| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Entfernung von greygray, lollipop und nation zoomWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.01.2014, 00:14
| #1 |
| |  Entfernung von greygray, lollipop und nation zoom Hallo, seit ein paar Tagen habe ich ein (anscheinend weit verbreitetes) Problem mit Nation Zoom, welche sich beim öffnen eines neuen Tabs bei Firefox immer als Startseite öffnet. Außerdem habe ich auch dieses extreme Werbung Problem trotz eingeschaltetem ADblock add-on. Ich habe mir beim Installieren von irgendwas folgendes eingefangen: greygray und lollipop. Klingt niedlich, ist es aber anscheinend nicht. Zu greygray habe ich folgende Infos gefunden: hxxp://www.loschenspywarevirus.com/entfernen-greygray-wie-greygray-entfernen (ist anscheinend mit einem Computerprogramm übersetzt wurden). Nachdem ich das las, bekam ich schon angst um meinen PC und die teils wichtigen Daten darauf. Ist dieses Programm tatsächlich so schädlich wie dort geschildert? Ich habe mir dieses Tool nicht herunter geladen, da ich nicht weiß wie sicher die Seite/der Download ist. Unternommen habe ich bis jetz: -Versuch Lollipop und greygray über Systemsteuerung-> "Programme und Funktionen" zu löschen. Dort ist es auch nicht mehr aufgeführt. Dann habe ich das System mit mbam (Quickscan) gescannt und die gefundenen Bedrohungen entfernt, danach Neustart des PCs. Voller Hoffnung öffnete ich Firefox, dann hat sich Nation Zoom wieder geöffnet..  Ich habe schon bei firefox in den ad-ons gesucht, aber da ist weder lollipop, greygray noch nation zoom zu finden. Die Startseite habe ich in firefox auch geändert, auf die Standard-Startseite von firefox, trotzdem öffnet sich Nation Zomom. Außerdem habe ich auch diverse Logs erstellt.gmer logfile Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-05 20:28:26
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEKT-60V5T1 rev.12.01A12 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\HP\AppData\Local\Temp\pxldipoc.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fbe000 45 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 574 fffff80002fbe02e 17 bytes [4B, 00, 00, 00, 00, 00, 00, ...]
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000163f00 7 bytes [80, 9D, F3, FF, 01, A9, F0]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000163f08 3 bytes [C0, 06, 02]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Connectify\ConnectifyService.exe[1952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000773e1465 2 bytes [3E, 77]
.text C:\Program Files (x86)\Connectify\ConnectifyService.exe[1952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000773e14bb 2 bytes [3E, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000773e1465 2 bytes [3E, 77]
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000773e14bb 2 bytes [3E, 77]
.text ... * 2
.text C:\PROGRAM FILES (X86)\ROCCAT\PYRA MOUSE\PYRAMONITOR.EXE[3740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000773e1465 2 bytes [3E, 77]
.text C:\PROGRAM FILES (X86)\ROCCAT\PYRA MOUSE\PYRAMONITOR.EXE[3740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000773e14bb 2 bytes [3E, 77]
.text ... * 2
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2014
Ran by HP (administrator) on HP-PC on 05-01-2014 20:02:38
Running from C:\Users\HP\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Connectify\ConnectifyService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Connectify) C:\Program Files (x86)\Connectify\Connectifyd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\HP\Downloads\adwcleaner_3.016.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-15] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [450048 2009-07-22] (IDT, Inc.)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPCam_Menu] - C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS)
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [ROCCAT Pyra Mouse] - C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe [532480 2010-09-07] (ROCCAT)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKCU\...\Run: [HP Deskjet 3520 series (NET)] - C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKCU\...\Run: [lollipop_01021904] - "c:\users\hp\appdata\local\lollipop\lollipop_01021904.exe" lollipop_01021904
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk -> C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2009-11-14] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default
FF user.js: detected! => C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\user.js
FF NewTab: hxxp://www.nationzoom.com/newtab/?type=nt&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\HP\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: Adblock Plus - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 Connectify; C:\Program Files (x86)\Connectify\ConnectifyService.exe [65536 2012-11-09] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [227232 2010-01-15] (McAfee, Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe [240128 2009-07-22] (IDT, Inc.)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [31344 2013-02-04] (Connectify)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S1 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-12-15] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-05 20:02 - 2014-01-05 20:03 - 00016934 _____ C:\Users\HP\Downloads\FRST.txt
2014-01-05 20:01 - 2014-01-05 20:01 - 00000000 ____D C:\FRST
2014-01-05 20:00 - 2014-01-05 20:00 - 01931368 _____ (Farbar) C:\Users\HP\Downloads\FRST64.exe
2014-01-05 19:55 - 2014-01-05 19:58 - 00000466 _____ C:\Users\HP\Downloads\defogger_disable.log
2014-01-05 19:55 - 2014-01-05 19:55 - 00050477 _____ C:\Users\HP\Downloads\Defogger.exe
2014-01-05 19:55 - 2014-01-05 19:55 - 00000000 _____ C:\Users\HP\defogger_reenable
2014-01-05 19:13 - 2014-01-05 19:13 - 01233962 _____ C:\Users\HP\Downloads\adwcleaner_3.016.exe
2014-01-05 19:13 - 2014-01-05 19:13 - 00000000 ____D C:\AdwCleaner
2014-01-05 18:17 - 2014-01-05 18:17 - 00003094 _____ C:\Windows\System32\Tasks\{0EC71F8B-5BB4-4732-9DA9-0DDCCEAD66D8}
2014-01-02 03:54 - 2014-01-02 03:54 - 00003104 _____ C:\Windows\System32\Tasks\{EE114A32-CFB7-4C59-9274-03C60BB1D9EA}
2014-01-02 02:08 - 2014-01-02 02:08 - 00007605 _____ C:\Users\HP\AppData\Local\Resmon.ResmonCfg
2014-01-02 02:03 - 2014-01-02 02:03 - 00821760 _____ (Browser Opt-out) C:\Users\HP\Downloads\uninstall.exe
2013-12-31 01:58 - 2013-12-31 02:04 - 00000000 ____D C:\Users\HP\Desktop\USB Stick
2013-12-31 01:13 - 2014-01-05 18:49 - 00000000 ____D C:\ProgramData\WPM
2013-12-31 01:13 - 2014-01-05 18:47 - 00000000 ____D C:\Program Files (x86)\AmiExt
2013-12-31 01:13 - 2014-01-02 20:18 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2013-12-31 01:07 - 2013-12-31 01:24 - 00000000 ____D C:\Users\HP\AppData\Local\cache
2013-12-31 01:06 - 2013-12-31 01:26 - 00000000 ____D C:\Users\HP\AppData\Local\Mobogenie
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 ____D C:\Users\HP\Documents\Mobogenie
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 _____ C:\Users\HP\daemonprocess.txt
2013-12-31 01:05 - 2014-01-02 02:03 - 00003232 _____ C:\Windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2013-12-31 00:41 - 2013-12-31 00:42 - 05159030 ____R (Swearware) C:\Users\HP\Desktop\ComboFix.exe
2013-12-31 00:41 - 2013-12-31 00:42 - 00000000 ___SD C:\ComboFix
2013-12-31 00:41 - 2013-12-31 00:41 - 00000000 ____D C:\Windows\ERDNT
2013-12-27 03:15 - 2013-12-27 03:24 - 00001648 _____ C:\Windows\system32\ASOROSet.bin
2013-12-27 03:15 - 2013-12-27 03:16 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-12-27 01:02 - 2013-12-27 01:02 - 00001194 _____ C:\Users\HP\Desktop\Amazon Cloud Player.lnk
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Local\Amazon Cloud Player
2013-12-27 00:59 - 2013-12-27 01:01 - 36152456 _____ (Amazon) C:\Users\HP\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-27 00:40 - 2013-12-27 03:01 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-27 00:39 - 2013-12-27 03:01 - 00000000 ____D C:\Program Files\mbar
2013-12-27 00:39 - 2013-12-27 00:39 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-26 19:15 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-12-22 20:51 - 2013-08-16 13:56 - 00216064 _____ C:\Windows\SysWOW64\gcapi_dll.dll
2013-12-22 18:26 - 2013-12-22 18:26 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-12-22 18:24 - 2013-12-22 18:26 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-22 18:24 - 2013-12-22 18:26 - 00000000 ____D C:\Program Files\iTunes
2013-12-22 18:24 - 2013-12-22 18:26 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-22 18:24 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files\iPod
2013-12-22 18:16 - 2013-12-22 18:19 - 33893112 _____ (DVDVideoSoft Ltd. ) C:\Users\HP\Downloads\FreeYouTubeToMP3Converter(1).exe
2013-12-20 02:42 - 2013-12-20 02:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 03:46 - 2013-12-15 03:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Avira
2013-12-15 03:43 - 2013-12-15 03:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-12-15 03:43 - 2013-12-09 11:37 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-15 03:43 - 2013-12-09 11:37 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-15 03:43 - 2013-12-09 11:37 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-15 03:43 - 2013-12-09 11:37 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-12-15 03:30 - 2013-12-15 03:33 - 129598176 _____ C:\Users\HP\Downloads\avira_free_antivirus_de.exe
2013-12-15 03:10 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-15 03:10 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-15 03:10 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-15 03:10 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-15 03:07 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-15 03:07 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-15 03:07 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-15 03:07 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-15 03:07 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-15 03:07 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-15 03:07 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-15 03:07 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-15 03:07 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-15 03:07 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-15 03:07 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-15 03:07 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-15 03:07 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-15 03:07 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-15 03:07 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-15 03:07 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-15 03:07 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-15 03:07 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-15 03:07 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-15 03:07 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-15 03:07 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-15 03:07 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-15 03:07 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-15 03:07 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-15 03:07 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-15 03:07 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-15 03:07 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-15 03:07 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-15 03:07 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-15 03:07 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-15 03:07 