|
Plagegeister aller Art und deren Bekämpfung: rvzr-a.akamaihd.net - Werbung im Browser und Pop-UpsWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
14.11.2013, 00:36 | #1 |
| rvzr-a.akamaihd.net - Werbung im Browser und Pop-Ups Hi! Ich hatte etwa eine Woche lang ständig Pop-Ups mit dem Hinweis, dass mein Java veraltet ist. Ich glaube es fing alles mit einem versehentlichen Download von Snap.do an. Nun ist auch noch der Firefox voller Werbung (mit dem Zusatz "ads not by this site") und friert manchmal im Sekundentakt ein. Ich habe mich eben erst angemeldet und hoffe, dass man mir helfen kann und, dass ich alles richtig mache. Ich habe Antivir ohne Fund durchlaufen lassen, Malwarebytes hat dann relativ viel gefunden, aber nach Löschen und Neustart ist es scheinbar noch schlimmer geworden. Malwarebytes Log im Anhang Log von AdwCleaner - ich habe nichts gelöscht - im Anhang Da es zu meinem problem schon Threads gegeben hat, habe ich es auch mit FRST, Log auch im Anhang Vielen Dank im Voraus! |
14.11.2013, 06:36 | #2 |
/// the machine /// TB-Ausbilder | rvzr-a.akamaihd.net - Werbung im Browser und Pop-Ups Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
14.11.2013, 11:05 | #3 |
| rvzr-a.akamaihd.net - Werbung im Browser und Pop-Ups Hi, das Malware-Bytes-Log ist zu lang und dann kam der Hinweis, dass ich es als Anhang beifügen soll. Da es auch als einzelner Post zu lang ist, habe ich es noch einmal angehangen, sorry.
__________________FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-11-2013 01 Ran by Joshua (administrator) on JOSHUA-HP on 13-11-2013 23:28:23 Running from C:\Users\Joshua\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe (AMD) C:\Windows\system32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar3.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe (Dropbox, Inc.) C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated) HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [525312 2010-12-17] (IDT, Inc.) HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [499608 2011-03-30] (Adobe Systems Incorporated) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2013-11-05] (Hewlett-Packard) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKCU\...\Run: [Google Update] - C:\Users\Joshua\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2012-01-18] (Google Inc.) HKCU\...\Run: [Active Desktop Calendar] - C:\Program Files (x86)\XemiComputers\Active Desktop Calendar\ADC.exe HKCU\...\Run: [DAEMON Tools Pro Agent] - C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [3035968 2012-02-02] (DT Soft Ltd) HKCU\...\Run: [AlcoholAutomount] - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [33120 2010-08-20] (Alcohol Soft Development Team) HKCU\...\Run: [KSS] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202296 2012-04-25] (Kaspersky Lab ZAO) HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-01-01] () HKCU\...\Run: [Overwolf] - C:\Program Files (x86)\Overwolf\Overwolf.exe -silent HKCU\...\Policies\system: [DisableLockWorkstation] 0 HKCU\...\Policies\system: [DisableChangePassword] 0 HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-27] (Hewlett-Packard Company) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35768 2012-07-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.) HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.) HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\BrCtrCen.exe [114688 2008-12-24] (Brother Industries, Ltd.) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.) HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.) HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-12] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH) HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-09-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\FOXJOSH\...\Run: [Google Update] - C:\Users\FOXJOSH\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2012-02-05] (Google Inc.) HKU\FOXJOSH\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.) HKU\Ghost\...\Run: [Google Update] - C:\Users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-06-24] (Google Inc.) AppInit_DLLs: [ ] () Startup: C:\Users\FOXJOSH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\FOXJOSH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Inspector Josh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) Startup: C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 URLSearchHook: HKLM-x32 - MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\tbMyAs.dll (Conduit Ltd.) SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM - {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=ds&q={searchTerms}&installDate=09/11/2013 SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=ds&q={searchTerms}&installDate=09/11/2013 SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM-x32 - {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=ds&q={searchTerms}&installDate=09/11/2013 SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=ds&q={searchTerms}&installDate=09/11/2013 SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKCU - {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File BHO: Snap.DoEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\System32\mscoree.dll (Microsoft Corporation) BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\tbMyAs.dll (Conduit Ltd.) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\System32\mscoree.dll (Microsoft Corporation) Toolbar: HKLM-x32 - MyAshampoo Toolbar - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\tbMyAs.dll (Conduit Ltd.) Toolbar: HKLM-x32 - Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-07-19] (EasyBits Software Corp.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\7rl7q1vm.default-1384036364845 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll () FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Joshua\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Joshua\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Joshua\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Extension: Feven 1.5 - C:\Users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\7rl7q1vm.default-1384036364845\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} Chrome: ======= CHR HomePage: hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=hp&installDate=09/11/2013 CHR RestoreOnStartup: "urls_to_restore_on_startup": [ CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Extension: (Snap.Do ) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0 CHR Extension: (Feven 1.5) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg\1.25.48_0 CHR Extension: (YouTube) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 CHR Extension: (Google Search) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: (Unseen (formerly FB unseen)) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcedcpmfdpjijiamkaeaefgfagnnpei\0.1.8.3_0 CHR Extension: (Chrome In-App Payments service) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0 CHR Extension: (Gmail) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-09-28] (Advanced Micro Devices, Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG) R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202296 2012-04-25] (Kaspersky Lab ZAO) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-12] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-12] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-03-31] (DT Soft Ltd) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [503352 2012-03-31] () U3 awdm79gq; C:\Windows\System32\Drivers\awdm79gq.sys [0 ] (Advanced Micro Devices) S3 ALSysIO; \??\C:\Users\Ghost\AppData\Local\Temp\ALSysIO64.sys [x] S3 atillk64; \??