| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei InternetnutzungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
20.02.2014, 13:11
| #1 |
 |  Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Hallo, Weihnachten war mein Neffe am Rechner seiner Oma und seitdem ist die Internetnutzung (Firefox) eine Katastrophe: unerwünschte Seiten, Popups, Weiterleitungen. Lt. Aussage meiner Mutter tauchen die Popups auch auf, wenn sie nicht im Internet ist. Ende 2013 habe ich dann als Ursache "Lollipop" (ich bin mir nicht mehr ganz sicher, ob der so hieß) ausgemacht und mit Internethilfe (chip.de) deinstalliert. Sah auch kurze Zeit so aus, als würde das funktionieren. Vor ca. zwei Wochen war diese Malware? Adware? (Sorry, auch ich bin nur Anwender) wieder unter den Programmen zu finden. Heute nicht mehr. Ich hoffe, dass ihr uns weiterhelfen könnt. Der PC läuft mit Windows 7. Gruß, Anscha Anbei die Scans. Wie bekomme ich die exportierten Scan-Ergebnisse von Avira hier rein? Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:54 on 20/02/2014 (Hannelore)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2014
Ran by Hannelore at 2014-02-20 11:57:40
Running from C:\Users\Hannelore\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
64 Bit HP CIO Components Installer (Version: 1.2.0 - Hewlett-Packard) Hidden
Adobe Flash Player 10 ActiveX (x32 Version: 10.1.102.64 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03 - Adobe Systems Incorporated)
AI Manager (x32 Version: 1.08.10 - ASUSTeK)
Alamandi (x32 Version: 0.0.0.0 - INTENIUM GmbH)
Allway Sync version 12.16.1 (x32 Version: - Botkind Inc)
AMD Fuel (Version: 2011.0126.1749.31909 - Ihr Firmenname) Hidden
AMD USB Filter Driver (x32 Version: 1.0.15.94 - Advanced Micro Devices, Inc.) Hidden
ASUS Backup Wizard (x32 Version: 1.00.10 - ASUSTeK Computer Inc.)
ASUSUpdate (x32 Version: 7.18.03 - ASUSTeK Computer Inc.)
AsusVibe2.0 (x32 Version: 2.0.3.585 - ASUSTEK)
ATI AVIVO64 Codecs (Version: 11.6.0.10126 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (Version: 3.0.812.0 - ATI Technologies, Inc.)
Avira Free Antivirus (x32 Version: 14.0.3.338 - Avira)
Big Fish Games: Game Manager (x32 Version: 2.0.0.8 - )
Brickshooter Egypt (x32 Version: 1.00.0000 - Purplehills)
Build It Green (x32 Version: - )
Butterfly Magic (x32 Version: - )
Campgrounds (x32 Version: - )
Canon Easy-PhotoPrint EX (x32 Version: - )
Canon Easy-WebPrint EX (x32 Version: - )
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (x32 Version: - )
Canon MG5100 series Benutzerregistrierung (x32 Version: - )
Canon MG5100 series MP Drivers (Version: - )
Canon MP Navigator EX 4.0 (x32 Version: - )
Canon My Printer (x32 Version: - )
Canon Solution Menu EX (x32 Version: - )
Casual Games 1 (x32 Version: 1 - KlickMedia)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0126.1749.31909 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0126.1749.31909 - ATI) Hidden
Catalyst Control Center Profiles Desktop (x32 Version: 2011.0126.1749.31909 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help English (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help French (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help German (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
ccc-core-static (x32 Version: 2011.0126.1749.31909 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2011.0126.1749.31909 - ATI) Hidden
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Crazy Machines Elements (x32 Version: - dtp)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Das gelobte Land (x32 Version: - )
Das Rettungsteam 2 (x32 Version: 1.00.0000 - PurpleHills)
Das Rettungsteam 3 (x32 Version: - )
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version: - Microsoft)
DEUTSCHLAND SPIELT GAME CENTER (x32 Version: 1.0.0.45 - INTENIUM GmbH)
Diamantenzauber (x32 Version: - )
Die ersten 10 Jahre (x32 Version: 1.00.0000 - )
Die Legende von Pocahontas (x32 Version: - cerasus.media GmbH)
Die Sage von Kolossus (x32 Version: - Alawar Entertainment Inc.)
Die Sims™ 3 (x32 Version: 1.50.56 - Electronic Arts)
DMUninstaller (x32 Version: - ) <==== ATTENTION
Dragon Portals (x32 Version: 1.00 - phenomedia publishing gmbh)
EPU-4 Engine (x32 Version: 1.01.02 - )
Euro Truck Simulator 2 (x32 Version: 1.1.1 - SCS Software)
Farm Frenzy - Helden der Vikinger (x32 Version: - )
Farm Frenzy 3 - Madagaskar (x32 Version: - )
Farm Frenzy 3 (x32 Version: - )
Farm Frenzy: Frische Fische (x32 Version: - Alawar Entertainment Inc.)
Farm Girl (x32 Version: - )
FarmFrenzy (x32 Version: - )
FarmFrenzy Pizza Party (x32 Version: - )
Farmscapes (x32 Version: - Playrix Entertainment)
Fishdom 2 Deluxe (x32 Version: - Playrix Entertainment)
Fishdom 3 (x32 Version: - Playrix Entertainment)
Fisher's Family Farm (x32 Version: - )
flash-Enhancer (x32 Version: 2.1 - flash-Enhancer.com) <==== ATTENTION
Fruit Lockers 2 (x32 Version: - )
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Gardenscapes (x32 Version: - Playrix Entertainment)
Goldene Jahre: Der weite Westen (x32 Version: 1.0.0.0 - INTENIUM GmbH)
GPL Ghostscript (x32 Version: 9.05 - Artifex Software Inc.)
Heroes of Hellas 2 - Olympia (x32 Version: 1.00.0000 - PurpleHills)
Hugo Retro Mania (x32 Version: 1.0.0 - Krea Medie)
Hund und Co. (x32 Version: 1.0.0.0 - INTENIUM GmbH)
HydraVision (x32 Version: 4.2.184.0 - ATI Technologies Inc.) Hidden
Ice-Land (x32 Version: - )
Internet Updater (x32 Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION
Jewel Quest: Heritage (nur deinstallation) (x32 Version: - )
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kitten Sanctuary (x32 Version: 1.00 - phenomedia publishing gmbh)
Lightspark 0.5.3-git (x32 Version: 0.5.3-git - Lightspark Team)
Lost City of Gold (x32 Version: - )
Media Player (x32 Version: 1.1 - Media Player)
Mein eigener Bauernhof (x32 Version: - Realore Studios)
Mein eigenes Tierheim (HKCU Version: V1.000000 - )
Mein Landleben (x32 Version: - )
Mein Landleben 2 (x32 Version: - )
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft Zoo Tycoon (x32 Version: - )
Minigolf Pro (x32 Version: - )
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0 - Microsoft Corporation)
MultiScreen (x32 Version: 1.00.0000 - Samsung Electronics Ltd.)
Mysterious City: Vegas (nur deinstallation) (x32 Version: - )
NeoBall (x32 Version: - )
Nero 7 Premium (x32 Version: 7.02.5043 - Nero AG)
NVIDIA PhysX (x32 Version: 9.10.0513 - NVIDIA Corporation)
p.i.c.s. Rätsel-Generator (x32 Version: - )
Pioneer Lands (x32 Version: 1.0.0.0 - INTENIUM GmbH)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Plus-HD-1.2 (x32 Version: 1.32.153.0 - Plus HD) <==== ATTENTION
PressAKey (www.blaeul.de) (x32 Version: - )
Realtek Ethernet Controller Driver (x32 Version: 7.31.1025.2010 - Realtek)
Re-markit (x32 Version: - Re-markit Software) <==== ATTENTION
Retter in der Not (x32 Version: - )
Samsung_MonSetup (x32 Version: 1.00.0000 - Samsung)
secrets of tahiti (x32 Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Snowy - Fish Frenzy (x32 Version: - )
Software Version Updater (x32 Version: 1.1.3.8 - ) <==== ATTENTION
Sunshine Acres (x32 Version: - )
TeamViewer 6 (x32 Version: 6.0.13992 - TeamViewer GmbH)
Tetris (x32 Version: 1.64 - Crystal Office Systems)
The Treasures Of Montezuma 3 (x32 Version: - Alawar Entertainment Inc.)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837583) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version: - Microsoft)
Updater (x32 Version: 2.6.53 - Creative Island Media, LLC) <==== ATTENTION
VIA Platform Device Manager (x32 Version: 1.34 - VIA Technologies, Inc.)
Video Player (x32 Version: 1.1 - Video Player) <==== ATTENTION
VirtualFarm (x32 Version: - )
VLC media player 1.1.5 (x32 Version: 1.1.5 - VideoLAN)
Weltraum Tycoon (x32 Version: 1.00.0000 - IncaGold)
Wildlife Park 2 (x32 Version: 1.25 - Deep Silver)
Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
World of Zoo (x32 Version: 1.0 - Blue Fang Games) Hidden
World of Zoo (x32 Version: 1.0 - THQ Inc.)
WPM17.8.0.3159 (x32 Version: 17.8.0.3159 - Cherished Technololgy LIMITED) <==== ATTENTION
XnView 1.98.2 (x32 Version: 1.98.2 - Gougelet Pierre-e)
Youda Survivor 2 (x32 Version: - )
Zoo Safari (x32 Version: - rondomedia Marketing & Vertriebs GmbH)
==================== Restore Points =========================
11-01-2014 09:26:45 Windows Update
12-01-2014 18:00:11 Windows-Sicherung
14-01-2014 12:52:23 Windows Update
16-01-2014 02:00:17 Windows Update
19-01-2014 18:00:24 Windows-Sicherung
21-01-2014 12:07:18 Windows Update
26-01-2014 20:38:36 Windows-Sicherung
28-01-2014 13:23:58 Windows Update
29-01-2014 22:42:41 Windows Update
02-02-2014 18:00:23 Windows-Sicherung
04-02-2014 13:18:37 Windows Update
09-02-2014 18:00:22 Windows-Sicherung
10-02-2014 10:54:55 Windows Defender Checkpoint
11-02-2014 10:32:30 Windows Update
12-02-2014 14:04:37 Windows Update
16-02-2014 18:00:23 Windows-Sicherung
17-02-2014 15:26:33 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {19DD2CEA-55C6-45D2-B2D4-C4DD58CA4859} - System32\Tasks\Plus-HD-1.2-firefoxinstaller => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-firefoxinstaller.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {27FC4FDA-AC05-4B5F-A53A-7935CDFCA1E6} - System32\Tasks\Plus-HD-1.2-chromeinstaller => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-chromeinstaller.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {30EC7B48-AC3D-48B5-B358-6DC6F61ED044} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-29] (ASUSTeK Computer Inc.)
Task: {3414EC92-737B-4004-B4F7-F0E552C57C5C} - System32\Tasks\Re-markit Update => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe [2013-12-25] () <==== ATTENTION
Task: {4870C426-3459-4919-8E9F-64E5F6AB3A5A} - System32\Tasks\Plus-HD-1.2-codedownloader => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-codedownloader.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {5708778C-52CE-4C37-BEB2-94ECD98A43E7} - System32\Tasks\ASUS\AsBackupWizard_Run => C:\Program Files (x86)\ASUS\\AsBackupWizard\\AsRunBkWizardHelper.exe [2010-04-24] (ASUSTeK Computer Inc.)
Task: {711B9B3B-9B9D-45C7-BFFC-1C92DA0BD24B} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2009-11-18] (ASUSTeK Computer Inc.)
Task: {9097B978-769E-4C2A-9177-A845FD8DB109} - System32\Tasks\Plus-HD-1.2-enabler => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-enabler.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {95523D8D-D7C5-40E1-9880-A0C54C2F66E1} - System32\Tasks\Plus-HD-1.2-updater => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-updater.exe [2013-12-25] (Plus HD) <==== ATTENTION
Task: {9607C6B8-D460-4953-80C0-FB233368DCAD} - System32\Tasks\AmiUpdXp => C:\Users\Hannelore\AppData\Local\SwvUpdater\Updater.exe [2013-12-29] (Amonetizé Ltd) <==== ATTENTION
Task: {C1F8DED2-34B2-484A-9B07-25E1A4803CE2} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.02\AsLoader.exe [2009-12-28] (ASUSTeK Computer Inc.)
Task: {D51A0DB4-0538-426A-90B2-E9406A6D84C0} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\Hannelore\AppData\Local\SwvUpdater\Updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-codedownloader.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-enabler.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.2-updater.job => C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\Re-markit Update.job => C:\Program Files (x86)\Re-markit\ReMarkit_up.exe <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2011-10-18 19:30 - 2010-04-05 20:55 - 00116104 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2013-12-06 02:30 - 2013-12-06 02:30 - 00040448 _____ () C:\ProgramData\InternetUpdater\InternetUpdaterService.exe
2011-01-26 18:00 - 2011-01-26 18:00 - 00079872 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Services.dll
2011-10-18 17:19 - 2009-08-11 12:57 - 00303104 _____ () C:\Program Files (x86)\MultiScreen\MultiScreen.exe
2011-05-27 05:16 - 2010-10-22 04:14 - 00078448 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2011-05-27 05:16 - 2010-10-22 04:14 - 00386160 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2011-05-27 05:16 - 2010-10-22 04:14 - 00105584 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll
2011-05-27 05:16 - 2010-10-22 04:14 - 64643696 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll
2011-01-26 18:01 - 2011-01-26 18:01 - 00102912 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-01-26 17:48 - 2011-01-26 17:48 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-02-15 09:56 - 2011-02-15 09:56 - 00430080 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-02-15 09:35 - 2011-02-15 09:35 - 00032768 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResources.dll
2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe
2011-05-27 05:17 - 2009-01-15 23:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
2011-05-27 05:17 - 2009-03-26 01:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
2011-10-18 17:19 - 2009-08-11 12:54 - 00094208 _____ () C:\Program Files (x86)\MultiScreen\TitleBar.dll
2011-10-18 17:19 - 2009-08-11 12:54 - 00053248 _____ () C:\Program Files (x86)\MultiScreen\SmartMouseDll.dll
2011-10-18 17:19 - 2009-08-11 12:56 - 00057344 _____ () C:\Program Files (x86)\MultiScreen\MGResGer.dll
2013-03-01 20:21 - 2013-03-01 20:16 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-12-25 11:48 - 2013-12-25 11:48 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-01-11 10:23 - 2014-01-11 10:23 - 16242056 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:7D288858
AlternateDataStreams: C:\ProgramData\TEMP:DD95E6D9
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/20/2014 11:22:03 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/19/2014 01:11:34 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/18/2014 10:16:40 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/18/2014 10:16:37 AM) (Source: Application Error) (User: )
Description: Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen werden:
Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der gespeicherten Datei bzw. den auf dem Computer installierten
Speichertreibern, oder der Datenträger fehlt.
Das Programm Updater service wurde wegen dieses Fehlers geschlossen.
Programm: Updater service
Datei:
Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.
Benutzeraktion
1. Öffnen Sie die Datei erneut.
Diese Situation ist eventuell ein temporäres Problem, das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.
2.
Wenn Sie weiterhin nicht auf die Datei zugreifen können und
- diese sich im Netzwerk befindet,
dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass eine Verbindung mit dem Server hergestellt werden kann.
- diese sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.
3. Überprüfen und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4. Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin besteht.
5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt.
Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.
Zusätzliche Daten
Fehlerwert: 00000000
Datenträgertyp: 0
Error: (02/18/2014 10:16:37 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: updater.exe, Version: 1.0.0.1, Zeitstempel: 0x52b219b0
Name des fehlerhaften Moduls: ole32.DLL, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000096
Fehleroffset: 0x00048665
ID des fehlerhaften Prozesses: 0xb8c
Startzeit der fehlerhaften Anwendung: 0xupdater.exe0
Pfad der fehlerhaften Anwendung: updater.exe1
Pfad des fehlerhaften Moduls: updater.exe2
Berichtskennung: updater.exe3
Error: (02/17/2014 07:36:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/17/2014 01:39:23 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/16/2014 07:02:23 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung war nicht erfolgreich. Fehler: "Auf diesem Laufwerk ist nicht genügend Speicherplatz zum Speichern der Sicherung verfügbar. Löschen Sie ältere Sicherungen und nicht benötigte Daten, um Speicherplatz freizugeben, oder ändern Sie die Sicherungseinstellungen. (0x81000005)"
Error: (02/16/2014 05:30:50 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/16/2014 01:28:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (02/19/2014 11:42:53 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (02/19/2014 07:56:47 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.
Error: (02/16/2014 01:27:21 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Internet Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/16/2014 01:27:21 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Updater erreicht.
Error: (02/15/2014 10:57:29 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Internet Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/15/2014 10:57:29 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Updater erreicht.