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-15 02:46 - 2014-01-05 16:54 - 00000000 ____D C:\ProgramData\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:46 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-12-15 02:46 - 2013-12-15 02:46 - 00001042 _____ C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-12-15 02:45 - 2013-12-15 02:46 - 05049344 _____ (Crawler.com ) C:\Users\HP\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-12-15 02:30 - 2013-12-15 02:30 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Users\HP\AppData\Roaming\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 02:30 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-15 02:29 - 2013-12-15 02:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\HP\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-15 02:19 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-15 02:19 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-15 02:19 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-15 02:19 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-15 02:19 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-15 02:19 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-15 02:19 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-15 02:19 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-15 02:19 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-15 02:18 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-15 02:18 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-15 02:18 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-15 02:18 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-15 02:18 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-15 02:18 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-15 02:18 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-15 02:18 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-15 02:18 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-12 01:54 - 2013-12-12 01:54 - 09272200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-12-12 00:38 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
==================== One Month Modified Files and Folders =======
2014-01-05 20:03 - 2014-01-05 20:02 - 00016934 _____ C:\Users\HP\Downloads\FRST.txt
2014-01-05 20:02 - 2009-12-20 01:26 - 01289264 _____ C:\Windows\WindowsUpdate.log
2014-01-05 20:01 - 2014-01-05 20:01 - 00000000 ____D C:\FRST
2014-01-05 20:00 - 2014-01-05 20:00 - 01931368 _____ (Farbar) C:\Users\HP\Downloads\FRST64.exe
2014-01-05 20:00 - 2009-07-14 05:51 - 00414081 _____ C:\Windows\setupact.log
2014-01-05 19:58 - 2014-01-05 19:55 - 00000466 _____ C:\Users\HP\Downloads\defogger_disable.log
2014-01-05 19:55 - 2014-01-05 19:55 - 00050477 _____ C:\Users\HP\Downloads\Defogger.exe
2014-01-05 19:55 - 2014-01-05 19:55 - 00000000 _____ C:\Users\HP\defogger_reenable
2014-01-05 19:55 - 2010-12-29 18:13 - 00000000 ____D C:\Users\HP
2014-01-05 19:54 - 2012-04-18 15:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-05 19:54 - 2009-07-14 05:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-05 19:54 - 2009-07-14 05:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-05 19:13 - 2014-01-05 19:13 - 01233962 _____ C:\Users\HP\Downloads\adwcleaner_3.016.exe
2014-01-05 19:13 - 2014-01-05 19:13 - 00000000 ____D C:\AdwCleaner
2014-01-05 18:54 - 2009-11-14 09:10 - 00654400 _____ C:\Windows\system32\perfh007.dat
2014-01-05 18:54 - 2009-11-14 09:10 - 00130240 _____ C:\Windows\system32\perfc007.dat
2014-01-05 18:54 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-05 18:49 - 2013-12-31 01:13 - 00000000 ____D C:\ProgramData\WPM
2014-01-05 18:49 - 2009-12-20 01:28 - 00409420 _____ C:\Windows\PFRO.log
2014-01-05 18:49 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-05 18:47 - 2013-12-31 01:13 - 00000000 ____D C:\Program Files (x86)\AmiExt
2014-01-05 18:17 - 2014-01-05 18:17 - 00003094 _____ C:\Windows\System32\Tasks\{0EC71F8B-5BB4-4732-9DA9-0DDCCEAD66D8}
2014-01-05 16:54 - 2013-12-15 02:46 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-02 20:18 - 2013-12-31 01:13 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-02 20:03 - 2013-08-05 12:56 - 00000298 _____ C:\Windows\Tasks\Registry Optimizer_UPDATES.job
2014-01-02 20:03 - 2013-08-05 12:56 - 00000290 _____ C:\Windows\Tasks\Registry Optimizer_DEFAULT.job
2014-01-02 20:03 - 2012-06-12 19:47 - 00001126 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000UA.job
2014-01-02 20:03 - 2012-06-12 19:47 - 00001104 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000Core.job
2014-01-02 03:54 - 2014-01-02 03:54 - 00003104 _____ C:\Windows\System32\Tasks\{EE114A32-CFB7-4C59-9274-03C60BB1D9EA}
2014-01-02 02:08 - 2014-01-02 02:08 - 00007605 _____ C:\Users\HP\AppData\Local\Resmon.ResmonCfg
2014-01-02 02:03 - 2014-01-02 02:03 - 00821760 _____ (Browser Opt-out) C:\Users\HP\Downloads\uninstall.exe
2014-01-02 02:03 - 2013-12-31 01:05 - 00003232 _____ C:\Windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2014-01-02 02:03 - 2013-08-05 12:56 - 00003030 _____ C:\Windows\System32\Tasks\Registry Optimizer_UPDATES
2014-01-02 02:03 - 2013-08-05 12:56 - 00002874 _____ C:\Windows\System32\Tasks\Registry Optimizer_DEFAULT
2014-01-02 02:03 - 2012-06-12 19:47 - 00004108 _____ C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000UA
2014-01-02 02:03 - 2012-06-12 19:47 - 00003740 _____ C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000Core
2014-01-02 02:03 - 2011-06-15 22:16 - 00002976 _____ C:\Windows\System32\Tasks\{4F439D31-FE66-419E-83ED-226959865089}
2014-01-02 02:03 - 2011-06-07 13:11 - 00002944 _____ C:\Windows\System32\Tasks\{DF839B04-3AAD-4816-88AD-8681C45D346E}
2014-01-02 02:03 - 2011-06-07 13:11 - 00002944 _____ C:\Windows\System32\Tasks\{2D3F316B-D4F7-494D-B304-4DD0EB6C1F54}
2014-01-02 02:03 - 2011-06-07 13:10 - 00002944 _____ C:\Windows\System32\Tasks\{36027D2C-8F38-4FB3-AD64-AF13885712AD}
2014-01-02 02:03 - 2011-06-07 12:52 - 00002880 _____ C:\Windows\System32\Tasks\{DDAE587A-FA93-40F2-B6E0-CCD070C4E8EF}
2014-01-02 02:03 - 2011-01-16 01:05 - 00002880 _____ C:\Windows\System32\Tasks\{053EF3CB-0602-4FFD-910E-C29615802CC7}
2014-01-02 02:03 - 2010-12-29 18:27 - 00003958 _____ C:\Windows\System32\Tasks\RecoveryCDWin7
2014-01-02 02:03 - 2010-12-29 18:26 - 00003766 _____ C:\Windows\System32\Tasks\Registration
2013-12-31 02:04 - 2013-12-31 01:58 - 00000000 ____D C:\Users\HP\Desktop\USB Stick
2013-12-31 01:26 - 2013-12-31 01:06 - 00000000 ____D C:\Users\HP\AppData\Local\Mobogenie
2013-12-31 01:24 - 2013-12-31 01:07 - 00000000 ____D C:\Users\HP\AppData\Local\cache
2013-12-31 01:13 - 2010-12-29 18:27 - 00001647 _____ C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 ____D C:\Users\HP\Documents\Mobogenie
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 _____ C:\Users\HP\daemonprocess.txt
2013-12-31 00:42 - 2013-12-31 00:41 - 05159030 ____R (Swearware) C:\Users\HP\Desktop\ComboFix.exe
2013-12-31 00:42 - 2013-12-31 00:41 - 00000000 ___SD C:\ComboFix
2013-12-31 00:41 - 2013-12-31 00:41 - 00000000 ____D C:\Windows\ERDNT
2013-12-27 21:44 - 2012-11-19 19:17 - 00000000 ____D C:\Users\HP\Documents\persoführung
2013-12-27 21:42 - 2012-07-30 18:10 - 00000000 ____D C:\Users\HP\Documents\Auslandspraktikum
2013-12-27 08:48 - 2010-12-29 18:27 - 00000000 ___RD C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 08:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-12-27 08:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-27 03:24 - 2013-12-27 03:15 - 00001648 _____ C:\Windows\system32\ASOROSet.bin
2013-12-27 03:24 - 2009-07-14 03:34 - 85721088 _____ C:\Windows\system32\config\software.bak
2013-12-27 03:24 - 2009-07-14 03:34 - 17301504 _____ C:\Windows\system32\config\system.bak
2013-12-27 03:24 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2013-12-27 03:17 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2013-12-27 03:16 - 2013-12-27 03:15 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-12-27 03:01 - 2013-12-27 00:40 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-27 03:01 - 2013-12-27 00:39 - 00000000 ____D C:\Program Files\mbar
2013-12-27 01:02 - 2013-12-27 01:02 - 00001194 _____ C:\Users\HP\Desktop\Amazon Cloud Player.lnk
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Local\Amazon Cloud Player
2013-12-27 01:01 - 2013-12-27 00:59 - 36152456 _____ (Amazon) C:\Users\HP\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-27 00:39 - 2013-12-27 00:39 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-22 20:51 - 2011-06-24 13:47 - 00000000 ____D C:\Users\HP\AppData\Roaming\Foxit Software
2013-12-22 18:26 - 2013-12-22 18:26 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-12-22 18:26 - 2013-12-22 18:24 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-22 18:26 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files\iTunes
2013-12-22 18:26 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-22 18:24 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files\iPod
2013-12-22 18:21 - 2011-01-20 06:19 - 00000000 ____D C:\Users\HP\AppData\Roaming\DVDVideoSoft
2013-12-22 18:21 - 2011-01-17 10:05 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-12-22 18:19 - 2013-12-22 18:16 - 33893112 _____ (DVDVideoSoft Ltd. ) C:\Users\HP\Downloads\FreeYouTubeToMP3Converter(1).exe
2013-12-22 16:42 - 2012-04-25 15:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-21 20:28 - 2013-11-17 16:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox.bak
2013-12-20 02:42 - 2013-12-20 02:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-15 15:13 - 2009-07-14 05:45 - 00459128 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-15 04:45 - 2010-12-30 02:40 - 00000000 ____D C:\ProgramData\Recovery
2013-12-15 03:46 - 2013-12-15 03:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Avira
2013-12-15 03:43 - 2013-12-15 03:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-12-15 03:43 - 2013-08-05 10:58 - 00000000 ____D C:\ProgramData\Avira
2013-12-15 03:33 - 2013-12-15 03:30 - 129598176 _____ C:\Users\HP\Downloads\avira_free_antivirus_de.exe
2013-12-15 03:09 - 2009-11-14 01:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 03:06 - 2013-08-16 19:45 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 03:01 - 2011-04-18 12:03 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 02:46 - 2013-12-15 02:46 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-12-15 02:46 - 2013-12-15 02:46 - 00001042 _____ C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:45 - 05049344 _____ (Crawler.com ) C:\Users\HP\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-12-15 02:30 - 2013-12-15 02:30 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Users\HP\AppData\Roaming\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 02:29 - 2013-12-15 02:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\HP\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-12 23:17 - 2009-12-20 10:15 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-12 01:54 - 2013-12-12 01:54 - 09272200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-12-12 01:54 - 2012-04-18 15:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-12 01:54 - 2012-04-18 15:56 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-12 01:54 - 2011-05-25 19:47 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-09 11:37 - 2013-12-15 03:43 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-09 11:37 - 2013-12-15 03:43 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-09 11:37 - 2013-12-15 03:43 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-09 11:37 - 2013-12-15 03:43 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
Some content of TEMP:
====================
