 - 00000000 ____D C:\Users\Gitte\AppData\Local\CrashDumps 2013-10-29 16:27 - 2012-10-16 15:06 - 00000000 ____D C:\Users\Gitte\Documents\Alles-Ordner 2013-10-02 09:48 - 2013-10-02 09:48 - 00002135 _____ C:\Users\Gitte\Desktop\FLV Player.lnk 2013-10-02 09:36 - 2013-10-02 09:36 - 00000000 ____D C:\ProgramData\Synaptics Some content of TEMP: ==================== C:\Users\Gitte\AppData\Local\Temp\8epgjtr_.dll C:\Users\Gitte\AppData\Local\Temp\APNStub.exe C:\Users\Gitte\AppData\Local\Temp\AskSLib.dll C:\Users\Gitte\AppData\Local\Temp\Extract.exe C:\Users\Gitte\AppData\Local\Temp\FoxyDeal.exe C:\Users\Gitte\AppData\Local\Temp\FoxyDeal_Setup.exe C:\Users\Gitte\AppData\Local\Temp\GenericUninstall.exe C:\Users\Gitte\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Gitte\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\Gitte\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\Gitte\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\Gitte\AppData\Local\Temp\Quarantine.exe C:\Users\Gitte\AppData\Local\Temp\Resource.exe C:\Users\Gitte\AppData\Local\Temp\sk1likgh.dll C:\Users\Gitte\AppData\Local\Temp\sp54620.exe C:\Users\Gitte\AppData\Local\Temp\SP54630.exe C:\Users\Gitte\AppData\Local\Temp\SP54714.exe C:\Users\Gitte\AppData\Local\Temp\SP56221.exe C:\Users\Gitte\AppData\Local\Temp\SP56878.exe C:\Users\Gitte\AppData\Local\Temp\SP57232.exe C:\Users\Gitte\AppData\Local\Temp\sp58915.exe C:\Users\Gitte\AppData\Local\Temp\uninst1.exe C:\Users\Gitte\AppData\Local\Temp\uninstaller.exe C:\Users\Gitte\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Gitte\AppData\Local\Temp\UninstallHPTCA.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-30 17:32 ==================== End Of Log ============================ Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-10-2013 Ran by Gitte at 2013-11-01 09:30:09 Running from C:\Users\Gitte\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: McAfee Anti-Virus und Anti-Spyware (Disabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892} AS: McAfee Anti-Virus und Anti-Spyware (Disabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9} ==================== Installed Programs ====================== Adobe Digital Editions 2.0 (x32 Version: 2.0) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117) Adobe Shockwave Player 11.5 (x32 Version: 11.5.9.620) Agatha Christie - Peril at End House (x32 Version: 2.2.0.95) Ashampoo Photo Commander 9 v.9.4.3 (x32 Version: 9.4.3) ATI Catalyst Install Manager (Version: 3.0.816.0) AuthenTec TrueAPI (Version: 1.2.1.33) Bejeweled 2 Deluxe (x32 Version: 2.2.0.95) Big Rig Europe (x32 Version: 2.2.0.95) Blasterball 3 (x32 Version: 2.2.0.95) Bounce Symphony (x32 Version: 2.2.0.95) Broadcom 802.11 Wireless LAN Adapter (Version: 5.60.48.61) Cake Mania (x32 Version: 2.2.0.95) Catalyst Control Center - Branding (x32 Version: 1.00.0000) Catalyst Control Center (x32 Version: 2011.0508.224.2391) Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0508.224.2391) Catalyst Control Center InstallProxy (x32 Version: 2011.0508.224.2391) Catalyst Control Center Localization All (x32 Version: 2011.0508.224.2391) Catalyst Control Center Profiles Mobile (x32 Version: 2011.0508.224.2391) CCC Help Chinese Standard (x32 Version: 2011.0508.0223.2391) CCC Help Chinese Traditional (x32 Version: 2011.0508.0223.2391) CCC Help Czech (x32 Version: 2011.0508.0223.2391) CCC Help Danish (x32 Version: 2011.0508.0223.2391) CCC Help Dutch (x32 Version: 2011.0508.0223.2391) CCC Help English (x32 Version: 2011.0508.0223.2391) CCC Help Finnish (x32 Version: 2011.0508.0223.2391) CCC Help French (x32 Version: 2011.0508.0223.2391) CCC Help German (x32 Version: 2011.0508.0223.2391) CCC Help Greek (x32 Version: 2011.0508.0223.2391) CCC Help Hungarian (x32 Version: 2011.0508.0223.2391) CCC Help Italian (x32 Version: 2011.0508.0223.2391) CCC Help Japanese (x32 Version: 2011.0508.0223.2391) CCC Help Korean (x32 Version: 2011.0508.0223.2391) CCC Help Norwegian (x32 Version: 2011.0508.0223.2391) CCC Help Polish (x32 Version: 2011.0508.0223.2391) CCC Help Portuguese (x32 Version: 2011.0508.0223.2391) CCC Help Russian (x32 Version: 2011.0508.0223.2391) CCC Help Spanish (x32 Version: 2011.0508.0223.2391) CCC Help Swedish (x32 Version: 2011.0508.0223.2391) CCC Help Thai (x32 Version: 2011.0508.0223.2391) CCC Help Turkish (x32 Version: 2011.0508.0223.2391) ccc-utility64 (Version: 2011.0508.224.2391) Chuzzle Deluxe (x32 Version: 2.2.0.95) Crazy Chicken Kart 2 (x32 Version: 2.2.0.95) CyberLink YouCam (x32 Version: 3.5.1.3922) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95) ElsterFormular (x32 Version: 13.3.0.9066) Energy Star Digital Logo (x32 Version: 1.0.1) ESU for Microsoft Windows 7 (x32 Version: 1.0.0) Evernote v. 4.2.2 (x32 Version: 4.2.2.3979) Farm Frenzy (x32 Version: 2.2.0.95) FATE (x32 Version: 2.2.0.95) Fishdom (x32 Version: 2.2.0.95) FOTOParadies (x32 Version: 3.5.0.3) FreePDF (Remove only) (x32) Google Chrome (x32 Version: 30.0.1599.101) Google Earth (x32 Version: 7.1.1.1888) Google Update Helper (x32 Version: 1.3.21.165) GPL Ghostscript (x32 Version: 9.04) HP 3D DriveGuard (Version: 4.1.16.1) HP Auto (Version: 1.0.12935.3667) HP Client Services (Version: 1.1.12938.3539) HP Connection Manager (x32 Version: 4.0.45.1) HP Customer Experience Enhancements (x32 Version: 6.0.1.7) HP Documentation (x32 Version: 1.1.0.0) HP DVB-T TV Tuner 8.0.64.43 (x32 Version: 8.0.64.43) HP FWUpdateEDO2 (x32 Version: 1.2.0.0) HP Games (x32 Version: 1.0.2.4) HP Officejet Pro 8600 - Grundlegende Software für das Gerät (Version: 25.0.619.0) HP Officejet Pro 8600 Hilfe (x32 Version: 140.0.2.2) HP On Screen Display (x32 Version: 1.1.2) HP Power Manager (x32 Version: 1.2.3) HP Quick Launch (x32 Version: 2.3.6) HP Setup (x32 Version: 8.6.4530.3651) HP Setup Manager (x32 Version: 1.1.13253.3682) HP SimplePass 2011 (x32 Version: 5.1.0.495) HP Software Framework (x32 Version: 4.1.13.1) HP Update (x32 Version: 5.005.000.001) HPDiagnosticAlert (x32 Version: 1.00.0000) I.R.I.S. OCR (x32 Version: 12.3.4.0) IDT Audio (x32 Version: 1.0.6329.0) Intel(R) Display Audio Driver (x32 Version: 6.14.00.3074) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Jewel Quest Solitaire (x32 Version: 2.2.0.95) Junk Mail filter update (x32 Version: 15.4.3502.0922) Magic Desktop (x32 Version: 3.0) Mah Jong Medley (x32 Version: 2.2.0.95) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) McAfee Total Protection (x32 Version: 11.6.511) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Office 2010 Service Pack 1 (SP1) (x32) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000) Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.5128.5002) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Mozilla Firefox 19.0 (x86 de) (x32 Version: 19.0) Mozilla Firefox 25.0 (x86 de) (HKCU Version: 25.0) Mozilla Maintenance Service (x32 Version: 19.0) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) Mystery P.I. - The London Caper (x32 Version: 2.2.0.95) Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95) Penguins! (x32 Version: 2.2.0.95) Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95) Polar Bowler (x32 Version: 2.2.0.95) ProfiSchafkopf (x32 Version: 1.0.10) PX Profile Update (x32 Version: 1.00.1.) Realtek Ethernet Controller Driver (x32 Version: 7.41.216.2011) Realtek PCIE Card Reader (x32 Version: 6.1.7600.74) Recovery Manager (x32 Version: 2.0.0) RedMon - Redirection Port Monitor Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0) Shared C Run-time for x64 (Version: 10.0.0) Slingo Deluxe (x32 Version: 2.2.0.95) Synaptics Pointing Device Driver (Version: 15.2.4.4) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2494150) (x32) Update for Microsoft Office 2010 (KB2553065) (x32) Update for Microsoft Office 2010 (KB2553157) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2566458) (x32) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589370) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760758) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32) Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32) Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32) Update Installer for WildTangent Games App (x32) USB Sharing (x32) Virtual Villagers - The Secret City (x32 Version: 2.2.0.95) Wedding Dash (x32 Version: 2.2.0.95) WildTangent Games App (HP Games) (x32 Version: 4.0.5.36) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3508.1109) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3508.1109) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Zuma Deluxe (x32 Version: 2.2.0.95) ==================== Restore Points ========================= 30-10-2013 18:30:19 Removed Adobe Reader X (10.1.7) MUI. 31-10-2013 08:12:56 Windows Update 31-10-2013 09:12:45 Wiederherstellungsvorgang ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {1C23437F-3C2D-49C8-9288-1FB366197106} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06] (Google Inc.) Task: {411C96B0-2495-4321-B479-A1C7AB4DC9EA} - System32\Tasks\PC Performer => C:\Program Files (x86)\PC Performer\PCPerformer.exe Task: {5AB7A3F5-C0BA-4170-ACC4-5AC1BDF4504D} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation) Task: {602BD713-5350-42A7-8C66-1DCC03242A4E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-06] (Google Inc.) Task: {64A46F3D-30FE-48EF-A230-452CFE1AFCCA} - \PC Performer_DEFAULT No Task File Task: {678CFABD-C896-4DEF-A8EC-7ABE97D00219} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {7936AB34-707A-4729-B1D2-03B4343B1173} - \DealPlyLiveUpdateTaskMachineCore No Task File Task: {902E1849-CA7F-447A-A69C-7120F99C1FF5} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-03-22] (CyberLink) Task: {A8DA141D-82FA-429B-9A3F-7A9EE33C18A4} - \DealPlyLiveUpdateTaskMachineUA No Task File Task: {ADE798BE-8EDC-4FA1-AD2C-7301EE5B3455} - \PC Performer_UPDATES No Task File Task: {DDEE29E4-7DDA-415A-9CB9-61C815A4964A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe Task: {E681F894-A68B-4687-B753-2F149828CBCB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-31] (Adobe Systems Incorporated) Task: {E6B2ED12-11F3-478C-BD8B-9400D3BDCEEA} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-01-31] () Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2013-04-04 00:09 - 2013-04-04 00:09 - 04300432 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF 2011-12-09 11:32 - 2011-04-15 04:16 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2011-05-12 14:13 - 2011-05-12 14:13 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll 2011-05-08 02:23 - 2011-05-08 02:23 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2010-06-24 02:21 - 2010-06-24 02:21 - 01102336 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\System.Data.SQLite.dll 2013-08-20 17:56 - 2013-08-20 17:56 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9ab0e818cb3d1b6930eba54179f89300\IsdiInterop.ni.dll 2011-12-09 11:31 - 2011-01-13 02:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll 2010-06-24 02:19 - 2010-06-24 02:19 - 00514570 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\sqlite3.dll 2013-10-30 19:54 - 2013-10-30 19:54 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2013-04-04 00:09 - 2013-04-04 00:09 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver" ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/31/2013 04:47:16 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/31/2013 04:46:00 PM) (Source: ATIeRecord) (User: ) Description: ATI EEU failed to post message to CCC Error: (10/31/2013 04:46:00 PM) (Source: ATIeRecord) (User: ) Description: ATI EEU failed to post message to CCC System errors: ============= Error: (10/31/2013 04:49:22 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Microsoft Office Sessions: ========================= Error: (10/31/2013 04:47:16 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/31/2013 04:46:00 PM) (Source: ATIeRecord)(User: ) Description: Error: (10/31/2013 04:46:00 PM) (Source: ATIeRecord)(User: ) Description: ==================== Memory info =========================== Percentage of memory in use: 22% Total physical RAM: 8139.86 MB Available physical RAM: 6310.84 MB Total Pagefile: 16277.9 MB Available Pagefile: 13361.27 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:680.46 GB) (Free:619.27 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (RECOVERY) (Fixed) (Total:17.88 GB) (Free:1.92 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 527073E8) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=680 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=18 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=103 MB) - (Type=0C) ==================== End Of Log ============================ Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff Log created at 09:52 on 01/11/2013 by Gitte Administrator - Elevation successful ========== filefind ========== Searching for "*Zula Games*" No files found. Searching for "*iminent*" C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mozilla Firefox\defaults\pref\all-iminent.js.vir --a---- 148 bytes [18:54 30/10/2013] [17:17 09/07/2013] 7691653CA43ACCD70F36A78C085DACD7 C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com\http_80\Aktiviere die Iminent Erweiterung in Chrome.ico --a---- 28134 bytes [17:21 09/07/2013] [18:24 11/07/2013] 9BA783C52AF26F59FA24DE05ECE95A69 C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com\http_80\Aktiviere die Iminent Erweiterung in Chrome.ico.md5 --a---- 16 bytes [17:21 09/07/2013] [17:21 09/07/2013] E51CDE84BE315BA756795D8BB8522A1B C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com\http_80\http___www.iminent.ico.md5 --a---- 16 bytes [07:07 01/10/2013] [07:07 01/10/2013] 9086FA35E26829DF4F1A84DAD48116C1 C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com\http_80\Aktiviere die Iminent Erweiterung in Chrome.ico --a---- 28134 bytes [17:21 09/07/2013] [18:24 11/07/2013] 9BA783C52AF26F59FA24DE05ECE95A69 C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com\http_80\Aktiviere die Iminent Erweiterung in Chrome.ico.md5 --a---- 16 bytes [17:21 09/07/2013] [17:21 09/07/2013] E51CDE84BE315BA756795D8BB8522A1B C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com\http_80\http___www.iminent.ico.md5 --a---- 16 bytes [07:07 01/10/2013] [07:07 01/10/2013] 9086FA35E26829DF4F1A84DAD48116C1 Searching for "*zulagames*" C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\gflandjopdloblmlcoiidmncpinmmacn\1.0.0.5_0\zulagames.rdf.vir --a---- 256 bytes [09:47 25/09/2013] [09:47 25/09/2013] D55E3C698702B2CB34901D2EBDF53808 