Error: (02/10/2014 01:18:04 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Microsoft Office Sessions:
=========================
Error: (02/20/2014 11:22:03 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/19/2014 01:11:34 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/18/2014 10:16:40 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/18/2014 10:16:37 AM) (Source: Application Error)(User: )
Description: Updater service000000000
Error: (02/18/2014 10:16:37 AM) (Source: Application Error)(User: )
Description: updater.exe1.0.0.152b219b0ole32.DLL6.1.7601.175144ce7b96fc000009600048665b8c01cf2c89ebfd4931C:\ProgramData\Updater\updater.exeC:\Windows\syswow64\ole32.DLL5da8406b-987d-11e3-9e04-14dae996d9a0
Error: (02/17/2014 07:36:02 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/17/2014 01:39:23 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/16/2014 07:02:23 PM) (Source: Windows Backup)(User: )
Description: Auf diesem Laufwerk ist nicht genügend Speicherplatz zum Speichern der Sicherung verfügbar. Löschen Sie ältere Sicherungen und nicht benötigte Daten, um Speicherplatz freizugeben, oder ändern Sie die Sicherungseinstellungen. (0x81000005)
Error: (02/16/2014 05:30:50 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/16/2014 01:28:33 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 36%
Total physical RAM: 6143.18 MB
Available physical RAM: 3899.86 MB
Total Pagefile: 12284.53 MB
Available Pagefile: 9523.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (WIN7) (Fixed) (Total:372.6 GB) (Free:183.75 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Externe Festplatte_Dasi) (Fixed) (Total:465.76 GB) (Free:0 GB) NTFS
Drive e: (DATA) (Fixed) (Total:544.72 GB) (Free:532.44 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: CB5BD2B2)
Partition 1: (Not Active) - (Size=14 GB) - (Type=1B)
Partition 2: (Active) - (Size=373 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=545 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 0D29753D)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
==================== End Of Log ============================
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2014 Ran by Hannelore (administrator) on HANNELORE-PC on 20-02-2014 11:56:49 Running from C:\Users\Hannelore\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe (Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe (ASUSTeK Computer Inc.) C:\Windows\SysWOW64\AsHookDevice.exe () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE () C:\ProgramData\InternetUpdater\InternetUpdaterService.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe () C:\Program Files (x86)\MultiScreen\MultiScreen.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Updater) C:\ProgramData\Updater\updater.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Microsoft Corporation) C:\Windows\splwow64.exe (WatchDog) C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe (WatchDog) C:\ProgramData\RHelpers\FireFoxHelper\FireFoxHelper.exe (WatchDog) C:\ProgramData\RHelpers\IEHelper\IeHelper.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE () C:\Users\Hannelore\Desktop\Defogger.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-25] (CANON INC.) HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.) HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2489456 2010-10-22] (VIA) HKLM-x32\...\Run: [RunAIShell] - C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe [232064 2009-12-23] (ASUSTeK Computer Inc.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-01-26] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Updater] - C:\ProgramData\Updater\Updater.exe [486264 2013-12-18] (Updater) HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [MultiScreen] - C:\Program Files (x86)\MultiScreen\MultiScreen.exe [303104 2009-08-11] () HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [143360 2006-12-23] (Nero AG) HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [EA Core] - "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [Updater] - C:\ProgramData\Updater\updater.exe [486264 2013-12-18] (Updater) HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [NextLive] - C:\Windows\SysWOW64\rundll32.exe "C:\Users\Hannelore\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms} BHO: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll (Plus HD) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Plus-HD-1.2 - {11111111-1111-1111-1111-110311121155} - C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho.dll (Plus HD) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: flash-Enhancer - {5A60B6BB-FA81-4EFA-AB9C-A820E2143736} - C:\Program Files (x86)\AmiExt\flashEnhancer\ie\AmiBho.dll () BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Re-markit - {d5de32ce-bd33-4a3e-8bd2-67fcf9b1377f} - C:\Program Files (x86)\Re-markit\150.dll () Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default FF user.js: detected! => C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default\user.js FF Homepage: hxxp://www.zdfsport.de/ZDFsport-Startseite-4002.html FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( ) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Widget context - C:\Users\Hannelore\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-18] FF HKLM-x32\...\Firefox\Extensions: [ext@flash-Enhancer.com] - C:\Program Files (x86)\AmiExt\flashEnhancer\ff FF Extension: No Name - C:\Program Files (x86)\AmiExt\flashEnhancer\ff [2013-12-29] FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta61.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff FF Extension: Video Player - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff [2014-01-13] FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha966.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff FF Extension: Media Player - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff [2014-01-29] FF HKCU\...\Firefox\Extensions: [{11307539-f37a-4068-81b0-5e786aad6f00}] - C:\Program Files (x86)\Re-markit\150.xpi FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.nationzoom.com/?type=sc&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9 Chrome: ======= CHR Extension: (No Name) - C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\Extensions\idpcbdkoekecjkbjeccbapdkpcmoiloa [2014-01-18] CHR Extension: (Widget context) - C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-18] CHR HKLM-x32\...\Chrome\Extension: [dcpfhaghaadpjpgocojgnlhjcieeooel] - C:\Program Files (x86)\Re-markit\150.crx [2014-01-18] CHR HKLM-x32\...\Chrome\Extension: [ehmnjgkmbpbohelngpclcdhgochdeoej] - C:\Program Files (x86)\AmiExt\flashEnhancer\ch\flashEnhancer.crx [2014-01-18] CHR HKLM-x32\...\Chrome\Extension: [hjbmanngghbhohodnkbgkgmkajiheieg] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ch\VideoPlayerV3beta61.crx [2014-01-07] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2011-01-26] (Advanced Micro Devices, Inc.) R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] () R2 InternetUpdater; C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [40448 2013-12-06] () R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG) R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [499856 2013-12-25] (Cherished Technololgy LIMITED) ==================== Drivers (Whitelisted) ==================== R2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] () R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] () R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG) R3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] () ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-20 11:56 - 2014-02-20 11:57 - 00017213 _____ () C:\Users\Hannelore\Desktop\FRST.txt 2014-02-20 11:56 - 2014-02-20 11:56 - 00000000 ____D () C:\FRST 2014-02-20 11:55 - 2014-02-20 11:55 - 02153472 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe 2014-02-20 11:54 - 2014-02-20 11:54 - 00000480 _____ () C:\Users\Hannelore\Desktop\defogger_disable.log 2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable 2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe 2014-02-12 18:44 - 2014-02-12 18:44 - 00000000 ____D () C:\Users\Hannelore\AppData\Local\{D131D82E-02BA-45D5-AF9D-AA7786D30218} 2014-02-12 18:43 - 2014-02-12 18:43 - 00000000 ____D () C:\Users\Hannelore\AppData\Local\{B5D985A5-983E-49EB-A9B4-09526F979BD6} 2014-02-12 15:05 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-12 15:05 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-12 15:05 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-12 15:05 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-12 15:05 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-12 15:05 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-12 15:05 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-12 15:05 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-12 15:05 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-12 15:05 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-12 15:05 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-12 15:05 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-12 15:05 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-12 15:05 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-12 15:05 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-12 15:05 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-12 15:05 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-12 15:05 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-12 15:05 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-12 15:05 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-12 15:05 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-12 15:05 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-12 15:05 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-12 15:05 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-12 15:05 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-12 15:05 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-12 15:05 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-12 15:05 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-12 15:05 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-12 15:05 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-12 15:05 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-12 15:05 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-12 15:05 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-12 15:05 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-12 15:05 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-12 15:05 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-12 15:05 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-12 15:05 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-02-12 15:04 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-12 15:04 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-12 15:04 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-12 14:58 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls 2014-02-12 14:58 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-02-12 14:58 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-12 14:58 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-12 14:58 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-12 14:58 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-02-12 14:58 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-02-12 14:58 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-02-12 14:58 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-02-12 14:58 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-02-12 14:58 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll 2014-02-12 14:58 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-02-12 14:58 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2014-02-12 14:58 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-12 14:58 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-01-29 23:28 - 2014-01-29 23:28 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-01-29 23:28 - 2014-01-29 23:28 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerV1 ==================== One Month Modified Files and Folders ======= 2014-02-20 11:57 - 2014-02-20 11:56 - 00017213 _____ () C:\Users\Hannelore\Desktop\FRST.txt 2014-02-20 11:56 - 2014-02-20 11:56 - 00000000 ____D () C:\FRST 2014-02-20 11:55 - 2014-02-20 11:55 - 02153472 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe 2014-02-20 11:54 - 2014-02-20 11:54 - 00000480 _____ () C:\Users\Hannelore\Desktop\defogger_disable.log 2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable 2014-02-20 11:54 - 2011-10-18 11:50 - 00000000 ____D () C:\Users\Hannelore 2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe 2014-02-20 11:49 - 2012-03-01 08:35 - 00000000 ____D () C:\Users\Hannelore\Desktop\Laptop Dateien\Documents\Anja Jöns,Kalender, Postkarten 2014-02-20 11:28 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-20 11:28 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-20 11:24 - 2011-10-18 11:49 - 01374822 _____ () C:\Windows\WindowsUpdate.log 2014-02-20 11:20 - 2013-12-29 13:05 - 00000372 _____ () C:\Windows\Tasks\AmiUpdXp.job 2014-02-20 11:20 - 2013-12-25 13:24 - 00002112 _____ () C:\Windows\Tasks\Plus-HD-1.2-firefoxinstaller.job 2014-02-20 11:20 - 2013-12-25 13:24 - 00001984 _____ () C:\Windows\Tasks\Plus-HD-1.2-chromeinstaller.job 2014-02-20 11:20 - 2013-12-25 13:24 - 00001336 _____ () C:\Windows\Tasks\Plus-HD-1.2-updater.job 2014-02-20 11:20 - 2013-12-25 13:24 - 00001238 _____ () C:\Windows\Tasks\Plus-HD-1.2-codedownloader.job 2014-02-20 11:20 - 2013-12-25 13:24 - 00001138 _____ () C:\Windows\Tasks\Plus-HD-1.2-enabler.job 2014-02-20 11:20 - 2013-12-25 13:23 - 00000392 _____ () C:\Windows\Tasks\Re-markit Update.job 2014-02-20 11:20 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-20 11:20 - 2009-07-14 05:51 - 00101255 _____ () C:\Windows\setupact.log 2014-02-18 22:16 - 2013-12-29 13:06 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\newnext.me 2014-02-17 16:28 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-17 16:26 - 2012-01-29 11:32 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-02-12 18:44 - 2014-02-12 18:44 - 00000000 ____D () C:\Users\Hannelore\AppData\Local\{D131D82E-02BA-45D5-AF9D-AA7786D30218} 2014-02-12 18:43 - 2014-02-12 18:43 - 00000000 ____D () C:\Users\Hannelore\AppData\Local\{B5D985A5-983E-49EB-A9B4-09526F979BD6} 2014-02-12 18:39 - 2010-11-21 04:47 - 00557246 _____ () C:\Windows\PFRO.log 2014-02-12 15:15 - 2011-11-04 19:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-12 15:14 - 2011-03-15 22:23 - 00665562 _____ () C:\Windows\system32\perfh007.dat 2014-02-12 15:14 - 2011-03-15 22:23 - 00133774 _____ () C:\Windows\system32\perfc007.dat 2014-02-12 15:14 - 2009-07-14 06:13 - 01550558 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-06 13:16 - 2014-02-12 15:05 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-06 12:30 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-06 12:30 - 2014-02-12 15:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-06 12:12 - 2014-02-12 15:05 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-06 12:07 - 2014-02-12 15:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-06 12:06 - 2014-02-12 15:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-06 11:57 - 2014-02-12 15:05 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-06 11:56 - 2014-02-12 15:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-06 11:52 - 2014-02-12 15:05 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-06 11:49 - 2014-02-12 15:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-06 11:48 - 2014-02-12 15:05 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-06 11:48 - 2014-02-12 15:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-06 11:38 - 2014-02-12 15:04 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-06 11:32 - 2014-02-12 15:05 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-06 11:20 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-06 11:17 - 2014-02-12 15:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-06 11:11 - 2014-02-12 15:04 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-06 11:01 - 2014-02-12 15:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-06 11:00 - 2014-02-12 15:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-06 10:57 - 2014-02-12 15:05 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-06 10:57 - 2014-02-12 15:05 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-06 10:52 - 2014-02-12 15:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-06 10:52 - 2014-02-12 15:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-06 10:50 - 2014-02-12 15:05 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-06 10:49 - 2014-02-12 15:05 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-06 10:47 - 2014-02-12 15:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-06 10:46 - 2014-02-12 15:05 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-06 10:25 - 2014-02-12 15:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-06 10:25 - 2014-02-12 15:04 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-06 10:24 - 2014-02-12 15:05 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-06 10:22 - 2014-02-12 15:05 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-06 10:13 - 2014-02-12 15:05 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-06 10:09 - 2014-02-12 15:05 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-06 10:03 - 2014-02-12 15:05 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-06 09:55 - 2014-02-12 15:05 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-06 09:41 - 2014-02-12 15:05 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-06 09:40 - 2014-02-12 15:05 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-06 09:36 - 2014-02-12 15:05 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-06 09:34 - 2014-02-12 15:05 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-04 19:32 - 2011-10-18 19:30 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-01-29 23:28 - 2014-01-29 23:28 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-01-29 23:28 - 2014-01-29 23:28 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerV1 2014-01-29 23:28 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-01-29 23:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy 2014-01-26 12:55 - 2012-07-28 13:02 - 00000000 ____D () C:\ProgramData\AlawarWrapper 2014-01-22 15:38 - 2013-11-17 17:05 - 00000000 ____D () C:\ProgramData\Origin Some content of TEMP: ==================== C:\Users\Hannelore\AppData\Local\Temp\AlawarGameBoxWebSetup.exe C:\Users\Hannelore\AppData\Local\Temp\avgnt.exe C:\Users\Hannelore\AppData\Local\Temp\BackupSetup.exe C:\Users\Hannelore\AppData\Local\Temp\EAD20D8.exe C:\Users\Hannelore\AppData\Local\Temp\EAD499C.exe C:\Users\Hannelore\AppData\Local\Temp\EAD581D.exe C:\Users\Hannelore\AppData\Local\Temp\EAD6576.exe C:\Users\Hannelore\AppData\Local\Temp\EAD693D.exe C:\Users\Hannelore\AppData\Local\Temp\EAD6B7E.exe C:\Users\Hannelore\AppData\Local\Temp\EAD6BEB.exe C:\Users\Hannelore\AppData\Local\Temp\EAD6CD5.exe C:\Users\Hannelore\AppData\Local\Temp\EAD6CD6.exe C:\Users\Hannelore\AppData\Local\Temp\EAD6ED8.exe C:\Users\Hannelore\AppData\Local\Temp\EAD6F45.exe C:\Users\Hannelore\AppData\Local\Temp\EAD6F74.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7010.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7011.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7020.exe C:\Users\Hannelore\AppData\Local\Temp\EAD704E.exe C:\Users\Hannelore\AppData\Local\Temp\EAD708D.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7119.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7399.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7416.exe C:\Users\Hannelore\AppData\Local\Temp\EAD751F.exe C:\Users\Hannelore\AppData\Local\Temp\EAD75EA.exe C:\Users\Hannelore\AppData\Local\Temp\EAD75F9.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7647.exe C:\Users\Hannelore\AppData\Local\Temp\EAD76D4.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7722.exe C:\Users\Hannelore\AppData\Local\Temp\EAD77CD.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7992.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7A6C.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7A7C.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7ABA.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7AE9.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7C8E.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7C8F.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7F2D.exe C:\Users\Hannelore\AppData\Local\Temp\EAD7F9A.exe C:\Users\Hannelore\AppData\Local\Temp\EAD8027.exe C:\Users\Hannelore\AppData\Local\Temp\EAD8757.exe C:\Users\Hannelore\AppData\Local\Temp\EAD87D4.exe C:\Users\Hannelore\AppData\Local\Temp\EAD88FD.exe C:\Users\Hannelore\AppData\Local\Temp\EAD894B.exe C:\Users\Hannelore\AppData\Local\Temp\EAD8B1F.exe C:\Users\Hannelore\AppData\Local\Temp\EAD8C47.exe C:\Users\Hannelore\AppData\Local\Temp\EAD8C66.exe C:\Users\Hannelore\AppData\Local\Temp\EAD8C67.exe C:\Users\Hannelore\AppData\Local\Temp\EAD8FD0.exe C:\Users\Hannelore\AppData\Local\Temp\EAD93C6.exe C:\Users\Hannelore\AppData\Local\Temp\EAD93E5.exe C:\Users\Hannelore\AppData\Local\Temp\EAD9433.exe C:\Users\Hannelore\AppData\Local\Temp\EAD94B0.exe C:\Users\Hannelore\AppData\Local\Temp\EAD972F.exe C:\Users\Hannelore\AppData\Local\Temp\EAD9858.exe C:\Users\Hannelore\AppData\Local\Temp\EAD9A0D.exe C:\Users\Hannelore\AppData\Local\Temp\EAD9DA5.exe C:\Users\Hannelore\AppData\Local\Temp\EAD9DF3.exe C:\Users\Hannelore\AppData\Local\Temp\EADA14D.exe C:\Users\Hannelore\AppData\Local\Temp\EADA237.exe C:\Users\Hannelore\AppData\Local\Temp\EADA3FB.exe C:\Users\Hannelore\AppData\Local\Temp\EADA41B.exe C:\Users\Hannelore\AppData\Local\Temp\EADA765.exe C:\Users\Hannelore\AppData\Local\Temp\EADA811.exe C:\Users\Hannelore\AppData\Local\Temp\EADAABF.exe C:\Users\Hannelore\AppData\Local\Temp\EADABF7.exe C:\Users\Hannelore\AppData\Local\Temp\EADAC26.exe C:\Users\Hannelore\AppData\Local\Temp\EADAF8F.exe C:\Users\Hannelore\AppData\Local\Temp\EADB9AD.exe C:\Users\Hannelore\AppData\Local\Temp\EADBE5E.exe C:\Users\Hannelore\AppData\Local\Temp\EADC10.exe C:\Users\Hannelore\AppData\Local\Temp\EADC5DD.exe C:\Users\Hannelore\AppData\Local\Temp\EADC65A.exe C:\Users\Hannelore\AppData\Local\Temp\EADCC72.exe C:\Users\Hannelore\AppData\Local\Temp\EADD835.exe C:\Users\Hannelore\AppData\Local\Temp\EADE63E.exe C:\Users\Hannelore\AppData\Local\Temp\EBU24ED.exe C:\Users\Hannelore\AppData\Local\Temp\EBU29CD.DLL C:\Users\Hannelore\AppData\Local\Temp\EBU703.exe C:\Users\Hannelore\AppData\Local\Temp\EBUB55.exe C:\Users\Hannelore\AppData\Local\Temp\FP_PL_PFS_INSTALLER_32bit.exe C:\Users\Hannelore\AppData\Local\Temp\InstallVBRuntime.exe C:\Users\Hannelore\AppData\Local\Temp\MSETUP4.EXE C:\Users\Hannelore\AppData\Local\Temp\Setup1.exe C:\Users\Hannelore\AppData\Local\Temp\setup{A75B97A1-72B4-4D6F-87CC-0B1CFBFD2861}.exe C:\Users\Hannelore\AppData\Local\Temp\UninstallEADM.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-12-20 11:10 ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-20 12:45:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST31000524AS rev.JC45 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\HANNEL~1\AppData\Local\Temp\uwldiuob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002dec000 65 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594 fffff80002dec042 4 bytes [00, 00, 00, 00]
---- User code sections - GMER 2.1 ----
.text C:\ProgramData\WPM\wprotectmanager.exe[1160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076811465 2 bytes [81, 76]
.text C:\ProgramData\WPM\wprotectmanager.exe[1160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768114bb 2 bytes [81, 76]
.text ... * 2
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076811465 2 bytes [81, 76]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768114bb 2 bytes [81, 76]
.text ... * 2
.text C:\ProgramData\InternetUpdater\InternetUpdaterService.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076811465 2 bytes [81, 76]
.text C:\ProgramData\InternetUpdater\InternetUpdaterService.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768114bb 2 bytes [81, 76]
.text ... * 2
.text C:\Program Files (x86)\MultiScreen\MultiScreen.exe[2940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076811465 2 bytes [81, 76]
.text C:\Program Files (x86)\MultiScreen\MultiScreen.exe[2940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768114bb 2 bytes [81, 76]
.text ... * 2
.text C:\ProgramData\Updater\updater.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076811465 2 bytes [81, 76]
.text C:\ProgramData\Updater\updater.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768114bb 2 bytes [81, 76]
.text ... * 2
.text C:\Windows\SysWOW64\rundll32.exe[2224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076811465 2 bytes [81, 76]
.text C:\Windows\SysWOW64\rundll32.exe[2224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768114bb 2 bytes [81, 76]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076811465 2 bytes [81, 76]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768114bb 2 bytes [81, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [3592:5148] 000007feea9d9688
---- Processes - GMER 2.1 ----
Process C:\ProgramData\InternetUpdater\InternetUpdaterService.exe (*** suspicious ***) @ C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [1736](2013-12-06 01:30:04) 00000000002a0000
Library C:\Users\Hannelore\AppData\Roaming\newnext.me\nengine.dll (*** suspicious ***) @ C:\Windows\SysWOW64\rundll32.exe [2224] (NewNext Helper Engine/NewNextDotMe)(2013-12-29 12:06:34) 000000006c960000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
20.02.2014, 13:48
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung hi,
__________________Scan mit Combofix
__________________ |
|
20.02.2014, 17:48
| #3 |
| | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Hallo und schonmal vielen Dank.