\C:\Program Files (x86)\AMD\System Monitor\atillk64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-13 23:28 - 2013-11-13 23:29 - 00028159 _____ C:\Users\Joshua\Downloads\FRST.txt 2013-11-13 23:28 - 2013-11-13 23:28 - 00000000 ____D C:\FRST 2013-11-13 23:27 - 2013-11-13 23:27 - 02347384 _____ (ESET) C:\Users\Joshua\Downloads\esetsmartinstaller_enu.exe 2013-11-13 23:24 - 2013-11-13 23:26 - 00000000 ____D C:\AdwCleaner 2013-11-13 23:24 - 2013-11-13 23:24 - 01957626 _____ (Farbar) C:\Users\Joshua\Downloads\FRST64.exe 2013-11-13 23:22 - 2013-11-13 23:22 - 01085542 _____ C:\Users\Joshua\Downloads\adwcleaner_3012.exe 2013-11-13 17:08 - 2013-11-13 17:08 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Malwarebytes 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-13 17:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Joshua\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Inspector Josh\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Ghost\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\FOXJOSH\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000000 ____D C:\Program Files (x86)\RegCleaner 2013-11-13 14:14 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-13 14:14 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-13 14:14 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-13 14:14 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-13 14:14 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-13 14:14 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-13 14:14 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-13 14:14 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-13 14:14 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-13 14:13 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-13 14:13 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-13 14:13 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-13 14:13 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-13 14:13 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-13 12:00 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2013-11-13 12:00 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-13 12:00 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2013-11-13 12:00 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2013-11-13 12:00 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2013-11-13 12:00 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-13 12:00 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-11-13 12:00 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2013-11-13 12:00 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2013-11-13 12:00 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2013-11-13 12:00 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll 2013-11-13 12:00 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-11-13 12:00 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll 2013-11-13 12:00 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-13 12:00 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2013-11-13 12:00 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-11-13 12:00 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-11-13 12:00 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2013-11-13 12:00 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2013-11-13 12:00 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2013-11-13 12:00 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2013-11-13 12:00 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-13 12:00 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-11-13 12:00 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2013-11-13 12:00 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2013-11-13 12:00 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2013-11-13 12:00 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2013-11-13 12:00 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-11-13 12:00 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2013-11-13 12:00 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-11-12 16:06 - 2013-11-12 19:46 - 2829679690 _____ C:\Users\Joshua\Downloads\Anal Skills (2013) [DvdRip].mp4 2013-11-09 17:12 - 2013-11-09 17:12 - 00002384 _____ C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2013-11-09 17:11 - 2013-11-13 23:11 - 00001286 _____ C:\Windows\Tasks\Feven 1.5-updater.job 2013-11-09 17:11 - 2013-11-13 23:11 - 00001188 _____ C:\Windows\Tasks\Feven 1.5-codedownloader.job 2013-11-09 17:11 - 2013-11-13 23:11 - 00001088 _____ C:\Windows\Tasks\Feven 1.5-enabler.job 2013-11-09 17:11 - 2013-11-10 05:49 - 00000000 ____D C:\Program Files (x86)\MyPC Backup 2013-11-09 17:11 - 2013-11-09 17:11 - 00004316 _____ C:\Windows\System32\Tasks\Feven 1.5-updater 2013-11-09 17:11 - 2013-11-09 17:11 - 00004218 _____ C:\Windows\System32\Tasks\Feven 1.5-codedownloader 2013-11-09 17:11 - 2013-11-09 17:11 - 00004118 _____ C:\Windows\System32\Tasks\Feven 1.5-enabler 2013-11-09 17:10 - 2013-11-13 23:16 - 00001816 _____ C:\Windows\Tasks\Feven 1.5-firefoxinstaller.job 2013-11-09 17:10 - 2013-11-13 23:10 - 00001892 _____ C:\Windows\Tasks\Feven 1.5-chromeinstaller.job 2013-11-09 17:10 - 2013-11-13 20:15 - 00000000 ____D C:\Program Files (x86)\Feven 1.5 2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____D C:\Users\Joshua\AppData\Local\SearchProtect 2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____D C:\Program Files (x86)\SearchProtect 2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 _____ C:\END 2013-11-06 01:27 - 2013-11-06 01:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-11-05 20:12 - 2013-11-05 20:12 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-11-05 20:12 - 2013-11-05 20:12 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-10-31 06:51 - 2013-10-31 06:51 - 00000000 ____D C:\Users\Joshua\Documents\Diablo III 2013-10-31 02:05 - 2013-10-31 02:05 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RAR Password Recovery 2013-10-31 02:05 - 2013-10-31 02:05 - 00000000 ____D C:\Program Files (x86)\Intelore 2013-10-31 00:43 - 2013-10-31 06:50 - 00000000 ____D C:\Program Files (x86)\Diablo III 2013-10-31 00:43 - 2013-10-31 02:17 - 00000000 ____D C:\ProgramData\Blizzard Entertainment 2013-10-31 00:42 - 2013-10-31 00:42 - 00000000 ____D C:\ProgramData\Battle.net 2013-10-23 21:04 - 2013-10-23 21:04 - 00000000 ____D C:\Users\Joshua\Downloads\www.NewAlbumReleases.net_Le1f - Tree House (2013) 2013-10-18 09:34 - 2013-10-18 09:34 - 00000000 ____D C:\Program Files\McAfee Security Scan 2013-10-16 11:28 - 2013-11-05 20:13 - 00000000 ____D C:\ProgramData\Oracle 2013-10-16 11:28 - 2013-10-16 11:27 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-10-16 11:27 - 2013-10-16 11:27 - 00000000 ____D C:\Program Files\Java ==================== One Month Modified Files and Folders ======= 2013-11-13 23:29 - 2013-11-13 23:28 - 00028159 _____ C:\Users\Joshua\Downloads\FRST.txt 2013-11-13 23:28 - 2013-11-13 23:28 - 00000000 ____D C:\FRST 2013-11-13 23:27 - 2013-11-13 23:27 - 02347384 _____ (ESET) C:\Users\Joshua\Downloads\esetsmartinstaller_enu.exe 2013-11-13 23:26 - 2013-11-13 23:24 - 00000000 ____D C:\AdwCleaner 2013-11-13 23:24 - 2013-11-13 23:24 - 01957626 _____ (Farbar) C:\Users\Joshua\Downloads\FRST64.exe 2013-11-13 23:22 - 2013-11-13 23:22 - 01085542 _____ C:\Users\Joshua\Downloads\adwcleaner_3012.exe 2013-11-13 23:18 - 2012-01-31 20:53 - 00000000 ____D C:\Users\Joshua\Scans 2013-11-13 23:18 - 2012-01-19 07:47 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\vlc 2013-11-13 23:16 - 2013-11-09 17:10 - 00001816 _____ C:\Windows\Tasks\Feven 1.5-firefoxinstaller.job 2013-11-13 23:12 - 2012-06-24 17:07 - 00000908 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1005UA.job 2013-11-13 23:11 - 2013-11-09 17:11 - 00001286 _____ C:\Windows\Tasks\Feven 1.5-updater.job 2013-11-13 23:11 - 2013-11-09 17:11 - 00001188 _____ C:\Windows\Tasks\Feven 1.5-codedownloader.job 2013-11-13 23:11 - 2013-11-09 17:11 - 00001088 _____ C:\Windows\Tasks\Feven 1.5-enabler.job 2013-11-13 23:10 - 2013-11-09 17:10 - 00001892 _____ C:\Windows\Tasks\Feven 1.5-chromeinstaller.job 2013-11-13 23:02 - 2013-01-22 00:30 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-11-13 22:40 - 2012-02-05 23:34 - 00001128 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1004UA.job 2013-11-13 22:40 - 2012-01-18 01:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1001UA.job 2013-11-13 