C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\zulagames\zulagames.crx.vir --a---- 58077 bytes [13:58 01/07/2013] [13:58 01/07/2013] D9F9DA3F2A4BA7454D691BC8C4ECE684 C:\Documents and Settings\Gitte\Desktop\ZulaGames.lnk --a---- 1200 bytes [22:00 24/09/2013] [22:00 24/09/2013] C74C6A74ECADDB12A981A3D91DB69BD2 C:\Users\Gitte\Desktop\ZulaGames.lnk --a---- 1200 bytes [22:00 24/09/2013] [22:00 24/09/2013] C74C6A74ECADDB12A981A3D91DB69BD2 Searching for "*pricepeep*" No files found. Searching for "*optimizerpro*" No files found. Searching for "*dealply*" C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe.vir --a---- 148000 bytes [17:17 09/07/2013] [17:17 09/07/2013] 9FCD1448C709C227BA6A146B681CC869 C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\DealPlyLive.exe.vir --a---- 148000 bytes [17:17 09/07/2013] [17:17 09/07/2013] 9FCD1448C709C227BA6A146B681CC869 C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\DealPlyLiveBroker.exe.vir --a---- 61984 bytes [17:17 09/07/2013] [17:17 09/07/2013] 4ED040118E13DBB1698AF876D0783BE4 C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\DealPlyLiveHandler.exe.vir --a---- 148000 bytes [17:17 09/07/2013] [17:17 09/07/2013] 9FCD1448C709C227BA6A146B681CC869 C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\DealPlyLiveHelper.msi.vir --a---- 40960 bytes [17:17 09/07/2013] [17:17 09/07/2013] 4AFAA1ED6A27FFEEE76EA2B7643B6309 C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive\Update\1.3.23.0\DealPlyLiveOnDemand.exe.vir --a---- 61984 bytes [17:17 09/07/2013] [17:17 09/07/2013] ED69D24A6366493C67824E2567AE13FA C:\AdwCleaner\Quarantine\C\ProgramData\DealPlyLive\Update\Log\DealPlyLive.log.vir --a---- 2747260 bytes [17:17 09/07/2013] [15:22 31/10/2013] D643EBAE065DEC9AC2949E6BFCB75F78 C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly\DealPly Help.url.vir --a---- 127 bytes [17:17 09/07/2013] [17:17 09/07/2013] AB29883A8864682F630D254295AC23E4 C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly\DealPly.url.vir --a---- 123 bytes [17:17 09/07/2013] [17:17 09/07/2013] FF6B5B9FE1BEDA0430870774896EDDC1 C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly\Uninstall DealPly.lnk.vir --a---- 960 bytes [17:17 09/07/2013] [17:17 09/07/2013] E66AD9FEED65661EE0DFE98571E8EF4F C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profiles\kmdq1sb8.default-1346945777968\Extensions\{906000A4-88D9-4D52-B209-7A772970D91F}\chrome\content\dealplyshopping.xul.vir --a---- 762 bytes [17:17 09/07/2013] [11:25 04/06/2013] E12B6C7460D6F3FD98C0EACF5DB56CD9 C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore.vir --a---- 3648 bytes [17:17 09/07/2013] [17:17 09/07/2013] B3BC345E6ED86319C034E683FC389C43 C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA.vir --a---- 3900 bytes [17:17 09/07/2013] [17:17 09/07/2013] 2B71517FE20ECF3D5A812309CC01B8B6 C:\AdwCleaner\Quarantine\C\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job.vir --a---- 900 bytes [17:17 09/07/2013] [12:46 31/10/2013] 4FBDBDDB8D3A7988B14A98A7E290985E C:\AdwCleaner\Quarantine\C\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job.vir --a---- 904 bytes [17:17 09/07/2013] [15:22 31/10/2013] 09D777D0CC0A4AB863374441FDAEAC7A Searching for "*DSearchLink*" C:\AdwCleaner\Quarantine\C\ProgramData\DSearchLink\DSearchLink.exe.vir --a---- 154112 bytes [22:00 24/09/2013] [11:53 27/08/2013] 30B9BD7CD6F7A4395A22B5D8907F302C Searching for "*IBUpdater*" No files found. Searching for "*PC Performer*" C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Performer\PC Performer entfernen.lnk.vir --a---- 1053 bytes [22:01 24/09/2013] [22:01 24/09/2013] CC0F93245F7568E54E28497ADFEFD1DF C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Performer\PC Performer.lnk.vir --a---- 1068 bytes [22:01 24/09/2013] [22:01 24/09/2013] 6CBF07446E6DFA3A9A2C38F40BF384F5 C:\AdwCleaner\Quarantine\C\Users\Public\Desktop\PC Performer.lnk.vir --a---- 1050 bytes [22:01 24/09/2013] [22:01 24/09/2013] C47BCC48DC403B0376F2F486B7E4A8C7 C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\PC Performer_DEFAULT.vir --a---- 2870 bytes [16:58 09/07/2013] [18:42 30/10/2013] 39E0852C169BFFF1DB741177EEA1CEC5 C:\AdwCleaner\Quarantine\C\Windows\System32\Tasks\PC Performer_UPDATES.vir --a---- 3026 bytes [16:58 09/07/2013] [18:42 30/10/2013] EB1C9BE6E1600488E6C72C47C751F339 C:\AdwCleaner\Quarantine\C\Windows\Tasks\PC Performer_DEFAULT.job.vir --a---- 276 bytes [16:58 09/07/2013] [14:12 31/10/2013] 12C62CC45234CC2ED2EDFC36E8F01FDC C:\AdwCleaner\Quarantine\C\Windows\Tasks\PC Performer_UPDATES.job.vir --a---- 284 bytes [16:58 09/07/2013] [18:43 30/10/2013] D54A5C06132DF7F426E976596DCB4864 C:\Windows\System32\Tasks\PC Performer --a---- 3118 bytes [13:01 23/07/2013] [18:46 30/10/2013] 8A4107F6702354B54317EB8AB6901CB9 Searching for "*MyPC Backup*" No files found. Searching for "*SpeedAnalysis*" C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\speedanalysis.ico.vir --a---- 30894 bytes [22:00 24/09/2013] [22:00 24/09/2013] 7E87C3301ED85E468ABF1204B85B335C C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\SpeedAnalysis2\speedanalysis.crx.vir --a---- 84434 bytes [16:53 11/06/2013] [16:53 11/06/2013] BE3A94909257299A5879463014811754 C:\AdwCleaner\Quarantine\C\Users\Gitte\Desktop\SpeedAnalysis.lnk.vir --a---- 1136 bytes [22:00 24/09/2013] [22:00 24/09/2013] DCC0D1BE4F93C42FDC8C22A3806DA255 ========== folderfind ========== Searching for "*Zula Games*" No folders found. Searching for "*iminent*" C:\AdwCleaner\Quarantine\C\Program Files (x86)\Iminent d------ [15:23 31/10/2013] C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com d------ [17:21 09/07/2013] C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com d------ [07:07 01/10/2013] C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com d------ [17:21 09/07/2013] C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com d------ [07:07 01/10/2013] Searching for "*zulagames*" C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\zulagames d------ [15:23 31/10/2013] C:\Documents and Settings\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\zulagames@ZulaGames.com d------ [22:00 24/09/2013] C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\zulagames@ZulaGames.com d------ [22:00 24/09/2013] Searching for "*pricepeep*" No folders found. Searching for "*optimizerpro*" No folders found. Searching for "*dealply*" C:\AdwCleaner\Quarantine\C\Program Files (x86)\DealPlyLive d------ [15:23 31/10/2013] C:\AdwCleaner\Quarantine\C\ProgramData\DealPlyLive d------ [15:23 31/10/2013] C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\DealPly d------ [15:23 31/10/2013] C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly d------ [15:23 31/10/2013] Searching for "*DSearchLink*" C:\AdwCleaner\Quarantine\C\ProgramData\DSearchLink d------ [15:23 31/10/2013] Searching for "*IBUpdater*" C:\AdwCleaner\Quarantine\C\ProgramData\IBUpdaterService d------ [15:23 31/10/2013] Searching for "*PC Performer*" C:\AdwCleaner\Quarantine\C\Program Files (x86)\PC Performer d------ [15:23 31/10/2013] C:\AdwCleaner\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Performer d------ [15:23 31/10/2013] C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\PerformerSoft\PC Performer d------ [15:23 31/10/2013] Searching for "*MyPC Backup*" No folders found. Searching for "*SpeedAnalysis*" C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Roaming\SpeedAnalysis2 d------ [15:23 31/10/2013] C:\Documents and Settings\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\speedanalysis02@SpeedAnalysis.com d------ [22:00 24/09/2013] C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\speedanalysis02@SpeedAnalysis.com d------ [22:00 24/09/2013] ========== regfind ========== Searching for "Zula Games" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-606896283-656086263-2595788825-1000\Software\Zula Games] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AB072B9A-8614-4d01-A514-5D36A46DE10A}] "AppPath"="C:\Program Files (x86)\Zula Games" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{145AEB41-FD4F-4960-A9D7-D49E6541DEF9}] "AppPath"="C:\Program Files (x86)\Zula Games" [HKEY_USERS\S-1-5-21-606896283-656086263-2595788825-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-606896283-656086263-2595788825-1000\Software\Zula Games] Searching for "iminent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files (x86)\Iminent\inst\Bootstrapper\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files (x86)\Iminent\inst\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders] "C:\Program Files (x86)\Iminent\"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] "00000000000000000000000000000000"="C:\Program Files (x86)\Iminent\inst\Bootstrapper\Bootstrapper.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] "00000000000000000000000000000000"="02:\SOFTWARE\Iminent\AppInstanceUid" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\43C098337DB065A49B665D4EA7F16D1C] "00000000000000000000000000000000"="C:\Program Files (x86)\Iminent\StartWeb.xml" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A71991503412AEB42838B02C5ED9F9CD] "00000000000000000000000000000000"="C:\Program Files (x86)\Iminent\USearch.xml" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7652513C62FF63448CFF05163719DB7] "00000000000000000000000000000000"="C:\Program Files (x86)\Iminent\SearchTheWeb.xml" Searching for "zulagames" [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\zulagames] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\zulagames] "UninstallString"="C:\Program Files (x86)\ZulaGames\uninst.exe" Searching for "pricepeep" [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU] "Item 