__________________Ich habe jetzt den Scan durchgeführt. Heute Mittag konnte ich Avira nach den Scans nicht mehr aktivieren. Hab dann einfach alles neu installiert. Vorm ComboFix Scan ließ sich Avira nicht deaktivieren. Habs dann erst damit aktiviertem Avira versucht, was Combofix nicht gefiel... Habe also Avira komplett deinstalliert (während Combofix auf mein ok wartete, dass ich Avira deaktiviert habe). Zum Deinstallieren war danach ein Neustart erforderlich. Das Herunterfahren funktionierte nicht - und ich hab nachgeholfen. Dann Combofix neu gestartet, funktionierte auch- obwohl nochmal dazu aufgefordert wurde, Avira zu deaktivieren. Dies war definitiv nicht mehr drauf. Ich hab ok gedrückt und danach hat das Scannen ca. 1 Stunde gedauert. Während des Scans erschien die Meldung, dass der TeamViewer aktiv sei. Ich hab das ignoriert, da Internet definitv abgestöpselt war. Hier das Ergebnis: Code:
ATTFilter ComboFix 14-02-20.01 - Hannelore 20.02.2014 16:58:17.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.6143.4567 [GMT 1:00]
ausgeführt von:: c:\users\Hannelore\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\AmiExt\flashEnhancer\ie\AmIBho.dll
c:\program files (x86)\VideoPlayerV3
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ch\VideoPlayerV3beta61.crx
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff\chrome.manifest
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff\chrome\content\ffVideoPlayerV3beta61.js
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff\chrome\content\ffVideoPlayerV3beta61ffaction.js
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff\chrome\content\icons\default\VideoPlayerV3beta61_32.png
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff\chrome\content\icons\Thumbs.db
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff\chrome\content\overlay.xul
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff\install.rdf
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ie\VideoPlayerV3beta61.dll
c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\uninstall.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-01-20 bis 2014-02-20 ))))))))))))))))))))))))))))))
.
.
2014-02-20 16:27 . 2014-02-20 16:27 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-20 16:03 . 2014-02-20 16:03 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9824C222-FC47-4C63-A883-FBC41D3E2BBC}\offreg.dll
2014-02-20 15:42 . 2014-02-20 15:42 -------- d-----w- c:\users\Hannelore\AppData\Roaming\TeamViewer
2014-02-20 10:56 . 2014-02-20 11:01 -------- d-----w- C:\FRST
2014-02-18 09:26 . 2014-02-06 09:01 10536864 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9824C222-FC47-4C63-A883-FBC41D3E2BBC}\mpengine.dll
2014-02-12 14:04 . 2014-02-06 10:11 5768704 ----a-w- c:\windows\system32\jscript9.dll
2014-02-12 14:04 . 2014-02-06 09:25 4244480 ----a-w- c:\windows\SysWow64\jscript9.dll
2014-01-29 22:28 . 2014-01-29 22:28 -------- d-----w- c:\program files (x86)\MediaPlayerV1
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-17 15:26 . 2012-01-29 10:32 88567024 ----a-w- c:\windows\system32\MRT.exe
2014-01-11 09:23 . 2013-04-01 10:31 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-11 09:23 . 2011-11-09 11:52 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-18 05:13 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-11-27 02:03 . 2013-11-27 02:03 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-27 02:03 . 2013-11-27 02:03 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-27 02:02 . 2013-11-27 02:02 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-27 02:02 . 2013-11-27 02:02 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-27 02:02 . 2013-11-27 02:02 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-27 02:02 . 2013-11-27 02:02 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-27 02:02 . 2013-11-27 02:02 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-27 02:02 . 2013-11-27 02:02 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-27 02:02 . 2013-11-27 02:02 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-27 02:02 . 2013-11-27 02:02 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-27 02:02 . 2013-11-27 02:02 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-27 02:02 . 2013-11-27 02:02 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-27 02:02 . 2013-11-27 02:02 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-27 02:02 . 2013-11-27 02:02 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-27 02:02 . 2013-11-27 02:02 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-27 02:02 . 2013-11-27 02:02 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-27 02:02 . 2013-11-27 02:02 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-27 02:02 . 2013-11-27 02:02 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-27 02:02 . 2013-11-27 02:02 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-27 02:02 . 2013-11-27 02:02 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-27 02:02 . 2013-11-27 02:02 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-27 02:02 . 2013-11-27 02:02 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-27 02:02 . 2013-11-27 02:02 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-27 02:02 . 2013-11-27 02:02 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-27 02:02 . 2013-11-27 02:02 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-27 02:02 . 2013-11-27 02:02 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-27 02:02 . 2013-11-27 02:02 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-27 02:02 . 2013-11-27 02:02 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-27 02:02 . 2013-11-27 02:02 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-27 02:02 . 2013-11-27 02:02 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-27 02:02 . 2013-11-27 02:02 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-27 02:02 . 2013-11-27 02:02 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-27 02:02 . 2013-11-27 02:02 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-27 02:02 . 2013-11-27 02:02 413696 ----a-w- c:\windows\system32\html.iec
2013-11-27 02:02 . 2013-11-27 02:02 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-27 02:02 . 2013-11-27 02:02 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-27 02:02 . 2013-11-27 02:02 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-27 02:02 . 2013-11-27 02:02 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-27 02:02 . 2013-11-27 02:02 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-27 02:02 . 2013-11-27 02:02 235520 ----a-w- c:\windows\system32\url.dll
2013-11-27 02:02 . 2013-11-27 02:02 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-27 02:02 . 2013-11-27 02:02 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-27 02:02 . 2013-11-27 02:02 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-27 02:02 . 2013-11-27 02:02 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-27 02:02 . 2013-11-27 02:02 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-27 02:02 . 2013-11-27 02:02 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-27 02:02 . 2013-11-27 02:02 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-27 02:02 . 2013-11-27 02:02 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-27 02:02 . 2013-11-27 02:02 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-27 02:02 . 2013-11-27 02:02 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-27 02:02 . 2013-11-27 02:02 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-27 02:02 . 2013-11-27 02:02 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-27 01:41 . 2014-01-15 07:58 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-11-27 01:41 . 2014-01-15 07:58 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-11-27 01:41 . 2014-01-15 07:58 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-11-27 01:41 . 2014-01-15 07:58 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-11-27 01:41 . 2014-01-15 07:58 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-11-27 01:41 . 2014-01-15 07:58 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-11-27 01:41 . 2014-01-15 07:58 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-11-26 11:40 . 2014-01-15 07:58 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2013-11-26 10:32 . 2014-01-15 07:58 3156480 ----a-w- c:\windows\system32\win32k.sys
2013-11-23 18:26 . 2013-12-12 12:06 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 12:06 465920 ----a-w- c:\windows\system32\WMPhoto.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110311121155}]
2013-12-25 12:24 644968 ----a-w- c:\program files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{d5de32ce-bd33-4a3e-8bd2-67fcf9b1377f}]
2013-12-25 12:23 146432 ----a-w- c:\program files (x86)\Re-markit\150.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MultiScreen"="c:\program files (x86)\MultiScreen\MultiScreen.exe" [2009-08-11 303104]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"Updater"="c:\programdata\Updater\updater.exe" [2013-12-18 486264]
"NextLive"="c:\users\Hannelore\AppData\Roaming\newnext.me\nengine.dll" [2013-11-14 1283584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2010-10-22 2489456]
"RunAIShell"="c:\program files (x86)\ASUS\AI Manager\AsShellApplication.exe" [2009-12-23 232064]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
"CanonSolutionMenuEx"="c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"Updater"="c:\programdata\Updater\Updater.exe" [2013-12-18 486264]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2011-5-27 548528]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 InternetUpdater;Internet Updater;c:\programdata\InternetUpdater\InternetUpdaterService.exe;c:\programdata\InternetUpdater\InternetUpdaterService.exe [x]
R2 Wpm;Wpm Service;c:\programdata\WPM\wprotectmanager.exe;c:\programdata\WPM\wprotectmanager.exe [x]
R3 ahcix64s;ahcix64s;c:\windows\system32\drivers\ahcix64s.sys;c:\windows\SYSNATIVE\drivers\ahcix64s.sys [x]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys;c:\windows\SYSNATIVE\drivers\asmthub3.sys [x]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys;c:\windows\SYSNATIVE\drivers\asmtxhci.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys;c:\windows\SYSNATIVE\drivers\mv91xx.sys [x]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys;SysWow64\drivers\AsUpIO.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [x]
S2 Device Handle Service;Device Handle Service;c:\windows\SysWOW64\AsHookDevice.exe;c:\windows\SysWOW64\AsHookDevice.exe [x]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-20 c:\windows\Tasks\AmiUpdXp.job
- c:\users\Hannelore\AppData\Local\SwvUpdater\Updater.exe [2013-12-29 12:05]
.
2014-02-20 c:\windows\Tasks\Plus-HD-1.2-chromeinstaller.job
- c:\program files (x86)\Plus-HD-1.2\Plus-HD-1.2-chromeinstaller.exe [2013-12-25 12:24]
.
2014-02-20 c:\windows\Tasks\Plus-HD-1.2-codedownloader.job
- c:\program files (x86)\Plus-HD-1.2\Plus-HD-1.2-codedownloader.exe [2013-12-25 12:24]
.
2014-02-20 c:\windows\Tasks\Plus-HD-1.2-enabler.job
- c:\program files (x86)\Plus-HD-1.2\Plus-HD-1.2-enabler.exe [2013-12-25 12:24]
.
2014-02-20 c:\windows\Tasks\Plus-HD-1.2-firefoxinstaller.job
- c:\program files (x86)\Plus-HD-1.2\Plus-HD-1.2-firefoxinstaller.exe [2013-12-25 12:24]
.
2014-02-20 c:\windows\Tasks\Plus-HD-1.2-updater.job
- c:\program files (x86)\Plus-HD-1.2\Plus-HD-1.2-updater.exe [2013-12-25 12:24]
.
2014-02-20 c:\windows\Tasks\Re-markit Update.job
- c:\program files (x86)\Re-markit\ReMarkit_up.exe [2013-12-25 12:23]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2726728]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1580368]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
mDefault_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
mDefault_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
mStart Page = hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.zdfsport.de/ZDFsport-Startseite-4002.html
FF - user.js: extensions.shownSelectionUI - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{5A60B6BB-FA81-4EFA-AB9C-A820E2143736} - c:\program files (x86)\AmiExt\flashEnhancer\ie\AmiBho.dll
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Wow6432Node-HKLM-Run-Adobe Reader Speed Launcher - c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe
Wow6432Node-HKLM-Run-mobilegeni daemon - c:\program files (x86)\Mobogenie\DaemonProcess.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-Video Player - c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta61\uninstall.exe
AddRemove-VirtualFarm - c:\habbyf~1\UNWISE.EXE
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-02-20 17:31:46
ComboFix-quarantined-files.txt 2014-02-20 16:31
.
Vor Suchlauf: 12 Verzeichnis(se), 246.730.764.288 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 251.593.256.960 Bytes frei
.