22:37 - 2012-04-03 08:25 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-11-13 22:08 - 2005-12-31 23:45 - 01855798 _____ C:\Windows\WindowsUpdate.log 2013-11-13 21:49 - 2012-10-08 17:23 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForJoshua 2013-11-13 21:49 - 2012-02-02 18:41 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForJoshua.job 2013-11-13 21:39 - 2013-01-01 21:33 - 00000000 ____D C:\Users\Joshua\AppData\Local\PMB Files 2013-11-13 21:39 - 2013-01-01 21:33 - 00000000 ____D C:\ProgramData\PMB Files 2013-11-13 20:26 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-13 20:26 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-13 20:24 - 2011-07-19 19:45 - 00697322 _____ C:\Windows\system32\perfh007.dat 2013-11-13 20:24 - 2011-07-19 19:45 - 00148328 _____ C:\Windows\system32\perfc007.dat 2013-11-13 20:24 - 2009-07-14 06:13 - 01614036 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-13 20:22 - 2012-03-25 16:14 - 00000000 ____D C:\Users\Joshua\Desktop\Mucke 2013-11-13 20:21 - 2012-01-17 21:15 - 00000000 ___RD C:\Users\Joshua\Dropbox 2013-11-13 20:21 - 2012-01-17 21:11 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Dropbox 2013-11-13 20:18 - 2013-01-22 00:30 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-11-13 20:17 - 2010-11-21 04:47 - 00784822 _____ C:\Windows\PFRO.log 2013-11-13 20:17 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-13 20:17 - 2009-07-14 05:51 - 00109357 _____ C:\Windows\setupact.log 2013-11-13 20:15 - 2013-11-09 17:10 - 00000000 ____D C:\Program Files (x86)\Feven 1.5 2013-11-13 20:15 - 2012-01-31 20:26 - 00000000 ____D C:\Program Files (x86)\SweetIM 2013-11-13 18:40 - 2012-01-18 01:41 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1001Core.job 2013-11-13 18:12 - 2012-06-24 17:07 - 00000856 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1005Core.job 2013-11-13 17:08 - 2013-11-13 17:08 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Malwarebytes 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Joshua\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Inspector Josh\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Ghost\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\FOXJOSH\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000000 ____D C:\Program Files (x86)\RegCleaner 2013-11-13 14:13 - 2013-07-29 02:01 - 00000000 ____D C:\Windows\system32\MRT 2013-11-13 14:10 - 2012-02-10 20:13 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-13 13:40 - 2012-02-05 23:34 - 00001076 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1004Core.job 2013-11-13 11:56 - 2012-01-17 18:05 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{2D8FFC54-CDA4-490C-82B4-FBA88BD0D8D6} 2013-11-12 22:15 - 2012-07-15 19:49 - 00000000 ____D C:\Users\Joshua\Desktop\shits 2013-11-12 21:02 - 2012-03-31 15:45 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\BitTorrent 2013-11-12 19:46 - 2013-11-12 16:06 - 2829679690 _____ C:\Users\Joshua\Downloads\Anal Skills (2013) [DvdRip].mp4 2013-11-12 11:17 - 2013-07-29 17:45 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-11-12 11:17 - 2013-07-29 17:45 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-11-12 10:59 - 2012-01-20 12:24 - 00000000 ____D C:\Users\Joshua\AppData\Local\CrashDumps 2013-11-10 05:49 - 2013-11-09 17:11 - 00000000 ____D C:\Program Files (x86)\MyPC Backup 2013-11-10 05:49 - 2012-01-17 18:05 - 00000000 ___RD C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-11-09 17:12 - 2013-11-09 17:12 - 00002384 _____ C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2013-11-09 17:11 - 2013-11-09 17:11 - 00004316 _____ C:\Windows\System32\Tasks\Feven 1.5-updater 2013-11-09 17:11 - 2013-11-09 17:11 - 00004218 _____ C:\Windows\System32\Tasks\Feven 1.5-codedownloader 2013-11-09 17:11 - 2013-11-09 17:11 - 00004118 _____ C:\Windows\System32\Tasks\Feven 1.5-enabler 2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____D C:\Users\Joshua\AppData\Local\SearchProtect 2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 ____D C:\Program Files (x86)\SearchProtect 2013-11-09 17:09 - 2013-11-09 17:09 - 00000000 _____ C:\END 2013-11-07 18:56 - 2012-05-05 07:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-11-07 16:00 - 2012-01-26 22:57 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-11-07 16:00 - 2012-01-19 18:31 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log 2013-11-06 17:07 - 2012-03-06 18:49 - 00000000 ____D C:\Users\Joshua\Desktop\Pix 2013-11-06 01:27 - 2013-11-06 01:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-11-05 21:17 - 2013-07-29 09:19 - 00000000 ____D C:\Users\Joshua\Desktop\Bewerbung 2013 2013-11-05 20:13 - 2013-10-16 11:28 - 00000000 ____D C:\ProgramData\Oracle 2013-11-05 20:12 - 2013-11-05 20:12 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-11-05 20:12 - 2013-11-05 20:12 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-11-05 20:12 - 2013-06-21 23:43 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-11-05 20:12 - 2013-06-21 23:43 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-11-05 20:12 - 2012-01-18 03:03 - 00000000 ____D C:\Program Files (x86)\java 2013-10-31 06:51 - 2013-10-31 06:51 - 00000000 ____D C:\Users\Joshua\Documents\Diablo III 2013-10-31 06:50 - 2013-10-31 00:43 - 00000000 ____D C:\Program Files (x86)\Diablo III 2013-10-31 02:17 - 2013-10-31 00:43 - 00000000 ____D C:\ProgramData\Blizzard Entertainment 2013-10-31 02:05 - 2013-10-31 02:05 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RAR Password Recovery 2013-10-31 02:05 - 2013-10-31 02:05 - 00000000 ____D C:\Program Files (x86)\Intelore 2013-10-31 00:42 - 2013-10-31 00:42 - 00000000 ____D C:\ProgramData\Battle.net 2013-10-29 23:04 - 2012-02-09 23:25 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\SoftGrid Client 2013-10-26 21:20 - 2013-02-07 16:06 - 00000000 ____D C:\Windows\Minidump 2013-10-26 21:19 - 2013-05-28 03:42 - 579745657 _____ C:\Windows\MEMORY.DMP 2013-10-24 14:41 - 2012-01-18 01:29 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2013-10-23 21:04 - 2013-10-23 21:04 - 00000000 ____D C:\Users\Joshua\Downloads\www.NewAlbumReleases.net_Le1f - Tree House (2013) 2013-10-21 11:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-10-18 09:34 - 2013-10-18 09:34 - 00000000 ____D C:\Program Files\McAfee Security Scan 2013-10-16 11:27 - 2013-10-16 11:28 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-10-16 11:27 - 2013-10-16 11:27 - 00000000 ____D C:\Program Files\Java 2013-10-16 11:22 - 2011-07-19 10:31 - 00000000 ____D C:\Windows\SysWOW64\Adobe 2013-10-16 11:07 - 2013-10-13 16:16 - 00000000 ____D C:\Users\Joshua\Desktop\filme 2013-10-16 11:06 - 2012-10-24 12:55 - 00000000 ____D C:\Users\Joshua\Desktop\Shows Some content of TEMP: ==================== C:\Users\FOXJOSH\AppData\Local\Temp\AskSLib.dll C:\Users\FOXJOSH\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe C:\Users\FOXJOSH\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe C:\Users\FOXJOSH\AppData\Local\Temp\Resource.exe C:\Users\FOXJOSH\AppData\Local\Temp\SkypeSetup.exe C:\Users\FOXJOSH\AppData\Local\Temp\sp54620.exe C:\Users\FOXJOSH\AppData\Local\Temp\swt-win32-3740.dll C:\Users\FOXJOSH\AppData\Local\Temp\UninstallHPSA.exe C:\Users\FOXJOSH\AppData\Local\Temp\xmlUpdater.exe C:\Users\FOXJOSH\AppData\Local\Temp\_is210A.exe C:\Users\Ghost\AppData\Local\Temp\SkypeSetup.exe C:\Users\Inspector Josh\AppData\Local\Temp\AskSLib.dll C:\Users\Joshua\AppData\Local\Temp\avgnt.exe C:\Users\Joshua\AppData\Local\Temp\BackupSetup.exe C:\Users\Joshua\AppData\Local\Temp\Extract.exe C:\Users\Joshua\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\Joshua\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\Joshua\AppData\Local\Temp\SkypeSetup.exe C:\Users\Joshua\AppData\Local\Temp\SP55081.exe C:\Users\Joshua\AppData\Local\Temp\SP55083.exe C:\Users\Joshua\AppData\Local\Temp\SP55085.exe C:\Users\Joshua\AppData\Local\Temp\SP55152.exe C:\Users\Joshua\AppData\Local\Temp\SP56215.exe C:\Users\Joshua\AppData\Local\Temp\SP56929.exe C:\Users\Joshua\AppData\Local\Temp\SP57049.exe C:\Users\Joshua\AppData\Local\Temp\vlc-2.0.8-win32.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-11-01 13:42 ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- AdwCleaner: Code:
ATTFilter # AdwCleaner v3.012 - Bericht erstellt am 14/11/2013 um 00:28:18 # Updated 11/11/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Joshua - JOSHUA-HP # Gestartet von : C:\Users\Joshua\Downloads\adwcleaner_3012.exe # Option : Suchen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Datei Gefunden : C:\Users\FOXJOSH\AppData\Roaming\Mozilla\Firefox\Profiles\57kcvvd4.default\searchplugins\Web Search.xml Datei Gefunden : C:\Users\Inspector Josh\AppData\Roaming\Mozilla\Firefox\Profiles\gri6rku0.default\searchplugins\Web Search.xml Datei Gefunden : C:\Windows\System32\Tasks\Feven 1.5-chromeinstaller Datei Gefunden : C:\Windows\System32\Tasks\Feven 1.5-codedownloader Datei Gefunden : C:\Windows\System32\Tasks\Feven 1.5-enabler Datei Gefunden : C:\Windows\System32\Tasks\Feven 1.5-firefoxinstaller Datei Gefunden : C:\Windows\System32\Tasks\Feven 1.5-updater Datei Gefunden : C:\Windows\Tasks\Feven 1.5-chromeinstaller.job Datei Gefunden : C:\Windows\Tasks\Feven 1.5-codedownloader.job Datei Gefunden : C:\Windows\Tasks\Feven 1.5-enabler.job Datei Gefunden : C:\Windows\Tasks\Feven 1.5-firefoxinstaller.job Datei Gefunden : C:\Windows\Tasks\Feven 1.5-updater.job Ordner Gefunden : C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl Ordner Gefunden : C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\baodmgdpdoelldjmkhknbolcldnfjegg Ordner Gefunden : C:\Users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\7rl7q1vm.default-1384036364845\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com Ordner Gefunden C:\Program Files (x86)\Feven 1.5 Ordner Gefunden C:\Users\FOXJOSH\AppData\LocalLow\SweetIM Ordner Gefunden C:\Users\Ghost\AppData\LocalLow\Conduit Ordner Gefunden C:\Users\Ghost\AppData\LocalLow\ConduitEngine Ordner Gefunden C:\Users\Ghost\AppData\LocalLow\MyAshampoo Ordner Gefunden C:\Users\Ghost\AppData\LocalLow\SweetIM Ordner Gefunden C:\Users\Inspector Josh\AppData\LocalLow\Conduit Ordner Gefunden C:\Users\Inspector Josh\AppData\LocalLow\ConduitEngine Ordner Gefunden C:\Users\Inspector Josh\AppData\LocalLow\MyAshampoo Ordner Gefunden C:\Users\Inspector Josh\AppData\LocalLow\PriceGong Ordner Gefunden C:\Users\Inspector Josh\AppData\LocalLow\SweetIM Ordner Gefunden C:\Users\Joshua\AppData\Local\Temp\OCS Ordner Gefunden C:\Users\Joshua\AppData\Local\Temp\Smartbar ***** [ Verknüpfungen ] ***** Verknüpfung Gefunden : C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk ( hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=sc&installDate=09/11/2013 ) ***** [ Registrierungsdatenbank ] ***** Schlüssel Gefunden : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F} Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Feven 1.5 Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\MyAshampoo Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\MyAshampoo\toolbar Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EDA8054B-E8A7-46F4-B197-3218DB72466C} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gefunden : HKCU\Software\OCS Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Schlüssel Gefunden : [x64] HKCU\Software\OCS Schlüssel Gefunden : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322852232} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{78EE86C9-A580-43E8-9C13-12F85C2829CE} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EDA8054B-E8A7-46F4-B197-3218DB72466C} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366856632} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2475029 Schlüssel Gefunden : HKLM\Software\Feven 1.5 Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28289B8D-354B-4DD8-860E-AE9BD982BAE4} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{440ecee3-187c-4d2c-b394-f11ba44cc47f} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{440ecee3-187c-4d2c-b394-f11ba44cc47f} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{440ecee3-187c-4d2c-b394-f11ba44cc47f} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5bde3de1-fd12-4a16-9704-d95da11546d8} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5bde3de1-fd12-4a16-9704-d95da11546d8} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5bde3de1-fd12-4a16-9704-d95da11546d8} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b84b598a-16a7-4f06-9bbb-ed8ac96c4deb} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b84b598a-16a7-4f06-9bbb-ed8ac96c4deb} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b84b598a-16a7-4f06-9bbb-ed8ac96c4deb} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ee347705-fa43-4899-9566-03009a106596} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ee347705-fa43-4899-9566-03009a106596} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ee347705-fa43-4899-9566-03009a106596} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbfbde7e-c983-4984-acd2-eae776f6a2fb} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbfbde7e-c983-4984-acd2-eae776f6a2fb} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbfbde7e-c983-4984-acd2-eae776f6a2fb} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-player_RASAPI32 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-player_RASMANCS Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A1E75A0E-4397-4BA8-BB50-E19FB66890F4} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78EE86C9-A580-43E8-9C13-12F85C2829CE} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Feven 1.5 Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyAshampoo Toolbar Schlüssel Gefunden : HKLM\Software\MyAshampoo Schlüssel Gefunden : HKLM\Software\MyAshampoo\toolbar Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322852232} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366856632} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{440ecee3-187c-4d2c-b394-f11ba44cc47f} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{440ecee3-187c-4d2c-b394-f11ba44cc47f} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{440ecee3-187c-4d2c-b394-f11ba44cc47f} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5bde3de1-fd12-4a16-9704-d95da11546d8} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5bde3de1-fd12-4a16-9704-d95da11546d8} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5bde3de1-fd12-4a16-9704-d95da11546d8} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b84b598a-16a7-4f06-9bbb-ed8ac96c4deb} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b84b598a-16a7-4f06-9bbb-ed8ac96c4deb} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b84b598a-16a7-4f06-9bbb-ed8ac96c4deb} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ee347705-fa43-4899-9566-03009a106596} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ee347705-fa43-4899-9566-03009a106596} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ee347705-fa43-4899-9566-03009a106596} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbfbde7e-c983-4984-acd2-eae776f6a2fb} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbfbde7e-c983-4984-acd2-eae776f6a2fb} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fbfbde7e-c983-4984-acd2-eae776f6a2fb} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}] Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}] Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}] Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}] Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}] Wert Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] ***** [ Browser ] ***** -\\ Internet Explorer v10.0.9200.16736 Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default] - hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=ds&q={searchTerms}&installDate=09/11/2013 Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default] - hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=ds&q={searchTerms}&installDate=09/11/2013 -\\ Mozilla Firefox v25.0 (en-US) [ Datei : C:\Users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\7rl7q1vm.default-1384036364845\prefs.js ] Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.InstallationThankYouPage", true); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.InstallationTime", 1384260494); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.active", true); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.addressbar", "NA"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.addressbarenhanced", ""); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.asyncdb_dbWasSet", true); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.asyncdb_dbWasSet_FF25_FIX", true); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.asyncinternaldb_dbWasSet", true); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.asyncinternaldb_dbWasSet_FF25_FIX", true); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.backgroundver", 1); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.certdomaininstaller", ""); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.changeprevious", false); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie.InstallationTime.value", "1384260494"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie._GPL_aoi.value", "%221384261499%22"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie._GPL_parent_zoneid.value", "%22345637%22"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie._GPL_zoneid.value", "%22418824%22"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie.geo.expiration", "Tue Nov 19 2013 14:05:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie.geo.value", "%22DE%22"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie.jw_token.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.cookie.jw_token.value", "%22394a6532-b73c-9470-ddd8-2326d1c34836%22"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.description", "Feven Shopping Companion"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.domain", ""); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.enablesearch", false); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.homepage", ""); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.iframe", false); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3A%2279DE87863ECF4D478CE32E5AF3813[...] Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.InstallerParamsCache.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.InstallerParamsCache.value", "%7B%22source_id%22%3A%22000272%22%2C%22sub_id%22%3A%220%2[...] Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.InstallerUserIdentifiersCache.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.InstallerUserIdentifiersCache.value", "%7B%22installer_bic%22%3A%2279DE87863ECF4D478CE3[...] Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_appVer.value", "50"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_lastVersion.value", "1"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_meta.value", "%7B%7D"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_nextCheck.expiration", "Thu Nov 14 2013 02:23:08 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_nextCheck.value", "true"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_queue.value", "%7B%7D"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_remote_resources.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.Resources_remote_resources.value", "%7B%22remoteId%22%3A0%7D"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb._country_code_.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb._country_code_.value", "%22DE%22"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.installer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.installer.value", "%7B%22InstallerIdentifiers%22%3A%7B%22installer_bic%22%3A%2279DE8786[...] Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.monetization_plugin_last_executable_request.expiration", "Thu Nov 14 2013 11:34:09 GMT+[...] Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.internaldb.monetization_plugin_last_executable_request.value", "%22hxxp%3A//dl.cdn.chip.de/downloa[...] Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.lastDailyReport", "1384383957816"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.lastUpdate", "1384370588609"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.manifesturl", ""); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.name", "Feven 1.5"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.newtab", ""); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.opensearch", ""); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.pluginsurl", "hxxps://w9u6a2p6.ssl.hwcdn.net/plugin/apps/38532/plugins/093/ff/plugins.json"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.pluginsversion", 47); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.publisher", "Feven"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.searchstatus", 0); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.setnewtab", false); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.thankyou", ""); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.updateinterval", 360); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.38532.ver", 50); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.apps", "38532"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.bic", "1424c5ae0cd6c302346bf748c953d2bb"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.cid", 38532); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.firstrun", false); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.hadappinstalled", true); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.installationdate", 1384260494); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.modetype", "production"); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.reportInstall", true); Zeile gefunden : user_pref("extensions.a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532.statsDailyCounter", 5); Zeile gefunden : user_pref("extensions.crossrider.bic", "1424c5ae0cd6c302346bf748c953d2bb"); [ Datei : C:\Users\FOXJOSH\AppData\Roaming\Mozilla\Firefox\Profiles\57kcvvd4.default\prefs.js ] Zeile gefunden : user_pref("browser.startup.homepage", "hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=hp&installDate=09/11/2013"); Zeile gefunden : user_pref("browser.search.selectedEngine", "Web Search"); Zeile gefunden : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=ds&installDate=09/11/2013&q="); Zeile gefunden : user_pref("browser.newtab.url", "hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=nt&installDate=09/11/2013"); [ Datei : C:\Users\Inspector Josh\AppData\Roaming\Mozilla\Firefox\Profiles\gri6rku0.default\prefs.js ] Zeile gefunden : user_pref("browser.startup.homepage", "hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=hp&installDate=09/11/2013"); Zeile gefunden : user_pref("browser.search.selectedEngine", "Web Search"); Zeile gefunden : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=ds&installDate=09/11/2013&q="); Zeile gefunden : user_pref("browser.newtab.url", "hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=4f8bd189-b668-b021-d6f5-69fd8ad49d4d&searchtype=nt&installDate=09/11/2013"); -\\ Google Chrome v [ Datei : C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\preferences ] Gefunden : homepage Gefunden : urls_to_restore_on_startup [ Datei : C:\Users\FOXJOSH\AppData\Local\Google\Chrome\User Data\Default\preferences ] Gefunden : homepage Gefunden : urls_to_restore_on_startup [ Datei : C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\preferences ] Gefunden : homepage Gefunden : urls_to_restore_on_startup ************************* AdwCleaner[R0].txt - [36164 octets] - [13/11/2013 23:24:57] AdwCleaner[R1].txt - [36225 octets] - [13/11/2013 23:42:20] AdwCleaner[R2].txt - [31658 octets] - [14/11/2013 00:14:43] AdwCleaner[R3].txt - [31417 octets] - [14/11/2013 00:28:18] ########## EOF - C:\AdwCleaner\AdwCleaner[R3].txt - [31478 octets] ########## |
14.11.2013, 13:26 | #4 |
| rvzr-a.akamaihd.net - Werbung im Browser und Pop-Ups Malwarebytes Log als Anhang angefügt. Auch hierbei heißt es, dass di Datei als Text zu groß sei, daher geht es nur als RAR. |
15.11.2013, 10:25 | #5 |
/// the machine /// TB-Ausbilder | rvzr-a.akamaihd.net - Werbung im Browser und Pop-Ups Fund bei ADW und MBAM musst du auch löschen lassen. Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
15.11.2013, 14:14 | #6 |
| rvzr-a.akamaihd.net - Werbung im Browser und Pop-Ups hi, vielen dank für deine mühen. entschuldige bitte, dass ich keine ahnung von diesen dingen habe. MBAM zeigt immer an, dass nichts gefunden wurde, daher wird auch nichts zum löschen angezeigt, log als anhang. JRT: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.8 (11.05.2013:1) OS: Windows 7 Home Premium x64 Ran by Joshua on 15.11.2013 at 13:21:33,76 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3B1AD447-318E-4575-8010-8A56A16120C4} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{3B1AD447-318E-4575-8010-8A56A16120C4} ~~~ Files ~~~ Folders Successfully deleted: [Empty Folder] C:\Users\Joshua\appdata\local\{03710E9D-C325-46C8-B7D0-E5B7242E0FBD} ~~~ FireFox Emptied folder: C:\Users\Joshua\AppData\Roaming\mozilla\firefox\profiles\7rl7q1vm.default-1384036364845\minidumps [3 files] ~~~ Chrome Successfully deleted: [Folder] C:\Users\Joshua\appdata\local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 15.11.2013 at 14:05:59,46 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-11-2013 Ran by Joshua (administrator) on JOSHUA-HP on 15-11-2013 14:10:47 Running from C:\Users\Joshua\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe (AMD) C:\Windows\system32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar3.exe (DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe (Dropbox, Inc.) C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe () C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe () C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.191\deploy\LoLLauncher.exe () C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.57\deploy\LolClient.exe (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe () C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated) HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [525312 2010-12-17] (IDT, Inc.) HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [499608 2011-03-30] (Adobe Systems Incorporated) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2013-11-05] (Hewlett-Packard) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKCU\...\Run: [Google Update] - C:\Users\Joshua\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2012-01-18] (Google Inc.) HKCU\...\Run: [Active Desktop Calendar] - C:\Program Files (x86)\XemiComputers\Active Desktop Calendar\ADC.exe HKCU\...\Run: [DAEMON Tools Pro Agent] - C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [3035968 2012-02-02] (DT Soft Ltd) HKCU\...\Run: [AlcoholAutomount] - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [33120 2010-08-20] (Alcohol Soft Development Team) HKCU\...\Run: [KSS] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202296 2012-04-25] (Kaspersky Lab ZAO) HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-01-01] () HKCU\...\Run: [Overwolf] - C:\Program Files (x86)\Overwolf\Overwolf.exe -silent HKCU\...\Policies\system: [DisableLockWorkstation] 0 HKCU\...\Policies\system: [DisableChangePassword] 0 HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-27] (Hewlett-Packard Company) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35768 2012-07-27] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.) HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.) HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\BrCtrCen.exe [114688 2008-12-24] (Brother Industries, Ltd.) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.) HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.) HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-12] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH) HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-09-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\FOXJOSH\...\Run: [Google Update] - C:\Users\FOXJOSH\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2012-02-05] (Google Inc.) HKU\FOXJOSH\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.) HKU\Ghost\...\Run: [Google Update] - C:\Users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-06-24] (Google Inc.) AppInit_DLLs: [ ] () Startup: C:\Users\FOXJOSH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\FOXJOSH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Inspector Josh\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Joshua\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) Startup: C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM - {3B1AD447-318E-4575-8010-8A56A16120C4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} BHO: Feven 1.5 - {11111111-1111-1111-1111-110311851132} - C:\Program Files (x86)\Feven 1.5\Feven 1.5-bho64.dll No File BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-07-19] (EasyBits Software Corp.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\7rl7q1vm.default-1384036364845 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll () FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Joshua\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Joshua\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Joshua\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} Chrome: ======= CHR HomePage: hxxp://www.google.com CHR RestoreOnStartup: "urls_to_restore_on_startup": [ CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Extension: (YouTube) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 CHR Extension: (Google Search) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: (Unseen (formerly FB unseen)) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcedcpmfdpjijiamkaeaefgfagnnpei\0.1.8.3_0 CHR Extension: (Chrome In-App Payments service) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0 CHR Extension: (Gmail) - C:\Users\Joshua\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-09-28] (Advanced Micro Devices, Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG) R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202296 2012-04-25] (Kaspersky Lab ZAO) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-12] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-12] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-03-31] (DT Soft Ltd) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [503352 2012-03-31] () U3 atzrod57; C:\Windows\System32\Drivers\atzrod57.sys [0 ] (Advanced Micro Devices) S3 ALSysIO; \??\C:\Users\Ghost\AppData\Local\Temp\ALSysIO64.sys [x] S3 atillk64; \??\C:\Program Files (x86)\AMD\System Monitor\atillk64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-15 14:11 - 2013-11-15 14:11 - 00000733 _____ C:\Users\Joshua\Desktop\mbam-log-2013-11-15 (10-42-02).rar 2013-11-15 14:10 - 2013-11-15 14:10 - 01957794 _____ (Farbar) C:\Users\Joshua\Downloads\FRST64.exe 2013-11-15 14:06 - 2013-11-15 14:06 - 00001332 _____ C:\Users\Joshua\Desktop\JRT.txt 2013-11-15 10:40 - 2013-11-15 10:40 - 00027227 _____ C:\Users\Joshua\Desktop\AdwCleaner 15.11..txt 2013-11-15 10:29 - 2013-11-15 10:29 - 00001931 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2013-11-14 10:59 - 2013-11-14 10:59 - 00000000 ____D C:\Users\Joshua\Desktop\FRST 2013-11-14 00:35 - 2013-11-14 00:35 - 00000801 _____ C:\Users\Joshua\Desktop\Trojaner2.txt 2013-11-14 00:30 - 2013-11-14 00:30 - 00031719 _____ C:\Users\Joshua\Desktop\AdwCleaner[R3].txt 2013-11-14 00:11 - 2013-11-14 00:11 - 00001097 _____ C:\Musik - Verknüpfung.lnk 2013-11-14 00:11 - 2013-11-14 00:11 - 00000000 ____D C:\Users\Joshua\Desktop\Security 2013-11-14 00:07 - 2013-11-14 00:22 - 00277580 _____ C:\Users\Joshua\Desktop\Trojaner.txt 2013-11-13 23:57 - 2013-11-13 23:57 - 00000000 ____D C:\Windows\ERUNT 2013-11-13 23:56 - 2013-11-13 23:56 - 01034531 _____ (Thisisu) C:\Users\Joshua\Downloads\JRT.exe 2013-11-13 23:30 - 2013-11-13 23:32 - 00034310 _____ C:\Users\Joshua\Downloads\Addition.txt 2013-11-13 23:28 - 2013-11-15 14:10 - 00023442 _____ C:\Users\Joshua\Downloads\FRST.txt 2013-11-13 23:28 - 2013-11-13 23:28 - 00000000 ____D C:\FRST 2013-11-13 23:27 - 2013-11-13 23:27 - 02347384 _____ (ESET) C:\Users\Joshua\Downloads\esetsmartinstaller_enu.exe 2013-11-13 23:24 - 2013-11-15 10:36 - 00000000 ____D C:\AdwCleaner 2013-11-13 23:22 - 2013-11-13 23:22 - 01085542 _____ C:\Users\Joshua\Downloads\adwcleaner_3012.exe 2013-11-13 17:08 - 2013-11-13 17:08 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Malwarebytes 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-13 17:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-11-13 17:00 - 2013-11-14 00:10 - 00000000 ____D C:\Program Files (x86)\RegCleaner 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Joshua\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Inspector Josh\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Ghost\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\FOXJOSH\Desktop\RegCleaner.lnk 2013-11-13 14:14 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-13 14:14 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-13 14:14 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-13 14:14 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-13 14:14 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-13 14:14 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-11-13 14:14 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-11-13 14:14 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-13 14:14 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-11-13 14:14 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-13 14:14 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-11-13 14:13 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-13 14:13 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-13 14:13 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-13 14:13 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-13 14:13 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-13 12:00 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2013-11-13 12:00 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-13 12:00 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2013-11-13 12:00 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2013-11-13 12:00 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2013-11-13 12:00 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-13 12:00 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-11-13 12:00 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2013-11-13 12:00 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2013-11-13 12:00 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2013-11-13 12:00 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll 2013-11-13 12:00 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-11-13 12:00 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll 2013-11-13 12:00 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-13 12:00 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2013-11-13 12:00 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-11-13 12:00 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-11-13 12:00 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2013-11-13 12:00 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2013-11-13 12:00 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2013-11-13 12:00 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2013-11-13 12:00 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-13 12:00 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-11-13 12:00 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2013-11-13 12:00 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2013-11-13 12:00 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2013-11-13 12:00 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2013-11-13 12:00 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-11-13 12:00 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2013-11-13 12:00 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-11-12 16:06 - 2013-11-12 19:46 - 2829679690 _____ C:\Users\Joshua\Downloads\Anal Skills (2013) [DvdRip].mp4 2013-11-09 17:12 - 2013-11-15 10:35 - 00001083 _____ C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2013-11-06 01:27 - 2013-11-06 01:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-11-05 20:12 - 2013-11-05 20:12 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-11-05 20:12 - 2013-11-05 20:12 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-10-31 06:51 - 2013-10-31 06:51 - 00000000 ____D C:\Users\Joshua\Documents\Diablo III 2013-10-31 02:05 - 2013-10-31 02:05 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RAR Password Recovery 2013-10-31 02:05 - 2013-10-31 02:05 - 00000000 ____D C:\Program Files (x86)\Intelore 2013-10-31 00:43 - 2013-10-31 06:50 - 00000000 ____D C:\Program Files (x86)\Diablo III 2013-10-31 00:43 - 2013-10-31 02:17 - 00000000 ____D C:\ProgramData\Blizzard Entertainment 2013-10-31 00:42 - 2013-10-31 00:42 - 00000000 ____D C:\ProgramData\Battle.net 2013-10-23 21:04 - 2013-10-23 21:04 - 00000000 ____D C:\Users\Joshua\Downloads\www.NewAlbumReleases.net_Le1f - Tree House (2013) 2013-10-18 09:34 - 2013-11-15 10:29 - 00000000 ____D C:\Program Files\McAfee Security Scan 2013-10-16 11:28 - 2013-11-05 20:13 - 00000000 ____D C:\ProgramData\Oracle 2013-10-16 11:28 - 2013-10-16 11:27 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-10-16 11:27 - 2013-10-16 11:27 - 00000000 ____D C:\Program Files\Java ==================== One Month Modified Files and Folders ======= 2013-11-15 14:12 - 2013-11-13 23:28 - 00023442 _____ C:\Users\Joshua\Downloads\FRST.txt 2013-11-15 14:12 - 2013-01-01 21:33 - 00000000 ____D C:\Users\Joshua\AppData\Local\PMB Files 2013-11-15 14:12 - 2012-06-24 17:07 - 00000908 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1005UA.job 2013-11-15 14:11 - 2013-11-15 14:11 - 00000733 _____ C:\Users\Joshua\Desktop\mbam-log-2013-11-15 (10-42-02).rar 2013-11-15 14:10 - 2013-11-15 14:10 - 01957794 _____ (Farbar) C:\Users\Joshua\Downloads\FRST64.exe 2013-11-15 14:06 - 2013-11-15 14:06 - 00001332 _____ C:\Users\Joshua\Desktop\JRT.txt 2013-11-15 14:02 - 2013-01-22 00:30 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-11-15 13:40 - 2012-02-05 23:34 - 00001128 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1004UA.job 2013-11-15 13:40 - 2012-02-05 23:34 - 00001076 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1004Core.job 2013-11-15 13:40 - 2012-01-18 01:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1001UA.job 2013-11-15 13:37 - 2012-04-03 08:25 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-11-15 13:27 - 2013-01-01 21:33 - 00000000 ____D C:\ProgramData\PMB Files 2013-11-15 13:19 - 2012-01-17 18:05 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{2D8FFC54-CDA4-490C-82B4-FBA88BD0D8D6} 2013-11-15 12:40 - 2005-12-31 23:45 - 02020910 _____ C:\Windows\WindowsUpdate.log 2013-11-15 11:06 - 2012-04-02 20:30 - 00000000 ____D C:\Program Files (x86)\Diablo 2013-11-15 10:47 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-15 10:47 - 2009-07-14 05:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-15 10:40 - 2013-11-15 10:40 - 00027227 _____ C:\Users\Joshua\Desktop\AdwCleaner 15.11..txt 2013-11-15 10:40 - 2012-01-17 21:15 - 00000000 ___RD C:\Users\Joshua\Dropbox 2013-11-15 10:40 - 2012-01-17 21:11 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Dropbox 2013-11-15 10:37 - 2013-01-22 00:30 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-11-15 10:37 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-15 10:37 - 2009-07-14 05:51 - 00109581 _____ C:\Windows\setupact.log 2013-11-15 10:36 - 2013-11-13 23:24 - 00000000 ____D C:\AdwCleaner 2013-11-15 10:36 - 2012-10-24 12:55 - 00000000 ____D C:\Users\Joshua\Desktop\Shows 2013-11-15 10:35 - 2013-11-09 17:12 - 00001083 _____ C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2013-11-15 10:29 - 2013-11-15 10:29 - 00001931 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2013-11-15 10:29 - 2013-10-18 09:34 - 00000000 ____D C:\Program Files\McAfee Security Scan 2013-11-14 18:40 - 2012-01-18 01:41 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1001Core.job 2013-11-14 18:34 - 2012-01-26 22:57 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-11-14 18:34 - 2012-01-19 18:31 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log 2013-11-14 10:59 - 2013-11-14 10:59 - 00000000 ____D C:\Users\Joshua\Desktop\FRST 2013-11-14 00:35 - 2013-11-14 00:35 - 00000801 _____ C:\Users\Joshua\Desktop\Trojaner2.txt 2013-11-14 00:30 - 2013-11-14 00:30 - 00031719 _____ C:\Users\Joshua\Desktop\AdwCleaner[R3].txt 2013-11-14 00:22 - 2013-11-14 00:07 - 00277580 _____ C:\Users\Joshua\Desktop\Trojaner.txt 2013-11-14 00:11 - 2013-11-14 00:11 - 00001097 _____ C:\Musik - Verknüpfung.lnk 2013-11-14 00:11 - 2013-11-14 00:11 - 00000000 ____D C:\Users\Joshua\Desktop\Security 2013-11-14 00:10 - 2013-11-13 17:00 - 00000000 ____D C:\Program Files (x86)\RegCleaner 2013-11-13 23:57 - 2013-11-13 23:57 - 00000000 ____D C:\Windows\ERUNT 2013-11-13 23:56 - 2013-11-13 23:56 - 01034531 _____ (Thisisu) C:\Users\Joshua\Downloads\JRT.exe 2013-11-13 23:32 - 2013-11-13 23:30 - 00034310 _____ C:\Users\Joshua\Downloads\Addition.txt 2013-11-13 23:28 - 2013-11-13 23:28 - 00000000 ____D C:\FRST 2013-11-13 23:27 - 2013-11-13 23:27 - 02347384 _____ (ESET) C:\Users\Joshua\Downloads\esetsmartinstaller_enu.exe 2013-11-13 23:22 - 2013-11-13 23:22 - 01085542 _____ C:\Users\Joshua\Downloads\adwcleaner_3012.exe 2013-11-13 23:18 - 2012-01-31 20:53 - 00000000 ____D C:\Users\Joshua\Scans 2013-11-13 23:18 - 2012-01-19 07:47 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\vlc 2013-11-13 21:49 - 2012-10-08 17:23 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForJoshua 2013-11-13 21:49 - 2012-02-02 18:41 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForJoshua.job 2013-11-13 20:24 - 2011-07-19 19:45 - 00697322 _____ C:\Windows\system32\perfh007.dat 2013-11-13 20:24 - 2011-07-19 19:45 - 00148328 _____ C:\Windows\system32\perfc007.dat 2013-11-13 20:24 - 2009-07-14 06:13 - 01614036 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-13 20:22 - 2012-03-25 16:14 - 00000000 ____D C:\Users\Joshua\Desktop\Mucke 2013-11-13 20:17 - 2010-11-21 04:47 - 00784822 _____ C:\Windows\PFRO.log 2013-11-13 18:12 - 2012-06-24 17:07 - 00000856 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3734979694-1403561643-1882672030-1005Core.job 2013-11-13 17:08 - 2013-11-13 17:08 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Malwarebytes 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-13 17:08 - 2013-11-13 17:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Joshua\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Inspector Josh\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\Ghost\Desktop\RegCleaner.lnk 2013-11-13 17:00 - 2013-11-13 17:00 - 00000962 _____ C:\Users\FOXJOSH\Desktop\RegCleaner.lnk 2013-11-13 14:13 - 2013-07-29 02:01 - 00000000 ____D C:\Windows\system32\MRT 2013-11-13 14:10 - 2012-02-10 20:13 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-12 22:15 - 2012-07-15 19:49 - 00000000 ____D C:\Users\Joshua\Desktop\shits 2013-11-12 21:02 - 2012-03-31 15:45 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\BitTorrent 2013-11-12 19:46 - 2013-11-12 16:06 - 2829679690 _____ C:\Users\Joshua\Downloads\Anal Skills (2013) [DvdRip].mp4 2013-11-12 11:17 - 2013-07-29 17:45 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-11-12 11:17 - 2013-07-29 17:45 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-11-12 10:59 - 2012-01-20 12:24 - 00000000 ____D C:\Users\Joshua\AppData\Local\CrashDumps 2013-11-10 05:49 - 2012-01-17 18:05 - 00000000 ___RD C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-11-07 18:56 - 2012-05-05 07:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-11-06 17:07 - 2012-03-06 18:49 - 00000000 ____D C:\Users\Joshua\Desktop\Pix 2013-11-06 01:27 - 2013-11-06 01:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-11-05 21:17 - 2013-07-29 09:19 - 00000000 ____D C:\Users\Joshua\Desktop\Bewerbung 2013 2013-11-05 20:13 - 2013-10-16 11:28 - 00000000 ____D C:\ProgramData\Oracle 2013-11-05 20:12 - 2013-11-05 20:12 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-11-05 20:12 - 2013-11-05 20:12 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-11-05 20:12 - 2013-06-21 23:43 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-11-05 20:12 - 2013-06-21 23:43 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-11-05 20:12 - 2012-01-18 03:03 - 00000000 ____D C:\Program Files (x86)\java 2013-10-31 06:51 - 2013-10-31 06:51 - 00000000 ____D C:\Users\Joshua\Documents\Diablo III 2013-10-31 06:50 - 2013-10-31 00:43 - 00000000 ____D C:\Program Files (x86)\Diablo III 2013-10-31 02:17 - 2013-10-31 00:43 - 00000000 ____D C:\ProgramData\Blizzard Entertainment 2013-10-31 02:05 - 2013-10-31 02:05 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RAR Password Recovery 2013-10-31 02:05 - 2013-10-31 02:05 - 00000000 ____D C:\Program Files (x86)\Intelore 2013-10-31 00:42 - 2013-10-31 00:42 - 00000000 ____D C:\ProgramData\Battle.net 2013-10-29 23:04 - 2012-02-09 23:25 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\SoftGrid Client 2013-10-26 21:20 - 2013-02-07 16:06 - 00000000 ____D C:\Windows\Minidump 2013-10-26 21:19 - 2013-05-28 03:42 - 579745657 _____ C:\Windows\MEMORY.DMP 2013-10-24 14:41 - 2012-01-18 01:29 - 00000000 ____D C:\Users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2013-10-23 21:04 - 2013-10-23 21:04 - 00000000 ____D C:\Users\Joshua\Downloads\www.NewAlbumReleases.net_Le1f - Tree House (2013) 2013-10-21 11:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-10-16 11:27 - 2013-10-16 11:28 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-10-16 11:27 - 2013-10-16 11:27 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-10-16 11:27 - 2013-10-16 11:27 - 00000000 ____D C:\Program Files\Java 2013-10-16 11:22 - 2011-07-19 10:31 - 00000000 ____D C:\Windows\SysWOW64\Adobe 2013-10-16 11:07 - 2013-10-13 16:16 - 00000000 ____D C:\Users\Joshua\Desktop\filme Some content of TEMP: ==================== C:\Users\FOXJOSH\AppData\Local\Temp\AskSLib.dll C:\Users\FOXJOSH\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe C:\Users\FOXJOSH\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe C:\Users\FOXJOSH\AppData\Local\Temp\Resource.exe C:\Users\FOXJOSH\AppData\Local\Temp\SkypeSetup.exe C:\Users\FOXJOSH\AppData\Local\Temp\sp54620.exe C:\Users\FOXJOSH\AppData\Local\Temp\swt-win32-3740.dll C:\Users\FOXJOSH\AppData\Local\Temp\UninstallHPSA.exe C:\Users\FOXJOSH\AppData\Local\Temp\xmlUpdater.exe C:\Users\FOXJOSH\AppData\Local\Temp\_is210A.exe C:\Users\Ghost\AppData\Local\Temp\SkypeSetup.exe C:\Users\Inspector Josh\AppData\Local\Temp\AskSLib.dll C:\Users\Joshua\AppData\Local\Temp\avgnt.exe C:\Users\Joshua\AppData\Local\Temp\BackupSetup.exe C:\Users\Joshua\AppData\Local\Temp\Extract.exe C:\Users\Joshua\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\Joshua\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\Joshua\AppData\Local\Temp\Quarantine.exe C:\Users\Joshua\AppData\Local\Temp\SkypeSetup.exe C:\Users\Joshua\AppData\Local\Temp\SP55081.exe C:\Users\Joshua\AppData\Local\Temp\SP55083.exe C:\Users\Joshua\AppData\Local\Temp\SP55085.exe C:\Users\Joshua\AppData\Local\Temp\SP55152.exe C:\Users\Joshua\AppData\Local\Temp\SP56215.exe C:\Users\Joshua\AppData\Local\Temp\SP56929.exe C:\Users\Joshua\AppData\Local\Temp\SP57049.exe C:\Users\Joshua\AppData\Local\Temp\vlc-2.0.8-win32.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-11-01 13:42 ==================== End Of Log ============================ danke und besten gruß! |
16.11.2013, 12:02 | #7 |
/// the machine /// TB-Ausbilder | rvzr-a.akamaihd.net - Werbung im Browser und Pop-UpsESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu rvzr-a.akamaihd.net - Werbung im Browser und Pop-Ups |
ads, angemeldet, antivir, browser, download, firefox, friert, fund, gelöscht, hinweis, java, log, löschen, malwarebytes, neustart, nichts, not, pop-ups, problem, relativ, rvzr-a.akamaihd.net, sekunden, snap.do, this, threads, werbung, woche |