C:\Users\HP\AppData\Local\Temp\7z920.exe
C:\Users\HP\AppData\Local\Temp\AskSLib.dll
C:\Users\HP\AppData\Local\Temp\avgnt.exe
C:\Users\HP\AppData\Local\Temp\Checkupdate.exe
C:\Users\HP\AppData\Local\Temp\contentDATs.exe
C:\Users\HP\AppData\Local\Temp\DivXSetup.exe
C:\Users\HP\AppData\Local\Temp\drm_dyndata_7340016.dll
C:\Users\HP\AppData\Local\Temp\DSETUP.dll
C:\Users\HP\AppData\Local\Temp\dsetup32.dll
C:\Users\HP\AppData\Local\Temp\DWPUpgradeInstaller.exe
C:\Users\HP\AppData\Local\Temp\DXSETUP.exe
C:\Users\HP\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\HP\AppData\Local\Temp\Foxit Updater.exe
C:\Users\HP\AppData\Local\Temp\gcapi_dll.dll
C:\Users\HP\AppData\Local\Temp\gtapi_signed.dll
C:\Users\HP\AppData\Local\Temp\HPQSi.exe
C:\Users\HP\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\HP\AppData\Local\Temp\jre-6u32-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\libProcessAccess641076667910485972521.dll
C:\Users\HP\AppData\Local\Temp\libProcessAccess648285416856447600650.dll
C:\Users\HP\AppData\Local\Temp\Mobogenie_Setup_2.1.23_515.exe
C:\Users\HP\AppData\Local\Temp\PCSpeedMaximizer.exe
C:\Users\HP\AppData\Local\Temp\Quarantine.exe
C:\Users\HP\AppData\Local\Temp\RewardsArcade-Bunndle_1.0.11.34_20111010.exe
C:\Users\HP\AppData\Local\Temp\scs.exe
C:\Users\HP\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\HP\AppData\Local\Temp\Show-Password_1030-8101.exe
C:\Users\HP\AppData\Local\Temp\SIntf16.dll
C:\Users\HP\AppData\Local\Temp\SIntf32.dll
C:\Users\HP\AppData\Local\Temp\SIntfNT.dll
C:\Users\HP\AppData\Local\Temp\SkypeSetup.exe
C:\Users\HP\AppData\Local\Temp\vzf-3124094598866748190.dll
C:\Users\HP\AppData\Local\Temp\vzf-6336627702037037531.dll
C:\Users\HP\AppData\Local\Temp\winziprosetup-WZRO6_20130221.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-21 21:47
==================== End Of Log ============================
dann noch mbam Code:
ATTFilter 2013/12/31 00:38:04 +0100 HP-PC HP MESSAGE Starting protection
2013/12/31 00:38:04 +0100 HP-PC HP MESSAGE Protection started successfully
2013/12/31 00:38:04 +0100 HP-PC HP MESSAGE Starting IP protection
2013/12/31 00:38:15 +0100 HP-PC HP MESSAGE IP Protection started successfully
2013/12/31 00:43:37 +0100 HP-PC HP IP-BLOCK 41.203.69.3 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 00:44:21 +0100 HP-PC HP MESSAGE Executing scheduled update: Daily
2013/12/31 00:45:06 +0100 HP-PC HP MESSAGE Scheduled update executed successfully: database updated from version v2013.12.27.06 to version v2013.12.30.09
2013/12/31 00:45:06 +0100 HP-PC HP MESSAGE Starting database refresh
2013/12/31 00:45:06 +0100 HP-PC HP MESSAGE Stopping IP protection
2013/12/31 00:45:07 +0100 HP-PC HP MESSAGE IP Protection stopped successfully
2013/12/31 00:45:39 +0100 HP-PC HP MESSAGE Database refreshed successfully
2013/12/31 00:45:39 +0100 HP-PC HP MESSAGE Starting IP protection
2013/12/31 00:45:48 +0100 HP-PC HP MESSAGE IP Protection started successfully
2013/12/31 00:59:44 +0100 HP-PC HP IP-BLOCK 213.186.115.247 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:02:09 +0100 HP-PC HP IP-BLOCK 91.205.157.43 (Type: outgoing, Port: 50245, Process: firefox.exe)
2013/12/31 01:02:09 +0100 HP-PC HP IP-BLOCK 91.205.157.43 (Type: outgoing, Port: 50246, Process: firefox.exe)
2013/12/31 01:03:21 +0100 HP-PC HP IP-BLOCK 41.203.69.3 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:11:40 +0100 HP-PC HP IP-BLOCK 41.203.69.3 (Type: outgoing, Port: 51135, Process: spywareterminatorupdate.exe)
2013/12/31 01:14:21 +0100 HP-PC HP IP-BLOCK 50.112.112.223 (Type: outgoing, Port: 51278, Process: firefox.exe)
2013/12/31 01:14:22 +0100 HP-PC HP IP-BLOCK 50.112.112.223 (Type: outgoing, Port: 51279, Process: firefox.exe)
2013/12/31 01:28:36 +0100 HP-PC HP IP-BLOCK 89.28.120.57 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:35:33 +0100 HP-PC HP IP-BLOCK 88.85.71.176 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:42:31 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 52803, Process: firefox.exe)
2013/12/31 01:42:31 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 52804, Process: firefox.exe)
2013/12/31 01:48:48 +0100 HP-PC HP IP-BLOCK 91.188.34.151 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:50:01 +0100 HP-PC HP IP-BLOCK 88.85.71.176 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:50:25 +0100 HP-PC HP IP-BLOCK 89.28.18.125 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:55:54 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53607, Process: firefox.exe)
2013/12/31 01:55:54 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53608, Process: firefox.exe)
2013/12/31 01:55:54 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53609, Process: firefox.exe)
2013/12/31 01:56:02 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53646, Process: firefox.exe)
2013/12/31 01:56:02 +0100 HP-PC HP IP-BLOCK 66.45.56.109 (Type: outgoing, Port: 53647, Process: firefox.exe)
2013/12/31 01:56:35 +0100 HP-PC HP IP-BLOCK 8.26.70.22 (Type: outgoing, Port: 53680, Process: firefox.exe)
2013/12/31 01:56:35 +0100 HP-PC HP IP-BLOCK 8.26.70.22 (Type: outgoing, Port: 53681, Process: firefox.exe)
2013/12/31 01:56:51 +0100 HP-PC HP IP-BLOCK 8.26.70.22 (Type: outgoing, Port: 53706, Process: firefox.exe)
2013/12/31 01:56:51 +0100 HP-PC HP IP-BLOCK 8.26.70.22 (Type: outgoing, Port: 53707, Process: firefox.exe)
2013/12/31 01:58:59 +0100 HP-PC HP IP-BLOCK 121.10.87.218 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:59:08 +0100 HP-PC HP IP-BLOCK 109.163.235.202 (Type: outgoing, Port: 6881, Process: spywareterminatorupdate.exe)
2013/12/31 01:59:33 +0100 HP-PC HP MESSAGE Stopping IP protection
2013/12/31 01:59:33 +0100 HP-PC HP MESSAGE IP Protection stopped successfully
Code:
ATTFilter # AdwCleaner v3.016 - Bericht erstellt am 05/01/2014 um 19:13:15
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : HP - HP-PC
# Gestartet von : C:\Users\HP\Downloads\adwcleaner_3.016.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\END
Datei Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gefunden : C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\user.js
Datei Gefunden : C:\Windows\System32\roboot64.exe
Ordner Gefunden C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gefunden C:\Program Files (x86)\Common Files\Plasmoo
Ordner Gefunden C:\Program Files (x86)\WinZip Registry Optimizer
Ordner Gefunden C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Registry Optimizer
Ordner Gefunden C:\ProgramData\WPM
Ordner Gefunden C:\Users\HP\AppData\Local\Mobogenie
Ordner Gefunden C:\Users\HP\AppData\Local\Temp\boost_interprocess
Ordner Gefunden C:\Users\HP\AppData\LocalLow\boost_interprocess
Ordner Gefunden C:\Users\HP\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden C:\Users\HP\AppData\Roaming\pdfforge
Ordner Gefunden C:\Users\HP\Documents\Mobogenie
***** [ Verknüpfungen ] *****
Verknüpfung Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
Verknüpfung Gefunden : C:\Users\HP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk ( hxxp://www.nationzoom.com/?type=sc&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292 )
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\RewardsArcade
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Show-Password
Schlüssel Gefunden : HKCU\Software\Classes\Applications\lollipop.exe
Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\Cr_Installer
Schlüssel Gefunden : HKCU\Software\lollipop
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\Somoto
Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : [x64] HKCU\Software\Conduit
Schlüssel Gefunden : [x64] HKCU\Software\Cr_Installer
Schlüssel Gefunden : [x64] HKCU\Software\lollipop
Schlüssel Gefunden : [x64] HKCU\Software\Softonic
Schlüssel Gefunden : [x64] HKCU\Software\Somoto
Schlüssel Gefunden : [x64] HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{7CD74AFF-3433-4E34-92E2-D98DFDB30754}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\RewardsArcade.BHO
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{0C58B7D1-D415-492B-A149-E976156BD3B8}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_sweet-home-3d_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_sweet-home-3d_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_winrar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\Software\supWPM
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Wert Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [lollipop_01021904]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\prefs.js ]
Zeile gefunden : user_pref("browser.newtab.url", "hxxp://www.nationzoom.com/newtab/?type=nt&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292");
Zeile gefunden : user_pref("extensions.crossrider.bic", "133a3868bc2826bd82f76db6a0cb55a0");
Zeile gefunden : user_pref("extensions.crossriderapp498.bic", "133a3868bc2826bd82f76db6a0cb55a0");
Zeile gefunden : user_pref("extensions.crossriderapp498.firstrun", false);
Zeile gefunden : user_pref("extensions.crossriderapp498.installationdate", 1321298464);
Zeile gefunden : user_pref("extensions.crossriderapp498.jsver", 3);
Zeile gefunden : user_pref("extensions.crossriderapp498.lastcheck", 22234849);
Zeile gefunden : user_pref("extensions.crossriderapp498.lastcheckitem", 22234859);
Zeile gefunden : user_pref("extensions.crossriderapp498.misc.lastBgWorkerTimer", "1334091583121");
Zeile gefunden : user_pref("extensions.crossriderapp498.misc.lastDomWorkerTimer", "1334091583103");
Zeile gefunden : user_pref("extensions.crossriderapp498@crossrider.com.install-event-fired", true);
Zeile gefunden : user_pref("extensions.enabledItems", "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3,{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23,{ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1,fmdownloader@gmail.com:1.0[...]
*************************
AdwCleaner[R0].txt - [8986 octets] - [05/01/2014 19:13:15]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [9046 octets] ##########
Beginne mit der Suche in 'C:\Users\HP\AppData\Local\Lollipop\lollipop_01021904.exe' C:\Users\HP\AppData\Local\Lollipop\lollipop_01021904.exe [FUND] Enthält Erkennungsmuster der Adware ADWARE/Symmi.36673.4 [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3c723b9b.qua' verschoben! Zur vollständigkeit halber: Nach dem Neustart habe ich mbam nochmal drüber laufen lassen und es hat (angeblich) nichts mehr von greygray gefunden. Das nation zoom Problem ist weiterhin beständig. zu guter letzt noch ein Bericht vom Spyware Terminator: Code:
ATTFilter ------
Säubern
------
Reinigungsstart um: 05.01.2014 17:06:17.
Browser schließt.
Affiliate tracking cookie (Tracking cookie):
Gelöscht FireFox® Cookie: amazon.de - FireFox®
Gelöscht FireFox® Cookie: dealtime.com - FireFox®
Gelöscht FireFox® Cookie: liveperson.net - FireFox®
Gelöscht FireFox® Cookie: statcounter.com - FireFox®
Gelöscht FireFox® Cookie: stat.dealtime.com - FireFox®
Gelöscht FireFox® Cookie: statse.webtrendslive.com - FireFox®
------
Report Ende
------
|
|
06.01.2014, 01:18
| #2 | |
| /// the machine /// TB-Ausbilder    | Entfernung von greygray, lollipop und nation zoom hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
06.01.2014, 02:33
| #3 |
| | Entfernung von greygray, lollipop und nation zoom Hi,
__________________erstmal danke für die prompte Antwort. Code:
ATTFilter ComboFix 14-01-04.03 - HP 06.01.2014 2:07.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4092.2067 [GMT 1:00]
ausgeführt von:: c:\users\HP\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_vpnagent
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-12-06 bis 2014-01-06 ))))))))))))))))))))))))))))))
.
.