8"="[F00000000][T01CE8AC71F44A340][O00000000]*C:\Users\Gitte\Desktop\Pricepeep.docx" [HKEY_USERS\S-1-5-21-606896283-656086263-2595788825-1000\Software\Microsoft\Office\14.0\Word\File MRU] "Item 8"="[F00000000][T01CE8AC71F44A340][O00000000]*C:\Users\Gitte\Desktop\Pricepeep.docx" Searching for "optimizerpro" [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers] "C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe"="RUNASADMIN ELEVATECREATEPROCESS" [HKEY_USERS\S-1-5-21-606896283-656086263-2595788825-1000\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers] "C:\Program Files (x86)\Optimizer Pro\OptimizerPro.exe"="RUNASADMIN ELEVATECREATEPROCESS" Searching for "dealply" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7936AB34-707A-4729-B1D2-03B4343B1173}] "Path"="\DealPlyLiveUpdateTaskMachineCore" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A8DA141D-82FA-429B-9A3F-7A9EE33C18A4}] "Path"="\DealPlyLiveUpdateTaskMachineUA" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineCore] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineUA] Searching for "DSearchLink" No data found. Searching for "IBUpdater" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\IBUpdaterService] Searching for "PC Performer" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{411C96B0-2495-4321-B479-A1C7AB4DC9EA}] "Path"="\PC Performer" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{64A46F3D-30FE-48EF-A230-452CFE1AFCCA}] "Path"="\PC Performer_DEFAULT" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ADE798BE-8EDC-4FA1-AD2C-7301EE5B3455}] "Path"="\PC Performer_UPDATES" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Performer] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Performer_DEFAULT] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Performer_UPDATES] Searching for "MyPC Backup" No data found. Searching for "SpeedAnalysis" No data found. Searching for " " [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell] "ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Hewlett-Packard\HP Software Framework\{41290DB4-0C21-46ad-9A12-C40FD90E1B0B}] "Wireless.GlobalChanged.2.0"="<?xml version="1.0"?> <WirelessGlobalDeviceInfoOutput2 xmlns="schemas-hp-com.casl"> <Output> <Data> <Capabilities> <NumberOfPowerSources>3</NumberOfPowerSources> <GlobalFeatures> <WWANAntenna>false</WWANAntenna> <GPSIncluded>false</GPSIncluded> </GlobalFeatures> </Capabilities> <Devices> <Device> <TechnologyType>WLAN</TechnologyType> <BusType>PCI</BusType> <VendorID>14E4</VendorID> <DeviceID>4727</DeviceID> <SubVendorID>103C</SubVendorID> <SubSystemID>145C</SubSystemID> <PowerSource>0</PowerSource> <CurrentState>on</CurrentState> <LastRequestedState> <WMI>on</WMI> <F10>on</F10> <HardwareButton>on</HardwareButton> <RadioState>on</Radio [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32] "ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Hewlett-Packard\HP Software Framework\{41290DB4-0C21-46ad-9A12-C40FD90E1B0B}] "Wireless.GlobalChanged.2.0"="<?xml version="1.0"?> <WirelessGlobalDeviceInfoOutput2 xmlns="schemas-hp-com.casl"> <Output> <Data> <Capabilities> <NumberOfPowerSources>3</NumberOfPowerSources> <GlobalFeatures> <WWANAntenna>false</WWANAntenna> <GPSIncluded>false</GPSIncluded> </GlobalFeatures> </Capabilities> <Devices> <Device> <TechnologyType>WLAN</TechnologyType> <BusType>PCI</BusType> <VendorID>14E4</VendorID> <DeviceID>4727</DeviceID> <SubVendorID>103C</SubVendorID> <SubSystemID>145C</SubSystemID> <PowerSource>0</PowerSource> <CurrentState>on</CurrentState> <LastRequestedState> <WMI>on</WMI> <F10>on</F10> <HardwareButton>on</HardwareButton> <RadioSta [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#10122758004726&0#] "DeviceDesc"=" " [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#10122758004726&0#] "DeviceDesc"=" " [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_&REV_#10122758004726&0#] "DeviceDesc"=" " -= EOF =- Soweit ich das jetzt beurteilen kann, läuft der Laptop gut! Frage: was haltet ihr hier eigentlich vom McAfee? Gruß franz |
01.11.2013, 16:54 | #6 |
/// TB-Ausbilder | PC Performer - Zula Games: Laptop langsam Servus Franz, McAfee ist ok. Ich persönlich bin der Meinung, dass man für ein AV Programm nicht unbedingt Geld ausgeben muss. Servus, wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File CHR HKLM-x32\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files (x86)\LyricsPal\125.crx C:\Program Files (x86)\LyricsPal Task: {411C96B0-2495-4321-B479-A1C7AB4DC9EA} - System32\Tasks\PC Performer => C:\Program Files (x86)\PC Performer\PCPerformer.exe C:\Program Files (x86)\PC Performer Task: {64A46F3D-30FE-48EF-A230-452CFE1AFCCA} - \PC Performer_DEFAULT No Task File Task: {7936AB34-707A-4729-B1D2-03B4343B1173} - \DealPlyLiveUpdateTaskMachineCore No Task File Task: {A8DA141D-82FA-429B-9A3F-7A9EE33C18A4} - \DealPlyLiveUpdateTaskMachineUA