- - End Of File - - A526DB6C56149871537E1B2038BC06BF
4976D4A7A40B83FC7F06EE4BDD84EB9B
|
|
21.02.2014, 14:23
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.02.2014, 14:13
| #5 |
| | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Hallo, vielen dank für Deine Hilfe! Ich habe nun alles ausgeführt. Das Problem ist aber anscheinend hartnäckiger. Hier die Scanergebnisse: Nachtrag: Anscheinend habe ich hier noch einen alten AdwareLog von meinem ersten Versuch, diesen Kram loszuwerden. Hab ich nicht bewusst reinkopiert, aber wo er jetzt schon mal "drin" ist, kanns ja nicht schaden... Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.24.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16518 Hannelore :: HANNELORE-PC [Administrator] Schutz: Aktiviert 24.02.2014 13:31:11 mbam-log-2014-02-24 (13-31-11).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: Registrierung | P2P Durchsuchte Objekte: 196059 Laufzeit: 2 Minute(n), 49 Sekunde(n) Infizierte Speicherprozesse: 6 C:\ProgramData\WPM\wprotectmanager.exe (PUP.Optional.WpManager.A) -> 1140 -> Löschen bei Neustart. C:\ProgramData\InternetUpdater\InternetUpdaterService.exe (PUP.Optional.InternetUpdater.A) -> 1892 -> Löschen bei Neustart. C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe (PUP.Optional.SearchDonkey.A) -> 3232 -> Löschen bei Neustart. C:\ProgramData\RHelpers\FirefoxHelper\FirefoxHelper.exe (PUP.Optional.SearchDonkey.A) -> 3280 -> Löschen bei Neustart. C:\ProgramData\RHelpers\IeHelper\IeHelper.exe (PUP.Optional.SearchDonkey.A) -> 3388 -> Löschen bei Neustart. C:\ProgramData\Updater\updater.exe (Trojan.Agent) -> 3000 -> Löschen bei Neustart. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 35 HKLM\SYSTEM\CurrentControlSet\Services\Wpm (PUP.Optional.WpManager.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WPM (PUP.Optional.WpManager.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SYSTEM\CurrentControlSet\Services\InternetUpdater (PUP.Optional.InternetUpdater.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{11111111-1111-1111-1111-110311121155} (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311121155} (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InternetUpdater (PUP.Optional.InternetUpdater.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0031255.BHO (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0031255.Sandbox (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CrossriderApp0031255.Sandbox.1 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\AmiExt\IE plugin (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\AppDataLow\Software\Plus-HD-1.2 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\InstalledBrowserExtensions\Plus HD (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\MediaPlayerV1alpha966 (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\nationzoomSoftware (PUP.Optional.NationZoom.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Plus-HD-1.2 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\AmiExt\flash-Enhancer (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Google\Chrome\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Google\Chrome\Extensions\ehmnjgkmbpbohelngpclcdhgochdeoej (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-1.2 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\flash-Enhancer (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{66B51873-B53D-42EC-BC1A-862EB4DB041D} (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{D01C1E11-ED7A-4791-8408-E63EECDA48FF} (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MediaPlayerV1alpha966 (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{d5de32ce-bd33-4a3e-8bd2-67fcf9b1377f} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{872bba1d-f55e-4d9b-a759-bea5cd716c9b} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{31865e38-393e-45dc-8894-ed8635e8a2c9} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D5DE32CE-BD33-4A3E-8BD2-67FCF9B1377F} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D5DE32CE-BD33-4A3E-8BD2-67FCF9B1377F} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D5DE32CE-BD33-4A3E-8BD2-67FCF9B1377F} (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fa040ad1-fd4a-407f-b039-8868bb3b0000 (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5A60B6BB-FA81-4EFA-AB9C-A820E2143736} (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{5A60B6BB-FA81-4EFA-AB9C-A820E2143736} (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 6 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NextLive (PUP.Optional.NextLive.A) -> Daten: C:\Windows\SysWOW64\rundll32.exe "C:\Users\Hannelore\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Updater (Trojan.Agent) -> Daten: C:\ProgramData\Updater\updater.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Updater (Trojan.Agent) -> Daten: C:\ProgramData\Updater\Updater.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Mozilla\Firefox\Extensions|ext@MediaPlayerV1alpha966.net (PUP.Optional.MediaPlayerAlpha.A) -> Daten: C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SYSTEM\CurrentControlSet\Services\InternetUpdater|ImagePath (PUP.Optional.InternetUpdater.A) -> Daten: "C:\ProgramData\InternetUpdater\InternetUpdaterService.exe" -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SYSTEM\CurrentControlSet\Services\Wpm|ImagePath (PUP.Optional.WpManager.A) -> Daten: C:\ProgramData\WPM\wprotectmanager.exe -service -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 7 HKCU\Software\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.NationZoom.A) -> Bösartig: (hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command| (PUP.Optional.NationZoom.A) -> Bösartig: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://www.nationzoom.com/?type=sc&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9) Gut: (firefox.exe) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Search_URL (PUP.Optional.NationZoom.A) -> Bösartig: (hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.NationZoom.A) -> Bösartig: (hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|DefaultScope (PUP.Optional.Qone8) -> Bösartig: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}) Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\Software\Microsoft\Internet Explorer\Main|Default_Page_URL (PUP.Optional.NationZoom.A) -> Bösartig: (hxxp://www.nationzoom.com/?type=hp&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. HKLM\Software\Microsoft\Internet Explorer\Main|Search Page (PUP.Optional.NationZoom) -> Bösartig: (hxxp://www.nationzoom.com/web/?type=ds&ts=1387974239&from=tugs&uid=ST31000524AS_6VPF0CD9XXXX6VPF0CD9&q={searchTerms}) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 33 C:\ProgramData\InternetUpdater (PUP.Optional.InternetUpdater.A) -> Löschen bei Neustart. C:\Users\Hannelore\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\AppData\Roaming\OpenCandy\65692450D50D4DDC9718085AD7EDED7D (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2 (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\RHelpers (PUP.Optional.Searchagent) -> Löschen bei Neustart. C:\ProgramData\RHelpers\ChromeHelper (PUP.Optional.Searchagent) -> Löschen bei Neustart. C:\ProgramData\RHelpers\FirefoxHelper (PUP.Optional.Searchagent) -> Löschen bei Neustart. C:\ProgramData\RHelpers\IeHelper (PUP.Optional.Searchagent) -> Löschen bei Neustart. C:\Program Files (x86)\AmiExt\flashEnhancer (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\core (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\utils (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\defaults (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\defaults\preferences (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\core (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\utils (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\AppData\Roaming\newnext.me (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\AppData\Roaming\newnext.me\cache (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\Extensions\idpcbdkoekecjkbjeccbapdkpcmoiloa (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\Extensions\idpcbdkoekecjkbjeccbapdkpcmoiloa\1.26.119_0 (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966 (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ch (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome\content (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome\content\icons (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome\content\icons\default (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ie (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Re-markit (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 97 C:\ProgramData\WPM\wprotectmanager.exe (PUP.Optional.WpManager.A) -> Löschen bei Neustart. C:\ProgramData\InternetUpdater\InternetUpdaterService.exe (PUP.Optional.InternetUpdater.A) -> Löschen bei Neustart. C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe (PUP.Optional.SearchDonkey.A) -> Löschen bei Neustart. C:\ProgramData\RHelpers\FirefoxHelper\FirefoxHelper.exe (PUP.Optional.SearchDonkey.A) -> Löschen bei Neustart. C:\ProgramData\RHelpers\IeHelper\IeHelper.exe (PUP.Optional.SearchDonkey.A) -> Löschen bei Neustart. C:\Users\Hannelore\AppData\Roaming\newnext.me\nengine.dll (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho.dll (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\AppData\Local\Temp\Setup-a.exe (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\FlashPlayer__4003_i220428627_il14.exe (PUP.Optional.InstallMonetizer) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\Java(1).exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\Java.exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpadcm1_ad_542_cm(1).exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpadcm1_ad_542_cm(2).exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpadcm1_ad_542_cm(3).exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpadcm1_ad_542_cm(4).exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpadcm1_ad_542_cm(5).exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpadcm1_ad_542_cm(6).exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpadcm1_ad_542_cm.exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpsetupmapp1_mapp12110663de.exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpsetupmapp1_mapp12152691de.exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpsetupmarm1_marm1203911984de(1).exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpsetupmarm1_marm1203911984de(2).exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpsetupmarm1_marm1203911984de(3).exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\rcpsetupmarm1_marm1203911984de.exe (PUP.Optional.RegCleanPro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\Setup(1).exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\Setup(2).exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\Setup(3).exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\Setup(4).exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\Setup(5).exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\Setup.exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\Downloads\winamp565_full_emusic-7plus_all.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\AppData\Local\genienext\nengine.dll (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Re-markit Update.job (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\InternetUpdater\InternetUpdater.ico (PUP.Optional.InternetUpdater.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\InternetUpdater\InternetUpdaterService.exe.config (PUP.Optional.InternetUpdater.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\InternetUpdater\Uninstall.exe (PUP.Optional.InternetUpdater.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-1.2-chromeinstaller.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-1.2-codedownloader.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-1.2-enabler.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-1.2-firefoxinstaller.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\Plus-HD-1.2-updater.job (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\Updater\updater.exe (Trojan.Agent) -> Löschen bei Neustart. C:\Users\Hannelore\AppData\Roaming\OpenCandy\65692450D50D4DDC9718085AD7EDED7D\Trial-14.0.1000.89_de-DE_1004732_DE-1.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bg.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-bho64.dll (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil.dll (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil64.dll (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-buttonutil64.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-chromeinstaller.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-codedownloader.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-enabler.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-firefoxinstaller.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-helper.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2-updater.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Plus-HD-1.2.ico (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\Uninstall.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Plus-HD-1.2\utils.exe (PUP.Optional.PlusHD.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\uninstall.exe (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\bootstrap.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome.manifest (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\core\core.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\utils\amiextension.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\utils\amihelper.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\utils\amilocal.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\utils\chaddon.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\utils\chback.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\utils\ffaddon.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\utils\hostutils.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\chrome\content\utils\ieaddon.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ff\defaults\preferences\myext.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\AmiStorage.exe (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\core\core.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\utils\amiextension.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\utils\amihelper.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\utils\amilocal.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\utils\chaddon.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\utils\chback.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\utils\ffaddon.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\utils\hostutils.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\AmiExt\flashEnhancer\ie\js\utils\ieaddon.js (PUP.Optional.Amonetize.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\AppData\Roaming\newnext.me\nengine.cookie (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Hannelore\AppData\Roaming\newnext.me\cache\spark.bin (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\uninstall.exe (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ch\MediaPlayerV1alpha966.crx (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome.manifest (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\install.rdf (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome\content\ffMediaPlayerV1alpha966.js (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome\content\ffMediaPlayerV1alpha966ffaction.js (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome\content\overlay.xul (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome\content\icons\Thumbs.db (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha966\ff\chrome\content\icons\default\MediaPlayerV1alpha966_32.png (PUP.Optional.MediaPlayerAlpha.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Re-markit\150.dll (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Re-markit\ReMarkit_up.exe (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Re-markit\Sqlite3.dll (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\Re-markit\Uninstall.exe (PUP.Optional.ReMarkIt.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Hannelore on 24.02.2014 at 13:51:30,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{0AEE5EDB-D6CB-4E19-82A5-E94A750B4457}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{0CCE586B-B611-4E38-B0E7-06F5C104F9ED}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{11C758C8-8602-47DE-BFEF-B629986ACFD7}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{11F4D8C0-CB55-4430-BD09-DB35969CD29A}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{1C64AB3B-27C5-41C1-8F9E-89FB66EEC7B5}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{26F1DFDE-45F6-4AC2-8433-31F4CF4819B8}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{4F5C2A24-3E02-4A72-BABE-86F575802F62}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{609B37F6-D3F8-4C7F-A628-D364A79E482B}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{7F844532-4D5F-4AA0-8F31-B9F0EA8521A3}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{8599513A-92DB-4682-8FA4-E5B1DECFF8B5}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{90B27BEE-3B0C-4A2F-87F1-8471F55E1F15}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{939E35A0-E4DF-4A2B-B97E-3E3FCD050EE0}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{97233F23-434C-4D76-8DDF-1DD0B91A0923}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{9EF7377C-8B0C-4922-B440-3BFD0CB2F53F}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{9F9EF167-4741-4D68-9219-8A799FB322F6}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{A0B4029A-A335-4974-A2A4-6C57AC5D2981}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{AE4D5338-74E0-4255-B273-2CBD0386488C}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{B5D985A5-983E-49EB-A9B4-09526F979BD6}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{C2FFA401-B110-4D7C-9590-CB414A5C8289}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{D131D82E-02BA-45D5-AF9D-AA7786D30218}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{D65CFF95-A0D9-4449-870D-EF7770FAA04F}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{DA404074-17BB-4457-B2D8-B20363EA48B4}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{E0976C93-D440-4762-ACE6-3A92C110567A}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{E337755E-3AB9-47D8-AA3A-F0B66B769863}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{EFEE51B2-B722-46E0-B38D-4C985952590D}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{F8BD480A-7B67-4931-A365-BC6E2AEEA3FD}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{FD7E49FE-D40B-4203-BBA0-4F019F5C685B}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{FEBA49FC-DD9E-4FC7-BCB5-FFD5C7BBCF21}
Successfully deleted: [Empty Folder] C:\Users\Hannelore\appdata\local\{FEC049B1-BAF7-4528-8B95-5014E231A9E4}
~~~ FireFox
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\ext@flash-enhancer.com
Emptied folder: C:\Users\Hannelore\AppData\Roaming\mozilla\firefox\profiles\jatlqnkh.default\minidumps [38 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.02.2014 at 13:58:21,85
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.016 - Bericht erstellt am 09/01/2014 um 19:31:57
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Hannelore - HANNELORE-PC
# Gestartet von : C:\Users\Hannelore\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : Wpm
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\ProgramData\Alawar
Ordner Gelöscht : C:\ProgramData\Alawar Stargaze
Ordner Gelöscht : C:\ProgramData\AlawarWrapper
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alawar
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\Re-markit
Ordner Gelöscht : C:\Program Files (x86)\Plus-HD-1.2
Ordner Gelöscht : C:\Program Files (x86)\Alawar
Ordner Gelöscht : C:\Users\Hannelore\AppData\Local\lollipop
Ordner Gelöscht : C:\Users\Hannelore\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\Hannelore\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Hannelore\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Hannelore\AppData\Roaming\Alawar
Ordner Gelöscht : C:\Users\Hannelore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Alawar
Ordner Gelöscht : C:\Users\Hannelore\Desktop\Laptop Dateien\Documents\Mobogenie
Ordner Gelöscht : C:\Users\Hannelore\Desktop\Laptop Dateien\Documents\optimizer pro
Ordner Gelöscht : C:\Users\Hannelore\Desktop\Laptop Dateien\Documents\Alawar
Ordner Gelöscht : C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default\Extensions\39e612de-2951-40c2-ab4a-82e121c42778@4e0cecc2-7c67-4374-bc4c-f15656d80ab7.com
Ordner Gelöscht : C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\nationzoom.xml
Datei Gelöscht : C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default\user.js
Datei Gelöscht : C:\Windows\Tasks\Re-markit Update.job
Datei Gelöscht : C:\Windows\System32\Tasks\Re-markit Update
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-1.2-chromeinstaller.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-1.2-chromeinstaller
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-1.2-codedownloader.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-1.2-codedownloader
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-1.2-enabler.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-1.2-enabler
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-1.2-firefoxinstaller.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-1.2-firefoxinstaller
Datei Gelöscht : C:\Windows\Tasks\Plus-HD-1.2-updater.job
Datei Gelöscht : C:\Windows\System32\Tasks\Plus-HD-1.2-updater
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Internet Explorer.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dcpfhaghaadpjpgocojgnlhjcieeooel
Schlüssel Gelöscht : HKCU\Software\Classes\Applications\lollipop.exe
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [lollipop]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NextLive]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0031255.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0031255.BHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0031255.Sandbox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CrossriderApp0031255.Sandbox.1
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Updater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311121155}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322122255}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355125555}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366126655}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344124455}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311121155}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0b26e070-e71c-413c-9cdc-bc2fa44395f1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{17b9e8c8-d922-4a6c-87a6-51a68a5362bd}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{adb28743-47f0-451d-a7d9-c11945d95990}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b894e567-ff2f-43f8-925d-4e0628e51bb0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bb27d832-0ead-490e-ab4e-60ba0f9c7071}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311121155}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322122255}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355125555}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366126655}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311121155}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0b26e070-e71c-413c-9cdc-bc2fa44395f1}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{17b9e8c8-d922-4a6c-87a6-51a68a5362bd}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{adb28743-47f0-451d-a7d9-c11945d95990}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{b894e567-ff2f-43f8-925d-4e0628e51bb0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{bb27d832-0ead-490e-ab4e-60ba0f9c7071}
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DynConIE
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Plus-HD-1.2
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\nationzoomSoftware
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\Plus-HD-1.2
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\lollipop
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-1.2
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.InstallationThankYouPage", false);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.InstallationTime", 1387974237);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.active", true);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.addressbar", "NA");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.addressbarenhanced", "");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.asyncdb.was_copied", "true");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.asyncdb_dbWasSet", true);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.asyncdb_dbWasSet_FF25_FIX", true);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.asyncinternaldb.was_copied", "true");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.asyncinternaldb_dbWasSet", true);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.asyncinternaldb_dbWasSet_FF25_FIX", true);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.backgroundver", 3);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.certdomaininstaller", "");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.changeprevious", false);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.InstallationTime.value", "%221387974237%22");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.InstallerParams.value", "%7B%22source_id%22%3A%22000817%22%2C%22sub_id%22%3A%220%22%2C%22uz[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.jw_token.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.jw_token.value", "%2235f244eb-7240-2b8e-5585-176ad1f0376b%22");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.load_balancer.expiration", "Fri Jan 10 2014 00:13:05 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.load_balancer.value", "%22%7B%20%5C%22Status%5C%22%3A%201%2C%5C%22Endpoint%5C%22%3A%20%5C%2[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.previous_page.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.previous_page.value", "%22hxxp%3A//de.yhs4.search.yahoo.com/yhs/search%3B_ylt%3DA7x9Un5r5s5[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.user_id.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.cookie.user_id.value", "%221434426eaac411905a586db5e1390f36%22");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.description", "Turn YouTube videos to High Definition by default");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.domain", "");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.enablesearch", false);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.homepage", "");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.iframe", false);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3A%2210D39B144A47401DAB1B1EE008C25[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.InstallerParams.value", "%7B%22source_id%22%3A%22000817%22%2C%22sub_id%22%3A%220%22%2C%[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.InstallerParamsCache.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.InstallerParamsCache.value", "%7B%22source_id%22%3A%22000817%22%2C%22sub_id%22%3A%220%2[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.InstallerUserIdentifiersCache.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.InstallerUserIdentifiersCache.value", "%7B%22installer_bic%22%3A%2210D39B144A47401DAB1B[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_appVer.value", "132");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_lastVersion.value", "1");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_meta.value", "%7B%7D");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_nextCheck.expiration", "Fri Jan 10 2014 00:12:38 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_nextCheck.value", "true");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_queue.value", "%7B%7D");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_remote_resources.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.Resources_remote_resources.value", "%7B%22remoteId%22%3A0%7D");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.installer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.installer.value", "%7B%22InstallerIdentifiers%22%3A%7B%22installer_bic%22%3A%2210D39B14[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.monetization_plugin_last_executable_request.expiration", "Fri Jan 10 2014 07:02:06 GMT+[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.internaldb.monetization_plugin_last_executable_request.value", "%22hxxp%3A//api.bizographics.com/v[...]
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.lastDailyReport", "1389287558239");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.lastUpdate", "1389287557272");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.manifesturl", "");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.name", "Plus-HD-1.2");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.newtab", "");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.opensearch", "");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.pluginsurl", "hxxps://w9u6a2p6.ssl.hwcdn.net/plugin/apps/31255/plugins/093/ff/plugins.json");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.pluginsversion", 124);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.publisher", "Plus HD");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.searchstatus", 0);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.setnewtab", false);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.thankyou", "");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.updateinterval", 360);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.31255.ver", 132);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.apps", "31255");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.bic", "1434426eaac411905a586db5e1390f36");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.cid", 31255);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.firstrun", false);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.hadappinstalled", true);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.installationdate", 1388417838);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.modetype", "production");
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.reportInstall", true);
Zeile gelöscht : user_pref("extensions.a39e612de295140c2ab4a82e121c427784e0cecc27c674374bc4cf15656d80ab7com31255.statsDailyCounter", 7);
Zeile gelöscht : user_pref("extensions.crossrider.bic", "1434426eaac411905a586db5e1390f36");
*************************
AdwCleaner[R0].txt - [29198 octets] - [09/01/2014 19:30:27]
AdwCleaner[S0].txt - [23575 octets] - [09/01/2014 19:31:57]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [23636 octets] ##########
AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.019 - Bericht erstellt am 24/02/2014 um 13:46:14
# Aktualisiert 17/02/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Hannelore - HANNELORE-PC
# Gestartet von : C:\Users\Hannelore\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\ProgramData\AlawarWrapper
Ordner Gelöscht : C:\Program Files (x86)\AmiExt
Ordner Gelöscht : C:\Program Files (x86)\MediaPlayerV1
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Users\Hannelore\AppData\Local\genienext
Ordner Gelöscht : C:\Users\Hannelore\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\Hannelore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
Datei Gelöscht : C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default\user.js
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Hannelore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Internet Explorer.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Updater.AmiUpd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Updater.AmiUpd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322122255}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355125555}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366126655}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322122255}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355125555}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366126655}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DynConIE
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\caphyon
Schlüssel Gelöscht : HKLM\Software\supWPM
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16518
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.crossrider.bic", "1434426eaac411905a586db5e1390f36");
-\\ Google Chrome v
[ Datei : C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [34813 octets] - [09/01/2014 19:30:27]
AdwCleaner[R1].txt - [1087 octets] - [09/01/2014 19:38:14]
AdwCleaner[S0].txt - [28488 octets] - [09/01/2014 19:31:57]
AdwCleaner[S1].txt - [1149 octets] - [09/01/2014 19:39:59]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [28609 octets] ##########
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-02-2014 02 Ran by Hannelore (administrator) on HANNELORE-PC on 24-02-2014 14:03:54 Running from C:\Users\Hannelore\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (ASUSTeK Computer Inc.) C:\Windows\SysWOW64\AsHookDevice.exe () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE () C:\Program Files (x86)\MultiScreen\MultiScreen.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-25] (CANON INC.) HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.) HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2489456 2010-10-22] (VIA) HKLM-x32\...\Run: [RunAIShell] - C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe [232064 2009-12-23] (ASUSTeK Computer Inc.) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-01-26] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-14] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [MultiScreen] - C:\Program Files (x86)\MultiScreen\MultiScreen.exe [303104 2009-08-11] () HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [143360 2006-12-23] (Nero AG) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default FF Homepage: hxxp://www.zdfsport.de/ZDFsport-Startseite-4002.html FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( ) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Widget context - C:\Users\Hannelore\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-18] FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta61.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewerV1alpha1292.net] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ff FF Extension: Media Viewer - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ff [2014-02-23] FF HKCU\...\Firefox\Extensions: [{11307539-f37a-4068-81b0-5e786aad6f00}] - C:\Program Files (x86)\Re-markit\150.xpi FF StartMenuInternet: FIREFOX.EXE - firefox.exe Chrome: ======= CHR Extension: (Widget context) - C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-18] CHR HKLM-x32\...\Chrome\Extension: [hjbmanngghbhohodnkbgkgmkajiheieg] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ch\VideoPlayerV3beta61.crx [2014-01-18] CHR HKLM-x32\...\Chrome\Extension: [oleagbdjcgdnlnpanloiifhdljihnkdm] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ch\MediaViewerV1alpha1292.crx [2014-02-23] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2011-01-26] (Advanced Micro Devices, Inc.) R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-14] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-14] (Avira Operations GmbH & Co. KG) R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] () R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG) ==================== Drivers (Whitelisted) ==================== R2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] () R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] () R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-02-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2014-02-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] () U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-24 14:03 - 2014-02-24 14:03 - 02155520 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe 2014-02-24 14:03 - 2014-02-24 14:03 - 00012524 _____ () C:\Users\Hannelore\Desktop\FRST.txt 2014-02-24 13:58 - 2014-02-24 13:58 - 00004076 _____ () C:\Users\Hannelore\Desktop\JRT_2014-02-24.txt 2014-02-24 13:58 - 2014-02-24 13:58 - 00004076 _____ () C:\Users\Hannelore\Desktop\JRT.txt 2014-02-24 13:51 - 2014-02-24 13:51 - 00000000 ____D () C:\Windows\ERUNT 2014-02-24 13:49 - 2014-02-24 13:50 - 01037734 _____ (Thisisu) C:\Users\Hannelore\Desktop\JRT.exe 2014-02-24 13:49 - 2014-02-24 13:49 - 00028714 _____ () C:\Users\Hannelore\Desktop\AdwCleaner[S0]_2014-02-24.txt 2014-02-24 13:40 - 2014-02-24 13:40 - 01241834 _____ () C:\Users\Hannelore\Desktop\adwcleaner.exe 2014-02-24 13:23 - 2014-02-24 13:23 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-24 13:23 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-02-24 13:22 - 2014-02-24 13:22 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Hannelore\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-23 18:28 - 2014-02-23 18:28 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-02-20 17:37 - 2014-02-20 17:36 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-02-20 17:35 - 2014-02-20 17:35 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\ProgramData\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-02-20 17:34 - 2014-02-14 11:00 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-02-20 17:34 - 2014-02-14 11:00 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-02-20 17:34 - 2014-02-14 11:00 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-02-20 17:31 - 2014-02-20 17:31 - 00022301 _____ () C:\ComboFix.txt 2014-02-20 16:55 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-02-20 16:55 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-02-20 16:55 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-02-20 16:42 - 2014-02-20 17:31 - 00000000 ____D () C:\Qoobox 2014-02-20 16:42 - 2014-02-20 16:42 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\TeamViewer 2014-02-20 16:41 - 2014-02-20 17:30 - 00000000 ____D () C:\Windows\erdnt 2014-02-20 16:37 - 2014-02-20 16:37 - 05183886 ____R (Swearware) C:\Users\Hannelore\Desktop\ComboFix.exe 2014-02-20 13:19 - 2014-02-20 17:54 - 00000000 ____D () C:\Users\Hannelore\Desktop\Trojahner-Board 2014-02-20 12:48 - 2014-02-20 12:49 - 137004504 _____ () C:\Users\Hannelore\Downloads\avira_free_antivirus_de(1).exe 2014-02-20 12:03 - 2014-02-20 12:03 - 00380416 _____ () C:\Users\Hannelore\Desktop\Gmer-19357.exe 2014-02-20 11:56 - 2014-02-24 14:03 - 00000000 ____D () C:\FRST 2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable 2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe 2014-02-12 15:05 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-12 15:05 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-12 15:05 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-12 15:05 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-12 15:05 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-12 15:05 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-12 15:05 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-12 15:05 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-12 15:05 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-12 15:05 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-12 15:05 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-12 15:05 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-12 15:05 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-12 15:05 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-12 15:05 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-12 15:05 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-12 15:05 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-12 15:05 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-12 15:05 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-12 15:05 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-12 15:05 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-12 15:05 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-12 15:05 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-12 15:05 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-12 15:05 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-12 15:05 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-12 15:05 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-12 15:05 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-12 15:05 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-12 15:05 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-12 15:05 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-12 15:05 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-12 15:05 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-12 15:05 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-12 15:05 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-12 15:05 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-12 15:05 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-12 15:05 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-02-12 15:04 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-12 15:04 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-12 15:04 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-12 14:58 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls 2014-02-12 14:58 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-02-12 14:58 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-12 14:58 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-12 14:58 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-12 14:58 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-02-12 14:58 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-02-12 14:58 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-02-12 14:58 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-02-12 14:58 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-02-12 14:58 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll 2014-02-12 14:58 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-02-12 14:58 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2014-02-12 14:58 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-12 14:58 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-01-29 23:28 - 2014-01-29 23:28 - 00000306 __RSH () C:\ProgramData\ntuser.pol ==================== One Month Modified Files and Folders ======= 2014-02-24 14:04 - 2014-02-24 14:03 - 00012524 _____ () C:\Users\Hannelore\Desktop\FRST.txt 2014-02-24 14:03 - 2014-02-24 14:03 - 02155520 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe 2014-02-24 14:03 - 2014-02-20 11:56 - 00000000 ____D () C:\FRST 2014-02-24 13:58 - 2014-02-24 13:58 - 00004076 _____ () C:\Users\Hannelore\Desktop\JRT_2014-02-24.txt 2014-02-24 13:58 - 2014-02-24 13:58 - 00004076 _____ () C:\Users\Hannelore\Desktop\JRT.txt 2014-02-24 13:55 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-24 13:55 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-24 13:51 - 2014-02-24 13:51 - 00000000 ____D () C:\Windows\ERUNT 2014-02-24 13:50 - 2014-02-24 13:49 - 01037734 _____ (Thisisu) C:\Users\Hannelore\Desktop\JRT.exe 2014-02-24 13:49 - 2014-02-24 13:49 - 00028714 _____ () C:\Users\Hannelore\Desktop\AdwCleaner[S0]_2014-02-24.txt 2014-02-24 13:47 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-24 13:47 - 2009-07-14 05:51 - 00101703 _____ () C:\Windows\setupact.log 2014-02-24 13:46 - 2014-01-09 19:30 - 00000000 ____D () C:\AdwCleaner 2014-02-24 13:46 - 2011-10-18 11:53 - 00001007 _____ () C:\Users\Hannelore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-02-24 13:46 - 2011-10-18 11:49 - 01540708 _____ () C:\Windows\WindowsUpdate.log 2014-02-24 13:40 - 2014-02-24 13:40 - 01241834 _____ () C:\Users\Hannelore\Desktop\adwcleaner.exe 2014-02-24 13:35 - 2013-12-29 13:05 - 00000000 ____D () C:\ProgramData\Updater 2014-02-24 13:35 - 2010-11-21 04:47 - 00791330 _____ () C:\Windows\PFRO.log 2014-02-24 13:23 - 2014-02-24 13:23 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-24 13:22 - 2014-02-24 13:22 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Hannelore\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-23 18:28 - 2014-02-23 18:28 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-02-20 23:29 - 2013-04-21 13:39 - 00000000 ____D () C:\Program Files (x86)\Farm Girl 2014-02-20 18:19 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-20 17:54 - 2014-02-20 13:19 - 00000000 ____D () C:\Users\Hannelore\Desktop\Trojahner-Board 2014-02-20 17:36 - 2014-02-20 17:37 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-02-20 17:35 - 2014-02-20 17:35 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\ProgramData\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-02-20 17:31 - 2014-02-20 17:31 - 00022301 _____ () C:\ComboFix.txt 2014-02-20 17:31 - 2014-02-20 16:42 - 00000000 ____D () C:\Qoobox 2014-02-20 17:31 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-02-20 17:30 - 2014-02-20 16:41 - 00000000 ____D () C:\Windows\erdnt 2014-02-20 17:30 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2014-02-20 16:42 - 2014-02-20 16:42 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\TeamViewer 2014-02-20 16:37 - 2014-02-20 16:37 - 05183886 ____R (Swearware) C:\Users\Hannelore\Desktop\ComboFix.exe 2014-02-20 12:49 - 2014-02-20 12:48 - 137004504 _____ () C:\Users\Hannelore\Downloads\avira_free_antivirus_de(1).exe 2014-02-20 12:03 - 2014-02-20 12:03 - 00380416 _____ () C:\Users\Hannelore\Desktop\Gmer-19357.exe 2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable 2014-02-20 11:54 - 2011-10-18 11:50 - 00000000 ____D () C:\Users\Hannelore 2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe 2014-02-20 11:49 - 2012-03-01 08:35 - 00000000 ____D () C:\Users\Hannelore\Desktop\Laptop Dateien\Documents\Anja Jöns,Kalender, Postkarten 2014-02-17 16:28 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-17 16:26 - 2012-01-29 11:32 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-02-14 11:00 - 2014-02-20 17:34 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-02-14 11:00 - 2014-02-20 17:34 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-02-14 11:00 - 2014-02-20 17:34 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-02-12 15:15 - 2011-11-04 19:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-12 15:14 - 2011-03-15 22:23 - 00665562 _____ () C:\Windows\system32\perfh007.dat 2014-02-12 15:14 - 2011-03-15 22:23 - 00133774 _____ () C:\Windows\system32\perfc007.dat 2014-02-12 15:14 - 2009-07-14 06:13 - 01550558 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-06 13:16 - 2014-02-12 15:05 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-06 12:30 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-06 12:30 - 2014-02-12 15:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-06 12:12 - 2014-02-12 15:05 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-06 12:07 - 2014-02-12 15:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-06 12:06 - 2014-02-12 15:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-06 11:57 - 2014-02-12 15:05 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-06 11:56 - 2014-02-12 15:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-06 11:52 - 2014-02-12 15:05 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-06 11:49 - 2014-02-12 15:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-06 11:48 - 2014-02-12 15:05 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-06 11:48 - 2014-02-12 15:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-06 11:38 - 2014-02-12 15:04 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-06 11:32 - 2014-02-12 15:05 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-06 11:20 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-06 11:17 - 2014-02-12 15:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-06 11:11 - 2014-02-12 15:04 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-06 11:01 - 2014-02-12 15:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-06 11:00 - 2014-02-12 15:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-06 10:57 - 2014-02-12 15:05 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-06 10:57 - 2014-02-12 15:05 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-06 10:52 - 2014-02-12 15:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-06 10:52 - 2014-02-12 15:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-06 10:50 - 2014-02-12 15:05 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-06 10:49 - 2014-02-12 15:05 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-06 10:47 - 2014-02-12 15:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-06 10:46 - 2014-02-12 15:05 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-06 10:25 - 2014-02-12 15:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-06 10:25 - 2014-02-12 15:04 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-06 10:24 - 2014-02-12 15:05 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-06 10:22 - 2014-02-12 15:05 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-06 10:13 - 2014-02-12 15:05 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-06 10:09 - 2014-02-12 15:05 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-06 10:03 - 2014-02-12 15:05 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-06 09:55 - 2014-02-12 15:05 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-06 09:41 - 2014-02-12 15:05 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-06 09:40 - 2014-02-12 15:05 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-06 09:36 - 2014-02-12 15:05 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-06 09:34 - 2014-02-12 15:05 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-04 19:32 - 2011-10-18 19:30 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-01-29 23:28 - 2014-01-29 23:28 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-01-29 23:28 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-01-29 23:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy Some content of TEMP: ==================== C:\Users\Hannelore\AppData\Local\Temp\avgnt.exe C:\Users\Hannelore\AppData\Local\Temp\Quarantine.exe C:\Users\Hannelore\AppData\Local\Temp\_ReMarkit_up.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-20 18:11 ==================== End Of Log ============================ --- --- --- |
|
25.02.2014, 13:00
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei InternetnutzungESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung |
|
26.02.2014, 16:19
| #7 |
| | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Wow. 4 Stunden Scan;-) Nun, hier die Meldungen- aber leider immer noch Weiterleitungen und Popups die reinlaufen. Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetesets_scanner_update returned -1 esets_gle=12
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=5f280eb06eced145ba90bb5f25247540
# engine=17223
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-25 10:37:06
# local_time=2014-02-25 11:37:06 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 40088 999380 32856 0
# compatibility_mode=5893 16776574 100 94 457311 144997676 0 0
# scanned=228800
# found=22
# cleaned=0
# scan_time=14609
sh=C194683392FDAEF18998E9AEA23A2B3A802C3AE0 ft=1 fh=c71c00118e80b4cf vn="a variant of Win32/AdWare.AddLyrics.AF application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Re-markit\ReMarkit_up.exe.vir"
sh=5E3E31C33969F6581FDFEDEF71F5C9BE687918E4 ft=1 fh=46ada96c174ae2b7 vn="a variant of Win32/AdWare.AddLyrics.AE application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Re-markit\Uninstall.exe.vir"
sh=63F3BBA3CF0DBBBD8FB65B042FEC5B7653C7FF2D ft=1 fh=0c63de394d0f8a7d vn="a variant of Win32/AdWare.BetterSurf.C application" ac=I fn="C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ie\MediaViewerV1alpha1292.dll"
sh=B1C9CF1BEA4D585F2E697D25A7BF16D05CD36B4B ft=1 fh=8d5e81d8cad7c3e0 vn="a variant of MSIL/Adware.PullUpdate.A application" ac=I fn="C:\ProgramData\Updater\Uninstall.exe"
sh=BCF2C918E9FCAAB7ED04881D4EAD3FE86E9BCBCE ft=1 fh=6d8af01e2d6f3561 vn="a variant of Win32/AdWare.BetterSurf.C application" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ie\VideoPlayerV3beta61.dll.vir"
sh=B1C9CF1BEA4D585F2E697D25A7BF16D05CD36B4B ft=1 fh=8d5e81d8cad7c3e0 vn="a variant of MSIL/Adware.PullUpdate.A application" ac=I fn="C:\Users\All Users\Updater\Uninstall.exe"
sh=E1D66F9BFBD7E73D3147992C826AD8A68F262959 ft=1 fh=352e5f030bf8b108 vn="multiple threats" ac=I fn="C:\Users\Hannelore\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6JKPRXTN\Re-markit_2040-2181_inL[1]"
sh=E1D66F9BFBD7E73D3147992C826AD8A68F262959 ft=1 fh=352e5f030bf8b108 vn="multiple threats" ac=I fn="C:\Users\Hannelore\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B23ZSHET\Re-markit_2040-2181_inL[1]"
sh=E1D66F9BFBD7E73D3147992C826AD8A68F262959 ft=1 fh=352e5f030bf8b108 vn="multiple threats" ac=I fn="C:\Users\Hannelore\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JOSR7NJP\Re-markit_2040-2181_inL[1]"
sh=E1D66F9BFBD7E73D3147992C826AD8A68F262959 ft=1 fh=352e5f030bf8b108 vn="multiple threats" ac=I fn="C:\Users\Hannelore\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPZTADGQ\Re-markit_2040-2181_inL[1]"
sh=E1D66F9BFBD7E73D3147992C826AD8A68F262959 ft=1 fh=352e5f030bf8b108 vn="multiple threats" ac=I fn="C:\Users\Hannelore\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UC2OS7NE\Re-markit_2040-2181_inL[1]"
sh=E1D66F9BFBD7E73D3147992C826AD8A68F262959 ft=1 fh=352e5f030bf8b108 vn="multiple threats" ac=I fn="C:\Users\Hannelore\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UC2OS7NE\Re-markit_2040-2181_inL[2]"
sh=E1D66F9BFBD7E73D3147992C826AD8A68F262959 ft=1 fh=352e5f030bf8b108 vn="multiple threats" ac=I fn="C:\Users\Hannelore\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X10M9SVV\Re-markit_2040-2181_inL[1]"
sh=E1D66F9BFBD7E73D3147992C826AD8A68F262959 ft=1 fh=352e5f030bf8b108 vn="multiple threats" ac=I fn="C:\Users\Hannelore\AppData\Local\Temp\_ReMarkit_up.exe"
sh=CF4B73974C6EFD3E573A287F2AC8E3F162A0699A ft=1 fh=8fdc7a78fe18d890 vn="Win32/StartPage.OIE trojan" ac=I fn="C:\Users\Hannelore\Desktop\Anscha\Schule\Alles auf Lager_DVDs\DVD, 1. Lehrjahr\VLC-Mediaplayer\vlc-1.1.5-win32.exe"
sh=CF4B73974C6EFD3E573A287F2AC8E3F162A0699A ft=1 fh=8fdc7a78fe18d890 vn="Win32/StartPage.OIE trojan" ac=I fn="C:\Users\Hannelore\Desktop\Anscha\Schule\Alles auf Lager_DVDs\DVD, 2. Lehrjahr\VLC-Mediaplayer\vlc-1.1.5-win32.exe"
sh=F3FF404DAEF5BEAA1EDBD9ED536471EC49C2F2F1 ft=0 fh=0000000000000000 vn="Win32/StartPage.OIE trojan" ac=I fn="G:\HANNELORE-PC\Backup Set 2013-08-11 190001\Backup Files 2013-08-11 190001\Backup files 1.zip"
sh=7C3629AF31B2428AA937FE3F700D1404C97070B7 ft=0 fh=0000000000000000 vn="Win32/StartPage.OIE trojan" ac=I fn="G:\HANNELORE-PC\Backup Set 2013-08-11 190001\Backup Files 2013-08-18 190001\Backup files 1.zip"
sh=047F8600754D055C2B93F3CC9A35F84689284F08 ft=0 fh=0000000000000000 vn="HTML/ScrInject.B.Gen virus" ac=I fn="G:\HANNELORE-PC\Backup Set 2013-08-11 190001\Backup Files 2013-08-18 190001\Backup files 3.zip"
sh=531C48CA932E6AD7C6A071FF735F6B5D541FB828 ft=0 fh=0000000000000000 vn="Win32/StartPage.OIE trojan" ac=I fn="G:\HANNELORE-PC\Backup Set 2013-08-11 190001\Backup Files 2013-10-06 203034\Backup files 1.zip"
sh=0BCDF81C0214E378AC64F178AE399F4B36E00686 ft=0 fh=0000000000000000 vn="Win32/StartPage.OIE trojan" ac=I fn="G:\HANNELORE-PC\Backup Set 2014-02-23 190001\Backup Files 2014-02-23 190001\Backup files 1.zip"
sh=4A5489B3E4FE4E594FD2B7ED04C23F10D0B4955A ft=0 fh=0000000000000000 vn="a variant of Win32/AdWare.iBryte.L.gen application" ac=I fn="G:\HANNELORE-PC\Backup Set 2014-02-23 190001\Backup Files 2014-02-23 190001\Backup files 12.zip"
Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.9.900.170 Adobe Reader XI Mozilla Firefox (26.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-02-2014 01 Ran by Hannelore (administrator) on HANNELORE-PC on 26-02-2014 16:14:33 Running from C:\Users\Hannelore\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (ASUSTeK Computer Inc.) C:\Windows\SysWOW64\AsHookDevice.exe () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE () C:\Program Files (x86)\MultiScreen\MultiScreen.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Microsoft Corporation) C:\Windows\splwow64.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-25] (CANON INC.) HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.) HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2489456 2010-10-22] (VIA) HKLM-x32\...\Run: [RunAIShell] - C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe [232064 2009-12-23] (ASUSTeK Computer Inc.) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-01-26] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-14] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [MultiScreen] - C:\Program Files (x86)\MultiScreen\MultiScreen.exe [303104 2009-08-11] () HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [143360 2006-12-23] (Nero AG) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default FF Homepage: hxxp://www.zdfsport.de/ZDFsport-Startseite-4002.html FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( ) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Widget context - C:\Users\Hannelore\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-18] FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta61.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewerV1alpha1292.net] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ff FF Extension: Media Viewer - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ff [2014-02-23] FF HKCU\...\Firefox\Extensions: [{11307539-f37a-4068-81b0-5e786aad6f00}] - C:\Program Files (x86)\Re-markit\150.xpi FF StartMenuInternet: FIREFOX.EXE - firefox.exe Chrome: ======= CHR Extension: (Widget context) - C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-18] CHR HKLM-x32\...\Chrome\Extension: [hjbmanngghbhohodnkbgkgmkajiheieg] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ch\VideoPlayerV3beta61.crx [2014-01-18] CHR HKLM-x32\...\Chrome\Extension: [oleagbdjcgdnlnpanloiifhdljihnkdm] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ch\MediaViewerV1alpha1292.crx [2014-02-23] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2011-01-26] (Advanced Micro Devices, Inc.) R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-14] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-14] (Avira Operations GmbH & Co. KG) R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] () R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG) ==================== Drivers (Whitelisted) ==================== R2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] () R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] () R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-02-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2014-02-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] () U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-26 16:14 - 2014-02-26 16:14 - 00012659 _____ () C:\Users\Hannelore\Desktop\FRST.txt 2014-02-26 16:13 - 2014-02-26 16:13 - 00000967 _____ () C:\Users\Hannelore\Desktop\SecurityCheck_14-02-26.txt 2014-02-26 16:13 - 2014-02-26 16:13 - 00000000 ____D () C:\Users\Hannelore\Desktop\FRST-OlderVersion 2014-02-26 16:07 - 2014-02-26 16:07 - 00987425 _____ () C:\Users\Hannelore\Desktop\SecurityCheck.exe 2014-02-25 23:52 - 2014-02-25 23:52 - 00005712 _____ () C:\Users\Hannelore\Desktop\ESET_2014_02_25.txt 2014-02-25 13:43 - 2014-02-26 14:17 - 01624788 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-24 14:03 - 2014-02-26 16:13 - 02155008 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe 2014-02-24 13:51 - 2014-02-24 13:51 - 00000000 ____D () C:\Windows\ERUNT 2014-02-24 13:49 - 2014-02-24 13:50 - 01037734 _____ (Thisisu) C:\Users\Hannelore\Desktop\JRT.exe 2014-02-24 13:40 - 2014-02-24 13:40 - 01241834 _____ () C:\Users\Hannelore\Desktop\adwcleaner.exe 2014-02-24 13:23 - 2014-02-24 13:23 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-24 13:23 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-02-24 13:22 - 2014-02-24 13:22 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Hannelore\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-23 18:28 - 2014-02-23 18:28 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-02-20 17:37 - 2014-02-20 17:36 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-02-20 17:35 - 2014-02-20 17:35 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\ProgramData\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-02-20 17:34 - 2014-02-14 11:00 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-02-20 17:34 - 2014-02-14 11:00 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-02-20 17:34 - 2014-02-14 11:00 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-02-20 17:31 - 2014-02-20 17:31 - 00022301 _____ () C:\ComboFix.txt 2014-02-20 16:55 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-02-20 16:55 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-02-20 16:55 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-02-20 16:42 - 2014-02-20 17:31 - 00000000 ____D () C:\Qoobox 2014-02-20 16:42 - 2014-02-20 16:42 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\TeamViewer 2014-02-20 16:41 - 2014-02-20 17:30 - 00000000 ____D () C:\Windows\erdnt 2014-02-20 16:37 - 2014-02-20 16:37 - 05183886 ____R (Swearware) C:\Users\Hannelore\Desktop\ComboFix.exe 2014-02-20 13:19 - 2014-02-24 14:15 - 00000000 ____D () C:\Users\Hannelore\Desktop\Trojahner-Board 2014-02-20 12:48 - 2014-02-20 12:49 - 137004504 _____ () C:\Users\Hannelore\Downloads\avira_free_antivirus_de(1).exe 2014-02-20 12:03 - 2014-02-20 12:03 - 00380416 _____ () C:\Users\Hannelore\Desktop\Gmer-19357.exe 2014-02-20 11:56 - 2014-02-26 16:14 - 00000000 ____D () C:\FRST 2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable 2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe 2014-02-12 15:05 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-12 15:05 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-12 15:05 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-12 15:05 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-12 15:05 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-12 15:05 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-12 15:05 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-12 15:05 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-12 15:05 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-12 15:05 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-12 15:05 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-12 15:05 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-12 15:05 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-12 15:05 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-12 15:05 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-12 15:05 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-12 15:05 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-12 15:05 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-12 15:05 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-12 15:05 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-12 15:05 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-12 15:05 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-12 15:05 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-12 15:05 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-12 15:05 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-12 15:05 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-12 15:05 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-12 15:05 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-12 15:05 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-12 15:05 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-12 15:05 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-12 15:05 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-12 15:05 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-12 15:05 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-12 15:05 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-12 15:05 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-12 15:05 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-12 15:05 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-02-12 15:04 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-12 15:04 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-12 15:04 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-12 14:58 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls 2014-02-12 14:58 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-02-12 14:58 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-12 14:58 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-12 14:58 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-12 14:58 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-02-12 14:58 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-02-12 14:58 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-02-12 14:58 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-02-12 14:58 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-02-12 14:58 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll 2014-02-12 14:58 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-02-12 14:58 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2014-02-12 14:58 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-12 14:58 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-01-29 23:28 - 2014-01-29 23:28 - 00000306 __RSH () C:\ProgramData\ntuser.pol ==================== One Month Modified Files and Folders ======= 2014-02-26 16:14 - 2014-02-26 16:14 - 00012659 _____ () C:\Users\Hannelore\Desktop\FRST.txt 2014-02-26 16:14 - 2014-02-20 11:56 - 00000000 ____D () C:\FRST 2014-02-26 16:13 - 2014-02-26 16:13 - 00000967 _____ () C:\Users\Hannelore\Desktop\SecurityCheck_14-02-26.txt 2014-02-26 16:13 - 2014-02-26 16:13 - 00000000 ____D () C:\Users\Hannelore\Desktop\FRST-OlderVersion 2014-02-26 16:13 - 2014-02-24 14:03 - 02155008 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe 2014-02-26 16:11 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-26 16:11 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-26 16:08 - 2011-10-18 11:49 - 01647270 _____ () C:\Windows\WindowsUpdate.log 2014-02-26 16:07 - 2014-02-26 16:07 - 00987425 _____ () C:\Users\Hannelore\Desktop\SecurityCheck.exe 2014-02-26 16:04 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-26 16:04 - 2009-07-14 05:51 - 00103629 _____ () C:\Windows\setupact.log 2014-02-26 14:17 - 2014-02-25 13:43 - 01624788 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-26 14:17 - 2011-03-15 22:23 - 00710844 _____ () C:\Windows\system32\perfh007.dat 2014-02-26 14:17 - 2011-03-15 22:23 - 00153324 _____ () C:\Windows\system32\perfc007.dat 2014-02-26 14:17 - 2009-07-14 06:13 - 01624788 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-26 06:42 - 2010-11-21 04:47 - 00903924 _____ () C:\Windows\PFRO.log 2014-02-25 23:52 - 2014-02-25 23:52 - 00005712 _____ () C:\Users\Hannelore\Desktop\ESET_2014_02_25.txt 2014-02-25 19:24 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-02-24 14:15 - 2014-02-20 13:19 - 00000000 ____D () C:\Users\Hannelore\Desktop\Trojahner-Board 2014-02-24 13:51 - 2014-02-24 13:51 - 00000000 ____D () C:\Windows\ERUNT 2014-02-24 13:50 - 2014-02-24 13:49 - 01037734 _____ (Thisisu) C:\Users\Hannelore\Desktop\JRT.exe 2014-02-24 13:46 - 2014-01-09 19:30 - 00000000 ____D () C:\AdwCleaner 2014-02-24 13:46 - 2011-10-18 11:53 - 00001007 _____ () C:\Users\Hannelore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-02-24 13:40 - 2014-02-24 13:40 - 01241834 _____ () C:\Users\Hannelore\Desktop\adwcleaner.exe 2014-02-24 13:35 - 2013-12-29 13:05 - 00000000 ____D () C:\ProgramData\Updater 2014-02-24 13:23 - 2014-02-24 13:23 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-24 13:22 - 2014-02-24 13:22 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Hannelore\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-23 18:28 - 2014-02-23 18:28 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-02-20 23:29 - 2013-04-21 13:39 - 00000000 ____D () C:\Program Files (x86)\Farm Girl 2014-02-20 18:19 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-20 17:36 - 2014-02-20 17:37 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-02-20 17:35 - 2014-02-20 17:35 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\ProgramData\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-02-20 17:31 - 2014-02-20 17:31 - 00022301 _____ () C:\ComboFix.txt 2014-02-20 17:31 - 2014-02-20 16:42 - 00000000 ____D () C:\Qoobox 2014-02-20 17:31 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-02-20 17:30 - 2014-02-20 16:41 - 00000000 ____D () C:\Windows\erdnt 2014-02-20 17:30 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2014-02-20 16:42 - 2014-02-20 16:42 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\TeamViewer 2014-02-20 16:37 - 2014-02-20 16:37 - 05183886 ____R (Swearware) C:\Users\Hannelore\Desktop\ComboFix.exe 2014-02-20 12:49 - 2014-02-20 12:48 - 137004504 _____ () C:\Users\Hannelore\Downloads\avira_free_antivirus_de(1).exe 2014-02-20 12:03 - 2014-02-20 12:03 - 00380416 _____ () C:\Users\Hannelore\Desktop\Gmer-19357.exe 2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable 2014-02-20 11:54 - 2011-10-18 11:50 - 00000000 ____D () C:\Users\Hannelore 2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe 2014-02-20 11:49 - 2012-03-01 08:35 - 00000000 ____D () C:\Users\Hannelore\Desktop\Laptop Dateien\Documents\Anja Jöns,Kalender, Postkarten 2014-02-17 16:28 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-17 16:26 - 2012-01-29 11:32 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-02-14 11:00 - 2014-02-20 17:34 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-02-14 11:00 - 2014-02-20 17:34 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-02-14 11:00 - 2014-02-20 17:34 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-02-12 15:15 - 2011-11-04 19:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-06 13:16 - 2014-02-12 15:05 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-06 12:30 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-06 12:30 - 2014-02-12 15:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-06 12:12 - 2014-02-12 15:05 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-06 12:07 - 2014-02-12 15:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-06 12:06 - 2014-02-12 15:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-06 11:57 - 2014-02-12 15:05 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-06 11:56 - 2014-02-12 15:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-06 11:52 - 2014-02-12 15:05 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-06 11:49 - 2014-02-12 15:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-06 11:48 - 2014-02-12 15:05 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-06 11:48 - 2014-02-12 15:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-06 11:38 - 2014-02-12 15:04 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-06 11:32 - 2014-02-12 15:05 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-06 11:20 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-06 11:17 - 2014-02-12 15:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-06 11:11 - 2014-02-12 15:04 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-06 11:01 - 2014-02-12 15:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-06 11:00 - 2014-02-12 15:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-06 10:57 - 2014-02-12 15:05 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-06 10:57 - 2014-02-12 15:05 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-06 10:52 - 2014-02-12 15:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-06 10:52 - 2014-02-12 15:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-06 10:50 - 2014-02-12 15:05 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-06 10:49 - 2014-02-12 15:05 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-06 10:47 - 2014-02-12 15:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-06 10:46 - 2014-02-12 15:05 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-06 10:25 - 2014-02-12 15:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-06 10:25 - 2014-02-12 15:04 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-06 10:24 - 2014-02-12 15:05 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-06 10:22 - 2014-02-12 15:05 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-06 10:13 - 2014-02-12 15:05 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-06 10:09 - 2014-02-12 15:05 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-06 10:03 - 2014-02-12 15:05 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-06 09:55 - 2014-02-12 15:05 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-06 09:41 - 2014-02-12 15:05 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-06 09:40 - 2014-02-12 15:05 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-06 09:36 - 2014-02-12 15:05 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-06 09:34 - 2014-02-12 15:05 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-04 19:32 - 2011-10-18 19:30 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-01-29 23:28 - 2014-01-29 23:28 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-01-29 23:28 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-01-29 23:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy Some content of TEMP: ==================== C:\Users\Hannelore\AppData\Local\Temp\avgnt.exe C:\Users\Hannelore\AppData\Local\Temp\Quarantine.exe C:\Users\Hannelore\AppData\Local\Temp\_ReMarkit_up.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-20 18:11 ==================== End Of Log ============================ |
|
27.02.2014, 13:53
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung In welchem Browser? Bitte mal FRST öffnen, Haken setzen bei Additional und scanne, poste bitte beide Logfiles.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.03.2014, 12:55
| #9 |
| | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Hallo Schrauber, bin erst heute wieder an diesem PC- und habe bisher keine unerwünschten Popups u. A. Scheint also, als wenns geklappt hat. Ein Riesen-Dankeschön nebst Kniefall an Dich!!! Den Scan hab ich vorsorglich trotzdem mal gemacht: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-03-2014 Ran by Hannelore (administrator) on HANNELORE-PC on 06-03-2014 12:18:08 Running from C:\Users\Hannelore\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (ASUSTeK Computer Inc.) C:\Windows\SysWOW64\AsHookDevice.exe () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE () C:\Program Files (x86)\MultiScreen\MultiScreen.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-25] (CANON INC.) HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.) HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2489456 2010-10-22] (VIA) HKLM-x32\...\Run: [RunAIShell] - C:\Program Files (x86)\ASUS\AI Manager\AsShellApplication.exe [232064 2009-12-23] (ASUSTeK Computer Inc.) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-01-26] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-14] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [MultiScreen] - C:\Program Files (x86)\MultiScreen\MultiScreen.exe [303104 2009-08-11] () HKU\S-1-5-21-629462868-1812135359-3476880325-1001\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [143360 2006-12-23] (Nero AG) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Hannelore\AppData\Roaming\Mozilla\Firefox\Profiles\jatlqnkh.default FF Homepage: hxxp://www.zdfsport.de/ZDFsport-Startseite-4002.html FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll ( ) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Widget context - C:\Users\Hannelore\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-18] FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta61.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ff FF HKLM-x32\...\Firefox\Extensions: [ext@MediaViewerV1alpha1292.net] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ff FF Extension: Media Viewer - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ff [2014-02-23] FF HKCU\...\Firefox\Extensions: [{11307539-f37a-4068-81b0-5e786aad6f00}] - C:\Program Files (x86)\Re-markit\150.xpi FF StartMenuInternet: FIREFOX.EXE - firefox.exe Chrome: ======= CHR Extension: (Widget context) - C:\Users\Hannelore\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-18] CHR HKLM-x32\...\Chrome\Extension: [hjbmanngghbhohodnkbgkgmkajiheieg] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta61\ch\VideoPlayerV3beta61.crx [2014-01-18] CHR HKLM-x32\...\Chrome\Extension: [oleagbdjcgdnlnpanloiifhdljihnkdm] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1292\ch\MediaViewerV1alpha1292.crx [2014-02-23] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2011-01-26] (Advanced Micro Devices, Inc.) R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-14] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-14] (Avira Operations GmbH & Co. KG) R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] () R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG) ==================== Drivers (Whitelisted) ==================== R2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] () R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] () R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-02-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2014-02-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] () U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-06 12:18 - 2014-03-06 12:18 - 00012424 _____ () C:\Users\Hannelore\Desktop\FRST.txt 2014-03-01 22:51 - 2014-03-01 22:51 - 00000000 ____D () C:\ProgramData\AlawarWrapper 2014-02-26 16:13 - 2014-03-06 12:17 - 00000000 ____D () C:\Users\Hannelore\Desktop\FRST-OlderVersion 2014-02-26 16:07 - 2014-02-26 16:07 - 00987425 _____ () C:\Users\Hannelore\Desktop\SecurityCheck.exe 2014-02-25 13:43 - 2014-02-26 14:17 - 01624788 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-24 14:03 - 2014-03-06 12:17 - 02156544 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe 2014-02-24 13:51 - 2014-02-24 13:51 - 00000000 ____D () C:\Windows\ERUNT 2014-02-24 13:49 - 2014-02-24 13:50 - 01037734 _____ (Thisisu) C:\Users\Hannelore\Desktop\JRT.exe 2014-02-24 13:40 - 2014-02-24 13:40 - 01241834 _____ () C:\Users\Hannelore\Desktop\adwcleaner.exe 2014-02-24 13:23 - 2014-02-24 13:23 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-24 13:23 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-02-24 13:22 - 2014-02-24 13:22 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Hannelore\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-23 18:28 - 2014-02-23 18:28 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-02-20 17:37 - 2014-02-20 17:36 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-02-20 17:35 - 2014-02-20 17:35 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\ProgramData\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-02-20 17:34 - 2014-02-14 11:00 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-02-20 17:34 - 2014-02-14 11:00 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-02-20 17:34 - 2014-02-14 11:00 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-02-20 17:31 - 2014-02-20 17:31 - 00022301 _____ () C:\ComboFix.txt 2014-02-20 16:55 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-02-20 16:55 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-02-20 16:55 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-02-20 16:55 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-02-20 16:42 - 2014-02-20 17:31 - 00000000 ____D () C:\Qoobox 2014-02-20 16:42 - 2014-02-20 16:42 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\TeamViewer 2014-02-20 16:41 - 2014-02-20 17:30 - 00000000 ____D () C:\Windows\erdnt 2014-02-20 16:37 - 2014-02-20 16:37 - 05183886 ____R (Swearware) C:\Users\Hannelore\Desktop\ComboFix.exe 2014-02-20 13:19 - 2014-02-26 16:39 - 00000000 ____D () C:\Users\Hannelore\Desktop\Trojahner-Board 2014-02-20 12:48 - 2014-02-20 12:49 - 137004504 _____ () C:\Users\Hannelore\Downloads\avira_free_antivirus_de(1).exe 2014-02-20 12:03 - 2014-02-20 12:03 - 00380416 _____ () C:\Users\Hannelore\Desktop\Gmer-19357.exe 2014-02-20 11:56 - 2014-03-06 12:18 - 00000000 ____D () C:\FRST 2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable 2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe 2014-02-12 15:05 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-12 15:05 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-12 15:05 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-12 15:05 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-12 15:05 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-12 15:05 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-12 15:05 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-12 15:05 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-12 15:05 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-12 15:05 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-12 15:05 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-12 15:05 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-12 15:05 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-12 15:05 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-12 15:05 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-12 15:05 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-12 15:05 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-12 15:05 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-12 15:05 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-12 15:05 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-12 15:05 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-12 15:05 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-12 15:05 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-12 15:05 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-12 15:05 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-12 15:05 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-12 15:05 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-12 15:05 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-12 15:05 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-12 15:05 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-12 15:05 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-12 15:05 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-12 15:05 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-12 15:05 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-12 15:05 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-12 15:05 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-12 15:05 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-12 15:05 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-02-12 15:04 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-12 15:04 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-12 15:04 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-12 14:58 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls 2014-02-12 14:58 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-02-12 14:58 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-12 14:58 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-12 14:58 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-12 14:58 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-02-12 14:58 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-02-12 14:58 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-02-12 14:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-02-12 14:58 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-02-12 14:58 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-02-12 14:58 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-02-12 14:58 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll 2014-02-12 14:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll 2014-02-12 14:58 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-02-12 14:58 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe 2014-02-12 14:58 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2014-02-12 14:58 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-12 14:58 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll ==================== One Month Modified Files and Folders ======= 2014-03-06 12:18 - 2014-03-06 12:18 - 00012424 _____ () C:\Users\Hannelore\Desktop\FRST.txt 2014-03-06 12:18 - 2014-02-20 11:56 - 00000000 ____D () C:\FRST 2014-03-06 12:17 - 2014-02-26 16:13 - 00000000 ____D () C:\Users\Hannelore\Desktop\FRST-OlderVersion 2014-03-06 12:17 - 2014-02-24 14:03 - 02156544 _____ (Farbar) C:\Users\Hannelore\Desktop\FRST64.exe 2014-03-06 12:16 - 2011-10-18 11:49 - 01792243 _____ () C:\Windows\WindowsUpdate.log 2014-03-06 12:13 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-06 12:13 - 2009-07-14 05:51 - 00104301 _____ () C:\Windows\setupact.log 2014-03-05 20:13 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-05 20:13 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-02 22:02 - 2012-03-17 17:40 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\EnchantedCavern 2014-03-01 22:51 - 2014-03-01 22:51 - 00000000 ____D () C:\ProgramData\AlawarWrapper 2014-03-01 00:03 - 2011-10-18 19:30 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-02-26 16:39 - 2014-02-20 13:19 - 00000000 ____D () C:\Users\Hannelore\Desktop\Trojahner-Board 2014-02-26 16:07 - 2014-02-26 16:07 - 00987425 _____ () C:\Users\Hannelore\Desktop\SecurityCheck.exe 2014-02-26 14:17 - 2014-02-25 13:43 - 01624788 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-26 14:17 - 2011-03-15 22:23 - 00710844 _____ () C:\Windows\system32\perfh007.dat 2014-02-26 14:17 - 2011-03-15 22:23 - 00153324 _____ () C:\Windows\system32\perfc007.dat 2014-02-26 14:17 - 2009-07-14 06:13 - 01624788 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-26 06:42 - 2010-11-21 04:47 - 00903924 _____ () C:\Windows\PFRO.log 2014-02-25 19:24 - 2009-07-14 06:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-02-24 13:51 - 2014-02-24 13:51 - 00000000 ____D () C:\Windows\ERUNT 2014-02-24 13:50 - 2014-02-24 13:49 - 01037734 _____ (Thisisu) C:\Users\Hannelore\Desktop\JRT.exe 2014-02-24 13:46 - 2014-01-09 19:30 - 00000000 ____D () C:\AdwCleaner 2014-02-24 13:46 - 2011-10-18 11:53 - 00001007 _____ () C:\Users\Hannelore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-02-24 13:40 - 2014-02-24 13:40 - 01241834 _____ () C:\Users\Hannelore\Desktop\adwcleaner.exe 2014-02-24 13:35 - 2013-12-29 13:05 - 00000000 ____D () C:\ProgramData\Updater 2014-02-24 13:23 - 2014-02-24 13:23 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-24 13:23 - 2014-02-24 13:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-24 13:22 - 2014-02-24 13:22 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Hannelore\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-23 18:28 - 2014-02-23 18:28 - 00000000 ____D () C:\Program Files (x86)\MediaViewerV1 2014-02-20 23:29 - 2013-04-21 13:39 - 00000000 ____D () C:\Program Files (x86)\Farm Girl 2014-02-20 18:19 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-20 17:36 - 2014-02-20 17:37 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-02-20 17:35 - 2014-02-20 17:35 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00002070 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\ProgramData\Avira 2014-02-20 17:34 - 2014-02-20 17:34 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-02-20 17:31 - 2014-02-20 17:31 - 00022301 _____ () C:\ComboFix.txt 2014-02-20 17:31 - 2014-02-20 16:42 - 00000000 ____D () C:\Qoobox 2014-02-20 17:31 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-02-20 17:30 - 2014-02-20 16:41 - 00000000 ____D () C:\Windows\erdnt 2014-02-20 17:30 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2014-02-20 16:42 - 2014-02-20 16:42 - 00000000 ____D () C:\Users\Hannelore\AppData\Roaming\TeamViewer 2014-02-20 16:37 - 2014-02-20 16:37 - 05183886 ____R (Swearware) C:\Users\Hannelore\Desktop\ComboFix.exe 2014-02-20 12:49 - 2014-02-20 12:48 - 137004504 _____ () C:\Users\Hannelore\Downloads\avira_free_antivirus_de(1).exe 2014-02-20 12:03 - 2014-02-20 12:03 - 00380416 _____ () C:\Users\Hannelore\Desktop\Gmer-19357.exe 2014-02-20 11:54 - 2014-02-20 11:54 - 00000000 _____ () C:\Users\Hannelore\defogger_reenable 2014-02-20 11:54 - 2011-10-18 11:50 - 00000000 ____D () C:\Users\Hannelore 2014-02-20 11:53 - 2014-02-20 11:53 - 00050477 _____ () C:\Users\Hannelore\Desktop\Defogger.exe 2014-02-20 11:49 - 2012-03-01 08:35 - 00000000 ____D () C:\Users\Hannelore\Desktop\Laptop Dateien\Documents\Anja Jöns,Kalender, Postkarten 2014-02-17 16:28 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-17 16:26 - 2012-01-29 11:32 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-02-14 11:00 - 2014-02-20 17:34 - 00131576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-02-14 11:00 - 2014-02-20 17:34 - 00108440 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-02-14 11:00 - 2014-02-20 17:34 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-02-12 15:15 - 2011-11-04 19:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-06 13:16 - 2014-02-12 15:05 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-06 12:30 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-06 12:30 - 2014-02-12 15:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-06 12:12 - 2014-02-12 15:05 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-06 12:07 - 2014-02-12 15:05 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-06 12:06 - 2014-02-12 15:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-06 11:57 - 2014-02-12 15:05 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-06 11:56 - 2014-02-12 15:05 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-06 11:52 - 2014-02-12 15:05 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-06 11:49 - 2014-02-12 15:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-06 11:48 - 2014-02-12 15:05 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-06 11:48 - 2014-02-12 15:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-06 11:38 - 2014-02-12 15:04 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-06 11:32 - 2014-02-12 15:05 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-06 11:20 - 2014-02-12 15:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-06 11:17 - 2014-02-12 15:05 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-06 11:11 - 2014-02-12 15:04 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-06 11:01 - 2014-02-12 15:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-06 11:00 - 2014-02-12 15:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-02-06 10:57 - 2014-02-12 15:05 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-06 10:57 - 2014-02-12 15:05 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-06 10:52 - 2014-02-12 15:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-06 10:52 - 2014-02-12 15:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-06 10:50 - 2014-02-12 15:05 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-06 10:49 - 2014-02-12 15:05 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-02-06 10:47 - 2014-02-12 15:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-02-06 10:46 - 2014-02-12 15:05 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-02-06 10:25 - 2014-02-12 15:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-06 10:25 - 2014-02-12 15:04 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-06 10:24 - 2014-02-12 15:05 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-06 10:22 - 2014-02-12 15:05 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-06 10:13 - 2014-02-12 15:05 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-06 10:09 - 2014-02-12 15:05 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-02-06 10:03 - 2014-02-12 15:05 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-06 09:55 - 2014-02-12 15:05 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-06 09:41 - 2014-02-12 15:05 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-06 09:40 - 2014-02-12 15:05 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-06 09:36 - 2014-02-12 15:05 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-06 09:34 - 2014-02-12 15:05 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll Some content of TEMP: ==================== C:\Users\Hannelore\AppData\Local\Temp\avgnt.exe C:\Users\Hannelore\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-01 17:59 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-03-2014
Ran by Hannelore at 2014-03-06 12:19:30
Running from C:\Users\Hannelore\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
64 Bit HP CIO Components Installer (Version: 1.2.0 - Hewlett-Packard) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.1.102.64 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.03) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.03 - Adobe Systems Incorporated)
AI Manager (HKLM-x32\...\{4AF95DE2-B54D-4C3F-9494-FD3B558E2C2D}) (Version: 1.08.10 - ASUSTeK)
Alamandi (HKLM-x32\...\Alamandi) (Version: 0.0.0.0 - INTENIUM GmbH)
Allway Sync version 12.16.1 (HKLM-x32\...\Allway Sync_is1) (Version: - Botkind Inc)
AMD Fuel (Version: 2011.0126.1749.31909 - Ihr Firmenname) Hidden
AMD USB Filter Driver (x32 Version: 1.0.15.94 - Advanced Micro Devices, Inc.) Hidden
ASUS Backup Wizard (HKLM-x32\...\{124C9BD0-8C52-40AB-8238-0605703B1C28}) (Version: 1.00.10 - ASUSTeK Computer Inc.)
ASUSUpdate (HKLM-x32\...\{587178E7-B1DF-494E-9838-FA4DD36E873C}) (Version: 7.18.03 - ASUSTeK Computer Inc.)
AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.3.585 - ASUSTEK)
ATI AVIVO64 Codecs (Version: 11.6.0.10126 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{942F6B96-0130-3EF3-DE43-77EE2D40C680}) (Version: 3.0.812.0 - ATI Technologies, Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.338 - Avira)
Big Fish Games: Game Manager (HKLM-x32\...\BFGC) (Version: 2.0.0.8 - )
Brickshooter Egypt (HKLM-x32\...\{9AA179F5-EAE2-4997-B03E-989068643DBF}) (Version: 1.00.0000 - Purplehills)
Build It Green (HKLM-x32\...\Build It Green) (Version: - )
Butterfly Magic (HKLM-x32\...\Butterfly Magic) (Version: - )
Campgrounds (HKLM-x32\...\BFG-Campgrounds) (Version: - )
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: - )
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
Canon MG5100 series Benutzerregistrierung (HKLM-x32\...\Canon MG5100 series Benutzerregistrierung) (Version: - )
Canon MG5100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series) (Version: - )
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version: - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
Casual Games 1 (HKLM-x32\...\Casual Games) (Version: 1 - KlickMedia)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0126.1749.31909 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0126.1749.31909 - ATI) Hidden
Catalyst Control Center Profiles Desktop (x32 Version: 2011.0126.1749.31909 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Czech (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Danish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Dutch (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help English (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Finnish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help French (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help German (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Greek (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Italian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Japanese (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Korean (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Polish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Russian (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Spanish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Swedish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Thai (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
CCC Help Turkish (x32 Version: 2011.0126.1748.31909 - ATI) Hidden
ccc-core-static (x32 Version: 2011.0126.1749.31909 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2011.0126.1749.31909 - ATI) Hidden
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Crazy Machines Elements (HKLM-x32\...\Crazy Machines Elements_is1) (Version: - dtp)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Das gelobte Land (HKLM-x32\...\Das gelobte Land) (Version: - )
Das Rettungsteam 2 (HKLM-x32\...\{5F78E1F9-0EE1-4A71-8E66-03F23B271D92}) (Version: 1.00.0000 - PurpleHills)
Das Rettungsteam 3 (HKLM-x32\...\Das Rettungsteam 3) (Version: - )
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{81FB7C60-565A-4869-9D90-3BE1D270E8B7}) (Version: - Microsoft)
DEUTSCHLAND SPIELT GAME CENTER (HKLM-x32\...\DSGPlayer) (Version: 1.0.0.45 - INTENIUM GmbH)
Diamantenzauber (HKLM-x32\...\Diamantenzauber) (Version: - )
Die ersten 10 Jahre (HKLM-x32\...\{1C12B0B2-91FB-439A-A64D-1A239F0B7FAB}) (Version: 1.00.0000 - )
Die Legende von Pocahontas (HKLM-x32\...\{00B52299-F42A-40C3-8232-F987B86E3FD6}_is1) (Version: - cerasus.media GmbH)
Die Sage von Kolossus (HKLM-x32\...\Die Sage von Kolossus) (Version: - Alawar Entertainment Inc.)
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.50.56 - Electronic Arts)
DMUninstaller (HKLM-x32\...\DMUninstaller) (Version: - ) <==== ATTENTION
Dragon Portals (HKLM-x32\...\Dragon Portals) (Version: 1.00 - phenomedia publishing gmbh)
EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.01.02 - )
Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.1.1 - SCS Software)
Farm Frenzy - Helden der Vikinger (HKLM-x32\...\Farm Frenzy - Helden der Vikinger) (Version: - )
Farm Frenzy 3 - Madagaskar (HKLM-x32\...\Farm Frenzy 3 - Madagaskar) (Version: - )
Farm Frenzy 3 (HKLM-x32\...\Farm Frenzy 3) (Version: - )
Farm Frenzy: Frische Fische (HKLM-x32\...\Farm Frenzy: Frische Fische) (Version: - Alawar Entertainment Inc.)
Farm Girl (HKLM-x32\...\Farm Girl) (Version: - )
FarmFrenzy (HKLM-x32\...\FarmFrenzy) (Version: - )
FarmFrenzy Pizza Party (HKLM-x32\...\FarmFrenzy Pizza Party) (Version: - )
Farmscapes (HKLM-x32\...\Farmscapes_is1) (Version: - Playrix Entertainment)
Fishdom 2 Deluxe (HKLM-x32\...\Fishdom 2 Deluxe_is1) (Version: - Playrix Entertainment)
Fishdom 3 (HKLM-x32\...\Fishdom 3_is1) (Version: - Playrix Entertainment)
Fisher's Family Farm (HKLM-x32\...\BFG-Fisher's Family Farm) (Version: - )
Fruit Lockers 2 (HKLM-x32\...\Fruit Lockers 2) (Version: - )
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Gardenscapes (HKLM-x32\...\Gardenscapes_is1) (Version: - Playrix Entertainment)
Goldene Jahre: Der weite Westen (HKLM-x32\...\Goldene Jahre: Der weite Westen) (Version: 1.0.0.0 - INTENIUM GmbH)
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.05) (Version: 9.05 - Artifex Software Inc.)
Heroes of Hellas 2 - Olympia (HKLM-x32\...\{DE33AEF1-3CFF-475D-83D9-C86CE4C9C19F}) (Version: 1.00.0000 - PurpleHills)
Hugo Retro Mania (HKLM-x32\...\{31902FF5-6B59-4768-BB7A-7F38B149A04F}) (Version: 1.0.0 - Krea Medie)
Hund und Co. (HKLM-x32\...\Hund und Co.) (Version: 1.0.0.0 - INTENIUM GmbH)
HydraVision (x32 Version: 4.2.184.0 - ATI Technologies Inc.) Hidden
Ice-Land (HKLM-x32\...\Ice-Land) (Version: - )
Jewel Quest: Heritage (nur deinstallation) (HKLM-x32\...\Jewel Quest: Heritage) (Version: - )
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kitten Sanctuary (HKLM-x32\...\Kitten Sanctuary) (Version: 1.00 - phenomedia publishing gmbh)
Lightspark 0.5.3-git (HKLM-x32\...\Lightspark) (Version: 0.5.3-git - Lightspark Team)
Lost City of Gold (HKLM-x32\...\Lost City of Gold) (Version: - )
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Media Viewer (HKLM-x32\...\MediaViewerV1alpha1292) (Version: 1.1 - Media Viewer)
Mein eigener Bauernhof (HKLM-x32\...\Mein eigener Bauernhof_is1) (Version: - Realore Studios)
Mein eigenes Tierheim (HKCU\...\Mein eigenes Tierheim) (Version: V1.000000 - )
Mein Landleben (HKLM-x32\...\Mein Landleben) (Version: - )
Mein Landleben 2 (HKLM-x32\...\Mein Landleben 2) (Version: - )
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft Zoo Tycoon (HKLM-x32\...\Zoo Tycoon 1.0) (Version: - )
Minigolf Pro (HKLM-x32\...\Minigolf Pro) (Version: - )
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
MultiScreen (HKLM-x32\...\{E36E864B-BFB6-440A-9A23-2B0BEDE59A92}) (Version: 1.00.0000 - Samsung Electronics Ltd.)
Mysterious City: Vegas (nur deinstallation) (HKLM-x32\...\Mysterious City: Vegas) (Version: - )
NeoBall (HKLM-x32\...\NeoBall) (Version: - )
Nero 7 Premium (HKLM-x32\...\{1CDFA6DE-FD15-4821-AB48-2832D6FA1031}) (Version: 7.02.5043 - Nero AG)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
p.i.c.s. Rätsel-Generator (HKLM-x32\...\p.i.c.s. Rätsel-Generator) (Version: - )
Pioneer Lands (HKLM-x32\...\Pioneer Lands) (Version: 1.0.0.0 - INTENIUM GmbH)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
PressAKey (www.blaeul.de) (HKLM-x32\...\PressAKey) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.31.1025.2010 - Realtek)
Retter in der Not (HKLM-x32\...\Retter in der Not) (Version: - )
Samsung_MonSetup (HKLM-x32\...\{8EA79DBF-D637-448A-89D6-410A087A4493}) (Version: 1.00.0000 - Samsung)
secrets of tahiti (HKLM-x32\...\secrets of tahiti) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Snowy - Fish Frenzy (HKLM-x32\...\Snowy - Fish Frenzy) (Version: - )
Sunshine Acres (HKLM-x32\...\Sunshine Acres) (Version: - )
TeamViewer 6 (HKLM-x32\...\TeamViewer 6) (Version: 6.0.13992 - TeamViewer GmbH)
Tetris (HKLM-x32\...\{95E0E6DC-C308-4C96-BEDB-68C75A32FAF8}_is1) (Version: 1.64 - Crystal Office Systems)
The Treasures Of Montezuma 3 (HKLM-x32\...\The Treasures Of Montezuma 3) (Version: - Alawar Entertainment Inc.)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{001E8BF3-EDC3-4D5E-9C11-1D0E599B6497}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837583) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{E21274CE-CA0C-49FA-93F4-DC292A052264}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{B5C70C99-B109-42FD-B219-FF12CA543F19}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{E78E2B68-8FD1-42EE-BB74-99A4D9E6222D}) (Version: - Microsoft)
Updater (HKLM-x32\...\{D54E3D9F-FEB8-4D2D-A138-B69A5C80080B}) (Version: 2.6.53 - Creative Island Media, LLC) <==== ATTENTION
VIA Platform Device Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
Video Player (HKLM-x32\...\Video Player) (Version: 1.1 - Video Player) <==== ATTENTION
VirtualFarm (HKLM-x32\...\VirtualFarm) (Version: - )
VLC media player 1.1.5 (HKLM-x32\...\VLC media player) (Version: 1.1.5 - VideoLAN)
Weltraum Tycoon (HKLM-x32\...\{91E5B1AB-B818-42A8-A3A3-A6B4F6D62A55}) (Version: 1.00.0000 - IncaGold)
Wildlife Park 2 (HKLM-x32\...\{151FFC5F-ADE2-4CC3-AB0B-D9F8EB3FBF7A}) (Version: 1.25 - Deep Silver)
Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
World of Zoo (HKLM-x32\...\World of Zoo) (Version: 1.0 - THQ Inc.)
World of Zoo (x32 Version: 1.0 - Blue Fang Games) Hidden
XnView 1.98.2 (HKLM-x32\...\XnView_is1) (Version: 1.98.2 - Gougelet Pierre-e)
Youda Survivor 2 (HKLM-x32\...\Youda Survivor 2) (Version: - )
Zoo Safari (HKLM-x32\...\Zoo Safari_is1) (Version: - rondomedia Marketing & Vertriebs GmbH)
==================== Restore Points =========================
25-02-2014 12:40:07 Windows Update
26-02-2014 13:15:23 Windows Update
02-03-2014 21:02:03 Windows-Sicherung
==================== Hosts content: ==========================
2009-07-14 03:34 - 2014-02-20 17:30 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {30EC7B48-AC3D-48B5-B358-6DC6F61ED044} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-29] (ASUSTeK Computer Inc.)
Task: {5708778C-52CE-4C37-BEB2-94ECD98A43E7} - System32\Tasks\ASUS\AsBackupWizard_Run => C:\Program Files (x86)\ASUS\\AsBackupWizard\\AsRunBkWizardHelper.exe [2010-04-24] (ASUSTeK Computer Inc.)
Task: {711B9B3B-9B9D-45C7-BFFC-1C92DA0BD24B} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2009-11-18] (ASUSTeK Computer Inc.)
Task: {C1F8DED2-34B2-484A-9B07-25E1A4803CE2} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.02\AsLoader.exe [2009-12-28] (ASUSTeK Computer Inc.)
Task: {D51A0DB4-0538-426A-90B2-E9406A6D84C0} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
==================== Loaded Modules (whitelisted) =============
2011-10-18 19:30 - 2010-04-05 20:55 - 00116104 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2011-01-26 18:00 - 2011-01-26 18:00 - 00079872 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Services.dll
2011-10-18 17:19 - 2009-08-11 12:57 - 00303104 _____ () C:\Program Files (x86)\MultiScreen\MultiScreen.exe
2011-05-27 05:16 - 2010-10-22 04:14 - 00078448 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2011-05-27 05:16 - 2010-10-22 04:14 - 00386160 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2011-05-27 05:16 - 2010-10-22 04:14 - 00105584 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll
2011-05-27 05:16 - 2010-10-22 04:14 - 64643696 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll
2011-01-26 18:01 - 2011-01-26 18:01 - 00102912 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-01-26 17:48 - 2011-01-26 17:48 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-02-15 09:56 - 2011-02-15 09:56 - 00430080 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-02-15 09:35 - 2011-02-15 09:35 - 00032768 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResources.dll
2014-02-20 17:34 - 2014-02-14 11:00 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-10-18 17:19 - 2009-08-11 12:54 - 00094208 _____ () C:\Program Files (x86)\MultiScreen\TitleBar.dll
2011-05-27 05:17 - 2009-01-15 23:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
2011-05-27 05:17 - 2009-03-26 01:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
2011-10-18 17:19 - 2009-08-11 12:54 - 00053248 _____ () C:\Program Files (x86)\MultiScreen\SmartMouseDll.dll
2011-10-18 17:19 - 2009-08-11 12:56 - 00057344 _____ () C:\Program Files (x86)\MultiScreen\MGResGer.dll
2013-12-25 11:48 - 2013-12-25 11:48 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:7D288858
AlternateDataStreams: C:\ProgramData\TEMP:DD95E6D9
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/06/2014 00:14:43 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/05/2014 08:07:23 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/04/2014 01:02:46 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FishersFamilyFarm.exe, Version: 0.0.0.0, Zeitstempel: 0x4d665ad6
Name des fehlerhaften Moduls: FishersFamilyFarm.exe, Version: 0.0.0.0, Zeitstempel: 0x4d665ad6
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0018fff9
ID des fehlerhaften Prozesses: 0x12f8
Startzeit der fehlerhaften Anwendung: 0xFishersFamilyFarm.exe0
Pfad der fehlerhaften Anwendung: FishersFamilyFarm.exe1
Pfad des fehlerhaften Moduls: FishersFamilyFarm.exe2
Berichtskennung: FishersFamilyFarm.exe3
Error: (03/04/2014 09:59:37 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/03/2014 08:57:13 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: game.exe, Version: 0.0.0.0, Zeitstempel: 0x48e9ec7d
Name des fehlerhaften Moduls: d3d8.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bd9a7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0004a179
ID des fehlerhaften Prozesses: 0x1350
Startzeit der fehlerhaften Anwendung: 0xgame.exe0
Pfad der fehlerhaften Anwendung: game.exe1
Pfad des fehlerhaften Moduls: game.exe2
Berichtskennung: game.exe3
Error: (03/03/2014 07:29:19 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/03/2014 00:38:09 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/02/2014 10:40:03 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: game.exe, Version: 0.0.0.0, Zeitstempel: 0x48e9ec7d
Name des fehlerhaften Moduls: game.exe, Version: 0.0.0.0, Zeitstempel: 0x48e9ec7d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000a99f3
ID des fehlerhaften Prozesses: 0x5ab0
Startzeit der fehlerhaften Anwendung: 0xgame.exe0
Pfad der fehlerhaften Anwendung: game.exe1
Pfad des fehlerhaften Moduls: game.exe2
Berichtskennung: game.exe3
Error: (03/02/2014 01:28:20 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/01/2014 02:14:36 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (03/03/2014 07:27:54 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (03/03/2014 07:27:51 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (03/02/2014 01:26:52 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (02/24/2014 08:19:39 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (02/24/2014 02:44:10 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Microsoft Office Sessions:
=========================
Error: (03/06/2014 00:14:43 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/05/2014 08:07:23 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/04/2014 01:02:46 PM) (Source: Application Error)(User: )
Description: FishersFamilyFarm.exe0.0.0.04d665ad6FishersFamilyFarm.exe0.0.0.04d665ad6c00000050018fff912f801cf37a19fefe099C:\Program Files (x86)\Fisher's Family Farm\FishersFamilyFarm.exeC:\Program Files (x86)\Fisher's Family Farm\FishersFamilyFarm.exee5ae2e71-a394-11e3-b328-14dae996d9a0
Error: (03/04/2014 09:59:37 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/03/2014 08:57:13 PM) (Source: Application Error)(User: )
Description: game.exe0.0.0.048e9ec7dd3d8.dll6.1.7600.163854a5bd9a7c00000050004a179135001cf370e9e99527eC:\Program Files (x86)\Purplehills\Diamantenzauber\game.exeC:\Windows\system32\d3d8.dll02ebfda0-a30e-11e3-b7d7-14dae996d9a0
Error: (03/03/2014 07:29:19 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/03/2014 00:38:09 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/02/2014 10:40:03 PM) (Source: Application Error)(User: )
Description: game.exe0.0.0.048e9ec7dgame.exe0.0.0.048e9ec7dc0000005000a99f35ab001cf365a9db70774C:\Program Files (x86)\Purplehills\Diamantenzauber\game.exeC:\Program Files (x86)\Purplehills\Diamantenzauber\game.exe364b8f71-a253-11e3-8e3b-14dae996d9a0
Error: (03/02/2014 01:28:20 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/01/2014 02:14:36 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2014-02-20 17:26:58.884
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-20 17:26:58.752
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 33%
Total physical RAM: 6143.18 MB
Available physical RAM: 4105.02 MB
Total Pagefile: 12284.53 MB
Available Pagefile: 9914.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (WIN7) (Fixed) (Total:372.6 GB) (Free:241.07 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (DATA) (Fixed) (Total:544.72 GB) (Free:532.44 GB) NTFS
Drive g: (Externe Festplatte_Dasi) (Fixed) (Total:465.76 GB) (Free:19.9 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: CB5BD2B2)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 0D29753D)
Partition: GPT Partition Type.
==================== End Of Log ============================
|
|
07.03.2014, 13:16
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.03.2014, 19:49
| #11 |
| | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Hier die Datei: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-03-2014
Ran by Hannelore at 2014-03-10 19:45:37 Run:1
Running from C:\Users\Hannelore\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
*****************
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
The system needed a reboot.
==== End of Fixlog ====
|
|
11.03.2014, 13:15
| #12 |
| /// the machine /// TB-Ausbilder | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.04.2014, 12:28
| #13 |
| | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Hallo, war ein bisschen länger nicht hier. Zwischenzeitlich gabs keine unerwünschten Aktionen mehr. Also hat wohl alles geklappt. Ich hab jetzt alles gelöscht und hier den DelFix: Code:
ATTFilter # DelFix v10.6 - Datei am 10/04/2014 um 13:32:19 erstellt
# Aktualisiert am 11/11/2013 von Xplode
# Benutzer : Hannelore - HANNELORE-PC
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
~ Aktiviere die Benutzerkontensteuerung ... OK
~ Entferne die Bereinigungsprogramme ...
Gelöscht : C:\Qoobox
Gelöscht : C:\FRST
Gelöscht : C:\AdwCleaner
Gelöscht : C:\ComboFix.txt
Gelöscht : C:\Users\Hannelore\Desktop\Fixlog.txt
Gelöscht : C:\Users\Hannelore\Desktop\FRST64.exe
Gelöscht : C:\Windows\grep.exe
Gelöscht : C:\Windows\PEV.exe
Gelöscht : C:\Windows\NIRCMD.exe
Gelöscht : C:\Windows\MBR.exe
Gelöscht : C:\Windows\SED.exe
Gelöscht : C:\Windows\SWREG.exe
Gelöscht : C:\Windows\SWSC.exe
Gelöscht : C:\Windows\SWXCACLS.exe
Gelöscht : C:\Windows\Zip.exe
Gelöscht : HKLM\SOFTWARE\AdwCleaner
Gelöscht : HKLM\SOFTWARE\Swearware
Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe
~ Erstelle ein Backup der Registrierungsdatenbank ... OK
~ Lösche die Wiederherstellungspunkte ...
Gelöscht : RP #326 [Windows-Sicherung | 03/02/2014 21:02:03]
Gelöscht : RP #327 [Windows-Sicherung | 03/09/2014 18:00:17]
Gelöscht : RP #328 [Windows Update | 03/13/2014 22:31:41]
Gelöscht : RP #329 [Windows-Sicherung | 03/16/2014 18:26:37]
Gelöscht : RP #330 [Windows Update | 03/19/2014 02:00:27]
Gelöscht : RP #331 [Windows-Sicherung | 03/23/2014 18:46:50]
Gelöscht : RP #332 [Windows-Sicherung | 03/30/2014 17:44:23]
Gelöscht : RP #333 [Windows-Sicherung | 04/06/2014 17:29:07]
Gelöscht : RP #334 [Windows Update | 04/09/2014 21:22:44]
Ein neuer Wiederherstellungspunkt wurde erstellt !
~ Stelle die Systemeinstellungen wieder her ... OK
########## - EOF - ##########
Anscha Geändert von AnschaPC (10.04.2014 um 12:37 Uhr) Grund: Hab den Thread nicht zuende gelesen... |
|
11.04.2014, 06:39
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7: Popups, unerwünschte Seiten, unerwünschte Weiterleitungen bei Internetnutzung Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
WARNUNG an die MITLESER: 
Linear-Darstellung