2014-01-06 01:16 . 2014-01-06 01:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-05 19:01 . 2014-01-05 19:01 -------- d-----w- C:\FRST
2014-01-05 18:13 . 2014-01-05 18:13 -------- d-----w- C:\AdwCleaner
2013-12-31 00:13 . 2014-01-05 17:47 -------- d-----w- c:\program files (x86)\AmiExt
2013-12-31 00:13 . 2014-01-05 17:49 -------- d-----w- c:\programdata\WPM
2013-12-31 00:07 . 2013-12-31 00:24 -------- d-----w- c:\users\HP\AppData\Local\cache
2013-12-31 00:06 . 2013-12-31 00:26 -------- d-----w- c:\users\HP\AppData\Local\Mobogenie
2013-12-27 02:15 . 2013-12-27 02:24 1648 ----a-w- c:\windows\system32\ASOROSet.bin
2013-12-27 00:02 . 2013-12-27 00:02 -------- d-----w- c:\users\HP\AppData\Local\Amazon Cloud Player
2013-12-26 23:40 . 2013-12-27 02:01 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-12-26 23:39 . 2013-12-26 23:39 89304 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-12-26 23:39 . 2013-12-27 02:01 -------- d-----w- c:\program files\mbar
2013-12-26 18:15 . 2013-09-04 12:12 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-12-26 18:15 . 2013-09-04 12:11 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-12-26 18:15 . 2013-09-04 12:11 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-12-26 18:15 . 2013-09-04 12:11 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-12-26 18:15 . 2013-09-04 12:11 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-12-26 18:15 . 2013-09-04 12:11 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-12-26 18:15 . 2013-09-04 12:11 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-12-22 19:51 . 2013-08-16 12:56 216064 ----a-w- c:\windows\SysWow64\gcapi_dll.dll
2013-12-22 17:24 . 2013-12-22 17:24 -------- d-----w- c:\program files\iPod
2013-12-22 17:24 . 2013-12-22 17:26 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-22 17:24 . 2013-12-22 17:26 -------- d-----w- c:\program files\iTunes
2013-12-22 17:24 . 2013-12-22 17:26 -------- d-----w- c:\program files (x86)\iTunes
2013-12-15 02:46 . 2013-12-15 02:46 -------- d-----w- c:\users\HP\AppData\Roaming\Avira
2013-12-15 02:43 . 2013-12-09 10:37 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-12-15 02:43 . 2013-12-09 10:37 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-12-15 02:43 . 2013-12-09 10:37 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-15 02:43 . 2013-12-09 10:37 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-15 02:43 . 2013-12-15 02:43 -------- d-----w- c:\program files (x86)\Avira
2013-12-15 02:10 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-15 02:10 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-15 02:10 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-15 02:10 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL
2013-12-15 02:10 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll
2013-12-15 01:46 . 2013-12-15 01:46 51496 ----a-w- c:\windows\system32\drivers\stflt.sys
2013-12-15 01:46 . 2014-01-05 15:54 -------- d-----w- c:\programdata\Spyware Terminator
2013-12-15 01:46 . 2013-12-15 01:46 -------- d-----w- c:\users\HP\AppData\Roaming\Spyware Terminator
2013-12-15 01:46 . 2013-12-15 01:46 -------- d-----w- c:\program files (x86)\Spyware Terminator
2013-12-15 01:30 . 2013-12-15 01:30 -------- d-----w- c:\users\HP\AppData\Roaming\Malwarebytes
2013-12-15 01:30 . 2013-12-15 01:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-12-15 01:30 . 2013-12-15 01:30 -------- d-----w- c:\programdata\Malwarebytes
2013-12-15 01:30 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-12-15 01:19 . 2013-10-30 02:32 335360 ----a-w- c:\windows\system32\msieftp.dll
2013-12-15 01:19 . 2013-10-30 02:19 301568 ----a-w- c:\windows\SysWow64\msieftp.dll
2013-12-15 01:19 . 2013-10-30 01:24 3155968 ----a-w- c:\windows\system32\win32k.sys
2013-12-15 01:19 . 2013-11-23 18:26 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-12-15 01:19 . 2013-11-23 17:47 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-12-15 01:19 . 2013-10-19 02:18 81408 ----a-w- c:\windows\system32\imagehlp.dll
2013-12-15 01:19 . 2013-10-19 01:36 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2013-12-15 01:19 . 2013-11-12 02:23 2048 ----a-w- c:\windows\system32\tzres.dll
2013-12-15 01:19 . 2013-11-12 02:07 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-12-15 01:18 . 2013-10-04 02:16 116736 ----a-w- c:\windows\system32\drivers\drmk.sys
2013-12-15 01:18 . 2013-10-04 01:36 230400 ----a-w- c:\windows\system32\drivers\portcls.sys
2013-12-15 01:18 . 2013-10-12 02:32 150016 ----a-w- c:\windows\system32\wshom.ocx
2013-12-15 01:18 . 2013-10-12 02:31 202752 ----a-w- c:\windows\system32\scrrun.dll
2013-12-15 01:18 . 2013-10-12 02:03 163840 ----a-w- c:\windows\SysWow64\scrrun.dll
2013-12-15 01:18 . 2013-10-12 01:33 156160 ----a-w- c:\windows\system32\cscript.exe
2013-12-15 01:18 . 2013-10-12 01:33 168960 ----a-w- c:\windows\system32\wscript.exe
2013-12-15 01:18 . 2013-10-12 01:15 141824 ----a-w- c:\windows\SysWow64\wscript.exe
2013-12-15 01:18 . 2013-10-12 01:15 126976 ----a-w- c:\windows\SysWow64\cscript.exe
2013-12-15 01:16 . 2013-11-08 03:12 10285968 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E4F0DCC9-3365-443D-B228-EA470556D1DC}\mpengine.dll
2013-12-12 00:54 . 2013-12-12 00:54 9272200 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-12-11 23:38 . 2013-10-12 02:04 121856 ----a-w- c:\windows\SysWow64\wshom.ocx
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-15 02:01 . 2011-04-18 11:03 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-12-12 00:54 . 2012-04-18 14:56 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-12 00:54 . 2011-05-25 18:47 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-19 03:34 . 2013-11-19 03:34 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-19 03:34 . 2013-11-19 03:34 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-19 03:34 . 2013-11-19 03:34 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-19 03:34 . 2013-11-19 03:34 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-19 03:34 . 2013-11-19 03:34 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-19 03:34 . 2013-11-19 03:34 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-19 03:34 . 2013-11-19 03:34 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-19 03:34 . 2013-11-19 03:34 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-19 03:34 . 2013-11-19 03:34 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-19 03:34 . 2013-11-19 03:34 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-19 03:34 . 2013-11-19 03:34 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-19 03:34 . 2013-11-19 03:34 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-19 03:34 . 2013-11-19 03:34 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-19 03:34 . 2013-11-19 03:34 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-19 03:34 . 2013-11-19 03:34 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-19 03:34 . 2013-11-19 03:34 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-19 03:34 . 2013-11-19 03:34 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-19 03:34 . 2013-11-19 03:34 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-19 03:34 . 2013-11-19 03:34 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-19 03:34 . 2013-11-19 03:34 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-19 03:34 . 2013-11-19 03:34 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-19 03:34 . 2013-11-19 03:34 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-19 03:34 . 2013-11-19 03:34 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-19 03:34 . 2013-11-19 03:34 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-19 03:34 . 2013-11-19 03:34 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-19 03:34 . 2013-11-19 03:34 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-19 03:34 . 2013-11-19 03:34 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-19 03:34 . 2013-11-19 03:34 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-19 03:34 . 2013-11-19 03:34 413696 ----a-w- c:\windows\system32\html.iec
2013-11-19 03:34 . 2013-11-19 03:34 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-19 03:34 . 2013-11-19 03:34 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-19 03:34 . 2013-11-19 03:34 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-19 03:34 . 2013-11-19 03:34 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-19 03:34 . 2013-11-19 03:34 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-19 03:34 . 2013-11-19 03:34 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-19 03:34 . 2013-11-19 03:34 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-19 03:34 . 2013-11-19 03:34 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-19 03:34 . 2013-11-19 03:34 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-19 03:34 . 2013-11-19 03:34 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-19 03:34 . 2013-11-19 03:34 235520 ----a-w- c:\windows\system32\url.dll
2013-11-19 03:34 . 2013-11-19 03:34 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-19 03:34 . 2013-11-19 03:34 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-19 03:34 . 2013-11-19 03:34 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-19 03:34 . 2013-11-19 03:34 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-19 03:34 . 2013-11-19 03:34 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-19 03:34 . 2013-11-19 03:34 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-19 03:34 . 2013-11-19 03:34 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-19 03:34 . 2013-11-19 03:34 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-19 03:34 . 2013-11-19 03:34 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-19 03:34 . 2013-11-19 03:34 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-19 03:34 . 2013-11-19 03:34 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-19 03:34 . 2013-11-19 03:34 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-19 03:34 . 2013-11-19 03:34 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-19 03:34 . 2013-11-19 03:34 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-19 03:34 . 2013-11-19 03:34 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-19 03:34 . 2013-11-19 03:34 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-19 03:34 . 2013-11-19 03:34 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-19 03:34 . 2013-11-19 03:34 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-19 03:34 . 2013-11-19 03:34 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-11 04:50 . 2011-01-11 14:11 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-10-14 17:00 . 2013-11-19 03:39 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-10-12 02:30 . 2013-11-13 00:19 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-11-13 00:19 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-11-13 00:19 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-11-13 00:19 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-11-13 00:19 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Deskjet 3520 series (NET)"="c:\program files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-04 98304]
"HPCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464]
"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"ROCCAT Pyra Mouse"="c:\program files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.EXE" [2010-09-07 532480]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-09 684600]
.
c:\users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 1050 J410 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN3651CK5J05YC;CONNECTION=USB;MONITOR=1; [2009-7-14 45568]
Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 3520 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN37I1G0DR05SY;CONNECTION=NW;MONITOR=1; [2009-7-14 45568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 cnnctfy2;Connectify LightWeight Filter;c:\windows\system32\DRIVERS\cnnctfy2.sys;c:\windows\SYSNATIVE\DRIVERS\cnnctfy2.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 Connectify;Connectify;c:\program files (x86)\Connectify\ConnectifyService.exe;c:\program files (x86)\Connectify\ConnectifyService.exe [x]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys;c:\windows\SYSNATIVE\DRIVERS\stflt.sys [x]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files (x86)\Spyware Terminator\st_rsser64.exe;c:\program files (x86)\Spyware Terminator\st_rsser64.exe [x]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys;c:\windows\SYSNATIVE\DRIVERS\enecir.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-08-20 12:24 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-18 00:54]
.
2014-01-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000Core.job
- c:\users\HP\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-12 18:52]
.
2014-01-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000UA.job
- c:\users\HP\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-12 18:52]
.
2014-01-02 c:\windows\Tasks\Registry Optimizer_DEFAULT.job
- c:\program files (x86)\WinZip Registry Optimizer\Winzipro.exe [2013-08-05 09:07]
.
2014-01-02 c:\windows\Tasks\Registry Optimizer_UPDATES.job
- c:\program files (x86)\WinZip Registry Optimizer\Winzipro.exe [2013-08-05 09:07]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-07-22 450048]
"SpywareTerminatorShield"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2013-04-03 2777736]
"SpywareTerminatorUpdater"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2013-04-03 3684488]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~4\Office14\ONBttnIE.dll/105
IE: Free YouTube to MP3 Converter - c:\users\HP\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~4\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - ExtSQL: !HIDDEN! 2011-01-11 16:30; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: !HIDDEN! 2011-01-12 22:04; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF - ExtSQL: !HIDDEN! 2011-01-17 10:12; fmdownloader@gmail.com; c:\program files (x86)\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox
FF - user.js: extensions.autoDisableScopes - 0
FF - user.js: extensions.shownSelectionUI - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\0b\04\0a\09\0a\0b?"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Connectify\ConnectifyD.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-01-06 02:27:12 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-01-06 01:27
.
Vor Suchlauf: 9 Verzeichnis(se), 25.176.768.512 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 53.516.816.384 Bytes frei
.
- - End Of File - - E56C40F021C37C6334401FDA5E70AAFC
DCCE884F95D61B98D59B7E6965A22219
Wie sieht es aus mit meinem PC, ist der Patient zu retten? ;-) Nation Zoom kam übrigens nach dem combofix scan wieder. Aber ich weiß auch nicht, oob combofix repariert oder nur analysiert. Wollte es vorsichtshalber erwähnen. Danke und LG Stephanie |
|
06.01.2014, 16:57
| #4 |
| /// the machine /// TB-Ausbilder | Entfernung von greygray, lollipop und nation zoom Bekommen wir schon hin  Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Downloade dir bitte Shortcut Cleaner (by Grinler) auf deinen Desktop.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.01.2014, 00:47
| #5 |
| | Entfernung von greygray, lollipop und nation zoom Na da bin ich beruhigt. Ich benutz das Teil ja auch für Online-Banking, da wäre es schon ganz nice wenn niemand den account hacked ;-) Also legen wir mal los. Hatte mbam schon drauf, habe es aktualisiert und nochmal einen Quickscan durchgeführt: Code:
ATTFilter Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.06.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 HP :: HP-PC [Administrator] Schutz: Deaktiviert 06.01.2014 23:35:43 mbam-log-2014-01-06 (23-35-43).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 220373 Laufzeit: 8 Minute(n), 53 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.9 (01.01.2014:1)
OS: Windows 7 Home Premium x64
Ran by HP on 06.01.2014 at 23:09:40,59
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\softonicdownloader_fuer_winrar_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\softonicdownloader_fuer_winrar_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_sweet-home-3d_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_fuer_sweet-home-3d_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_fuer_sweet-home-3d_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_fuer_sweet-home-3d_RASMANCS
~~~ Files
Successfully deleted: [File] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ebay.lnk"
Successfully deleted: [File] "C:\end"
~~~ Folders
Successfully deleted: [Folder] "C:\Users\HP\AppData\Roaming\dvdvideosoftiehelpers"
Successfully deleted: [Folder] "C:\Users\HP\AppData\Roaming\pdfforge"
Successfully deleted: [Folder] "C:\Users\HP\appdata\locallow\boost_interprocess"
Successfully deleted: [Folder] "C:\Program Files (x86)\winzip registry optimizer"
~~~ FireFox
Successfully deleted: [File] C:\Users\HP\AppData\Roaming\mozilla\firefox\profiles\v7vqmpsy.default\user.js
Successfully deleted the following from C:\Users\HP\AppData\Roaming\mozilla\firefox\profiles\v7vqmpsy.default\prefs.js
user_pref("extensions.crossrider.bic", "133a3868bc2826bd82f76db6a0cb55a0");
user_pref("extensions.crossriderapp498.bic", "133a3868bc2826bd82f76db6a0cb55a0");
user_pref("extensions.crossriderapp498.firstrun", false);
user_pref("extensions.crossriderapp498.installationdate", 1321298464);
user_pref("extensions.crossriderapp498.jsver", 3);
user_pref("extensions.crossriderapp498.lastcheck", 22234849);
user_pref("extensions.crossriderapp498.lastcheckitem", 22234859);
user_pref("extensions.crossriderapp498.misc.lastBgWorkerTimer", "1334091583121");
user_pref("extensions.crossriderapp498.misc.lastDomWorkerTimer", "1334091583103");
user_pref("extensions.crossriderapp498@crossrider.com.install-event-fired", true);
Emptied folder: C:\Users\HP\AppData\Roaming\mozilla\firefox\profiles\v7vqmpsy.default\minidumps [169 files]
~~~ Event Viewer Logs were cleared
Shortcut cl. logfile:
sieht so aus als wäre der lollipop kram noch drauf: Code:
ATTFilter # AdwCleaner v3.016 - Bericht erstellt am 07/01/2014 um 00:39:34
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : HP - HP-PC
# Gestartet von : C:\Users\HP\Downloads\adwcleaner_3.016.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Windows\System32\roboot64.exe
Ordner Gefunden C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gefunden C:\Program Files (x86)\Common Files\Plasmoo
Ordner Gefunden C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Registry Optimizer
Ordner Gefunden C:\ProgramData\WPM
Ordner Gefunden C:\Users\HP\AppData\Local\Mobogenie
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\RewardsArcade
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Show-Password
Schlüssel Gefunden : HKCU\Software\Classes\Applications\lollipop.exe
Schlüssel Gefunden : HKCU\Software\lollipop
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : [x64] HKCU\Software\lollipop
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{7CD74AFF-3433-4E34-92E2-D98DFDB30754}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\RewardsArcade.BHO
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{0C58B7D1-D415-492B-A149-E976156BD3B8}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\Software\supWPM
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\prefs.js ]
Zeile gefunden : user_pref("browser.newtab.url", "hxxp://www.nationzoom.com/newtab/?type=nt&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292");
Zeile gefunden : user_pref("extensions.enabledItems", "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3,{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23,{ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1,fmdownloader@gmail.com:1.0[...]
*************************
AdwCleaner[R0].txt - [9178 octets] - [05/01/2014 19:13:15]
AdwCleaner[R1].txt - [3950 octets] - [07/01/2014 00:39:34]
########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [4010 octets] ##########
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-01-2014
Ran by HP (administrator) on HP-PC on 07-01-2014 00:45:12
Running from C:\Users\HP\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Connectify\ConnectifyService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Connectify) C:\Program Files (x86)\Connectify\Connectifyd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-15] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [450048 2009-07-22] (IDT, Inc.)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPCam_Menu] - C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS)
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [ROCCAT Pyra Mouse] - C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe [532480 2010-09-07] (ROCCAT)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [HP Deskjet 3520 series (NET)] - C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk -> C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2009-11-14] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 172.31.0.1
FireFox:
========
FF ProfilePath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default
FF NewTab: hxxp://www.nationzoom.com/newtab/?type=nt&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\HP\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: Adblock Plus - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 Connectify; C:\Program Files (x86)\Connectify\ConnectifyService.exe [65536 2012-11-09] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [227232 2010-01-15] (McAfee, Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe [240128 2009-07-22] (IDT, Inc.)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [84720 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [31344 2013-02-04] (Connectify)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S1 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-12-15] (Windows (R) Win 7 DDK provider)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-07 00:45 - 2014-01-07 00:45 - 00000000 ____D C:\Users\HP\Downloads\FRST-OlderVersion
2014-01-07 00:19 - 2014-01-07 00:19 - 00005730 _____ C:\sc-cleaner.txt
2014-01-07 00:18 - 2014-01-07 00:18 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\HP\Downloads\sc-cleaner.exe
2014-01-06 23:09 - 2014-01-06 23:09 - 01036305 _____ (Thisisu) C:\Users\HP\Downloads\JRT.exe
2014-01-06 23:09 - 2014-01-06 23:09 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 02:43 - 2014-01-06 02:43 - 00000000 ____D C:\Users\HP\Desktop\txt dateien
2014-01-06 02:42 - 2014-01-07 00:38 - 00000000 ____D C:\Users\HP\Desktop\log Dateien
2014-01-06 02:27 - 2014-01-06 02:27 - 00030935 _____ C:\ComboFix.txt
2014-01-06 02:04 - 2014-01-06 02:27 - 00000000 ____D C:\Qoobox
2014-01-06 02:04 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-06 02:04 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-06 02:04 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-06 00:51 - 2014-01-06 23:06 - 00000000 ____D C:\Users\HP\Desktop\Fallstudien Media Markt
2014-01-05 20:08 - 2014-01-05 20:08 - 00377856 _____ C:\Users\HP\Downloads\gmer_2.1.19163.exe
2014-01-05 20:04 - 2014-01-05 20:05 - 00035104 _____ C:\Users\HP\Downloads\Addition.txt
2014-01-05 20:02 - 2014-01-07 00:45 - 00016024 _____ C:\Users\HP\Downloads\FRST.txt
2014-01-05 20:01 - 2014-01-07 00:45 - 00000000 ____D C:\FRST
2014-01-05 20:00 - 2014-01-07 00:45 - 01931762 _____ (Farbar) C:\Users\HP\Downloads\FRST64.exe
2014-01-05 19:55 - 2014-01-05 19:58 - 00000466 _____ C:\Users\HP\Downloads\defogger_disable.log
2014-01-05 19:55 - 2014-01-05 19:55 - 00050477 _____ C:\Users\HP\Downloads\Defogger.exe
2014-01-05 19:55 - 2014-01-05 19:55 - 00000000 _____ C:\Users\HP\defogger_reenable
2014-01-05 19:13 - 2014-01-07 00:40 - 00000000 ____D C:\AdwCleaner
2014-01-05 19:13 - 2014-01-05 19:13 - 01233962 _____ C:\Users\HP\Downloads\adwcleaner_3.016.exe
2014-01-05 18:17 - 2014-01-05 18:17 - 00003094 _____ C:\Windows\System32\Tasks\{0EC71F8B-5BB4-4732-9DA9-0DDCCEAD66D8}
2014-01-02 03:54 - 2014-01-02 03:54 - 00003104 _____ C:\Windows\System32\Tasks\{EE114A32-CFB7-4C59-9274-03C60BB1D9EA}
2014-01-02 02:08 - 2014-01-02 02:08 - 00007605 _____ C:\Users\HP\AppData\Local\Resmon.ResmonCfg
2014-01-02 02:03 - 2014-01-02 02:03 - 00821760 _____ (Browser Opt-out) C:\Users\HP\Downloads\uninstall.exe
2013-12-31 01:58 - 2013-12-31 02:04 - 00000000 ____D C:\Users\HP\Desktop\USB Stick
2013-12-31 01:13 - 2014-01-05 18:49 - 00000000 ____D C:\ProgramData\WPM
2013-12-31 01:13 - 2014-01-05 18:47 - 00000000 ____D C:\Program Files (x86)\AmiExt
2013-12-31 01:13 - 2014-01-02 20:18 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2013-12-31 01:07 - 2013-12-31 01:24 - 00000000 ____D C:\Users\HP\AppData\Local\cache
2013-12-31 01:06 - 2013-12-31 01:26 - 00000000 ____D C:\Users\HP\AppData\Local\Mobogenie
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 _____ C:\Users\HP\daemonprocess.txt
2013-12-31 01:05 - 2014-01-02 02:03 - 00003232 _____ C:\Windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2013-12-31 00:41 - 2014-01-06 02:25 - 00000000 ____D C:\Windows\ERDNT
2013-12-31 00:41 - 2014-01-06 02:04 - 05160001 ____R (Swearware) C:\Users\HP\Desktop\ComboFix.exe
2013-12-27 03:15 - 2013-12-27 03:24 - 00001648 _____ C:\Windows\system32\ASOROSet.bin
2013-12-27 03:15 - 2013-12-27 03:16 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-12-27 01:02 - 2013-12-27 01:02 - 00001194 _____ C:\Users\HP\Desktop\Amazon Cloud Player.lnk
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Local\Amazon Cloud Player
2013-12-27 00:59 - 2013-12-27 01:01 - 36152456 _____ (Amazon) C:\Users\HP\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-27 00:40 - 2013-12-27 03:01 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-27 00:39 - 2013-12-27 03:01 - 00000000 ____D C:\Program Files\mbar
2013-12-27 00:39 - 2013-12-27 00:39 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-26 19:15 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-12-26 19:15 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-12-22 20:51 - 2013-08-16 13:56 - 00216064 _____ C:\Windows\SysWOW64\gcapi_dll.dll
2013-12-22 18:26 - 2013-12-22 18:26 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-12-22 18:24 - 2013-12-22 18:26 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-22 18:24 - 2013-12-22 18:26 - 00000000 ____D C:\Program Files\iTunes
2013-12-22 18:24 - 2013-12-22 18:26 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-22 18:24 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files\iPod
2013-12-22 18:16 - 2013-12-22 18:19 - 33893112 _____ (DVDVideoSoft Ltd. ) C:\Users\HP\Downloads\FreeYouTubeToMP3Converter(1).exe
2013-12-20 02:42 - 2013-12-20 02:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 03:46 - 2013-12-15 03:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Avira
2013-12-15 03:43 - 2013-12-15 03:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-12-15 03:43 - 2013-12-09 11:37 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-15 03:43 - 2013-12-09 11:37 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-15 03:43 - 2013-12-09 11:37 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-15 03:43 - 2013-12-09 11:37 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-12-15 03:30 - 2013-12-15 03:33 - 129598176 _____ C:\Users\HP\Downloads\avira_free_antivirus_de.exe
2013-12-15 03:10 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-15 03:10 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-15 03:10 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-15 03:10 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-15 03:07 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-15 03:07 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-15 03:07 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-15 03:07 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-15 03:07 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-15 03:07 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-15 03:07 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-15 03:07 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-15 03:07 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-15 03:07 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-15 03:07 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-15 03:07 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-15 03:07 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-15 03:07 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-15 03:07 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-15 03:07 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-15 03:07 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-15 03:07 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-15 03:07 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-15 03:07 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-15 03:07 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-15 03:07 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-15 03:07 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-15 03:07 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-15 03:07 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-15 03:07 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-15 03:07 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-15 03:07 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-15 03:07 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-15 03:07 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-15 03:07 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-15 02:46 - 2014-01-06 22:48 - 00000000 ____D C:\ProgramData\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:46 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-12-15 02:46 - 2013-12-15 02:46 - 00001042 _____ C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-12-15 02:45 - 2013-12-15 02:46 - 05049344 _____ (Crawler.com ) C:\Users\HP\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-12-15 02:30 - 2013-12-15 02:30 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Users\HP\AppData\Roaming\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 02:30 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-12-15 02:29 - 2013-12-15 02:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\HP\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-15 02:19 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-15 02:19 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-15 02:19 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-15 02:19 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-15 02:19 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-15 02:19 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-15 02:19 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-15 02:19 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-15 02:19 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-15 02:18 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-15 02:18 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-15 02:18 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-15 02:18 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-15 02:18 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-15 02:18 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-15 02:18 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-15 02:18 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-15 02:18 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-12 01:54 - 2013-12-12 01:54 - 09272200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-12-12 00:38 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
==================== One Month Modified Files and Folders =======
2014-01-07 00:45 - 2014-01-07 00:45 - 00000000 ____D C:\Users\HP\Downloads\FRST-OlderVersion
2014-01-07 00:45 - 2014-01-05 20:02 - 00016024 _____ C:\Users\HP\Downloads\FRST.txt
2014-01-07 00:45 - 2014-01-05 20:01 - 00000000 ____D C:\FRST
2014-01-07 00:45 - 2014-01-05 20:00 - 01931762 _____ (Farbar) C:\Users\HP\Downloads\FRST64.exe
2014-01-07 00:42 - 2009-07-14 05:51 - 00416209 _____ C:\Windows\setupact.log
2014-01-07 00:40 - 2014-01-05 19:13 - 00000000 ____D C:\AdwCleaner
2014-01-07 00:38 - 2014-01-06 02:42 - 00000000 ____D C:\Users\HP\Desktop\log Dateien
2014-01-07 00:19 - 2014-01-07 00:19 - 00005730 _____ C:\sc-cleaner.txt
2014-01-07 00:19 - 2010-12-29 18:27 - 00001425 _____ C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-07 00:18 - 2014-01-07 00:18 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\HP\Downloads\sc-cleaner.exe
2014-01-06 23:54 - 2012-04-18 15:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-06 23:29 - 2009-12-20 01:26 - 01355410 _____ C:\Windows\WindowsUpdate.log
2014-01-06 23:09 - 2014-01-06 23:09 - 01036305 _____ (Thisisu) C:\Users\HP\Downloads\JRT.exe
2014-01-06 23:09 - 2014-01-06 23:09 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 23:06 - 2014-01-06 00:51 - 00000000 ____D C:\Users\HP\Desktop\Fallstudien Media Markt
2014-01-06 22:55 - 2009-07-14 05:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-06 22:55 - 2009-07-14 05:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-06 22:51 - 2009-11-14 09:10 - 00654400 _____ C:\Windows\system32\perfh007.dat
2014-01-06 22:51 - 2009-11-14 09:10 - 00130240 _____ C:\Windows\system32\perfc007.dat
2014-01-06 22:51 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-06 22:48 - 2013-12-15 02:46 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-06 22:46 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-06 02:43 - 2014-01-06 02:43 - 00000000 ____D C:\Users\HP\Desktop\txt dateien
2014-01-06 02:27 - 2014-01-06 02:27 - 00030935 _____ C:\ComboFix.txt
2014-01-06 02:27 - 2014-01-06 02:04 - 00000000 ____D C:\Qoobox
2014-01-06 02:25 - 2013-12-31 00:41 - 00000000 ____D C:\Windows\ERDNT
2014-01-06 02:20 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-06 02:18 - 2009-12-20 01:28 - 00409960 _____ C:\Windows\PFRO.log
2014-01-06 02:04 - 2013-12-31 00:41 - 05160001 ____R (Swearware) C:\Users\HP\Desktop\ComboFix.exe
2014-01-05 20:08 - 2014-01-05 20:08 - 00377856 _____ C:\Users\HP\Downloads\gmer_2.1.19163.exe
2014-01-05 20:05 - 2014-01-05 20:04 - 00035104 _____ C:\Users\HP\Downloads\Addition.txt
2014-01-05 19:58 - 2014-01-05 19:55 - 00000466 _____ C:\Users\HP\Downloads\defogger_disable.log
2014-01-05 19:55 - 2014-01-05 19:55 - 00050477 _____ C:\Users\HP\Downloads\Defogger.exe
2014-01-05 19:55 - 2014-01-05 19:55 - 00000000 _____ C:\Users\HP\defogger_reenable
2014-01-05 19:55 - 2010-12-29 18:13 - 00000000 ____D C:\Users\HP
2014-01-05 19:13 - 2014-01-05 19:13 - 01233962 _____ C:\Users\HP\Downloads\adwcleaner_3.016.exe
2014-01-05 18:49 - 2013-12-31 01:13 - 00000000 ____D C:\ProgramData\WPM
2014-01-05 18:47 - 2013-12-31 01:13 - 00000000 ____D C:\Program Files (x86)\AmiExt
2014-01-05 18:17 - 2014-01-05 18:17 - 00003094 _____ C:\Windows\System32\Tasks\{0EC71F8B-5BB4-4732-9DA9-0DDCCEAD66D8}
2014-01-02 20:18 - 2013-12-31 01:13 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-02 20:03 - 2013-08-05 12:56 - 00000298 _____ C:\Windows\Tasks\Registry Optimizer_UPDATES.job
2014-01-02 20:03 - 2013-08-05 12:56 - 00000290 _____ C:\Windows\Tasks\Registry Optimizer_DEFAULT.job
2014-01-02 20:03 - 2012-06-12 19:47 - 00001126 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000UA.job
2014-01-02 20:03 - 2012-06-12 19:47 - 00001104 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000Core.job
2014-01-02 03:54 - 2014-01-02 03:54 - 00003104 _____ C:\Windows\System32\Tasks\{EE114A32-CFB7-4C59-9274-03C60BB1D9EA}
2014-01-02 02:08 - 2014-01-02 02:08 - 00007605 _____ C:\Users\HP\AppData\Local\Resmon.ResmonCfg
2014-01-02 02:03 - 2014-01-02 02:03 - 00821760 _____ (Browser Opt-out) C:\Users\HP\Downloads\uninstall.exe
2014-01-02 02:03 - 2013-12-31 01:05 - 00003232 _____ C:\Windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2014-01-02 02:03 - 2013-08-05 12:56 - 00003030 _____ C:\Windows\System32\Tasks\Registry Optimizer_UPDATES
2014-01-02 02:03 - 2013-08-05 12:56 - 00002874 _____ C:\Windows\System32\Tasks\Registry Optimizer_DEFAULT
2014-01-02 02:03 - 2012-06-12 19:47 - 00004108 _____ C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000UA
2014-01-02 02:03 - 2012-06-12 19:47 - 00003740 _____ C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000Core
2014-01-02 02:03 - 2011-06-15 22:16 - 00002976 _____ C:\Windows\System32\Tasks\{4F439D31-FE66-419E-83ED-226959865089}
2014-01-02 02:03 - 2011-06-07 13:11 - 00002944 _____ C:\Windows\System32\Tasks\{DF839B04-3AAD-4816-88AD-8681C45D346E}
2014-01-02 02:03 - 2011-06-07 13:11 - 00002944 _____ C:\Windows\System32\Tasks\{2D3F316B-D4F7-494D-B304-4DD0EB6C1F54}
2014-01-02 02:03 - 2011-06-07 13:10 - 00002944 _____ C:\Windows\System32\Tasks\{36027D2C-8F38-4FB3-AD64-AF13885712AD}
2014-01-02 02:03 - 2011-06-07 12:52 - 00002880 _____ C:\Windows\System32\Tasks\{DDAE587A-FA93-40F2-B6E0-CCD070C4E8EF}
2014-01-02 02:03 - 2011-01-16 01:05 - 00002880 _____ C:\Windows\System32\Tasks\{053EF3CB-0602-4FFD-910E-C29615802CC7}
2014-01-02 02:03 - 2010-12-29 18:27 - 00003958 _____ C:\Windows\System32\Tasks\RecoveryCDWin7
2014-01-02 02:03 - 2010-12-29 18:26 - 00003766 _____ C:\Windows\System32\Tasks\Registration
2013-12-31 02:04 - 2013-12-31 01:58 - 00000000 ____D C:\Users\HP\Desktop\USB Stick
2013-12-31 01:26 - 2013-12-31 01:06 - 00000000 ____D C:\Users\HP\AppData\Local\Mobogenie
2013-12-31 01:24 - 2013-12-31 01:07 - 00000000 ____D C:\Users\HP\AppData\Local\cache
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 _____ C:\Users\HP\daemonprocess.txt
2013-12-27 21:44 - 2012-11-19 19:17 - 00000000 ____D C:\Users\HP\Documents\persoführung
2013-12-27 21:42 - 2012-07-30 18:10 - 00000000 ____D C:\Users\HP\Documents\Auslandspraktikum
2013-12-27 08:48 - 2010-12-29 18:27 - 00000000 ___RD C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 08:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-12-27 08:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-27 03:24 - 2013-12-27 03:15 - 00001648 _____ C:\Windows\system32\ASOROSet.bin
2013-12-27 03:24 - 2009-07-14 03:34 - 85721088 _____ C:\Windows\system32\config\software.bak
2013-12-27 03:24 - 2009-07-14 03:34 - 17301504 _____ C:\Windows\system32\config\system.bak
2013-12-27 03:24 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2013-12-27 03:17 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2013-12-27 03:16 - 2013-12-27 03:15 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-12-27 03:01 - 2013-12-27 00:40 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-27 03:01 - 2013-12-27 00:39 - 00000000 ____D C:\Program Files\mbar
2013-12-27 01:02 - 2013-12-27 01:02 - 00001194 _____ C:\Users\HP\Desktop\Amazon Cloud Player.lnk
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Local\Amazon Cloud Player
2013-12-27 01:01 - 2013-12-27 00:59 - 36152456 _____ (Amazon) C:\Users\HP\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-27 00:39 - 2013-12-27 00:39 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-22 20:51 - 2011-06-24 13:47 - 00000000 ____D C:\Users\HP\AppData\Roaming\Foxit Software
2013-12-22 18:26 - 2013-12-22 18:26 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-12-22 18:26 - 2013-12-22 18:24 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-12-22 18:26 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files\iTunes
2013-12-22 18:26 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-12-22 18:24 - 2013-12-22 18:24 - 00000000 ____D C:\Program Files\iPod
2013-12-22 18:21 - 2011-01-20 06:19 - 00000000 ____D C:\Users\HP\AppData\Roaming\DVDVideoSoft
2013-12-22 18:21 - 2011-01-17 10:05 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-12-22 18:19 - 2013-12-22 18:16 - 33893112 _____ (DVDVideoSoft Ltd. ) C:\Users\HP\Downloads\FreeYouTubeToMP3Converter(1).exe
2013-12-22 16:42 - 2012-04-25 15:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-21 20:28 - 2013-11-17 16:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox.bak
2013-12-20 02:42 - 2013-12-20 02:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-15 15:13 - 2009-07-14 05:45 - 00459128 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-15 04:45 - 2010-12-30 02:40 - 00000000 ____D C:\ProgramData\Recovery
2013-12-15 03:46 - 2013-12-15 03:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Avira
2013-12-15 03:43 - 2013-12-15 03:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-12-15 03:43 - 2013-08-05 10:58 - 00000000 ____D C:\ProgramData\Avira
2013-12-15 03:33 - 2013-12-15 03:30 - 129598176 _____ C:\Users\HP\Downloads\avira_free_antivirus_de.exe
2013-12-15 03:09 - 2009-11-14 01:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 03:06 - 2013-08-16 19:45 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 03:01 - 2011-04-18 12:03 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-15 02:46 - 2013-12-15 02:46 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2013-12-15 02:46 - 2013-12-15 02:46 - 00001042 _____ C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Users\HP\AppData\Roaming\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:46 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2013-12-15 02:46 - 2013-12-15 02:45 - 05049344 _____ (Crawler.com ) C:\Users\HP\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-12-15 02:30 - 2013-12-15 02:30 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Users\HP\AppData\Roaming\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-15 02:30 - 2013-12-15 02:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 02:29 - 2013-12-15 02:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\HP\Downloads\mbam-setup-1.75.0.1300.exe
2013-12-12 23:17 - 2009-12-20 10:15 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-12 01:54 - 2013-12-12 01:54 - 09272200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-12-12 01:54 - 2012-04-18 15:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-12 01:54 - 2012-04-18 15:56 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-12 01:54 - 2011-05-25 19:47 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-09 11:37 - 2013-12-15 03:43 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-09 11:37 - 2013-12-15 03:43 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-09 11:37 - 2013-12-15 03:43 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-09 11:37 - 2013-12-15 03:43 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
Some content of TEMP:
====================
C:\Users\HP\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-05 22:01
==================== End Of Log ============================
liebe grüße Stephanie |
|
07.01.2014, 13:11
| #6 |
| /// the machine /// TB-Ausbilder | Entfernung von greygray, lollipop und nation zoom Hast Du mit ADwCleaner auch löschen lassen? ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Entfernung von greygray, lollipop und nation zoom |
|
18.01.2014, 03:43
| #7 |
| | Entfernung von greygray, lollipop und nation zoom Hallo! Vorerst einmal sorry, dass es so lange gedauert hat, aber der ESET Scanner hat mich viele Nerven gekostet, weil er stundenlang gebraucht hat und ich es deswegen zweimal unterbrechen musste, bis ich heute die Zeit fand es ganz durchlaufen zu lassen. Und hier das Ergebnis: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2c5f00f5cc284747a00b667d6fbc6e5f
# engine=16574
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-09 03:54:55
# local_time=2014-01-09 04:54:55 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 0 2657857 3866 0
# compatibility_mode=5893 16776574 100 94 1337891 140869545 0 0
# compatibility_mode=7937 16777214 28 75 2167699 24284943 0 0
# scanned=206239
# found=1
# cleaned=0
# scan_time=6603
sh=359D977D432E4F90FE627B2717144AE873990AC4 ft=1 fh=63c7b0ee3e7f229d vn="a variant of Win32/Toolbar.Conduit.B application" ac=I fn="C:\Program Files (x86)\Common Files\DVDVideoSoft\TB\DVDVideoSoftTB.exe"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2c5f00f5cc284747a00b667d6fbc6e5f
# engine=16637
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-14 01:26:24
# local_time=2014-01-14 02:26:24 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 13891 3080946 17887 0
# compatibility_mode=5893 16776574 100 94 1760980 141292634 0 0
# compatibility_mode=7937 16777214 28 75 2590788 24708032 0 0
# scanned=109317
# found=0
# cleaned=0
# scan_time=13575
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2c5f00f5cc284747a00b667d6fbc6e5f
# engine=16694
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-17 10:45:58
# local_time=2014-01-17 11:45:58 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 0 3416920 72190 0
# compatibility_mode=5893 16776574 100 94 2096954 141628608 0 0
# compatibility_mode=7937 16777214 28 75 2095162 25044006 0 0
# scanned=265774
# found=0
# cleaned=0
# scan_time=23059
Logfile vom Security Check: Code:
ATTFilter Results of screen317's Security Check version 0.99.78 Windows 7 Service Pack 1 x64 Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Spyware Terminator 2012 Malwarebytes Anti-Malware Version 1.75.0.1300 Wise Registry Cleaner 7.82 Java(TM) 6 Update 32 Java 7 Update 25 Java version out of Date! Adobe Flash Player 11.9.900.170 Mozilla Firefox (26.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Aus Fehlern lernt man ;-) Die hässliche Nationzoom Startseite öffnet sich immer noch.. :/ Liebe Grüße Stephanie |
|
18.01.2014, 17:05
| #8 |
| /// the machine /// TB-Ausbilder | Entfernung von greygray, lollipop und nation zoom AdwCleaner auch löschen lassen, dann den ShortCut Cleaner von oben. dann ein frisches FRST log.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.01.2014, 01:07
| #9 |
| | Entfernung von greygray, lollipop und nation zoom adwCleaner log (mit löschen) Code:
ATTFilter # AdwCleaner v3.017 - Bericht erstellt am 26/01/2014 um 00:43:57
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : HP - HP-PC
# Gestartet von : C:\Users\HP\Downloads\adwcleaner(1).exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\WPM
[x] Nicht Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Registry Optimizer
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Program Files (x86)\Common Files\Plasmoo
Ordner Gelöscht : C:\Users\HP\AppData\Local\Mobogenie
Datei Gelöscht : C:\Windows\System32\roboot64.exe
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Classes\Applications\lollipop.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RewardsArcade.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RewardsArcade.Sandbox.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7CD74AFF-3433-4E34-92E2-D98DFDB30754}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{0C58B7D1-D415-492B-A149-E976156BD3B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\RewardsArcade
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Show-Password
Schlüssel Gelöscht : HKLM\Software\supWPM
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www.nationzoom.com/newtab/?type=nt&ts=1388448801&from=amt&uid=WDCXWD3200BEKT-60V5T1_WD-WX80AB9N0292N0292");
Zeile gelöscht : user_pref("extensions.enabledItems", "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.3,{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23,{ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1,fmdownloader@gmail.com:1.0[...]
*************************
AdwCleaner[R0].txt - [9178 octets] - [05/01/2014 19:13:15]
AdwCleaner[R1].txt - [4110 octets] - [07/01/2014 00:39:34]
AdwCleaner[R2].txt - [4167 octets] - [26/01/2014 00:35:51]
AdwCleaner[S0].txt - [3936 octets] - [26/01/2014 00:43:57]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3996 octets] ##########
Code:
ATTFilter Shortcut Cleaner 1.2.6 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Shortcut Cleaner can be found at this link:
hxxp://www.bleepingcomputer.com/download/shortcut-cleaner/
Windows Version: Windows 7 Home Premium Service Pack 1
Program started at: 01/26/2014 12:51:54 AM.
Scanning for registry hijacks:
* No issues found in the Registry.
Searching for Hijacked Shortcuts:
Searching C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\
Searching C:\ProgramData\Microsoft\Windows\Start Menu\
Searching C:\Users\HP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\
Searching C:\Users\Public\Desktop\
Searching C:\Users\HP\Desktop
0 bad shortcuts found.
Program finished at: 01/26/2014 12:51:59 AM
Execution time: 0 hours(s), 0 minute(s), and 4 seconds(s)
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-01-2014 01
Ran by HP (administrator) on HP-PC on 26-01-2014 00:58:23
Running from C:\Users\HP\Downloads\FRST-OlderVersion
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Connectify\ConnectifyService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Connectify) C:\Program Files (x86)\Connectify\Connectifyd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(ROCCAT) C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-15] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [450048 2009-07-22] (IDT, Inc.)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HPCam_Menu] - c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS)
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [ROCCAT Pyra Mouse] - C:\Program Files (x86)\ROCCAT\Pyra Mouse\PyraMonitor.EXE [532480 2010-09-07] (ROCCAT)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKCU\...\Run: [HP Deskjet 3520 series (NET)] - C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1050 J410 series.lnk -> C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2009-11-14] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\HP\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-23]
FF Extension: Adblock Plus - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\v7vqmpsy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-07-03]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-12-20]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
R2 Connectify; C:\Program Files (x86)\Connectify\ConnectifyService.exe [65536 2012-11-09] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [227232 2010-01-15] (McAfee, Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe [240128 2009-07-22] (IDT, Inc.)
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [x]
==================== Drivers (Whitelisted) ====================
R1 cnnctfy2; C:\Windows\System32\DRIVERS\cnnctfy2.sys [31344 2013-02-04] (Connectify)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S1 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-12-15] (Windows (R) Win 7 DDK provider)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-26 00:34 - 2014-01-26 00:34 - 01236282 _____ C:\Users\HP\Downloads\adwcleaner(1).exe
2014-01-24 21:52 - 2012-03-14 05:00 - 00385024 _____ (CANON INC.) C:\Windows\system32\CNMLMAD.DLL
2014-01-16 03:22 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-16 03:22 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-16 03:22 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-16 03:22 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-16 03:22 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-16 03:22 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-16 03:22 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-16 03:22 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-16 03:22 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-13 22:37 - 2014-01-13 22:38 - 02347384 _____ (ESET) C:\Users\HP\Downloads\esetsmartinstaller_enu(1).exe
2014-01-09 04:57 - 2014-01-09 04:57 - 00987410 _____ C:\Users\HP\Downloads\SecurityCheck.exe
2014-01-09 03:00 - 2014-01-09 03:00 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-09 02:50 - 2014-01-09 02:59 - 02347384 _____ (ESET) C:\Users\HP\Downloads\esetsmartinstaller_enu.exe
2014-01-07 12:26 - 2014-01-07 12:27 - 00000077 _____ C:\Users\HP\Desktop\Link zu präsentationstip.txt
2014-01-07 00:45 - 2014-01-26 00:58 - 00000000 ____D C:\Users\HP\Downloads\FRST-OlderVersion
2014-01-07 00:19 - 2014-01-26 00:51 - 00001778 _____ C:\sc-cleaner.txt
2014-01-07 00:18 - 2014-01-07 00:18 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\HP\Downloads\sc-cleaner.exe
2014-01-06 23:09 - 2014-01-06 23:09 - 01036305 _____ (Thisisu) C:\Users\HP\Downloads\JRT.exe
2014-01-06 23:09 - 2014-01-06 23:09 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 02:43 - 2014-01-06 02:43 - 00000000 ____D C:\Users\HP\Desktop\txt dateien
2014-01-06 02:42 - 2014-01-26 00:53 - 00000000 ____D C:\Users\HP\Desktop\log Dateien
2014-01-06 02:27 - 2014-01-06 02:27 - 00030935 _____ C:\ComboFix.txt
2014-01-06 02:04 - 2014-01-06 02:27 - 00000000 ____D C:\Qoobox
2014-01-06 02:04 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-06 02:04 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-06 02:04 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-06 02:04 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-06 00:51 - 2014-01-17 02:40 - 00000000 ____D C:\Users\HP\Desktop\Fallstudien Media Markt
2014-01-05 20:08 - 2014-01-05 20:08 - 00377856 _____ C:\Users\HP\Downloads\gmer_2.1.19163.exe
2014-01-05 20:04 - 2014-01-05 20:05 - 00035104 _____ C:\Users\HP\Downloads\Addition.txt
2014-01-05 20:02 - 2014-01-07 00:46 - 00043998 _____ C:\Users\HP\Downloads\FRST.txt
2014-01-05 20:01 - 2014-01-26 00:55 - 00000000 ____D C:\FRST
2014-01-05 20:00 - 2014-01-07 00:45 - 01931762 _____ (Farbar) C:\Users\HP\Downloads\FRST64.exe
2014-01-05 19:55 - 2014-01-05 19:58 - 00000466 _____ C:\Users\HP\Downloads\defogger_disable.log
2014-01-05 19:55 - 2014-01-05 19:55 - 00050477 _____ C:\Users\HP\Downloads\Defogger.exe
2014-01-05 19:55 - 2014-01-05 19:55 - 00000000 _____ C:\Users\HP\defogger_reenable
2014-01-05 19:13 - 2014-01-26 00:44 - 00000000 ____D C:\AdwCleaner
2014-01-05 19:13 - 2014-01-05 19:13 - 01233962 _____ C:\Users\HP\Downloads\adwcleaner_3.016.exe
2014-01-05 18:17 - 2014-01-05 18:17 - 00003094 _____ C:\Windows\System32\Tasks\{0EC71F8B-5BB4-4732-9DA9-0DDCCEAD66D8}
2014-01-02 03:54 - 2014-01-02 03:54 - 00003104 _____ C:\Windows\System32\Tasks\{EE114A32-CFB7-4C59-9274-03C60BB1D9EA}
2014-01-02 02:08 - 2014-01-02 02:08 - 00007605 _____ C:\Users\HP\AppData\Local\Resmon.ResmonCfg
2014-01-02 02:03 - 2014-01-02 02:03 - 00821760 _____ (Browser Opt-out) C:\Users\HP\Downloads\uninstall.exe
2013-12-31 01:58 - 2013-12-31 02:04 - 00000000 ____D C:\Users\HP\Desktop\USB Stick
2013-12-31 01:13 - 2014-01-05 18:47 - 00000000 ____D C:\Program Files (x86)\AmiExt
2013-12-31 01:13 - 2014-01-02 20:18 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2013-12-31 01:07 - 2013-12-31 01:24 - 00000000 ____D C:\Users\HP\AppData\Local\cache
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 _____ C:\Users\HP\daemonprocess.txt
2013-12-31 01:05 - 2014-01-02 02:03 - 00003232 _____ C:\Windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2013-12-31 00:41 - 2014-01-06 02:25 - 00000000 ____D C:\Windows\ERDNT
2013-12-31 00:41 - 2014-01-06 02:04 - 05160001 ____R (Swearware) C:\Users\HP\Desktop\ComboFix.exe
2013-12-27 03:15 - 2013-12-27 03:24 - 00001648 _____ C:\Windows\system32\ASOROSet.bin
2013-12-27 03:15 - 2013-12-27 03:16 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-12-27 01:02 - 2013-12-27 01:02 - 00001194 _____ C:\Users\HP\Desktop\Amazon Cloud Player.lnk
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Local\Amazon Cloud Player
2013-12-27 00:59 - 2013-12-27 01:01 - 36152456 _____ (Amazon) C:\Users\HP\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-27 00:40 - 2013-12-27 03:01 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-27 00:39 - 2013-12-27 03:01 - 00000000 ____D C:\Program Files\mbar
2013-12-27 00:39 - 2013-12-27 00:39 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
==================== One Month Modified Files and Folders =======
2014-01-26 00:58 - 2014-01-07 00:45 - 00000000 ____D C:\Users\HP\Downloads\FRST-OlderVersion
2014-01-26 00:55 - 2014-01-05 20:01 - 00000000 ____D C:\FRST
2014-01-26 00:54 - 2012-04-18 15:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-26 00:54 - 2009-07-14 05:51 - 00422662 _____ C:\Windows\setupact.log
2014-01-26 00:53 - 2014-01-06 02:42 - 00000000 ____D C:\Users\HP\Desktop\log Dateien
2014-01-26 00:53 - 2009-07-14 05:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-26 00:53 - 2009-07-14 05:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-26 00:51 - 2014-01-07 00:19 - 00001778 _____ C:\sc-cleaner.txt
2014-01-26 00:50 - 2009-11-14 09:10 - 00654400 _____ C:\Windows\system32\perfh007.dat
2014-01-26 00:50 - 2009-11-14 09:10 - 00130240 _____ C:\Windows\system32\perfc007.dat
2014-01-26 00:50 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-26 00:46 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-26 00:45 - 2009-12-20 01:26 - 01281626 _____ C:\Windows\WindowsUpdate.log
2014-01-26 00:44 - 2014-01-05 19:13 - 00000000 ____D C:\AdwCleaner
2014-01-26 00:34 - 2014-01-26 00:34 - 01236282 _____ C:\Users\HP\Downloads\adwcleaner(1).exe
2014-01-26 00:18 - 2009-12-20 01:28 - 00466350 _____ C:\Windows\PFRO.log
2014-01-25 00:16 - 2012-03-26 22:31 - 00000000 ____D C:\Users\HP\Documents\Kostenrechnung
2014-01-24 21:06 - 2013-12-15 02:46 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-18 02:54 - 2013-08-05 10:58 - 00000000 ____D C:\ProgramData\Avira
2014-01-17 02:40 - 2014-01-06 00:51 - 00000000 ____D C:\Users\HP\Desktop\Fallstudien Media Markt
2014-01-16 20:36 - 2009-07-14 05:45 - 00459128 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-16 04:25 - 2013-08-16 19:45 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 04:22 - 2011-04-18 12:03 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-13 22:38 - 2014-01-13 22:37 - 02347384 _____ (ESET) C:\Users\HP\Downloads\esetsmartinstaller_enu(1).exe
2014-01-09 04:57 - 2014-01-09 04:57 - 00987410 _____ C:\Users\HP\Downloads\SecurityCheck.exe
2014-01-09 03:00 - 2014-01-09 03:00 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-09 02:59 - 2014-01-09 02:50 - 02347384 _____ (ESET) C:\Users\HP\Downloads\esetsmartinstaller_enu.exe
2014-01-07 12:27 - 2014-01-07 12:26 - 00000077 _____ C:\Users\HP\Desktop\Link zu präsentationstip.txt
2014-01-07 00:46 - 2014-01-05 20:02 - 00043998 _____ C:\Users\HP\Downloads\FRST.txt
2014-01-07 00:45 - 2014-01-05 20:00 - 01931762 _____ (Farbar) C:\Users\HP\Downloads\FRST64.exe
2014-01-07 00:19 - 2010-12-29 18:27 - 00001425 _____ C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-07 00:18 - 2014-01-07 00:18 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\HP\Downloads\sc-cleaner.exe
2014-01-06 23:09 - 2014-01-06 23:09 - 01036305 _____ (Thisisu) C:\Users\HP\Downloads\JRT.exe
2014-01-06 23:09 - 2014-01-06 23:09 - 00000000 ____D C:\Windows\ERUNT
2014-01-06 02:43 - 2014-01-06 02:43 - 00000000 ____D C:\Users\HP\Desktop\txt dateien
2014-01-06 02:27 - 2014-01-06 02:27 - 00030935 _____ C:\ComboFix.txt
2014-01-06 02:27 - 2014-01-06 02:04 - 00000000 ____D C:\Qoobox
2014-01-06 02:25 - 2013-12-31 00:41 - 00000000 ____D C:\Windows\ERDNT
2014-01-06 02:20 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-06 02:04 - 2013-12-31 00:41 - 05160001 ____R (Swearware) C:\Users\HP\Desktop\ComboFix.exe
2014-01-05 20:08 - 2014-01-05 20:08 - 00377856 _____ C:\Users\HP\Downloads\gmer_2.1.19163.exe
2014-01-05 20:05 - 2014-01-05 20:04 - 00035104 _____ C:\Users\HP\Downloads\Addition.txt
2014-01-05 19:58 - 2014-01-05 19:55 - 00000466 _____ C:\Users\HP\Downloads\defogger_disable.log
2014-01-05 19:55 - 2014-01-05 19:55 - 00050477 _____ C:\Users\HP\Downloads\Defogger.exe
2014-01-05 19:55 - 2014-01-05 19:55 - 00000000 _____ C:\Users\HP\defogger_reenable
2014-01-05 19:55 - 2010-12-29 18:13 - 00000000 ____D C:\Users\HP
2014-01-05 19:13 - 2014-01-05 19:13 - 01233962 _____ C:\Users\HP\Downloads\adwcleaner_3.016.exe
2014-01-05 18:47 - 2013-12-31 01:13 - 00000000 ____D C:\Program Files (x86)\AmiExt
2014-01-05 18:17 - 2014-01-05 18:17 - 00003094 _____ C:\Windows\System32\Tasks\{0EC71F8B-5BB4-4732-9DA9-0DDCCEAD66D8}
2014-01-02 20:18 - 2013-12-31 01:13 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-02 20:03 - 2013-08-05 12:56 - 00000298 _____ C:\Windows\Tasks\Registry Optimizer_UPDATES.job
2014-01-02 20:03 - 2013-08-05 12:56 - 00000290 _____ C:\Windows\Tasks\Registry Optimizer_DEFAULT.job
2014-01-02 20:03 - 2012-06-12 19:47 - 00001126 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000UA.job
2014-01-02 20:03 - 2012-06-12 19:47 - 00001104 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000Core.job
2014-01-02 03:54 - 2014-01-02 03:54 - 00003104 _____ C:\Windows\System32\Tasks\{EE114A32-CFB7-4C59-9274-03C60BB1D9EA}
2014-01-02 02:08 - 2014-01-02 02:08 - 00007605 _____ C:\Users\HP\AppData\Local\Resmon.ResmonCfg
2014-01-02 02:03 - 2014-01-02 02:03 - 00821760 _____ (Browser Opt-out) C:\Users\HP\Downloads\uninstall.exe
2014-01-02 02:03 - 2013-12-31 01:05 - 00003232 _____ C:\Windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2014-01-02 02:03 - 2013-08-05 12:56 - 00003030 _____ C:\Windows\System32\Tasks\Registry Optimizer_UPDATES
2014-01-02 02:03 - 2013-08-05 12:56 - 00002874 _____ C:\Windows\System32\Tasks\Registry Optimizer_DEFAULT
2014-01-02 02:03 - 2012-06-12 19:47 - 00004108 _____ C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000UA
2014-01-02 02:03 - 2012-06-12 19:47 - 00003740 _____ C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3418313437-4185168109-3229983112-1000Core
2014-01-02 02:03 - 2011-06-15 22:16 - 00002976 _____ C:\Windows\System32\Tasks\{4F439D31-FE66-419E-83ED-226959865089}
2014-01-02 02:03 - 2011-06-07 13:11 - 00002944 _____ C:\Windows\System32\Tasks\{DF839B04-3AAD-4816-88AD-8681C45D346E}
2014-01-02 02:03 - 2011-06-07 13:11 - 00002944 _____ C:\Windows\System32\Tasks\{2D3F316B-D4F7-494D-B304-4DD0EB6C1F54}
2014-01-02 02:03 - 2011-06-07 13:10 - 00002944 _____ C:\Windows\System32\Tasks\{36027D2C-8F38-4FB3-AD64-AF13885712AD}
2014-01-02 02:03 - 2011-06-07 12:52 - 00002880 _____ C:\Windows\System32\Tasks\{DDAE587A-FA93-40F2-B6E0-CCD070C4E8EF}
2014-01-02 02:03 - 2011-01-16 01:05 - 00002880 _____ C:\Windows\System32\Tasks\{053EF3CB-0602-4FFD-910E-C29615802CC7}
2014-01-02 02:03 - 2010-12-29 18:27 - 00003958 _____ C:\Windows\System32\Tasks\RecoveryCDWin7
2014-01-02 02:03 - 2010-12-29 18:26 - 00003766 _____ C:\Windows\System32\Tasks\Registration
2013-12-31 02:04 - 2013-12-31 01:58 - 00000000 ____D C:\Users\HP\Desktop\USB Stick
2013-12-31 01:24 - 2013-12-31 01:07 - 00000000 ____D C:\Users\HP\AppData\Local\cache
2013-12-31 01:06 - 2013-12-31 01:06 - 00000000 _____ C:\Users\HP\daemonprocess.txt
2013-12-27 21:44 - 2012-11-19 19:17 - 00000000 ____D C:\Users\HP\Documents\persoführung
2013-12-27 21:42 - 2012-07-30 18:10 - 00000000 ____D C:\Users\HP\Documents\Auslandspraktikum
2013-12-27 08:48 - 2010-12-29 18:27 - 00000000 ___RD C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-27 08:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-12-27 08:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-27 03:24 - 2013-12-27 03:15 - 00001648 _____ C:\Windows\system32\ASOROSet.bin
2013-12-27 03:24 - 2009-07-14 03:34 - 85721088 _____ C:\Windows\system32\config\software.bak
2013-12-27 03:24 - 2009-07-14 03:34 - 17301504 _____ C:\Windows\system32\config\system.bak
2013-12-27 03:24 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2013-12-27 03:17 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2013-12-27 03:16 - 2013-12-27 03:15 - 00000000 ____D C:\Windows\system32\config\RCCBakup
2013-12-27 03:01 - 2013-12-27 00:40 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-27 03:01 - 2013-12-27 00:39 - 00000000 ____D C:\Program Files\mbar
2013-12-27 01:02 - 2013-12-27 01:02 - 00001194 _____ C:\Users\HP\Desktop\Amazon Cloud Player.lnk
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Cloud Player
2013-12-27 01:02 - 2013-12-27 01:02 - 00000000 ____D C:\Users\HP\AppData\Local\Amazon Cloud Player
2013-12-27 01:01 - 2013-12-27 00:59 - 36152456 _____ (Amazon) C:\Users\HP\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-27 00:39 - 2013-12-27 00:39 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
Some content of TEMP:
====================
C:\Users\HP\AppData\Local\Temp\avgnt.exe
C:\Users\HP\AppData\Local\Temp\Checkupdate.exe
C:\Users\HP\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\HP\AppData\Local\Temp\gcapi_dll.dll
C:\Users\HP\AppData\Local\Temp\gtapi_signed.dll
C:\Users\HP\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-24 21:29
==================== End Of Log ============================
Und, wie gehts dem Patienten? Kann ich beruhigt meine Studiengebühren überweisen oder find ich mein Konto danach im Minusbereich vor? ;-) Btw Meine email Adresse wurde nicht geknackt, falls das hier irgendwie relevant sein sollte. Oh und das beste zum Schluss: Die Nationzoom Startseite ist ENDLICH weg!      |
|
26.01.2014, 08:25
| #10 |
| /// the machine /// TB-Ausbilder | Entfernung von greygray, lollipop und nation zoom Ja, bezahl bevor du noch Ärger bekommst  ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Entfernung von greygray, lollipop und nation zoom |
| ad-ons, adblock, adware/symmi.36673.4, antivir, antivirus, appdatalow, askbar, converter, desktop, dvdvideosoft ltd., explorer, firefox, flash player, greygray, homepage, iexplore.exe, launch, lollipop, mobogenie, mobogenie entfernen, mozilla, mp3, nation zoom, nationzoom, nationzoom entfernen, netzwerk, neustart, newtab, plug-in, programme und funktionen, registrierungsdatenbank, security, services.exe, show-password, software, werbung, win32k.sys |
Linear-Darstellung