No Task File Task: {ADE798BE-8EDC-4FA1-AD2C-7301EE5B3455} - \PC Performer_UPDATES No Task File C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com C:\Documents and Settings\Gitte\Desktop\ZulaGames.lnk C:\Users\Gitte\Desktop\ZulaGames.lnk C:\Documents and Settings\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\zulagames@ZulaGames.com C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\zulagames@ZulaGames.com C:\Documents and Settings\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\speedanalysis02@SpeedAnalysis.com C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\speedanalysis02@SpeedAnalysis.com Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-606896283-656086263-2595788825-1000\Software\Zula Games" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AB072B9A-8614-4d01-A514-5D36A46DE10A}" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{145AEB41-FD4F-4960-A9D7-D49E6541DEF9}" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\zulagames" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\IBUpdaterService" /f end Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Downloade Dir bitte Malwarebytes Anti-Malware
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
02.11.2013, 17:59 | #7 |
| PC Performer - Zula Games: Laptop langsam FRST Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-10-2013 Ran by Gitte at 2013-11-02 12:20:14 Run:1 Running from C:\Users\Gitte\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** start Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File CHR HKLM-x32\...\Chrome\Extension: [mmiopbgcekanlhpjkonogoljpfmhpkhf] - C:\Program Files (x86)\LyricsPal\125.crx C:\Program Files (x86)\LyricsPal Task: {411C96B0-2495-4321-B479-A1C7AB4DC9EA} - System32\Tasks\PC Performer => C:\Program Files (x86)\PC Performer\PCPerformer.exe C:\Program Files (x86)\PC Performer Task: {64A46F3D-30FE-48EF-A230-452CFE1AFCCA} - \PC Performer_DEFAULT No Task File Task: {7936AB34-707A-4729-B1D2-03B4343B1173} - \DealPlyLiveUpdateTaskMachineCore No Task File Task: {A8DA141D-82FA-429B-9A3F-7A9EE33C18A4} - \DealPlyLiveUpdateTaskMachineUA No Task File Task: {ADE798BE-8EDC-4FA1-AD2C-7301EE5B3455} - \PC Performer_UPDATES No Task File C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com C:\Documents and Settings\Gitte\Desktop\ZulaGames.lnk C:\Users\Gitte\Desktop\ZulaGames.lnk C:\Documents and Settings\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\zulagames@ZulaGames.com C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\zulagames@ZulaGames.com C:\Documents and Settings\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\speedanalysis02@SpeedAnalysis.com C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\speedanalysis02@SpeedAnalysis.com Reg: reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-606896283-656086263-2595788825-1000\Software\Zula Games" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AB072B9A-8614-4d01-A514-5D36A46DE10A}" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{145AEB41-FD4F-4960-A9D7-D49E6541DEF9}" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\zulagames" /f Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\IBUpdaterService" /f end ***************** HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Value deleted successfully. HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found. HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\mmiopbgcekanlhpjkonogoljpfmhpkhf => Key deleted successfully. "C:\Program Files (x86)\LyricsPal\125.crx" => File/Directory not found. "C:\Program Files (x86)\LyricsPal" => File/Directory not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{411C96B0-2495-4321-B479-A1C7AB4DC9EA} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{411C96B0-2495-4321-B479-A1C7AB4DC9EA} => Key deleted successfully. C:\Windows\System32\Tasks\PC Performer => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Performer => Key deleted successfully. "C:\Program Files (x86)\PC Performer" => File/Directory not found. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{64A46F3D-30FE-48EF-A230-452CFE1AFCCA} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{64A46F3D-30FE-48EF-A230-452CFE1AFCCA} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Performer_DEFAULT => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7936AB34-707A-4729-B1D2-03B4343B1173} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7936AB34-707A-4729-B1D2-03B4343B1173} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineCore => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A8DA141D-82FA-429B-9A3F-7A9EE33C18A4} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A8DA141D-82FA-429B-9A3F-7A9EE33C18A4} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineUA => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ADE798BE-8EDC-4FA1-AD2C-7301EE5B3455} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ADE798BE-8EDC-4FA1-AD2C-7301EE5B3455} => Key deleted successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Performer_UPDATES => Key deleted successfully. C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com => Moved successfully. C:\Documents and Settings\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com => Moved successfully. "C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\de.iminent.com" => File/Directory not found. "C:\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.iminent.com" => File/Directory not found. C:\Documents and Settings\Gitte\Desktop\ZulaGames.lnk => Moved successfully. "C:\Users\Gitte\Desktop\ZulaGames.lnk" => File/Directory not found. C:\Documents and Settings\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\zulagames@ZulaGames.com => Moved successfully. "C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\zulagames@ZulaGames.com" => File/Directory not found. C:\Documents and Settings\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\speedanalysis02@SpeedAnalysis.com => Moved successfully. "C:\Users\Gitte\AppData\Roaming\Mozilla\Firefox\Profileskmdq1sb8.default-1346945777968\speedanalysis02@SpeedAnalysis.com" => File/Directory not found. ========= reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-606896283-656086263-2595788825-1000\Software\Zula Games" /f ========= Der Vorgang wurde erfolgreich beendet. ========= End of Reg: ========= ========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AB072B9A-8614-4d01-A514-5D36A46DE10A}" /f ========= Der Vorgang wurde erfolgreich beendet. ========= End of Reg: ========= ========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{145AEB41-FD4F-4960-A9D7-D49E6541DEF9}" /f ========= Der Vorgang wurde erfolgreich beendet. ========= End of Reg: ========= ========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\zulagames" /f ========= Der Vorgang wurde erfolgreich beendet. ========= End of Reg: ========= ========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\IBUpdaterService" /f ========= Der Vorgang wurde erfolgreich beendet. ========= End of Reg: ========= ==== End of Fixlog ==== Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.02.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16721 Gitte :: GITTE-HP [Administrator] Schutz: Aktiviert 02.11.2013 12:22:56 mbam-log-2013-11-02 (12-22-56).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 204388 Laufzeit: 5 Minute(n), 12 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=7ecba4b567553c4d8e3008f3e57a08f2 # engine=15730 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-11-02 01:53:42 # local_time=2013-11-02 02:53:42 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5122 16777213 100 90 157718 132183018 0 0 # compatibility_mode=5893 16776574 100 94 157336 135030272 0 0 # scanned=190839 # found=1 # cleaned=0 # scan_time=8293 sh=0E7ADC69C61116EF698D27019B7E235216FC0F4A ft=0 fh=0000000000000000 vn="Win32/AdWare.AddLyrics.T application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Gitte\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnbbffeddnekkhjmokkhdebbfbibbflc\1.133_0\c.js.vir" Code:
ATTFilter Results of screen317's Security Check version 0.99.74 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` McAfee Anti-Virus und Anti-Spyware WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 25 Java version out of Date! Adobe Flash Player 11.9.900.117 Mozilla Firefox 19.0 Firefox out of Date! Google Chrome 29.0.1547.76 Google Chrome 30.0.1599.101 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
03.11.2013, 10:20 | #8 |
/// TB-Ausbilder | PC Performer - Zula Games: Laptop langsam Servus, Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber. Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 1 Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Schritt 2
Prüfe bitte auch (regelmässig) ob folgende Links fehlende Updates bei deinen Plugins zeigen: Schritt 3 Die Reihenfolge ist hier entscheidend.
Schritt 4 Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von Registry Cleanern. Diese Schaden deinem System mehr als dass sie helfen. Hier ein englischer Link: Miekemoes Blogspot ( MVP ) Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
03.11.2013, 17:51 | #9 |
| PC Performer - Zula Games: Laptop langsam Hallo Mathias, vielen vielen herzlichen Dank für Deine Mühen! Ich werde all Deine Tipps an meine Nachbarin weitergeben! ) Und ich hoffe das Ganze hält ein Weilchen!!!!!! Gruß franz |
04.11.2013, 15:58 | #10 |
/// TB-Ausbilder | PC Performer - Zula Games: Laptop langsam Das hängt ganz von dir ab. Ich bin froh, dass wir helfen konnten In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest: Lob, Kritik und Wünsche Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |