Via vorgetäuschten java-update Malware webssearches.com eingefangen

Gulliver · 28.03.2014, 10:27

Hallo allerseits!

Ich habe mir durch ein wohl vorgetäuschtes java-update die Malware webssearches.com eingefangen. Obwohl ich einiges deaktivieren konnte, versucht sich jetzt diese Malware immer noch bei allen Suchen vorzuschalten.

Bitte herzlichst, wie werde ich webssearches.com wieder los?

Herzliche Grüße!

Christoph E.

schrauber · 28.03.2014, 10:58

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Gulliver · 28.03.2014, 19:02

Hi schrauber, danke schon mal für deine Antwort. Jetzt hab ich dir die gescannte frst-Datei doch hier unten reinkopieren können:
FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Christoph Engen (administrator) on VAIO on 28-03-2014 12:11:11
Running from C:\Users\Christoph Engen\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Parallel Lines Development, LLC) C:\ProgramData\InternetUpdater\InternetUpdaterService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(McAfee, Inc.) C:\Windows\system32\mfevtps.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\wwahost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
() C:\Users\Christoph Engen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Updater) C:\ProgramData\Updater\updater.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(WatchDog) C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe
(WatchDog) C:\ProgramData\RHelpers\FireFoxHelper\FireFoxHelper.exe
(WatchDog) C:\ProgramData\RHelpers\IEHelper\IeHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(McAfee, Inc.) C:\Program Files\mcafee.com\agent\mcagent.exe
(McAfee, Inc.) C:\Program Files\mcafee\virusscan\McVsShld.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Conduit) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
(Conduit) C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe
(Conduit) C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe
(Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe
() C:\Program Files\Sony\VAIO Care\listener.exe
() C:\Users\Christoph Engen\Downloads\FRST64(1).exe
() C:\Users\Christoph Engen\Desktop\FRST64.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] - C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [764032 2012-08-13] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-08-13] (Atheros Communications)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-21] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [68776 2012-08-17] (Sony Corporation)
HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [152896 2012-06-25] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1648264 2013-04-25] (Ask)
HKLM-x32\...\Run: [LifeCam] - "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
HKLM-x32\...\Run: [LWS] - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-12] (Logitech Inc.)
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [740888 2013-04-24] (Sony Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [185896 2013-10-28] (Geek Software GmbH)
HKLM-x32\...\Run: [Updater] - C:\ProgramData\Updater\Updater.exe [486264 2013-12-18] (Updater)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2337137634-1657450788-3013061541-1001\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4272640 2012-09-12] (Microsoft Corporation)
HKU\S-1-5-21-2337137634-1657450788-3013061541-1001\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\Christoph Engen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-2337137634-1657450788-3013061541-1001\...\Run: [Updater] - C:\ProgramData\Updater\updater.exe [486264 2013-12-18] (Updater)
HKU\S-1-5-21-2337137634-1657450788-3013061541-1001\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-2337137634-1657450788-3013061541-1001\...\Policies\Explorer: [HideSCAHealth] 0
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [1355040 2014-03-22] (Conduit)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [1050400 2014-03-22] (Conduit)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Suche
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Webs Searches
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = CountrySelector - Sony
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Webs Searches
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Webs Searches
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = Webs Searches
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = Webs Searches
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe Webs Searches
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPCDA220CD-164B-494B-82A8-8F72248E479E&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPCDA220CD-164B-494B-82A8-8F72248E479E&q={searchTerms}&SSPV=
SearchScopes: HKCU - {1D77A73B-8592-47F4-A8DA-FA22A802C077} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=2C27BEE0-67A9-4B9F-B1CF-2D979FE5AEC3&apn_sauid=9EA67FD2-8776-4B55-A44A-5A110A667262
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
SearchScopes: HKCU - {A607C9C8-0182-4E87-A5ED-E43FBBF89C3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASEJS
SearchScopes: HKCU - {A72F2F0D-E7D6-4D9B-8119-845C25791800} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q312&_nkw={searchTerms}
BHO: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default
FF user.js: detected! => C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\user.js
FF NewTab: chrome://quick_start/content/index.html
FF SearchEngineOrder.1: Ask.com
FF Homepage: Google
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Christoph Engen\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\webssearches.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: MediaPlayerplus - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com [2014-03-26]
FF Extension: HQ-Vid-1.9b - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com [2014-03-26]
FF Extension: Quick Start - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\quick_start@gmail.com [2014-03-27]
FF Extension: Better Experience - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\support@betterxperience.com [2014-02-21]
FF Extension: Ask Toolbar - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\toolbar@ask.com [2013-03-06]
FF Extension: WOT - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: MyVideo  - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\{d1e96ee9-8227-4791-adb9-c3d4bb586a8b} [2013-12-13]
FF Extension: All-in-One Sidebar - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\{097d3191-e6fa-4728-9826-b533d755359d}.xpi [2013-02-21]
FF Extension: Easy YouTube Video Downloader - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi [2013-03-14]
FF HKLM-x32\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com
FF Extension: Quick Start - C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com [2014-03-27]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2012-09-18]
FF HKCU\...\Firefox\Extensions: [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] - C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
FF Extension: Wajam - C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi [2013-02-14]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe Webs Searches

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR Extension: (Google Docs) - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-21]
CHR Extension: (Google Drive) - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-21]
CHR Extension: (YouTube) - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-21]
CHR Extension: (Google-Suche) - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-21]
CHR Extension: (HQ-Vid-1.9b) - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm [2014-03-26]
CHR Extension: (Better Experience) - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb [2014-02-21]
CHR Extension: (MediaPlayerplus) - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd [2014-03-26]
CHR Extension: (Google Wallet) - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-21]
CHR Extension: (Google Mail) - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-21]
CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-03-26]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Webs Searches
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-13] (Qualcomm Atheros Commnucations)
R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2466080 2014-03-22] (Conduit)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 InternetUpdater; C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [45568 2014-01-15] (Parallel Lines Development, LLC)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 McAWFwk; C:\Program Files\mcafee\msc\McAWFwk.exe [332080 2012-01-26] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-08-08] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-08-08] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [623784 2012-08-18] (Sony Corporation)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-04-24] (Sony Corporation)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [972000 2012-08-08] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1368624 2013-08-01] (Sony Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-13] (Atheros)
S4 McOobeSv2; "C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]

==================== Drivers (Whitelisted) ====================

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-08-20] (Advanced Micro Devices)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-13] (Qualcomm Atheros)
R3 BTATH_VDP; C:\Windows\system32\drivers\btath_vdp.sys [427416 2012-08-13] (Qualcomm Atheros)
R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [117632 2013-06-01] (Microsoft Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-09-25] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-09-25] (Windows (R) Win 7 DDK provider)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-08-08] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-08-08] (McAfee, Inc.)
U3 mfeavfk01; No ImagePath
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69168 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519064 2013-08-08] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [776168 2013-08-08] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-08-08] (McAfee, Inc.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-21] (Synaptics Incorporated)
R3 SOWS; C:\Windows\System32\drivers\sows.sys [24280 2012-06-11] (Sony Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-28 12:11 - 2014-03-28 12:11 - 00030277 _____ () C:\Users\Christoph Engen\Desktop\FRST.txt
2014-03-28 12:01 - 2014-03-28 12:01 - 02157056 _____ (Farbar) C:\Users\Christoph Engen\Desktop\FRST64(1).exe
2014-03-28 09:47 - 2014-03-28 09:47 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-03-28 09:47 - 2014-03-28 09:47 - 00001153 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-03-28 09:47 - 2014-03-28 09:47 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Nico Mak Computing
2014-03-28 09:47 - 2014-03-28 09:47 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-03-28 09:47 - 2014-03-28 09:47 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-03-28 09:47 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\system32\wsusnative64.exe
2014-03-28 09:46 - 2014-03-28 09:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmp_8.exe
2014-03-28 08:58 - 2014-03-28 08:59 - 00028236 _____ () C:\Users\Christoph Engen\Downloads\Addition.txt
2014-03-28 08:57 - 2014-03-28 12:04 - 00048696 _____ () C:\Users\Christoph Engen\Downloads\FRST.txt
2014-03-28 08:38 - 2014-03-28 12:02 - 00000000 ____D () C:\FRST
2014-03-28 08:37 - 2014-03-28 08:37 - 02157056 _____ (Farbar) C:\Users\Christoph Engen\Downloads\FRST64.exe
2014-03-28 08:30 - 2014-03-28 08:30 - 00000492 _____ () C:\Users\Christoph Engen\Downloads\defogger_disable.log
2014-03-28 08:30 - 2014-03-28 08:30 - 00000000 _____ () C:\Users\Christoph Engen\defogger_reenable
2014-03-28 08:25 - 2014-03-28 08:25 - 00050477 _____ () C:\Users\Christoph Engen\Downloads\Defogger.exe
2014-03-28 05:31 - 2014-03-28 05:31 - 00573860 _____ () C:\Users\Christoph Engen\Desktop\DSZ_f_rs_Internet.eml
2014-03-26 09:13 - 2014-03-26 09:13 - 00279696 _____ () C:\Windows\Minidump\032614-55000-01.dmp
2014-03-26 09:12 - 2014-03-26 09:12 - 00000000 __SHD () C:\found.001
2014-03-26 08:50 - 2014-03-26 08:50 - 00000000 ___RD () C:\Users\Christoph Engen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-26 06:45 - 2014-03-26 06:45 - 00001400 _____ () C:\Windows\Tasks\HQ-Vid-1.9b-codedownloader.job
2014-03-26 06:44 - 2014-03-26 06:45 - 00001170 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.scan.quick.results
2014-03-26 06:44 - 2014-03-26 06:45 - 00000314 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.uninstall.scan.results
2014-03-26 06:44 - 2014-03-26 06:44 - 00000000 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.scan.results
2014-03-26 06:43 - 2014-03-28 05:02 - 00003474 _____ () C:\Windows\Tasks\MediaPlayerplus-chromeinstaller.job
2014-03-26 06:43 - 2014-03-28 05:02 - 00002574 _____ () C:\Windows\Tasks\HQ-Vid-1.9b-firefoxinstaller.job
2014-03-26 06:43 - 2014-03-28 05:02 - 00002450 _____ () C:\Windows\Tasks\MediaPlayerplus-firefoxinstaller.job
2014-03-26 06:43 - 2014-03-26 06:44 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2014-03-26 06:43 - 2014-03-26 06:43 - 01172720 _____ (AnyProtect.com) C:\Users\Christoph Engen\AppData\Local\nst7B42.tmp
2014-03-26 06:43 - 2014-03-26 06:43 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerplus
2014-03-26 06:43 - 2014-03-26 06:43 - 00000000 ____D () C:\2352408143b84ec165656890
2014-03-26 06:42 - 2014-03-28 05:02 - 00003122 _____ () C:\Windows\Tasks\HQ-Vid-1.9b-chromeinstaller.job
2014-03-26 06:42 - 2014-03-26 08:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-26 06:42 - 2014-03-26 06:44 - 00000000 ____D () C:\Program Files (x86)\HQ-Vid-1.9b
2014-03-26 06:41 - 2014-03-26 06:41 - 00407328 _____ () C:\Users\Christoph Engen\Downloads\Java(2).exe
2014-03-23 06:45 - 2014-03-23 06:46 - 00632696 _____ () C:\Windows\Minidump\032314-34781-01.dmp
2014-03-12 06:15 - 2014-03-12 06:31 - 00000000 ____D () C:\Cakewalk Projects
2014-03-12 06:15 - 2014-03-12 06:15 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Cakewalk
2014-03-12 06:14 - 2006-11-30 14:49 - 00368640 _____ (Propellerhead Software AB) C:\Windows\SysWOW64\ReWire.dll
2014-03-12 06:14 - 2006-02-24 09:00 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2014-03-12 06:14 - 2006-02-24 09:00 - 01047552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71u.dll
2014-03-12 06:14 - 2006-02-24 09:00 - 00487424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp70.dll
2014-03-12 06:04 - 2014-03-12 06:09 - 00000000 ____D () C:\Cakewalk Content
2014-03-12 06:01 - 2014-03-12 06:14 - 00000000 ____D () C:\ProgramData\Cakewalk
2014-03-12 06:01 - 2014-03-12 06:14 - 00000000 ____D () C:\Program Files (x86)\Cakewalk
2014-03-11 03:46 - 2014-03-11 03:46 - 00379032 _____ () C:\Users\Christoph Engen\Downloads\Setup_V2(1).exe
2014-03-10 13:05 - 2014-03-10 13:05 - 00318104 _____ () C:\Users\Christoph Engen\Downloads\Setup_V2.exe
2014-03-09 17:07 - 2014-03-09 17:09 - 00635504 _____ () C:\Windows\Minidump\030914-40359-01.dmp
2014-03-08 14:51 - 2014-03-08 14:51 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Sony
2014-03-08 10:11 - 2014-03-08 14:42 - 27858496 _____ (Sony Mobile Communications ) C:\Users\Christoph Engen\Downloads\Sony PC Companion_Web.exe
2014-03-08 07:27 - 2014-03-08 07:27 - 00667264 _____ ( ) C:\Users\Christoph Engen\Downloads\skype_setup(1).exe
2014-03-06 17:18 - 2014-03-06 17:18 - 00000000 ____D () C:\Windows\SysWOW64\SearchProtect
2014-03-06 17:17 - 2014-03-06 17:17 - 00000000 ____D () C:\Users\Christoph Engen\Documents\DVD Architect Studio 5.0 Projekte
2014-03-06 11:34 - 2014-03-06 11:34 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\WinRAR
2014-03-06 11:31 - 2014-03-06 11:31 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-03-02 16:42 - 2014-03-02 16:42 - 00541592 _____ (McAfee, Inc.) C:\Users\Christoph Engen\Downloads\MVTInstaller.exe
2014-03-02 06:44 - 2014-03-02 06:44 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-03-01 11:01 - 2014-03-01 11:01 - 00922385 _____ () C:\Users\Christoph Engen\Downloads\AW_Lesung_von_Dieter_in_M_nchen.eml
2014-02-27 16:15 - 2014-02-27 16:15 - 00000000 ____D () C:\Update

==================== One Month Modified Files and Folders =======

2014-03-28 12:11 - 2014-03-28 12:11 - 00030277 _____ () C:\Users\Christoph Engen\Desktop\FRST.txt
2014-03-28 12:11 - 2014-03-28 08:38 - 00000000 ____D () C:\FRST
2014-03-28 12:11 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru
2014-03-28 12:04 - 2014-03-28 08:57 - 00048696 _____ () C:\Users\Christoph Engen\Downloads\FRST.txt
2014-03-28 12:04 - 2013-03-13 07:28 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-28 12:01 - 2014-03-28 12:01 - 02157056 _____ (Farbar) C:\Users\Christoph Engen\Desktop\FRST64(1).exe
2014-03-28 11:56 - 2012-09-18 06:49 - 02171886 _____ () C:\Windows\WindowsUpdate.log
2014-03-28 09:47 - 2014-03-28 09:47 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-03-28 09:47 - 2014-03-28 09:47 - 00001153 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-03-28 09:47 - 2014-03-28 09:47 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Nico Mak Computing
2014-03-28 09:47 - 2014-03-28 09:47 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-03-28 09:47 - 2014-03-28 09:47 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-03-28 09:46 - 2014-03-28 09:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmp_8.exe
2014-03-28 08:59 - 2014-03-28 08:58 - 00028236 _____ () C:\Users\Christoph Engen\Downloads\Addition.txt
2014-03-28 08:38 - 2014-02-19 07:17 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-03-28 08:37 - 2014-03-28 08:37 - 02157056 _____ (Farbar) C:\Users\Christoph Engen\Downloads\FRST64.exe
2014-03-28 08:30 - 2014-03-28 08:30 - 00000492 _____ () C:\Users\Christoph Engen\Downloads\defogger_disable.log
2014-03-28 08:30 - 2014-03-28 08:30 - 00000000 _____ () C:\Users\Christoph Engen\defogger_reenable
2014-03-28 08:30 - 2012-12-08 17:17 - 00000000 ____D () C:\Users\Christoph Engen
2014-03-28 08:25 - 2014-03-28 08:25 - 00050477 _____ () C:\Users\Christoph Engen\Downloads\Defogger.exe
2014-03-28 05:31 - 2014-03-28 05:31 - 00573860 _____ () C:\Users\Christoph Engen\Desktop\DSZ_f_rs_Internet.eml
2014-03-28 05:03 - 2013-03-29 10:58 - 00000000 ____D () C:\Users\Christoph Engen\Tracing
2014-03-28 05:02 - 2014-03-26 06:43 - 00003474 _____ () C:\Windows\Tasks\MediaPlayerplus-chromeinstaller.job
2014-03-28 05:02 - 2014-03-26 06:43 - 00002574 _____ () C:\Windows\Tasks\HQ-Vid-1.9b-firefoxinstaller.job
2014-03-28 05:02 - 2014-03-26 06:43 - 00002450 _____ () C:\Windows\Tasks\MediaPlayerplus-firefoxinstaller.job
2014-03-28 05:02 - 2014-03-26 06:42 - 00003122 _____ () C:\Windows\Tasks\HQ-Vid-1.9b-chromeinstaller.job
2014-03-28 05:02 - 2013-03-13 07:28 - 00001134 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-27 10:19 - 2013-12-20 13:05 - 00000000 ____D () C:\Users\Christoph Engen\Documents\DIE SINGENDEN ZEHEN
2014-03-26 13:06 - 2014-01-30 13:57 - 00000000 ____D () C:\Users\Christoph Engen\Documents\CHRIS VITA
2014-03-26 09:54 - 2012-12-31 05:42 - 00940544 ___SH () C:\Users\Christoph Engen\Desktop\Thumbs.db
2014-03-26 09:15 - 2012-12-15 05:18 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Local\CrashDumps
2014-03-26 09:14 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-26 09:13 - 2014-03-26 09:13 - 00279696 _____ () C:\Windows\Minidump\032614-55000-01.dmp
2014-03-26 09:13 - 2012-12-16 00:57 - 528456719 _____ () C:\Windows\MEMORY.DMP
2014-03-26 09:13 - 2012-12-16 00:57 - 00000000 ____D () C:\Windows\Minidump
2014-03-26 09:13 - 2012-08-03 03:22 - 00049418 _____ () C:\Windows\PFRO.log
2014-03-26 09:12 - 2014-03-26 09:12 - 00000000 __SHD () C:\found.001
2014-03-26 08:50 - 2014-03-26 08:50 - 00000000 ___RD () C:\Users\Christoph Engen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-26 08:48 - 2013-04-14 09:12 - 00000000 ____D () C:\ProgramData\Sony
2014-03-26 08:48 - 2012-09-18 06:55 - 00000000 ____D () C:\Program Files (x86)\Sony
2014-03-26 08:47 - 2014-03-26 06:42 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-03-26 08:40 - 2014-02-19 07:17 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro
2014-03-26 06:52 - 2012-09-18 06:38 - 00379772 _____ () C:\Windows\DPINST.LOG
2014-03-26 06:52 - 2012-09-18 06:37 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-03-26 06:45 - 2014-03-26 06:45 - 00001400 _____ () C:\Windows\Tasks\HQ-Vid-1.9b-codedownloader.job
2014-03-26 06:45 - 2014-03-26 06:44 - 00001170 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.scan.quick.results
2014-03-26 06:45 - 2014-03-26 06:44 - 00000314 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.uninstall.scan.results
2014-03-26 06:44 - 2014-03-26 06:44 - 00000000 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.scan.results
2014-03-26 06:44 - 2014-03-26 06:43 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2014-03-26 06:44 - 2014-03-26 06:42 - 00000000 ____D () C:\Program Files (x86)\HQ-Vid-1.9b
2014-03-26 06:43 - 2014-03-26 06:43 - 01172720 _____ (AnyProtect.com) C:\Users\Christoph Engen\AppData\Local\nst7B42.tmp
2014-03-26 06:43 - 2014-03-26 06:43 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerplus
2014-03-26 06:43 - 2014-03-26 06:43 - 00000000 ____D () C:\2352408143b84ec165656890
2014-03-26 06:43 - 2013-10-21 04:19 - 00002399 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-26 06:43 - 2012-12-13 10:16 - 00001375 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-03-26 06:42 - 2012-07-26 09:12 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-03-26 06:42 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-03-26 06:41 - 2014-03-26 06:41 - 00407328 _____ () C:\Users\Christoph Engen\Downloads\Java(2).exe
2014-03-25 04:13 - 2013-09-21 11:50 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Briefe  und Emails
2014-03-23 06:47 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-03-23 06:46 - 2014-03-23 06:45 - 00632696 _____ () C:\Windows\Minidump\032314-34781-01.dmp
2014-03-20 07:09 - 2012-09-18 07:26 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-03-20 07:09 - 2012-09-18 07:26 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-03-20 07:09 - 2012-07-26 08:28 - 01212036 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-19 12:28 - 2013-04-14 09:10 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Sony
2014-03-16 09:20 - 2014-02-16 13:57 - 00000000 ____D () C:\Users\Christoph Engen\Documents\THE HEALING POWER OF A COURSE IN MIRACLES
2014-03-15 07:37 - 2013-06-11 08:57 - 00000000 ____D () C:\Users\Christoph Engen\Documents\FLYER
2014-03-14 09:23 - 2012-09-18 06:52 - 00000000 ____D () C:\ProgramData\McAfee
2014-03-14 07:00 - 2013-09-21 11:52 - 00000000 ____D () C:\Users\Christoph Engen\Documents\AUSSCHREIBUNGEN 2013
2014-03-14 06:19 - 2013-09-21 11:56 - 00000000 ____D () C:\Users\Christoph Engen\Documents\TEXTE
2014-03-12 14:05 - 2013-12-16 18:27 - 00358064 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-12 14:05 - 2012-09-18 06:53 - 00000000 ____D () C:\Program Files\Common Files\mcafee
2014-03-12 14:04 - 2012-07-26 06:26 - 01310720 ___SH () C:\Windows\system32\config\BBI
2014-03-12 09:33 - 2012-09-18 07:24 - 00000000 ____D () C:\Program Files\McAfeeEx
2014-03-12 06:31 - 2014-03-12 06:15 - 00000000 ____D () C:\Cakewalk Projects
2014-03-12 06:15 - 2014-03-12 06:15 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Cakewalk
2014-03-12 06:14 - 2014-03-12 06:01 - 00000000 ____D () C:\ProgramData\Cakewalk
2014-03-12 06:14 - 2014-03-12 06:01 - 00000000 ____D () C:\Program Files (x86)\Cakewalk
2014-03-12 06:11 - 2012-07-26 08:21 - 00033082 _____ () C:\Windows\setupact.log
2014-03-12 06:09 - 2014-03-12 06:04 - 00000000 ____D () C:\Cakewalk Content
2014-03-11 12:55 - 2014-02-25 11:33 - 00000000 ____D () C:\Users\Christoph Engen\Documents\AUDIO Die singenden Zehen
2014-03-11 03:46 - 2014-03-11 03:46 - 00379032 _____ () C:\Users\Christoph Engen\Downloads\Setup_V2(1).exe
2014-03-10 18:37 - 2013-08-14 17:53 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Angebote
2014-03-10 13:05 - 2014-03-10 13:05 - 00318104 _____ () C:\Users\Christoph Engen\Downloads\Setup_V2.exe
2014-03-09 17:09 - 2014-03-09 17:07 - 00635504 _____ () C:\Windows\Minidump\030914-40359-01.dmp
2014-03-08 14:51 - 2014-03-08 14:51 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Sony
2014-03-08 14:42 - 2014-03-08 10:11 - 27858496 _____ (Sony Mobile Communications ) C:\Users\Christoph Engen\Downloads\Sony PC Companion_Web.exe
2014-03-08 07:27 - 2014-03-08 07:27 - 00667264 _____ ( ) C:\Users\Christoph Engen\Downloads\skype_setup(1).exe
2014-03-06 17:41 - 2013-01-12 05:18 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\CyberLink
2014-03-06 17:18 - 2014-03-06 17:18 - 00000000 ____D () C:\Windows\SysWOW64\SearchProtect
2014-03-06 17:17 - 2014-03-06 17:17 - 00000000 ____D () C:\Users\Christoph Engen\Documents\DVD Architect Studio 5.0 Projekte
2014-03-06 11:34 - 2014-03-06 11:34 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\WinRAR
2014-03-06 11:31 - 2014-03-06 11:31 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-03-06 11:09 - 2013-07-12 12:20 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Miracles are no miracle!
2014-03-02 16:42 - 2014-03-02 16:42 - 00541592 _____ (McAfee, Inc.) C:\Users\Christoph Engen\Downloads\MVTInstaller.exe
2014-03-02 06:44 - 2014-03-02 06:44 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-03-02 06:44 - 2012-12-14 06:44 - 00001931 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2014-03-01 18:17 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-01 11:01 - 2014-03-01 11:01 - 00922385 _____ () C:\Users\Christoph Engen\Downloads\AW_Lesung_von_Dieter_in_M_nchen.eml
2014-02-27 16:21 - 2013-04-14 09:12 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Local\Sony
2014-02-27 16:16 - 2012-09-18 06:32 - 00000000 ____D () C:\ProgramData\Sony Corporation
2014-02-27 16:15 - 2014-02-27 16:15 - 00000000 ____D () C:\Update

Some content of TEMP:
====================
C:\Users\Christoph Engen\AppData\Local\Temp\APNStub.exe
C:\Users\Christoph Engen\AppData\Local\Temp\BackupSetup.exe
C:\Users\Christoph Engen\AppData\Local\Temp\ICReinstall_skype_setup.exe
C:\Users\Christoph Engen\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Christoph Engen\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Christoph Engen\AppData\Local\Temp\nsg9C30.exe
C:\Users\Christoph Engen\AppData\Local\Temp\nsp973D.exe
C:\Users\Christoph Engen\AppData\Local\Temp\nspE40B.exe
C:\Users\Christoph Engen\AppData\Local\Temp\nsqE6CB.exe
C:\Users\Christoph Engen\AppData\Local\Temp\nsrE93D.exe
C:\Users\Christoph Engen\AppData\Local\Temp\nsv9980.exe
C:\Users\Christoph Engen\AppData\Local\Temp\ose00000.exe
C:\Users\Christoph Engen\AppData\Local\Temp\setup.exe
C:\Users\Christoph Engen\AppData\Local\Temp\SPSetup.exe
C:\Users\Christoph Engen\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Christoph Engen\AppData\Local\Temp\wajam_install.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_is47EF.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_is5EF.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_is824C.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_is99ED.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_isC9D1.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_isDE12.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_isF203.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2012-08-03 03:22

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---
Liebe Grüße!
Gulli

Hallo nochmal schrauber,

und hier ist der Addition txt.:FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Christoph Engen at 2014-03-28 13:13:14
Running from C:\Users\Christoph Engen\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: McAfee  Anti-Virus und Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee  Anti-Virus und Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee  Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}

==================== Installed Programs ======================

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Amazon MP3-Downloader 1.0.18 (HKCU\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{AF091FA7-20BF-49D4-4C98-4E4AD04D6FB3}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Ask Toolbar Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.6.36191 - Ask.com) <==== ATTENTION
ccc-utility64 (Version: 2012.0806.1156.19437 - Advanced Micro Devices, Inc.) Hidden
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP Photosmart All-In-One Driver Software (HKLM\...\{4F6C1178-3FC0-44BB-8F9A-28D8516DFEE2}) (Version: 14.0 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Java(TM) 7 Update 5 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417005FF}) (Version: 7.0.50 - Oracle)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Corporation (Version: 11.0.50727.0 - Microsoft Corporation) Hidden
Microsoft LifeCam (HKLM\...\{8EC9E7BB-2443-49B1-8476-490EBF932C2E}) (Version: 4.25.512.0 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Studio Platinum 12.0 (64-bit) (HKLM\...\{BFB6D89E-0BDF-11E2-A35E-F04DA23A5C58}) (Version: 12.0.530 - Sony)
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Network64 (Version: 140.0.306.000 - Hewlett-Packard) Hidden
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.206 - Ihr Firmenname)
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.12.10.97 - Conduit) <==== ATTENTION
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
SSLx64 (Version: 1.0.0 - Sony Corporation ) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.5 - Synaptics Incorporated)
VAIO Care (HKLM\...\{E0F928B4-2BB2-4D7E-B16E-2B202CB58EDE}) (Version: 8.0.0.08150 - Sony Corporation)
VAIO Media Server Settings (HKLM\...\{62A172B2-550E-499D-9A82-5190D18390AA}) (Version: 1.0.0.08240 - Sony Corporation)
VCCx64 (Version: 1.0.0 - Sony Corporation) Hidden
VGClientX64 (Version: 1.0.0 - Sony Corporation) Hidden
VIx64 (Version: 1.0.0 - Sony Corporation) Hidden
VPMx64 (Version: 1.0.0 - Sony Corporation ) Hidden
VSSTx64 (Version: 1.0.0 - Sony Corporation ) Hidden
VU5x64 (Version: 1.0.0 - Sony Corporation ) Hidden
VUx64 (Version: 1.0.0 - Sony Corporation ) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
WinZip Malware Protector (HKLM-x32\...\WinZip Malware Protector_is1) (Version: 2.1.1000.10798 - WinZip International LLC)

==================== Restore Points  =========================

27-02-2014 15:16:11 Installiert VAIO Update
01-03-2014 19:39:43 Installiert VAIO Update
02-03-2014 20:37:30 Installiert VAIO Update
06-03-2014 16:11:07 Installiert VAIO Update
08-03-2014 09:13:18 Sony PC Companion
12-03-2014 05:11:17 Microsoft Visual C++ 2005 Redistributable wird installiert

==================== Hosts content: ==========================

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1F7C7066-19DA-4484-BDD8-3A23472A1252} - System32\Tasks\MediaPlayerplus-chromeinstaller => C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-chromeinstaller.exe [2014-03-26] (Freeven)
Task: {1FF526CB-9A3A-4FA8-9348-970466B98A4E} - System32\Tasks\HQ-Vid-1.9b-firefoxinstaller => C:\Program Files (x86)\HQ-Vid-1.9b\HQ-Vid-1.9b-firefoxinstaller.exe [2014-03-26] (HQ-forPC)
Task: {79A1403C-6FF3-4164-BBED-36DAE537D314} - System32\Tasks\MediaPlayerplus-firefoxinstaller => C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-firefoxinstaller.exe [2014-03-26] (Freeven)
Task: {7E002C00-38ED-4A6A-8799-394F4A4492D1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-13] (Google Inc.)
Task: {86CDB596-BF59-471C-ADA9-FBC6C47FC9DE} - System32\Tasks\HQ-Vid-1.9b-chromeinstaller => C:\Program Files (x86)\HQ-Vid-1.9b\HQ-Vid-1.9b-chromeinstaller.exe [2014-03-26] (HQ-forPC)
Task: {C2F20A4F-0BF3-44DF-874B-D91F0635CA8F} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Ultimate Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2013-08-01] (Sony Corporation)
Task: {CB084857-872B-40A3-940C-EED17824C6FB} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-07-15] (Nico Mak Computing)
Task: {CEBAE05F-7A7D-4F65-8F64-8403B3BB4B14} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-13] (Google Inc.)
Task: {D242B539-ABE7-4582-8AFC-8D3C59AFD118} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-04-25] () <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HQ-Vid-1.9b-chromeinstaller.job => C:\Program Files (x86)\HQ-Vid-1.9b\HQ-Vid-1.9b-chromeinstaller.exe
Task: C:\Windows\Tasks\HQ-Vid-1.9b-codedownloader.job => C:\Program Files (x86)\HQ-Vid-1.9b\HQ-Vid-1.9b-codedownloader.exe
Task: C:\Windows\Tasks\HQ-Vid-1.9b-firefoxinstaller.job => C:\Program Files (x86)\HQ-Vid-1.9b\HQ-Vid-1.9b-firefoxinstaller.exe
Task: C:\Windows\Tasks\MediaPlayerplus-chromeinstaller.job => C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-chromeinstaller.exe
Task: C:\Windows\Tasks\MediaPlayerplus-firefoxinstaller.job => C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-firefoxinstaller.exe

==================== Loaded Modules (whitelisted) =============

2012-08-06 09:28 - 2012-08-06 09:28 - 00156672 _____ () C:\Program Files\Sony\VAIO Care\VCPerfService.exe
2014-03-06 11:31 - 2009-12-12 15:12 - 00052224 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2012-08-13 16:25 - 2012-08-13 16:25 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-08-13 16:20 - 2012-08-13 16:20 - 00020992 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2013-05-22 19:50 - 2013-05-22 19:50 - 00400704 _____ () C:\Users\Christoph Engen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
2012-09-12 23:38 - 2012-09-12 23:38 - 00264040 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2012-08-06 10:54 - 2012-08-06 10:54 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-08-06 09:29 - 2012-08-06 09:29 - 00062464 _____ () C:\Program Files\Sony\VAIO Care\listener.exe
2012-09-18 06:45 - 2012-06-25 09:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00891392 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtNetwork4.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 02281984 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtCore4.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00015872 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\featureController.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\osEvents.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00322048 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\log4cplus.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00339456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtXml4.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00400384 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\sqlite3.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00195584 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\libgsoap.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00062464 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\zlib1.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00443904 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\deviceProfile.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00019456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\eventsSender.dll
2012-09-18 07:24 - 2012-06-25 14:47 - 00060928 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\serviceManagerStarter.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 02144104 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 07955304 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 00341352 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 00028008 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2012-09-12 23:38 - 2012-09-12 23:38 - 00127336 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-12 23:39 - 2012-09-12 23:39 - 00336232 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2014-02-15 06:09 - 2014-02-15 06:09 - 03578992 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-03-28 09:47 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files (x86)\WinZip Malware Protector\System.Data.SQLite.dll
2014-03-28 09:47 - 2013-07-15 16:53 - 01717936 _____ () C:\Program Files (x86)\WinZip Malware Protector\aspsys.dll
2014-03-28 09:47 - 2013-02-28 16:53 - 00168448 _____ () C:\Program Files (x86)\WinZip Malware Protector\UNRAR.DLL

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\Users\Christoph Engen\Desktop\DSZ_f_rs_Internet.eml:OECustomProperty
AlternateDataStreams: C:\Users\Christoph Engen\Downloads\AW_Lesung_von_Dieter_in_M_nchen.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/28/2014 01:13:50 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:13:50Z. Fehlercode: 0x80070002.

Error: (03/28/2014 01:13:20 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:13:20Z. Fehlercode: 0x80070002.

Error: (03/28/2014 01:12:50 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:12:50Z. Fehlercode: 0x80070002.

Error: (03/28/2014 01:12:20 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:12:20Z. Fehlercode: 0x80070002.

Error: (03/28/2014 01:11:50 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:11:50Z. Fehlercode: 0x80070002.

Error: (03/28/2014 01:11:20 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:11:20Z. Fehlercode: 0x80070002.

Error: (03/28/2014 01:10:50 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:10:50Z. Fehlercode: 0x80070002.

Error: (03/28/2014 01:10:20 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:10:20Z. Fehlercode: 0x80070002.

Error: (03/28/2014 01:09:50 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:09:50Z. Fehlercode: 0x80070002.

Error: (03/28/2014 01:09:20 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2114-03-04T12:09:20Z. Fehlercode: 0x80070002.


System errors:
=============
Error: (03/28/2014 01:07:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee Personal Firewall Service" ist vom Dienst "Windows-Firewall" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (03/28/2014 01:07:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee Personal Firewall Service" ist vom Dienst "Windows-Firewall" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (03/28/2014 11:56:48 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee Personal Firewall Service" ist vom Dienst "Windows-Firewall" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (03/28/2014 11:56:48 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee Personal Firewall Service" ist vom Dienst "Windows-Firewall" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (03/28/2014 10:03:44 AM) (Source: DCOM) (User: VAIO)
Description: {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A}

Error: (03/28/2014 10:03:14 AM) (Source: DCOM) (User: VAIO)
Description: {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A}

Error: (03/28/2014 09:55:29 AM) (Source: DCOM) (User: VAIO)
Description: {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A}

Error: (03/28/2014 08:59:08 AM) (Source: DCOM) (User: VAIO)
Description: {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A}

Error: (03/28/2014 07:27:07 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee Personal Firewall Service" ist vom Dienst "Windows-Firewall" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (03/28/2014 07:27:07 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee Personal Firewall Service" ist vom Dienst "Windows-Firewall" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058


Microsoft Office Sessions:
=========================
Error: (03/28/2014 01:13:50 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:13:50Z

Error: (03/28/2014 01:13:20 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:13:20Z

Error: (03/28/2014 01:12:50 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:12:50Z

Error: (03/28/2014 01:12:20 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:12:20Z

Error: (03/28/2014 01:11:50 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:11:50Z

Error: (03/28/2014 01:11:20 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:11:20Z

Error: (03/28/2014 01:10:50 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:10:50Z

Error: (03/28/2014 01:10:20 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:10:20Z

Error: (03/28/2014 01:09:50 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:09:50Z

Error: (03/28/2014 01:09:20 PM) (Source: Software Protection Platform Service)(User: )
Description: 0x800700022114-03-04T12:09:20Z


CodeIntegrity Errors:
===================================
  Date: 2013-03-08 07:26:32.421
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-03-08 07:26:32.390
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-03-08 07:26:32.359
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-03-08 07:26:32.343
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-03-08 07:26:32.312
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-03-08 07:26:32.281
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-03-08 07:26:32.250
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-03-08 07:26:32.234
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-03-08 07:26:32.203
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-03-08 07:26:32.187
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\Drivers\mfefirek.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info =========================== 

Percentage of memory in use: 39%
Total physical RAM: 4043.27 MB
Available physical RAM: 2438.03 MB
Total Pagefile: 8139.27 MB
Available Pagefile: 5650.47 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:560.07 GB) (Free:480.23 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 596 GB) (Disk ID: EDE137BD)

Partition: GPT Partition Type.

==================== End Of Log ============================

--- --- ---
Danke!

Gulliver

Hallo Schrauber,
habe eben festgestellt, dass sich diese Malware auch auf meinem Tablet eingenistet hat. Obwohl ich dort nichts Neues installiert hatte.
...???
Liebe Grüße und danke für Deine Hilfe!
Gulliver

Was hältst Du denn von WINZIP? Das wird mir auf Eurer Seite immer wieder angeboten. Kostet aber im Endeffekt was.

schrauber · 29.03.2014, 10:06

Das ist Werbung die wir nicht beeinflussen können! Runter mit Winzip.

Revo Uninstaller - Download - Filepony
Damit alles deinstallieren was Du in der Additional.txt findest mit dem Zusatz <== ATTENTION

Mit Revo auch Moderat die Reste entfernen lassen.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Gulliver · 31.03.2014, 09:35

1. Was meinst du bitte mit dem Satz:
"Mit Revo auch Moderat die Reste entfernen lassen."?

2. Wenn ich den Fixlist.txt auf dem Desktop speichere, meldet FRST, die Fixlist.txt muss in dem gleichen Verzeichnis stehen wie das Tool. Ich weiss aber nicht, wie ich die Fixlist und das Tool ins gleiche Verzeichnis bringen soll.

Bitte um Klärung.

Hallo Schrauber,

jetzt hab ich mit der Hilfe eines Freundes doch herausgefunden, was Du meinst mit "Mit Revo auch Moderat die Reste entfernen lassen" und die Reste entfernen können.

Bleibt also nur der zweite Teil meiner vorhergehenden Fragen offen. Bitte sag mir doch diesbezüglich Bescheid.

Fröhlichen Sonntag und Danke!

Gulliver

Jetzt hat dieser Schritt doch geklappt, Schrauber. Hier der fixlog.txt:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by Christoph Engen at 2014-03-30 11:52:52 Run:1
Running from C:\Users\Christoph Engen\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
*****************

C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.

The system needed a reboot.

==== End of Fixlog ====

Jetzt läuft grad der MBAM Bedrohungs-Suchlauf.
LG

Hi Schrauber,
wollte Dir gerade den mbam-file schicken, aber der ist mit 185980 Zeichen zu lang zum Einfügen. Soll den auf 120000 Zeichen kürzen. Bloß ich hab keine Ahnung, was ich da entfernen soll aus dem mbam-file.
Bitte um Tipp.
Danke.
Gulliver

Hi Schrauber,
alles fertig. Wollte Dir die ebem die drei Dateien schicken, weiss aber nicht wie, da die zu groß sind. Die webssearches.com-Seite öffnet sich übrigens immer noch, wenn ich Firefox aufrufe!
Danke.
Gulliver

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.022 - Bericht erstellt am 31/03/2014 um 08:17:14
# Aktualisiert 13/03/2014 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Christoph Engen - VAIO
# Gestartet von : C:\Users\Christoph Engen\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\Websteroids
Ordner Gelöscht : C:\Program Files (x86)\AnyProtectEx
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Program Files (x86)\Optimizer Pro
Ordner Gelöscht : C:\Program Files (x86)\sweetpacks bundle uninstaller
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Windows\SysWOW64\SearchProtect
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\adi\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Smartbar
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\ValueApps
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\CT2508583
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\toolbar@ask.com
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\{d1e96ee9-8227-4791-adb9-c3d4bb586a8b}
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\invalidprefs.js
Datei Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Wert Gelöscht : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DynConIE
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\prefs.js ]

Zeile gelöscht : user_pref("CT2508583.1371369228.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 07\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.1727132673537634929.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 06\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.2118850536042987431.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 07\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.2394073538.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 07\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.3174054215061172570.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 06\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.8563675133831946032.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 07\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.FirstTime", "true");
Zeile gelöscht : user_pref("CT2508583.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT2508583.UserID", "UN90145688839394753");
Zeile gelöscht : user_pref("CT2508583.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2508583.autoDisableScopes", -1);
Zeile gelöscht : user_pref("CT2508583.countryCode", "DE");
Zeile gelöscht : user_pref("CT2508583.defaultSearch", "false");
Zeile gelöscht : user_pref("CT2508583.enableAlerts", "always");
Zeile gelöscht : user_pref("CT2508583.enableFix404ByUser", "FALSE");
Zeile gelöscht : user_pref("CT2508583.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT2508583.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT2508583.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT2508583.fixPageNotFoundErrorByUser", "true");
Zeile gelöscht : user_pref("CT2508583.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT2508583.fixUrls", true);
Zeile gelöscht : user_pref("CT2508583.fullUserID", "UN90145688839394753.UP.20130626104213");
Zeile gelöscht : user_pref("CT2508583.homepageuserchanged", true);
Zeile gelöscht : user_pref("CT2508583.installType", "xpe");
Zeile gelöscht : user_pref("CT2508583.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT2508583.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT2508583.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT2508583.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT2508583.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"hxxp://search.conduit.com/?gd=&ctid=CT2508583&octid=CT2508583&ISID=ISID_ID&SearchSource=15&CUI=UN90145688839394753&SSPV=[...]
Zeile gelöscht : user_pref("CT2508583.lastVersion", "10.23.0.822");
Zeile gelöscht : user_pref("CT2508583.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT2508583.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT2508583.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"\",\"EB_MAIN_FRAME_TITLE\":\"\",\"EB_SEARCH_TERM\":\"\",\"EB_TOOLBAR_SUB_DOMAIN\":\"hxxp://MyVideo.OurToolbar.com/\",\"EB_TOOLBAR[...]
Zeile gelöscht : user_pref("CT2508583.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT2508583.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT2508583.revertSettingsEnabled", "true");
Zeile gelöscht : user_pref("CT2508583.search.searchAppId", "129083702311085146");
Zeile gelöscht : user_pref("CT2508583.search.searchCount", "2");
Zeile gelöscht : user_pref("CT2508583.searchInNewTabEnabledByUser", "false");
Zeile gelöscht : user_pref("CT2508583.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2508583.searchSuggestEnabledByUser", "false");
Zeile gelöscht : user_pref("CT2508583.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2508583\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://MyVideo.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"MyVideo \"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_Configuration_lastUpdate", "1396172276099");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_app.twitter.user-myvideo_de_lastUpdate", "1363012058907");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1376292100675");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_appTracking_lastUpdate", "1376311289905");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_appsMetadata_lastUpdate", "1376663875853");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1376459556823");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_location_lastUpdate", "1372225254120");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.14.65.43_lastUpdate", "1364229531125");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.15.0.562_lastUpdate", "1366347124718");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.15.2.523_lastUpdate", "1372225253866");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.16.4.519_lastUpdate", "1374556220753");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.16.70.505_lastUpdate", "1376640265311");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.19.2.505_lastUpdate", "1378817502505");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.20.0.513_lastUpdate", "1380520077038");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.20.1.508_lastUpdate", "1382411223013");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.21.1.507_lastUpdate", "1384504335455");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.22.3.518_lastUpdate", "1385042982138");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.22.5.510_lastUpdate", "1386882087754");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.23.0.822_lastUpdate", "1396241501096");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1376459557051");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_searchAPI_lastUpdate", "1396172276059");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_serviceMap_lastUpdate", "1396172275944");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_setupAPI_lastUpdate", "1364229531099");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_toolbarContextMenu_lastUpdate", "1376459556775");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_toolbarSettings_lastUpdate", "1396241500985");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_translation_lastUpdate", "1396172275791");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps217d4478-1c32-43bd-b9c2-9cdb3778b4c4_lastUpdate", "1376663876383");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps6a060db5-7b12-4964-8c5d-8c7ba0f8e472_lastUpdate", "1376663876452");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps6f2d2f6a-7685-48f5-8558-e7fd68c0938e_lastUpdate", "1376663876398");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps7f5031f3-d548-4e84-b3af-0eadff483480_lastUpdate", "1376663876356");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps_lastUpdate", "1376663876465");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userAppsbba001b9-b9f7-413b-9da1-fe498607f2a8_lastUpdate", "1376663876366");
Zeile gelöscht : user_pref("CT2508583.settingsINI", true);
Zeile gelöscht : user_pref("CT2508583.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT2508583.showToolbarPermission", "false");
Zeile gelöscht : user_pref("CT2508583.smartbar.CTID", "CT2508583");
Zeile gelöscht : user_pref("CT2508583.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT2508583.smartbar.isHidden", true);
Zeile gelöscht : user_pref("CT2508583.smartbar.toolbarName", "MyVideo ");
Zeile gelöscht : user_pref("CT2508583.startPage", "false");
Zeile gelöscht : user_pref("CT2508583.toolbarBornServerTime", "11-3-2013");
Zeile gelöscht : user_pref("CT2508583.toolbarCurrentServerTime", "31-3-2014");
Zeile gelöscht : user_pref("CT2508583.toolbarLoginClientTime", "Tue Mar 26 2013 13:24:45 GMT+0100");
Zeile gelöscht : user_pref("CT2508583_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1396246285679,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Zeile gelöscht : user_pref("browser.search.order.1", "Ask.com");
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "144fd47f207e3be30d6559fb3212ed8c");
Zeile gelöscht : user_pref("extensions.wajam.affiliate_id", "6334");
Zeile gelöscht : user_pref("extensions.wajam.firstrun", "false");
Zeile gelöscht : user_pref("extensions.wajam.log_send_info", "false");
Zeile gelöscht : user_pref("extensions.wajam.mappingListJsonString", "{\"version\":\"0.21088\",\"update_interval\":1360,\"base_url\":\"hxxp:\\/\\/www.wajam.com\\/\",\"update_url\":\"hxxp:\\/\\/www.wajam.com\\/addon\\/[...]
Zeile gelöscht : user_pref("extensions.wajam.no_trace", "true");
Zeile gelöscht : user_pref("extensions.wajam.server_current_mapping_version", "0.21088");
Zeile gelöscht : user_pref("extensions.wajam.supported_sites.ebay_v2.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';window[...]
Zeile gelöscht : user_pref("extensions.wajam.supported_sites.wikipedia.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';wind[...]
Zeile gelöscht : user_pref("extensions.wajam.supported_sites.yelp.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';window['W[...]
Zeile gelöscht : user_pref("extensions.wajam.trace_log", "1362996659670 - load - processBrowserLoad\n1362996659670 - readNoTrace - 64 bits - Error Message: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE[...]
Zeile gelöscht : user_pref("extensions.wajam.unique_id", "3AB94EB1B0C9348A11339CF57A929D05");
Zeile gelöscht : user_pref("extensions.wajam.user_current_mapping_version", "0");
Zeile gelöscht : user_pref("extensions.wajam.version", "1.26");
Zeile gelöscht : user_pref("extensions.wajam.website_version", "1.00294.0");
Zeile gelöscht : user_pref("plugin.state.npconduitfirefoxplugin", 2);
Zeile gelöscht : user_pref("smartbar.machineId", "XSXRJRYT/U6TCT83QQT+HO2GR+46U5S41KAV7KAYDYQJ01HPAI6HUYATIZAOJ5WR6KL+1IAHFXKVTPBRUSOAJA");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_currentVersion", "312E31332E302E3137");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_currentVersion.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_globalKeysMigratedToLocalStorage", "31");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_globalKeysMigratedToLocalStorage.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_migrated_from_ls", "31");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_migrated_from_ls.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_userBornDate", "4E2F41");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_userBornDate.storedInFile", false);

-\\ Google Chrome v33.0.1750.154

[ Datei : C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [22126 octets] - [28/03/2014 23:04:34]
AdwCleaner[R1].txt - [20323 octets] - [31/03/2014 08:15:18]
AdwCleaner[S0].txt - [19963 octets] - [31/03/2014 08:17:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [20024 octets] ##########

--- --- ---

Gulliver · 31.03.2014, 10:46

Hoffe, das klappt jetzt. Siehe Anhänge.

Gulliver · 31.03.2014, 11:14

Hallo Schrauber,
hoffe Du hast jetzt alles erhalten.
Die webssearches.com-Seite öffnet sich allerdings immer noch, wenn ich Firefox aufrufe.
LG
Gulliver

schrauber · 01.04.2014, 08:59

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Gulliver · 01.04.2014, 10:39

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 30.03.2014
Suchlauf-Zeit: 14:57:57
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.0.1000
Malware Datenbank: v2014.03.30.02
Rootkit Datenbank: v2014.03.27.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Chameleon: Deaktiviert

Betriebssystem: Windows 8
CPU: x64
Dateisystem: NTFS
Benutzer: Christoph Engen

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 292272
Verstrichene Zeit: 2 Std, 5 Min, 40 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 11
PUP.Optional.DynConIE.A, HKLM\SOFTWARE\CLASSES\APPID\DynConIE.DLL, In Quarantäne, [ea164bb569975ea2e47dbcaabe444db3], 
PUP.Optional.DynConIE.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\DynConIE.DLL, In Quarantäne, [a8588b754ab69769aab73e2820e2dd23], 
PUP.Optional.HQVideo.A, HKLM\SOFTWARE\WOW6432NODE\HQ-Vid-1.9b, In Quarantäne, [9868a95722ded52b3d1fd0891be7629e], 
PUP.Optional.MediaPlayerplus.A, HKLM\SOFTWARE\WOW6432NODE\MediaPlayerplus, In Quarantäne, [e8184bb5c040c7393a640850cd35748c], 
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\webssearchesSoftware, In Quarantäne, [d12f639d7e82b44cd3a583d6659db050], 
PUP.Optional.DynConIE.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\DynConIE.DLL, In Quarantäne, [c43cb14fcc347a8675ecff673ec438c8], 
PUP.Optional.QuickStart.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pelmeidfhdlhlbjimpabfcbnnojbboma, In Quarantäne, [52ae8b75837d8a760b29085245bd06fa], 
PUP.Optional.SweetIM.A, HKLM\SOFTWARE\WOW6432NODE\SWEETIM, In Quarantäne, [a15f2fd1c63a55ab2f9888f5a75ccb35], 
PUP.Optional.Conduit.A, HKU\S-1-5-21-2337137634-1657450788-3013061541-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\FF, In Quarantäne, [05fb6d9351af77898cd5a6dc0af950b0], 
PUP.Optional.ValueApps.A, HKU\S-1-5-21-2337137634-1657450788-3013061541-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\ValueApps, In Quarantäne, [6c94936d56aa18e8c744c1a6fd05867a], 
PUP.Optional.SweetIM.A, HKU\S-1-5-21-2337137634-1657450788-3013061541-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SWEETIM, In Quarantäne, [4ab66b95af5144bcf5d16a13d62dbe42], 

Registrierungswerte: 4
PUP.Optional.QuickStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|quick_start@gmail.com, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com, In Quarantäne, [a060649cb749f808bb7af565c042738d]
PUP.Optional.SweetIM.A, HKLM\SOFTWARE\WOW6432NODE\SWEETIM|simapp_id, 1763663475789070335, In Quarantäne, [a15f2fd1c63a55ab2f9888f5a75ccb35]
PUP.Optional.Wajam.A, HKU\S-1-5-21-2337137634-1657450788-3013061541-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}, C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi, In Quarantäne, [58a8b050cb35da263e445115699922de]
PUP.Optional.SweetIM.A, HKU\S-1-5-21-2337137634-1657450788-3013061541-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SWEETIM|simapp_id, 1763663475789070335, In Quarantäne, [4ab66b95af5144bcf5d16a13d62dbe42]

Registrierungsdaten: 11
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://istart.webssearches.com/?type=sc&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://istart.webssearches.com/?type=sc&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7),Ersetzt,[53adf7095ba5e61a3097857c6b99fc04]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7),Ersetzt,[be42748c56aab14f4484659cab59e31d]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}),Ersetzt,[20e041bf689813ed7f4ce8197d87748c]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://istart.webssearches.com/?type=hp&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7),Ersetzt,[05fbfe021be546ba4783f9083fc560a0]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://istart.webssearches.com/?type=hp&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7),Ersetzt,[b44cad537a86cc34e7e5ef128480c040]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\FIREFOX.EXE\SHELL\OPEN\COMMAND, "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://istart.webssearches.com/?type=sc&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7, Gut: (firefox.exe), Schlecht: ("C:\Program Files (x86)\Mozilla Firefox\firefox.exe" hxxp://istart.webssearches.com/?type=sc&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7),Ersetzt,[6e921ce4cd3301ff0eb95da4e12334cc]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7),Ersetzt,[45bb07f9c33d5ea2cefa946d28dc47b9]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}),Ersetzt,[f7095fa1dc240af6d5f639c832d2a15f]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://istart.webssearches.com/?type=hp&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7),Ersetzt,[689832ce4ab6659b6961e91864a007f9]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://istart.webssearches.com/?type=hp&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7),Ersetzt,[fc04619fbb459c64923a51b0fd07619f]
PUP.Optional.Conduit.A, HKU\S-1-5-21-2337137634-1657450788-3013061541-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPCDA220CD-164B-494B-82A8-8F72248E479E&SSPV=, Gut: (hxxp://www.google.com), Schlecht: (hxxp://search.conduit.com/?ctid=CT3323737&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPCDA220CD-164B-494B-82A8-8F72248E479E&SSPV=),Ersetzt,[ff0127d938c8ce3238e8ef13cd3733cd]

Ordner: 132
PUP.Optional.InternetUpdater.A, C:\ProgramData\InternetUpdater, In Quarantäne, [14ec728e68986e92fe45e08756ac4ab6], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\bin, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\Logs, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\bin, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\Logs, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\rep, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\bin, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\rep, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam, In Quarantäne, [e61a20e0bf41dd233b2e65ea649e31cf], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam\Firefox, In Quarantäne, [e61a20e0bf41dd233b2e65ea649e31cf], 
PUP.Optional.OpenCandy, C:\Users\Christoph Engen\AppData\Roaming\OpenCandy, In Quarantäne, [ff01679946bab54b3763aea19f6351af], 
PUP.Optional.OpenCandy, C:\Users\Christoph Engen\AppData\Roaming\OpenCandy\8AD5B7038837479A825AE0FD0826710C, In Quarantäne, [ff01679946bab54b3763aea19f6351af], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583\xpi, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583\xpi\defaults, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583\xpi\defaults\preferences, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT3324066, In Quarantäne, [ec149e62817f6898fc1608482ad840c0], 
PUP.Optional.Searchagent, C:\ProgramData\RHelpers, In Quarantäne, [08f820e09868649ccd1149079270b947], 
PUP.Optional.Searchagent, C:\ProgramData\RHelpers\ChromeHelper, In Quarantäne, [08f820e09868649ccd1149079270b947], 
PUP.Optional.Searchagent, C:\ProgramData\RHelpers\FirefoxHelper, In Quarantäne, [08f820e09868649ccd1149079270b947], 
PUP.Optional.Searchagent, C:\ProgramData\RHelpers\IeHelper, In Quarantäne, [08f820e09868649ccd1149079270b947], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\defaults, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\defaults\preferences, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\locale, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\locale\en-US, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\defaults, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\defaults\preferences, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\userCode, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\locale, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\locale\en-US, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.ValueApps.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\valueApps, In Quarantäne, [4ab6c13f31cf867a20bedd7853afd42c], 
PUP.Optional.ValueApps.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\valueApps\CT2508583, In Quarantäne, [4ab6c13f31cf867a20bedd7853afd42c], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\userCode, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\icons, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\icons\actions, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\api, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\popupResource, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\include, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\include\tools, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\en, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\en-US, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\es, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\es-419, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr-BE, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr-CA, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr-CH, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr-LU, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\it, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\it-CH, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\pl, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\pt-BR, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\ru, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\ru-MO, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\tr, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\vi, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\zh-CN, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\zh-TW, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\defaults, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\defaults\preferences, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\images, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.HQVideo.A, C:\Program Files (x86)\HQ-Vid-1.9b, In Quarantäne, [c63a2dd3e02057a9844013437c86bf41], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\userCode, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\icons, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\icons\actions, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\api, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\popupResource, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\userCode, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\icons, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\icons\actions, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\api, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\popupResource, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_majjphhgppkndjjkmhhnbgafooenebhd_0, In Quarantäne, [fe02be42bb45877974aa2c2b16ecf808], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd, In Quarantäne, [37c906faf60ad22e1b0fdd7a877b45bb], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_deghekbbihbapplmbffglehkdhkeibbm_0, In Quarantäne, [35cb5ca424dc7090df7b67f0cc362cd4], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm, In Quarantäne, [916f07f90bf5fa064c1b92c5cd358977], 

Dateien: 662
PUP.Optional.InstallCore.A, C:\Users\Christoph Engen\AppData\Local\Temp\nspA2C.tmp, In Quarantäne, [15eb6898897748b889ed13d9ea198878], 
PUP.Optional.InstallCore.A, C:\Users\Christoph Engen\AppData\Local\Temp\ICReinstall_nspA2C.tmp, In Quarantäne, [7090d62ac53b9967b7bfcb216c972dd3], 
PUP.Optional.InstallCore.A, C:\Users\Christoph Engen\AppData\Local\Temp\ICReinstall_nsw4D0F.tmp, In Quarantäne, [c9377b85649cb749eb8b37b5699a34cc], 
PUP.Optional.InstallCore.A, C:\Users\Christoph Engen\AppData\Local\Temp\nsw4D0F.tmp, In Quarantäne, [4eb20bf5e21e9a6677ff9c50a85bc23e], 
PUP.Optional.Wajam.A, C:\Users\Christoph Engen\AppData\Local\Temp\wajam_install.exe, In Quarantäne, [8779de22827e4bb554132fefac54b749], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Temp\nsc4424.tmp\Cidaulpl.exe, In Quarantäne, [fd0326da0000659bd0fd313161a0768a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Temp\nsgF4BC.tmp\Osoxlwdkcmi.exe, In Quarantäne, [20e0768aec14dd23f82bc39f8081738d], 
Backdoor.Bot, C:\Users\Christoph Engen\AppData\Local\Temp\android\android.exe, In Quarantäne, [8f71e51bfb05b64ad41a273c0ff257a9], 
PUP.Optional.SkyTech.A, C:\Users\Christoph Engen\AppData\Local\Temp\fullpackage_temp1395812547\alilog.dll, In Quarantäne, [bb459868709011ef46cd84aee818b14f], 
PUP.Optional.SkyTech.A, C:\Users\Christoph Engen\AppData\Local\Temp\fullpackage_temp1395812547\package1.zip, In Quarantäne, [1ce4629e31cf49b7ed2653df56aaac54], 
PUP.Optional.HQVideo.A, C:\Users\Christoph Engen\AppData\Local\Temp\nsx48B.tmp\138515, In Quarantäne, [ca365ba56d934fb1f3321f4305fc936d], 
PUP.Optional.MediaPlayerplus.A, C:\Users\Christoph Engen\AppData\Local\Temp\nsx5D69.tmp\30264, In Quarantäne, [d82834cce41c629ead216ef424ddca36], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Temp\ee71b964-c7f3-4565-bc9c-b8ec9d23e29d\software\mediaplayer.exe, In Quarantäne, [ca3654ac31cfe9176d141329e51b36ca], 
PUP.Optional.ReMarkIt.A, C:\Users\Christoph Engen\AppData\Local\Temp\ee71b964-c7f3-4565-bc9c-b8ec9d23e29d\software\Re-markit_2040-2082.exe, In Quarantäne, [57a9857bdb259e62f2bf84df16eb966a], 
PUP.Optional.SkyTech.A, C:\Users\Christoph Engen\AppData\Local\Temp\ee71b964-c7f3-4565-bc9c-b8ec9d23e29d\software\tugs_webssearches.exe, In Quarantäne, [51af10f05da3916f8867e36a010042be], 
PUP.Optional.SilenceInstall, C:\Users\Christoph Engen\AppData\Local\Temp\ee71b964-c7f3-4565-bc9c-b8ec9d23e29d\software\VOPackage.exe, In Quarantäne, [e0204db39b657987e5edd268817fcb35], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nseC260.exe, In Quarantäne, [3bc526da7d8369978c7c8f928b762bd5], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nshCB74.exe, In Quarantäne, [6c94c63aa060956b13f5d34ee02102fe], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsl6EBD.exe, In Quarantäne, [758b1ee23bc5d62ae2260c1511f06799], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsoC250.exe, In Quarantäne, [3dc3857bd927ec142adef8294fb21ee2], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nss2617.exe, In Quarantäne, [5da3c040a35de51b32d678a916ebbc44], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nssFFC7.exe, In Quarantäne, [79876f91d12fea1640c8061b1ae73ac6], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsv2B5C.exe, In Quarantäne, [21dfe31d5ea237c9ca3e1110ad54fa06], 
PUP.Optional.SearchProtect.A, C:\Windows\Temp\nsv6EAD.exe, In Quarantäne, [89774cb44db38d7351b71e03867b0bf5], 
PUP.Optional.DomaIQ, C:\Users\Christoph Engen\Downloads\Java(2).exe, In Quarantäne, [2cd4a858c13ff30de19a78c4986820e0], 
PUP.Optional.RegCleanPro, C:\Users\Christoph Engen\Downloads\rcpafterdownloadcp_ntb_ad_9138_cpntb1.exe, In Quarantäne, [38c8748cb749768ad8b2cc681de34cb4], 
PUP.Optional.RegCleanPro, C:\Users\Christoph Engen\Downloads\rcp_chip_468_a.exe, In Quarantäne, [6f9152aeab5598683a5060d46c94fd03], 
PUP.Optional.BundleInstaller.A, C:\Users\Christoph Engen\Downloads\Setup_V2.exe, In Quarantäne, [0df3d42cc04056aa79dd8365847f13ed], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\Downloads\tb_MyVideo.exe, In Quarantäne, [9769a75938c81ae68d9b90b239c81ce4], 
PUP.Optional.Wajam.A, C:\Users\Christoph Engen\Downloads\wajam_install.exe, In Quarantäne, [2cd46e920ff1728e0f5858c638c85ba5], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_deghekbbihbapplmbffglehkdhkeibbm_0.localstorage, In Quarantäne, [c43c43bde41c06fa1a07f56325dd4bb5], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_deghekbbihbapplmbffglehkdhkeibbm_0.localstorage-journal, In Quarantäne, [d42c0bf5669af40cfd2471e7b34f6799], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx, In Quarantäne, [50b049b7c63a1de33a11e276877b08f8], 
PUP.Optional.Websteroids.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_d.websteroidsapp.com_0.localstorage, In Quarantäne, [68988080639dca366ef287d1ad556997], 
PUP.Optional.Websteroids.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_d.websteroidsapp.com_0.localstorage-journal, In Quarantäne, [4cb498684bb5619f194732263ec4ce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_majjphhgppkndjjkmhhnbgafooenebhd_0.localstorage, In Quarantäne, [4db3b34d659b10f075ffc890e022e719], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_majjphhgppkndjjkmhhnbgafooenebhd_0.localstorage-journal, In Quarantäne, [33cdaa5613edf20e81f35ff9fb0734cc], 
PUP.Optional.MediaPlayerplus.A, C:\Windows\Tasks\MediaPlayerplus-chromeinstaller.job, In Quarantäne, [9c64d7297b8589778914abada1616997], 
PUP.Optional.MediaPlayerplus.A, C:\Windows\Tasks\MediaPlayerplus-firefoxinstaller.job, In Quarantäne, [7e82b34d88786b957a23b2a671917b85], 
PUP.Optional.HQVideo.A, C:\Windows\Tasks\HQ-Vid-1.9b-chromeinstaller.job, In Quarantäne, [b848e61a56aa25db4316afaafb07bd43], 
PUP.Optional.HQVideo.A, C:\Windows\Tasks\HQ-Vid-1.9b-codedownloader.job, In Quarantäne, [2dd34eb239c725db0950095049b9a35d], 
PUP.Optional.HQVideo.A, C:\Windows\Tasks\HQ-Vid-1.9b-firefoxinstaller.job, In Quarantäne, [ee1278885ca41de377e209505ba72dd3], 
PUP.Optional.WebsSearches.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\webssearches.xml, In Quarantäne, [788832ce45bbf20ef981adac05fd1ce4], 
PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot64.exe, In Quarantäne, [e31de51bfd0320e04a011e42768cd729], 
PUP.Optional.InternetUpdater.A, C:\ProgramData\InternetUpdater\InternetUpdater.ico, In Quarantäne, [14ec728e68986e92fe45e08756ac4ab6], 
PUP.Optional.InternetUpdater.A, C:\ProgramData\InternetUpdater\app.dat, In Quarantäne, [14ec728e68986e92fe45e08756ac4ab6], 
PUP.Optional.InternetUpdater.A, C:\ProgramData\InternetUpdater\data.dat, In Quarantäne, [14ec728e68986e92fe45e08756ac4ab6], 
PUP.Optional.InternetUpdater.A, C:\ProgramData\InternetUpdater\InternetUpdaterService.exe.config, In Quarantäne, [14ec728e68986e92fe45e08756ac4ab6], 
PUP.Optional.InternetUpdater.A, C:\ProgramData\InternetUpdater\Uninstall.exe, In Quarantäne, [14ec728e68986e92fe45e08756ac4ab6], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\EULA.txt, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings.html, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\style.css, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.css, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.html, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\defaults.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettingsDS.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\text-field.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\v.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\x.png, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\defaults.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\main.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\SPDialogAPI.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\defaults.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.css, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.html, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\defaults.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.css, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.html, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js, In Quarantäne, [40c0f30dc937e21e7897bccbfa09e719], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam\uninstall.exe, In Quarantäne, [e61a20e0bf41dd233b2e65ea649e31cf], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi, In Quarantäne, [e61a20e0bf41dd233b2e65ea649e31cf], 
PUP.Optional.OpenCandy, C:\Users\Christoph Engen\AppData\Roaming\OpenCandy\8AD5B7038837479A825AE0FD0826710C\TuneUpUtilities2013-2200218_de-DE.exe, In Quarantäne, [ff01679946bab54b3763aea19f6351af], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583\conduit.xml, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583\CT2508583.xpi, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583\ddt.csf, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583\version.txt, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583\xpi\install.rdf, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT2508583\xpi\defaults\preferences\defaults.js, In Quarantäne, [4cb453ad23ddbf4114fee868b84a49b7], 
PUP.Optional.Conduit.A, C:\Users\Christoph Engen\AppData\Local\Temp\CT3324066\ddt.csf, In Quarantäne, [ec149e62817f6898fc1608482ad840c0], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\announce.js, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\background.html, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\common.js, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\common.js.old, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\contentscript.js, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\icon.png, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\icon128.png, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\icon16.png, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\icon48.png, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\iframecontentscript.js, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.MultiIE, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb\2.6.61_0\manifest.json, In Quarantäne, [28d84cb413ed867a8198a5ac2ed4d927], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome.manifest, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\install.rdf, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\background.html, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\baseObject.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\browser.xul, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\dialog.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\ffCoreFilesIndex.txt, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\main.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\options.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\options.xul, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\platformVersion.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\search_dialog.xul, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\console.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\delegate.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\logFile.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\prefs.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\registry.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\reloadObserver.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\searchSettings.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\updateManager.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core\xhr.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\defaults\preferences\prefs.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\manifest.xml, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins.json, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\220_icm_base_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\102_dealply_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\103_intext_5_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\104_jollywallet_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\13_CrossriderAppUtils.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\14_CrossriderUtils.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\155_ibario_pops_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\16_FFAppAPIWrapper.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\177_crossriderDashboard.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\17_jQuery.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\22_resources.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\233_revizer_p_dynamic_b2b_2_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\242_price_gong_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\246_setup.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\28_initializer.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\47_resources_background.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\4_jquery_1_7_1.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\64_appApiMessage.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\72_appApiValidation.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\78_CrossriderInfo.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\7_hooks.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\91_monetizationLoader.js.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\93_superfish_no_coupons_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\98_omniCommands.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\9_search_engine_hook.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\182_openUrl.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\183_tabsWrapper.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\184_noproblemppc_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\190_pops_5_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\191_ciuvo_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\195_icm_convertmedia_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\1_base.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\207_dbWrapper.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\211_revizer_ws_dynamic_b2b_light_m.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\21_debug.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode\background.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode\extension.js, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\locale\en-US\translations.dtd, In Quarantäne, [c33d718fd22e47b961162c29e919cf31], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome.manifest, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\install.rdf, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\background.html, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\baseObject.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\browser.xul, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\dialog.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\ffCoreFilesIndex.txt, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\main.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\options.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\options.xul, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\platformVersion.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\search_dialog.xul, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\asyncDB.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\background.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\browserAction.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\contextMenu.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\dbManager.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\dom_bg.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\fileManager.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\firefox.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\firefoxNotifications.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\firefoxOmnibox.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\message.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\pageAction.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\request.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\tabs.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\webRequest.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\api\windowsMessagingHandler.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\addressBarChangeObserver.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\console.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\consts.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\delegate.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\extensionDataStore.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\folderIOWrapper.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\httpObserver.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\IDBWrapper.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\installer.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\logFile.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\prefs.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\progressListenerObserver.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\registry.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\reloadObserver.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\reports.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\requestObject.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\searchSettings.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\uninstallObserver.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\updateManager.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\utils.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\chrome\content\core\xhr.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\defaults\preferences\prefs.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\manifest.xml, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins.json, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\207_dbWrapper.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\102_dealply_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\104_jollywallet_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\119_similar_web_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\13_CrossriderAppUtils.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\14_CrossriderUtils.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\16_FFAppAPIWrapper.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\177_crossriderDashboard.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\179_revizer_p_dynamic_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\17_jQuery.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\180_bpo_serp_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\182_openUrl.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\183_tabsWrapper.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\191_ciuvo_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\1_base.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\21_debug.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\223_imonomy_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\22_resources.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\231_revizer_ws_dynamic_2_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\242_price_gong_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\246_setup.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\28_initializer.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\47_resources_background.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\4_jquery_1_7_1.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\64_appApiMessage.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\72_appApiValidation.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\78_CrossriderInfo.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\91_monetizationLoader.js.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\93_superfish_no_coupons_m.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\plugins\98_omniCommands.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\userCode\background.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\extensionData\userCode\extension.js, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\locale\en-US\translations.dtd, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\button1.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\button2.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\button3.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\button4.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\button5.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\crossrider_statusbar.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\icon128.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\icon16.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\icon24.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\icon48.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\panelarrow-up.png, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\popup.html, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\skin.css, In Quarantäne, [df21d03077893cc41661d18407fbce32], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\ee5ad154-f909-4cc0-aa51-d7e94e3fb0af@36204afd-f43e-4917-9c71-8384e2e4d3ad.com\skin\update.css, In Quarantäne, [df21d03077893cc41661d18407fbce32],

Gulliver · 01.04.2014, 10:55

Code:

ATTFilter

PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\background.html, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\chromeCoreFilesIndex.txt, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\crossriderManifest.json, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\manifest.json, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\popup.html, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\manifest.xml, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins.json, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\22_resources.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\102_dealply_m.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\104_jollywallet_m.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\13_CrossriderAppUtils.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\14_CrossriderUtils.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\177_crossriderDashboard.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\17_jQuery.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\182_openUrl.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\183_tabsWrapper.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\191_ciuvo_m.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\19_CHAppAPIWrapper.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\1_base.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\207_dbWrapper.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\21_debug.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\242_price_gong_m.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\246_setup.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\28_initializer.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\47_resources_background.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\4_jquery_1_7_1.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\64_appApiMessage.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\72_appApiValidation.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\78_CrossriderInfo.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\80_CHPopupAppAPI.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\91_monetizationLoader.js.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\93_superfish_no_coupons_m.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\plugins\97_resourceApiWrapper.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\userCode\background.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\extensionData\userCode\extension.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\icons\icon128.png, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\icons\icon16.png, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\icons\icon48.png, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\icons\actions\1.png, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\background.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\main.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\platformVersion.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\api\chrome.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\api\cookie.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\api\message.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\api\monitor.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\api\pageAction.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\api\pageActionBG.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\app_api.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\bg_app_api.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\consts.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\cookie_store.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\crossriderAPI.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\delegate.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\events.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\extensionDataStore.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\installer.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\logFile.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\logging.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\onBGDocumentLoad.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\reports.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\storageWrapper.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\updateManager.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\util.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\xhr.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\popupResource\newPopup.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\deghekbbihbapplmbffglehkdhkeibbm\1.26.25_0\js\lib\popupResource\popup.js, In Quarantäne, [0ff153ad22de8c74bb5c54027092926e], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome.manifest, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\install.rdf, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\index.html, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\quick_start.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\quick_start.xul, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\include\speed_dial.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\include\tools\about_blank_hook.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\include\tools\misc.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\include\tools\popup_image_helper.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\include\tools\urlrequestor.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\js\common.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\js\ga.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\js\jquery.autocomplete.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\js\js.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\js\library.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\content\js\xagainit.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\en\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\en-US\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\es\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\es-419\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr-BE\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr-CA\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr-CH\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\fr-LU\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\it\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\it-CH\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\pl\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\pt-BR\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\ru\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\ru-MO\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\tr\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\vi\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\zh-CN\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\locale\zh-TW\locale.properties, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\default_add_logo.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\default_add_logo_hover.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\default_logo.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\google_trends.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\icon.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\icon128.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\icon16.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\icon48.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\iconsmall.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\loading.gif, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\logo.ico, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\logo.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\logo32.ico, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\search.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\style.css, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\33.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\0.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\1.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\10.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\11.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\12.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\13.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\14.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\15.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\16.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\17.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\18.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\19.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\2.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\20.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\21.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\22.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\23.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\24.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\25.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\26.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\27.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\28.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\29.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\3.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\30.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\31.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\32.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\34.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\35.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\36.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\37.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\38.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\39.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\4.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\40.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\41.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\42.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\43.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\44.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\45.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\46.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\47.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\5.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\6.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\7.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\8.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\chrome\skin\weather\9.png, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\defaults\preferences\fvd.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\addonmanager.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\aes.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\config.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\dialogs.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\last_tab.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\misc.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\properties.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\remoterequest.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\restoreprefs.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.QuickStart.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\extensions\quick_start@gmail.com\modules\settings.js, In Quarantäne, [3cc4bf4168989070d07af066af533fc1], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\92.json, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\uninstallDlg.xml, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\UninstallManager.exe, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\images\bg1.png, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\images\button1.png, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\images\checked.png, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\images\close.png, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\images\min.png, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\images\Thumbs.db, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.WebsSearches.A, C:\Users\Christoph Engen\AppData\Roaming\webssearches\images\unchecked.png, In Quarantäne, [b24ef10fc8380bf51d8f7dd914eec23e], 
PUP.Optional.HQVideo.A, C:\Program Files (x86)\HQ-Vid-1.9b\53172.crx, In Quarantäne, [c63a2dd3e02057a9844013437c86bf41], 
PUP.Optional.HQVideo.A, C:\Program Files (x86)\HQ-Vid-1.9b\53172.xpi, In Quarantäne, [c63a2dd3e02057a9844013437c86bf41], 
PUP.Optional.HQVideo.A, C:\Program Files (x86)\HQ-Vid-1.9b\HQ-Vid-1.9b-chromeinstaller.exe, In Quarantäne, [c63a2dd3e02057a9844013437c86bf41], 
PUP.Optional.HQVideo.A, C:\Program Files (x86)\HQ-Vid-1.9b\HQ-Vid-1.9b-codedownloader.exe, In Quarantäne, [c63a2dd3e02057a9844013437c86bf41], 
PUP.Optional.HQVideo.A, C:\Program Files (x86)\HQ-Vid-1.9b\HQ-Vid-1.9b-firefoxinstaller.exe, In Quarantäne, [c63a2dd3e02057a9844013437c86bf41], 
PUP.Optional.HQVideo.A, C:\Program Files (x86)\HQ-Vid-1.9b\Uninstall.exe, In Quarantäne, [c63a2dd3e02057a9844013437c86bf41], 
PUP.Optional.HQVideo.A, C:\Program Files (x86)\HQ-Vid-1.9b\utils.exe, In Quarantäne, [c63a2dd3e02057a9844013437c86bf41], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\background.html, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\chromeCoreFilesIndex.txt, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\crossriderManifest.json, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\manifest.json, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\popup.html, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\manifest.xml, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins.json, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\220_icm_base_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\102_dealply_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\103_intext_5_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\104_jollywallet_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\13_CrossriderAppUtils.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\14_CrossriderUtils.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\155_ibario_pops_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\177_crossriderDashboard.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\17_jQuery.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\182_openUrl.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\22_resources.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\233_revizer_p_dynamic_b2b_2_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\242_price_gong_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\246_setup.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\28_initializer.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\47_resources_background.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\4_jquery_1_7_1.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\64_appApiMessage.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\72_appApiValidation.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\78_CrossriderInfo.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\7_hooks.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\80_CHPopupAppAPI.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\91_monetizationLoader.js.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\93_superfish_no_coupons_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\97_resourceApiWrapper.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\9_search_engine_hook.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\183_tabsWrapper.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\184_noproblemppc_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\190_pops_5_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\191_ciuvo_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\195_icm_convertmedia_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\19_CHAppAPIWrapper.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\1_base.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\207_dbWrapper.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\211_revizer_ws_dynamic_b2b_light_m.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\plugins\21_debug.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\userCode\background.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\extensionData\userCode\extension.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\icons\icon128.png, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\icons\icon16.png, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\icons\icon48.png, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\icons\actions\1.png, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\background.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\main.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\platformVersion.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\api\chrome.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\api\cookie.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\api\message.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\api\monitor.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\api\pageAction.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\api\pageActionBG.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\app_api.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\bg_app_api.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\consts.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\cookie_store.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\crossriderAPI.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\delegate.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\events.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\extensionDataStore.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\installer.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\logFile.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\logging.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\onBGDocumentLoad.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\reports.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\storageWrapper.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\updateManager.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\util.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\xhr.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\popupResource\newPopup.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.17_0\js\lib\popupResource\popup.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\background.html, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\chromeCoreFilesIndex.txt, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\crossriderManifest.json, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\manifest.json, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\popup.html, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\manifest.xml, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins.json, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\1.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\102.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\103.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\104.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\13.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\14.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\155.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\17.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\177.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\182.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\183.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\184.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\19.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\190.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\191.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\195.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\207.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\21.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\211.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\22.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\220.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\233.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\242.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\246.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\28.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\4.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\47.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\64.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\7.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\72.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\78.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\80.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\9.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\91.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\93.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\plugins\97.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\userCode\background.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\extensionData\userCode\extension.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\icons\icon128.png, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\icons\icon16.png, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\icons\icon48.png, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\icons\actions\1.png, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\background.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\main.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\platformVersion.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\api\chrome.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\api\cookie.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\api\message.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\api\monitor.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\api\pageAction.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\api\pageActionBG.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\app_api.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\bg_app_api.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\consts.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\cookie_store.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\crossriderAPI.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\delegate.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\events.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\extensionDataStore.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\installer.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\logFile.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\logging.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\onBGDocumentLoad.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\reports.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\storageWrapper.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\updateManager.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\util.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\xhr.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\popupResource\newPopup.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd\1.26.18_0\js\lib\popupResource\popup.js, In Quarantäne, [cd33fa068e7230d0807cd0860ef4f60a], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_majjphhgppkndjjkmhhnbgafooenebhd_0\2, In Quarantäne, [fe02be42bb45877974aa2c2b16ecf808], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\000016.ldb, In Quarantäne, [37c906faf60ad22e1b0fdd7a877b45bb], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\000042.ldb, In Quarantäne, [37c906faf60ad22e1b0fdd7a877b45bb], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\000046.log, In Quarantäne, [37c906faf60ad22e1b0fdd7a877b45bb], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\CURRENT, In Quarantäne, [37c906faf60ad22e1b0fdd7a877b45bb], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\LOCK, In Quarantäne, [37c906faf60ad22e1b0fdd7a877b45bb], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\LOG, In Quarantäne, [37c906faf60ad22e1b0fdd7a877b45bb], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\LOG.old, In Quarantäne, [37c906faf60ad22e1b0fdd7a877b45bb], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\majjphhgppkndjjkmhhnbgafooenebhd\MANIFEST-000044, In Quarantäne, [37c906faf60ad22e1b0fdd7a877b45bb], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_deghekbbihbapplmbffglehkdhkeibbm_0\3, In Quarantäne, [35cb5ca424dc7090df7b67f0cc362cd4], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\000043.ldb, In Quarantäne, [916f07f90bf5fa064c1b92c5cd358977], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\000046.log, In Quarantäne, [916f07f90bf5fa064c1b92c5cd358977], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\CURRENT, In Quarantäne, [916f07f90bf5fa064c1b92c5cd358977], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\LOCK, In Quarantäne, [916f07f90bf5fa064c1b92c5cd358977], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\LOG, In Quarantäne, [916f07f90bf5fa064c1b92c5cd358977], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\LOG.old, In Quarantäne, [916f07f90bf5fa064c1b92c5cd358977], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\deghekbbihbapplmbffglehkdhkeibbm\MANIFEST-000044, In Quarantäne, [916f07f90bf5fa064c1b92c5cd358977], 
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.aee5ad154f9094cc0aa51d7e94e3fb0af36204afdf43e49179c718384e2e4d3adcom53172.53172.pluginsurl", "hxxp://js.clientdataservice.com/plugin/apps/53172/plugins/094/ff/plugins.json");), Ersetzt,[5aa69b654bb56d9355145cd956ae5fa1]
PUP.Optional.CrossRider.A, C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.crossrider.bic", "144fd47f207e3be30d6559fb3212ed8c");), Ersetzt,[7e826b95b14f23dd9dcfd85d41c359a7]

Physische Sektoren: 0
(No malicious items detected)


(end)

Code:

ATTFilter

# AdwCleaner v3.022 - Bericht erstellt am 31/03/2014 um 08:17:14
# Aktualisiert 13/03/2014 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : Christoph Engen - VAIO
# Gestartet von : C:\Users\Christoph Engen\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\Websteroids
Ordner Gelöscht : C:\Program Files (x86)\AnyProtectEx
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Program Files (x86)\Optimizer Pro
Ordner Gelöscht : C:\Program Files (x86)\sweetpacks bundle uninstaller
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Windows\SysWOW64\SearchProtect
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\adi\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Smartbar
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\ValueApps
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\CT2508583
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\toolbar@ask.com
Ordner Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\Extensions\{d1e96ee9-8227-4791-adb9-c3d4bb586a8b}
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\invalidprefs.js
Datei Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Wert Gelöscht : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DynConIE
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Mozilla Firefox v27.0.1 (de)

[ Datei : C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\plpfkncq.default\prefs.js ]

Zeile gelöscht : user_pref("CT2508583.1371369228.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 07\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.1727132673537634929.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 06\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.2118850536042987431.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 07\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.2394073538.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 07\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.3174054215061172570.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 06\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.8563675133831946032.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"03\\\\/12\\\\/2013 07\\\"}\"}");
Zeile gelöscht : user_pref("CT2508583.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.FirstTime", "true");
Zeile gelöscht : user_pref("CT2508583.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT2508583.UserID", "UN90145688839394753");
Zeile gelöscht : user_pref("CT2508583.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2508583.autoDisableScopes", -1);
Zeile gelöscht : user_pref("CT2508583.countryCode", "DE");
Zeile gelöscht : user_pref("CT2508583.defaultSearch", "false");
Zeile gelöscht : user_pref("CT2508583.enableAlerts", "always");
Zeile gelöscht : user_pref("CT2508583.enableFix404ByUser", "FALSE");
Zeile gelöscht : user_pref("CT2508583.enableSearchFromAddressBar", "true");
Zeile gelöscht : user_pref("CT2508583.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT2508583.fixPageNotFoundError", "true");
Zeile gelöscht : user_pref("CT2508583.fixPageNotFoundErrorByUser", "true");
Zeile gelöscht : user_pref("CT2508583.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT2508583.fixUrls", true);
Zeile gelöscht : user_pref("CT2508583.fullUserID", "UN90145688839394753.UP.20130626104213");
Zeile gelöscht : user_pref("CT2508583.homepageuserchanged", true);
Zeile gelöscht : user_pref("CT2508583.installType", "xpe");
Zeile gelöscht : user_pref("CT2508583.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT2508583.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT2508583.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT2508583.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT2508583.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"hxxp://search.conduit.com/?gd=&ctid=CT2508583&octid=CT2508583&ISID=ISID_ID&SearchSource=15&CUI=UN90145688839394753&SSPV=[...]
Zeile gelöscht : user_pref("CT2508583.lastVersion", "10.23.0.822");
Zeile gelöscht : user_pref("CT2508583.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
Zeile gelöscht : user_pref("CT2508583.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT2508583.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"\",\"EB_MAIN_FRAME_TITLE\":\"\",\"EB_SEARCH_TERM\":\"\",\"EB_TOOLBAR_SUB_DOMAIN\":\"hxxp://MyVideo.OurToolbar.com/\",\"EB_TOOLBAR[...]
Zeile gelöscht : user_pref("CT2508583.openThankYouPage", "false");
Zeile gelöscht : user_pref("CT2508583.openUninstallPage", "true");
Zeile gelöscht : user_pref("CT2508583.revertSettingsEnabled", "true");
Zeile gelöscht : user_pref("CT2508583.search.searchAppId", "129083702311085146");
Zeile gelöscht : user_pref("CT2508583.search.searchCount", "2");
Zeile gelöscht : user_pref("CT2508583.searchInNewTabEnabledByUser", "false");
Zeile gelöscht : user_pref("CT2508583.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT2508583.searchSuggestEnabledByUser", "false");
Zeile gelöscht : user_pref("CT2508583.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2508583\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://MyVideo.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"MyVideo \"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_Configuration_lastUpdate", "1396172276099");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_app.twitter.user-myvideo_de_lastUpdate", "1363012058907");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1376292100675");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_appTracking_lastUpdate", "1376311289905");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_appsMetadata_lastUpdate", "1376663875853");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1376459556823");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_location_lastUpdate", "1372225254120");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.14.65.43_lastUpdate", "1364229531125");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.15.0.562_lastUpdate", "1366347124718");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.15.2.523_lastUpdate", "1372225253866");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.16.4.519_lastUpdate", "1374556220753");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.16.70.505_lastUpdate", "1376640265311");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.19.2.505_lastUpdate", "1378817502505");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.20.0.513_lastUpdate", "1380520077038");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.20.1.508_lastUpdate", "1382411223013");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.21.1.507_lastUpdate", "1384504335455");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.22.3.518_lastUpdate", "1385042982138");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.22.5.510_lastUpdate", "1386882087754");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_login_10.23.0.822_lastUpdate", "1396241501096");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1376459557051");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_searchAPI_lastUpdate", "1396172276059");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_serviceMap_lastUpdate", "1396172275944");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_setupAPI_lastUpdate", "1364229531099");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_toolbarContextMenu_lastUpdate", "1376459556775");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_toolbarSettings_lastUpdate", "1396241500985");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_translation_lastUpdate", "1396172275791");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps217d4478-1c32-43bd-b9c2-9cdb3778b4c4_lastUpdate", "1376663876383");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps6a060db5-7b12-4964-8c5d-8c7ba0f8e472_lastUpdate", "1376663876452");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps6f2d2f6a-7685-48f5-8558-e7fd68c0938e_lastUpdate", "1376663876398");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps7f5031f3-d548-4e84-b3af-0eadff483480_lastUpdate", "1376663876356");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userApps_lastUpdate", "1376663876465");
Zeile gelöscht : user_pref("CT2508583.serviceLayer_services_userAppsbba001b9-b9f7-413b-9da1-fe498607f2a8_lastUpdate", "1376663876366");
Zeile gelöscht : user_pref("CT2508583.settingsINI", true);
Zeile gelöscht : user_pref("CT2508583.shouldFirstTimeDialog", "false");
Zeile gelöscht : user_pref("CT2508583.showToolbarPermission", "false");
Zeile gelöscht : user_pref("CT2508583.smartbar.CTID", "CT2508583");
Zeile gelöscht : user_pref("CT2508583.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT2508583.smartbar.isHidden", true);
Zeile gelöscht : user_pref("CT2508583.smartbar.toolbarName", "MyVideo ");
Zeile gelöscht : user_pref("CT2508583.startPage", "false");
Zeile gelöscht : user_pref("CT2508583.toolbarBornServerTime", "11-3-2013");
Zeile gelöscht : user_pref("CT2508583.toolbarCurrentServerTime", "31-3-2014");
Zeile gelöscht : user_pref("CT2508583.toolbarLoginClientTime", "Tue Mar 26 2013 13:24:45 GMT+0100");
Zeile gelöscht : user_pref("CT2508583_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1396246285679,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Zeile gelöscht : user_pref("browser.search.order.1", "Ask.com");
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
Zeile gelöscht : user_pref("extensions.crossrider.bic", "144fd47f207e3be30d6559fb3212ed8c");
Zeile gelöscht : user_pref("extensions.wajam.affiliate_id", "6334");
Zeile gelöscht : user_pref("extensions.wajam.firstrun", "false");
Zeile gelöscht : user_pref("extensions.wajam.log_send_info", "false");
Zeile gelöscht : user_pref("extensions.wajam.mappingListJsonString", "{\"version\":\"0.21088\",\"update_interval\":1360,\"base_url\":\"hxxp:\\/\\/www.wajam.com\\/\",\"update_url\":\"hxxp:\\/\\/www.wajam.com\\/addon\\/[...]
Zeile gelöscht : user_pref("extensions.wajam.no_trace", "true");
Zeile gelöscht : user_pref("extensions.wajam.server_current_mapping_version", "0.21088");
Zeile gelöscht : user_pref("extensions.wajam.supported_sites.ebay_v2.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';window[...]
Zeile gelöscht : user_pref("extensions.wajam.supported_sites.wikipedia.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';wind[...]
Zeile gelöscht : user_pref("extensions.wajam.supported_sites.yelp.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_UC'] = 'Wajam';window['W[...]
Zeile gelöscht : user_pref("extensions.wajam.trace_log", "1362996659670 - load - processBrowserLoad\n1362996659670 - readNoTrace - 64 bits - Error Message: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE[...]
Zeile gelöscht : user_pref("extensions.wajam.unique_id", "3AB94EB1B0C9348A11339CF57A929D05");
Zeile gelöscht : user_pref("extensions.wajam.user_current_mapping_version", "0");
Zeile gelöscht : user_pref("extensions.wajam.version", "1.26");
Zeile gelöscht : user_pref("extensions.wajam.website_version", "1.00294.0");
Zeile gelöscht : user_pref("plugin.state.npconduitfirefoxplugin", 2);
Zeile gelöscht : user_pref("smartbar.machineId", "XSXRJRYT/U6TCT83QQT+HO2GR+46U5S41KAV7KAYDYQJ01HPAI6HUYATIZAOJ5WR6KL+1IAHFXKVTPBRUSOAJA");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_currentVersion", "312E31332E302E3137");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_currentVersion.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_globalKeysMigratedToLocalStorage", "31");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_globalKeysMigratedToLocalStorage.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_migrated_from_ls", "31");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_migrated_from_ls.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_userBornDate", "4E2F41");
Zeile gelöscht : user_pref("valueApps.CT2508583.mam_gk_userBornDate.storedInFile", false);

-\\ Google Chrome v33.0.1750.154

[ Datei : C:\Users\Christoph Engen\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [22126 octets] - [28/03/2014 23:04:34]
AdwCleaner[R1].txt - [20323 octets] - [31/03/2014 08:15:18]
AdwCleaner[S0].txt - [19963 octets] - [31/03/2014 08:17:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [20024 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 8 x64
Ran by Christoph Engen on 31.03.2014 at  8:45:05,25
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs



~~~ Registry Keys

Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2830488C-079B-45C2-88B6-AFE4EAA2DF85}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{2830488C-079B-45C2-88B6-AFE4EAA2DF85}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{2830488C-079B-45C2-88B6-AFE4EAA2DF85}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{2830488C-079B-45C2-88B6-AFE4EAA2DF85}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{1D77A73B-8592-47F4-A8DA-FA22A802C077}
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9"



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Users\Christoph Engen\AppData\Roaming\mozilla\firefox\profiles\plpfkncq.default\prefs.js

user_pref("extensions.wajam.supported_sites.amazon_product.priam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_
user_pref("extensions.wajam.supported_sites.amazon_v2.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL
user_pref("extensions.wajam.supported_sites.ask.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LABEL_NAME_
user_pref("extensions.wajam.supported_sites.ebay_product.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_LA
user_pref("extensions.wajam.supported_sites.encryptedgoogle.wajam_google_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM
user_pref("extensions.wajam.supported_sites.google.wajam_google_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_L
user_pref("extensions.wajam.supported_sites.youtubesearch.wajam_se_js", "try {window['APP_LABEL_NAME'] = 'wajam';window['APP_LABEL_NAME_FULL_UC'] = 'WAJAM';window['WAJAM_APP_L
Emptied folder: C:\Users\Christoph Engen\AppData\Roaming\mozilla\firefox\profiles\plpfkncq.default\minidumps [93 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31.03.2014 at  8:50:08,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hi Schrauber, ich hoffe, die zuletzt übermittelten Files sind, was Du brauchst. Habe grad den filepony-link gemäß Deiner Anweisung runtergeladen, finde dort aber keinen Firefox zum Deinstallieren. Nur Google Chrome. Wat nu?
Danke!
Gulli

schrauber · 02.04.2014, 08:49

Du findest im programm Revo keinen Firefox? Dann deinstalliere ihn normal und mach den Rest.

Gulliver · 03.04.2014, 17:46

Okidoki, Schrauber, habe jetzt firefox entfernt und mir stattdessen Google Chrome als Standardbrowser eingesetzt. Dieses webssearches.com ist somit weg.

Was den zweiten Link mit mozilla betrifft - https://support.mozilla.org/de/kb/fi...einfach-loesen -, weiss ich nicht,was ich dort machen soll, aufrufen kann ich's.

Grüße!
Gulliver

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=9ee107a3bc01044b989a3536585c2717
# engine=17721
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-02 10:24:47
# local_time=2014-04-02 12:24:47 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT
# compatibility_mode=5122 16777213 100 88 1793870 145216883 0 0
# compatibility_mode=5893 16776574 100 94 9223400 55940398 0 0
# scanned=2314
# found=0
# cleaned=0
# scan_time=58
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=9ee107a3bc01044b989a3536585c2717
# engine=17721
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-02 02:03:58
# local_time=2014-04-02 04:03:58 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT
# compatibility_mode=5122 16777213 100 88 1807021 145230034 0 0
# compatibility_mode=5893 16776574 100 94 9236551 55953549 0 0
# scanned=320060
# found=8
# cleaned=0
# scan_time=13064
sh=1AB5FE7F5654ECBB42397AE222C0B8159081D6C6 ft=1 fh=2b551abc4ed949a7 vn="a variant of MSIL/Adware.PullUpdate.A application" ac=I fn="C:\ProgramData\Updater\Uninstall.exe"
sh=1AB5FE7F5654ECBB42397AE222C0B8159081D6C6 ft=1 fh=2b551abc4ed949a7 vn="a variant of MSIL/Adware.PullUpdate.A application" ac=I fn="C:\Users\All Users\Updater\Uninstall.exe"
sh=858BA44106373D5FDCA3D68B537A24BD9AB835B9 ft=1 fh=fa32e38cf056fa2f vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\Christoph Engen\AppData\Local\Temp\ICReinstall_skype_setup.exe"
sh=8405853EB6516C8F45A313D9C0924051CA877538 ft=1 fh=048c9f26147e5502 vn="a variant of Win32/AdWare.Lollipop.U application" ac=I fn="C:\Users\Christoph Engen\AppData\Local\Temp\ee71b964-c7f3-4565-bc9c-b8ec9d23e29d\software\LollipopInstaller_uni.exe"
sh=08AACAA579099EB10879AC6B90E6D39CFC398A1A ft=1 fh=2b5e415f204ff3b2 vn="a variant of Win32/SpeedingUpMyPC.H application" ac=I fn="C:\Users\Christoph Engen\AppData\Local\Temp\ee71b964-c7f3-4565-bc9c-b8ec9d23e29d\software\OptimizerPro.exe"
sh=DB5E4E4F64BAA359255F230C658BE286E266892A ft=1 fh=cc4c339215781df4 vn="multiple threats" ac=I fn="C:\Users\Christoph Engen\AppData\Local\Temp\{6789C096-AA8E-4868-B6CD-719AC305F1F5}\setup.exe"
sh=72103332DFA9ABD60D0F6BC30A9990E5AEEA7220 ft=1 fh=844b0ef66f87062d vn="a variant of Win32/Kryptik.BWAM trojan" ac=I fn="C:\Users\Christoph Engen\Downloads\skype_setup(1).exe"
sh=858BA44106373D5FDCA3D68B537A24BD9AB835B9 ft=1 fh=fa32e38cf056fa2f vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\Christoph Engen\Downloads\skype_setup.exe"

Hi Schrauber,
das eben war der ESET-Editor. Habe jetzt übrigens doch google chrome deinstallieren müssen, da dort auch webssearches drauf kam. Habe auch Firefox komplett deinstalliert und mir ein neues firefox downgelodet. Da ist kein webssearches draufgekommen. Bis jetzt jedenfalls.
Mache jetzt weiter.
Grüsse und danke schon mal für Deine klare, kompetente Anleitung!
Gulliver

Results of screen317's Security Check version 0.99.80
x64 (UAC is enabled)
Internet Explorer 10 Out of date!
``````````````Antivirus/Firewall Check:``````````````
McAfee Anti-Virus und Anti-Spyware
Windows Defender
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 12.0.0.77
Mozilla Firefox (28.0)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Christoph Engen (administrator) on VAIO on 02-04-2014 16:39:35
Running from C:\Users\Christoph Engen\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(McAfee, Inc.) C:\Windows\system32\mfevtps.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\LiveComm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Users\Christoph Engen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe
(Microsoft Corporation) C:\Windows\system32\wwahost.exe
(McAfee, Inc.) C:\Program Files\mcafee.com\agent\mcagent.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Microsoft Corporation) C:\Windows\system32\wwahost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowsphotos_16.4.4388.928_x64__8wekyb3d8bbwe\LiveComm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.2.9200.20523_x64__8wekyb3d8bbwe\glcnd.exe
() C:\Program Files\Sony\VAIO Care\listener.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\backgroundTaskHost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] - C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [764032 2012-08-13] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-08-13] (Atheros Communications)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-21] (Synaptics Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [68776 2012-08-18] (Sony Corporation)
HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [152896 2012-06-25] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [LifeCam] - "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
HKLM-x32\...\Run: [LWS] - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [740888 2013-04-24] (Sony Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [185896 2013-10-28] (Geek Software GmbH)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\.DEFAULT\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\.DEFAULT\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2337137634-1657450788-3013061541-1001\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4272640 2012-09-12] (Microsoft Corporation)
HKU\S-1-5-21-2337137634-1657450788-3013061541-1001\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\Christoph Engen\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-2337137634-1657450788-3013061541-1001\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-2337137634-1657450788-3013061541-1001\...\Policies\Explorer: [HideSCAHealth] 0

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Webs Searches
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = CountrySelector - Sony
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Google
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = Google
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1395812624&from=tugs&uid=WDCXWD6400BPVT-55HXZT3_WD-WXF1E32UUKJ7UUKJ7&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {A607C9C8-0182-4E87-A5ED-E43FBBF89C3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASEJS
SearchScopes: HKCU - {A607C9C8-0182-4E87-A5ED-E43FBBF89C3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASEJS
SearchScopes: HKCU - {A72F2F0D-E7D6-4D9B-8119-845C25791800} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q312&_nkw={searchTerms}
BHO: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll No File
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll No File
BHO-x32: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Christoph Engen\AppData\Roaming\Mozilla\Firefox\Profiles\cu23the7.default-1396433512178
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Christoph Engen\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2012-09-18]

==================== Services (Whitelisted) =================

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-13] (Qualcomm Atheros Commnucations)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 McAWFwk; C:\Program Files\mcafee\msc\McAWFwk.exe [332080 2012-01-26] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-08-08] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-08-08] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [623784 2012-08-18] (Sony Corporation)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-04-24] (Sony Corporation)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [972000 2012-08-08] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1368624 2013-08-01] (Sony Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-13] (Atheros)
S4 McOobeSv2; "C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]

==================== Drivers (Whitelisted) ====================

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-08-20] (Advanced Micro Devices)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-13] (Qualcomm Atheros)
R3 BTATH_VDP; C:\Windows\system32\drivers\btath_vdp.sys [427416 2012-08-13] (Qualcomm Atheros)
R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [117632 2013-06-01] (Microsoft Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-09-25] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-09-25] (Windows (R) Win 7 DDK provider)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-02] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-08-08] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-08-08] (McAfee, Inc.)
U3 mfeavfk01; No ImagePath
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69168 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519064 2013-08-08] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [776168 2013-08-08] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-08-08] (McAfee, Inc.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-21] (Synaptics Incorporated)
R3 SOWS; C:\Windows\System32\drivers\sows.sys [24280 2012-06-11] (Sony Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-02 16:38 - 2014-04-02 16:38 - 00000762 _____ () C:\Users\Christoph Engen\Desktop\checkup.txt
2014-04-02 16:33 - 2014-04-02 16:33 - 00987442 _____ () C:\Users\Christoph Engen\Downloads\SecurityCheck.exe
2014-04-02 12:25 - 2014-04-02 12:25 - 02347384 _____ (ESET) C:\Users\Christoph Engen\Downloads\esetsmartinstaller_enu(2).exe
2014-04-02 12:21 - 2014-04-02 12:21 - 02347384 _____ (ESET) C:\Users\Christoph Engen\Downloads\esetsmartinstaller_enu(1).exe
2014-04-02 12:20 - 2014-03-02 07:44 - 00000426 _____ () C:\AVScanner.ini
2014-04-02 12:15 - 2014-04-02 12:15 - 02347384 _____ (ESET) C:\Users\Christoph Engen\Downloads\esetsmartinstaller_enu.exe
2014-04-02 11:58 - 2014-04-02 12:11 - 00000000 ____D () C:\Users\Christoph Engen\Desktop\Alte Firefox-Daten
2014-04-02 11:53 - 2014-04-02 11:53 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Desktop\revosetup95.exe
2014-04-02 11:52 - 2014-04-02 11:52 - 00001111 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-02 11:51 - 2014-04-02 11:51 - 00283192 _____ (Mozilla) C:\Users\Christoph Engen\Desktop\Firefox Setup Stub 28.0.exe
2014-04-02 09:30 - 2014-04-02 09:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Downloads\revosetup95(2).exe
2014-04-01 11:51 - 2014-04-01 11:51 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Downloads\revosetup95(1).exe
2014-04-01 11:51 - 2014-04-01 11:51 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Downloads\revosetup95(1)(1).exe
2014-03-31 09:38 - 2014-03-31 09:38 - 01110476 _____ () C:\Users\Christoph Engen\Downloads\7z920.exe
2014-03-31 09:38 - 2014-03-31 09:38 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-03-31 08:50 - 2014-03-31 08:50 - 00003432 _____ () C:\Users\Christoph Engen\Desktop\JRT.txt
2014-03-31 08:45 - 2014-03-31 08:45 - 00000000 ____D () C:\Windows\ERUNT
2014-03-31 08:43 - 2014-03-31 08:43 - 01038974 _____ (Thisisu) C:\Users\Christoph Engen\Desktop\JRT.exe
2014-03-31 08:41 - 2014-03-31 08:41 - 00020117 _____ () C:\Users\Christoph Engen\Desktop\AdwCleaner[S0] Editor 31.3.2014.txt
2014-03-31 08:14 - 2014-03-31 08:14 - 01950720 _____ () C:\Users\Christoph Engen\Downloads\adwcleaner.exe
2014-03-30 15:21 - 2014-03-30 15:21 - 00185980 _____ () C:\Users\Christoph Engen\Desktop\mbam.txt
2014-03-30 12:10 - 2014-04-02 12:14 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-30 12:08 - 2014-03-30 12:08 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-30 12:08 - 2014-03-30 12:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-30 12:08 - 2014-03-30 12:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-03-30 12:08 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 12:08 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-30 12:08 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-30 12:05 - 2014-03-30 12:06 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Christoph Engen\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-29 20:56 - 2014-03-29 20:56 - 02157056 _____ (Farbar) C:\Users\Christoph Engen\Downloads\FRST64(1).exe
2014-03-29 20:33 - 2014-03-29 20:33 - 02157056 _____ (Farbar) C:\Users\Christoph Engen\Desktop\FRST64.exe
2014-03-29 19:31 - 2014-04-02 11:54 - 00001228 _____ () C:\Users\Christoph Engen\Desktop\Revo Uninstaller.lnk
2014-03-29 19:31 - 2014-04-02 09:30 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-03-29 19:31 - 2014-03-29 19:31 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Downloads\revosetup95.exe
2014-03-29 07:07 - 2014-03-29 19:23 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Nico Mak Computing
2014-03-29 07:04 - 2014-03-29 07:04 - 04894544 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmalwareprotector_1.exe
2014-03-28 23:13 - 2014-03-28 23:13 - 04892480 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmp_8(2).exe
2014-03-28 23:04 - 2014-03-31 08:17 - 00000000 ____D () C:\AdwCleaner
2014-03-28 16:31 - 2014-03-28 16:31 - 04892480 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmp_8(1).exe
2014-03-28 14:13 - 2014-03-28 14:13 - 00023703 _____ () C:\Users\Christoph Engen\Desktop\Addition.txt
2014-03-28 13:11 - 2014-04-02 16:39 - 00019858 _____ () C:\Users\Christoph Engen\Desktop\FRST.txt
2014-03-28 10:46 - 2014-03-28 10:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmp_8.exe
2014-03-28 09:58 - 2014-03-28 09:59 - 00028236 _____ () C:\Users\Christoph Engen\Downloads\Addition.txt
2014-03-28 09:57 - 2014-03-28 13:04 - 00048696 _____ () C:\Users\Christoph Engen\Downloads\FRST.txt
2014-03-28 09:38 - 2014-04-02 16:39 - 00000000 ____D () C:\FRST
2014-03-28 09:30 - 2014-03-28 09:30 - 00000492 _____ () C:\Users\Christoph Engen\Downloads\defogger_disable.log
2014-03-28 09:30 - 2014-03-28 09:30 - 00000000 _____ () C:\Users\Christoph Engen\defogger_reenable
2014-03-28 09:25 - 2014-03-28 09:25 - 00050477 _____ () C:\Users\Christoph Engen\Downloads\Defogger.exe
2014-03-28 06:31 - 2014-03-28 06:31 - 00573860 _____ () C:\Users\Christoph Engen\Desktop\DSZ_f_rs_Internet.eml
2014-03-26 10:13 - 2014-03-26 10:13 - 00279696 _____ () C:\Windows\Minidump\032614-55000-01.dmp
2014-03-26 10:12 - 2014-03-26 10:12 - 00000000 __SHD () C:\found.001
2014-03-26 09:50 - 2014-03-29 19:27 - 00000000 ___RD () C:\Users\Christoph Engen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-26 07:44 - 2014-03-26 07:45 - 00001170 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.scan.quick.results
2014-03-26 07:44 - 2014-03-26 07:45 - 00000314 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.uninstall.scan.results
2014-03-26 07:44 - 2014-03-26 07:44 - 00000000 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.scan.results
2014-03-26 07:43 - 2014-03-26 07:43 - 01172720 _____ (AnyProtect.com) C:\Users\Christoph Engen\AppData\Local\nst7B42.tmp
2014-03-26 07:43 - 2014-03-26 07:43 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerplus
2014-03-26 07:43 - 2014-03-26 07:43 - 00000000 ____D () C:\2352408143b84ec165656890
2014-03-26 07:42 - 2014-03-30 11:56 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-03-23 07:45 - 2014-03-23 07:46 - 00632696 _____ () C:\Windows\Minidump\032314-34781-01.dmp
2014-03-12 07:15 - 2014-03-12 07:31 - 00000000 ____D () C:\Cakewalk Projects
2014-03-12 07:15 - 2014-03-12 07:15 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Cakewalk
2014-03-12 07:14 - 2006-11-30 15:49 - 00368640 _____ (Propellerhead Software AB) C:\Windows\SysWOW64\ReWire.dll
2014-03-12 07:14 - 2006-02-24 10:00 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2014-03-12 07:14 - 2006-02-24 10:00 - 01047552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71u.dll
2014-03-12 07:14 - 2006-02-24 10:00 - 00487424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp70.dll
2014-03-12 07:04 - 2014-03-12 07:09 - 00000000 ____D () C:\Cakewalk Content
2014-03-12 07:01 - 2014-03-12 07:14 - 00000000 ____D () C:\ProgramData\Cakewalk
2014-03-12 07:01 - 2014-03-12 07:14 - 00000000 ____D () C:\Program Files (x86)\Cakewalk
2014-03-09 18:07 - 2014-03-09 18:09 - 00635504 _____ () C:\Windows\Minidump\030914-40359-01.dmp
2014-03-08 15:51 - 2014-03-08 15:51 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Sony
2014-03-08 11:11 - 2014-03-08 15:42 - 27858496 _____ (Sony Mobile Communications ) C:\Users\Christoph Engen\Downloads\Sony PC Companion_Web.exe
2014-03-08 08:27 - 2014-03-08 08:27 - 00667264 _____ ( ) C:\Users\Christoph Engen\Downloads\skype_setup(1).exe
2014-03-06 18:17 - 2014-03-06 18:17 - 00000000 ____D () C:\Users\Christoph Engen\Documents\DVD Architect Studio 5.0 Projekte
2014-03-06 12:34 - 2014-03-06 12:34 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\WinRAR
2014-03-06 12:31 - 2014-03-06 12:31 - 00000000 ____D () C:\Program Files (x86)\WinRAR

==================== One Month Modified Files and Folders =======

2014-04-02 16:40 - 2014-03-28 13:11 - 00019858 _____ () C:\Users\Christoph Engen\Desktop\FRST.txt
2014-04-02 16:40 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\system32\sru
2014-04-02 16:39 - 2014-03-28 09:38 - 00000000 ____D () C:\FRST
2014-04-02 16:38 - 2014-04-02 16:38 - 00000762 _____ () C:\Users\Christoph Engen\Desktop\checkup.txt
2014-04-02 16:33 - 2014-04-02 16:33 - 00987442 _____ () C:\Users\Christoph Engen\Downloads\SecurityCheck.exe
2014-04-02 16:09 - 2013-03-13 08:28 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-02 16:09 - 2013-03-13 08:28 - 00001134 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-02 12:25 - 2014-04-02 12:25 - 02347384 _____ (ESET) C:\Users\Christoph Engen\Downloads\esetsmartinstaller_enu(2).exe
2014-04-02 12:21 - 2014-04-02 12:21 - 02347384 _____ (ESET) C:\Users\Christoph Engen\Downloads\esetsmartinstaller_enu(1).exe
2014-04-02 12:16 - 2012-09-18 07:49 - 01467553 _____ () C:\Windows\WindowsUpdate.log
2014-04-02 12:15 - 2014-04-02 12:15 - 02347384 _____ (ESET) C:\Users\Christoph Engen\Downloads\esetsmartinstaller_enu.exe
2014-04-02 12:14 - 2014-03-30 12:10 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-02 12:11 - 2014-04-02 11:58 - 00000000 ____D () C:\Users\Christoph Engen\Desktop\Alte Firefox-Daten
2014-04-02 12:04 - 2013-03-13 08:28 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-02 12:03 - 2013-03-13 08:28 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Local\Google
2014-04-02 11:54 - 2014-03-29 19:31 - 00001228 _____ () C:\Users\Christoph Engen\Desktop\Revo Uninstaller.lnk
2014-04-02 11:53 - 2014-04-02 11:53 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Desktop\revosetup95.exe
2014-04-02 11:52 - 2014-04-02 11:52 - 00001111 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-02 11:52 - 2014-02-15 07:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-02 11:52 - 2012-12-13 11:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-02 11:51 - 2014-04-02 11:51 - 00283192 _____ (Mozilla) C:\Users\Christoph Engen\Desktop\Firefox Setup Stub 28.0.exe
2014-04-02 09:30 - 2014-04-02 09:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Downloads\revosetup95(2).exe
2014-04-02 09:30 - 2014-03-29 19:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-02 05:14 - 2012-12-15 06:18 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Local\CrashDumps
2014-04-02 05:13 - 2013-03-29 11:58 - 00000000 ____D () C:\Users\Christoph Engen\Tracing
2014-04-02 05:12 - 2012-07-26 09:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-01 20:35 - 2012-07-26 07:26 - 01310720 ___SH () C:\Windows\system32\config\BBI
2014-04-01 11:51 - 2014-04-01 11:51 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Downloads\revosetup95(1).exe
2014-04-01 11:51 - 2014-04-01 11:51 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Downloads\revosetup95(1)(1).exe
2014-04-01 06:10 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-03-31 09:38 - 2014-03-31 09:38 - 01110476 _____ () C:\Users\Christoph Engen\Downloads\7z920.exe
2014-03-31 09:38 - 2014-03-31 09:38 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-03-31 08:50 - 2014-03-31 08:50 - 00003432 _____ () C:\Users\Christoph Engen\Desktop\JRT.txt
2014-03-31 08:45 - 2014-03-31 08:45 - 00000000 ____D () C:\Windows\ERUNT
2014-03-31 08:43 - 2014-03-31 08:43 - 01038974 _____ (Thisisu) C:\Users\Christoph Engen\Desktop\JRT.exe
2014-03-31 08:41 - 2014-03-31 08:41 - 00020117 _____ () C:\Users\Christoph Engen\Desktop\AdwCleaner[S0] Editor 31.3.2014.txt
2014-03-31 08:17 - 2014-03-28 23:04 - 00000000 ____D () C:\AdwCleaner
2014-03-31 08:14 - 2014-03-31 08:14 - 01950720 _____ () C:\Users\Christoph Engen\Downloads\adwcleaner.exe
2014-03-30 15:22 - 2012-08-03 04:22 - 00316182 _____ () C:\Windows\PFRO.log
2014-03-30 15:21 - 2014-03-30 15:21 - 00185980 _____ () C:\Users\Christoph Engen\Desktop\mbam.txt
2014-03-30 15:20 - 2014-02-27 17:15 - 00000000 ____D () C:\Update
2014-03-30 12:22 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\Globalization
2014-03-30 12:08 - 2014-03-30 12:08 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-30 12:08 - 2014-03-30 12:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-30 12:08 - 2014-03-30 12:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-03-30 12:06 - 2014-03-30 12:05 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\Christoph Engen\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-30 11:58 - 2012-07-26 07:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-03-30 11:56 - 2014-03-26 07:42 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-03-30 11:52 - 2012-07-26 10:12 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-03-30 10:24 - 2012-09-18 08:26 - 00753134 _____ () C:\Windows\system32\perfh007.dat
2014-03-30 10:24 - 2012-09-18 08:26 - 00155826 _____ () C:\Windows\system32\perfc007.dat
2014-03-30 10:24 - 2012-07-26 09:28 - 01212036 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-29 20:56 - 2014-03-29 20:56 - 02157056 _____ (Farbar) C:\Users\Christoph Engen\Downloads\FRST64(1).exe
2014-03-29 20:33 - 2014-03-29 20:33 - 02157056 _____ (Farbar) C:\Users\Christoph Engen\Desktop\FRST64.exe
2014-03-29 19:31 - 2014-03-29 19:31 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Christoph Engen\Downloads\revosetup95.exe
2014-03-29 19:27 - 2014-03-26 09:50 - 00000000 ___RD () C:\Users\Christoph Engen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-29 19:23 - 2014-03-29 07:07 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Nico Mak Computing
2014-03-29 07:04 - 2014-03-29 07:04 - 04894544 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmalwareprotector_1.exe
2014-03-28 23:13 - 2014-03-28 23:13 - 04892480 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmp_8(2).exe
2014-03-28 19:37 - 2013-01-13 15:21 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Local\Adobe
2014-03-28 17:04 - 2013-03-13 08:28 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-28 17:04 - 2013-03-13 08:28 - 00003874 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-28 16:31 - 2014-03-28 16:31 - 04892480 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmp_8(1).exe
2014-03-28 14:13 - 2014-03-28 14:13 - 00023703 _____ () C:\Users\Christoph Engen\Desktop\Addition.txt
2014-03-28 13:04 - 2014-03-28 09:57 - 00048696 _____ () C:\Users\Christoph Engen\Downloads\FRST.txt
2014-03-28 10:46 - 2014-03-28 10:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Christoph Engen\Downloads\wzmp_8.exe
2014-03-28 09:59 - 2014-03-28 09:58 - 00028236 _____ () C:\Users\Christoph Engen\Downloads\Addition.txt
2014-03-28 09:30 - 2014-03-28 09:30 - 00000492 _____ () C:\Users\Christoph Engen\Downloads\defogger_disable.log
2014-03-28 09:30 - 2014-03-28 09:30 - 00000000 _____ () C:\Users\Christoph Engen\defogger_reenable
2014-03-28 09:30 - 2012-12-08 18:17 - 00000000 ____D () C:\Users\Christoph Engen
2014-03-28 09:25 - 2014-03-28 09:25 - 00050477 _____ () C:\Users\Christoph Engen\Downloads\Defogger.exe
2014-03-28 06:31 - 2014-03-28 06:31 - 00573860 _____ () C:\Users\Christoph Engen\Desktop\DSZ_f_rs_Internet.eml
2014-03-27 11:19 - 2013-12-20 14:05 - 00000000 ____D () C:\Users\Christoph Engen\Documents\DIE SINGENDEN ZEHEN
2014-03-26 14:06 - 2014-01-30 14:57 - 00000000 ____D () C:\Users\Christoph Engen\Documents\CHRIS VITA
2014-03-26 10:54 - 2012-12-31 06:42 - 00940544 ___SH () C:\Users\Christoph Engen\Desktop\Thumbs.db
2014-03-26 10:13 - 2014-03-26 10:13 - 00279696 _____ () C:\Windows\Minidump\032614-55000-01.dmp
2014-03-26 10:13 - 2012-12-16 01:57 - 528456719 _____ () C:\Windows\MEMORY.DMP
2014-03-26 10:13 - 2012-12-16 01:57 - 00000000 ____D () C:\Windows\Minidump
2014-03-26 10:12 - 2014-03-26 10:12 - 00000000 __SHD () C:\found.001
2014-03-26 09:48 - 2013-04-14 10:12 - 00000000 ____D () C:\ProgramData\Sony
2014-03-26 09:48 - 2012-09-18 07:55 - 00000000 ____D () C:\Program Files (x86)\Sony
2014-03-26 07:52 - 2012-09-18 07:38 - 00379772 _____ () C:\Windows\DPINST.LOG
2014-03-26 07:52 - 2012-09-18 07:37 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-03-26 07:45 - 2014-03-26 07:44 - 00001170 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.scan.quick.results
2014-03-26 07:45 - 2014-03-26 07:44 - 00000314 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.uninstall.scan.results
2014-03-26 07:44 - 2014-03-26 07:44 - 00000000 _____ () C:\Users\Christoph Engen\AppData\Roaming\aps.scan.results
2014-03-26 07:43 - 2014-03-26 07:43 - 01172720 _____ (AnyProtect.com) C:\Users\Christoph Engen\AppData\Local\nst7B42.tmp
2014-03-26 07:43 - 2014-03-26 07:43 - 00000000 ____D () C:\Program Files (x86)\MediaPlayerplus
2014-03-26 07:43 - 2014-03-26 07:43 - 00000000 ____D () C:\2352408143b84ec165656890
2014-03-26 07:42 - 2012-07-26 10:12 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-03-25 05:13 - 2013-09-21 12:50 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Briefe  und Emails
2014-03-23 07:46 - 2014-03-23 07:45 - 00632696 _____ () C:\Windows\Minidump\032314-34781-01.dmp
2014-03-19 13:28 - 2013-04-14 10:10 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Sony
2014-03-16 10:20 - 2014-02-16 14:57 - 00000000 ____D () C:\Users\Christoph Engen\Documents\THE HEALING POWER OF A COURSE IN MIRACLES
2014-03-15 08:37 - 2013-06-11 09:57 - 00000000 ____D () C:\Users\Christoph Engen\Documents\FLYER
2014-03-14 10:23 - 2012-09-18 07:52 - 00000000 ____D () C:\ProgramData\McAfee
2014-03-14 08:00 - 2013-09-21 12:52 - 00000000 ____D () C:\Users\Christoph Engen\Documents\AUSSCHREIBUNGEN 2013
2014-03-14 07:19 - 2013-09-21 12:56 - 00000000 ____D () C:\Users\Christoph Engen\Documents\TEXTE
2014-03-12 15:05 - 2013-12-16 19:27 - 00358064 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-12 15:05 - 2012-09-18 07:53 - 00000000 ____D () C:\Program Files\Common Files\mcafee
2014-03-12 10:33 - 2012-09-18 08:24 - 00000000 ____D () C:\Program Files\McAfeeEx
2014-03-12 07:31 - 2014-03-12 07:15 - 00000000 ____D () C:\Cakewalk Projects
2014-03-12 07:15 - 2014-03-12 07:15 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\Cakewalk
2014-03-12 07:14 - 2014-03-12 07:01 - 00000000 ____D () C:\ProgramData\Cakewalk
2014-03-12 07:14 - 2014-03-12 07:01 - 00000000 ____D () C:\Program Files (x86)\Cakewalk
2014-03-12 07:11 - 2012-07-26 09:21 - 00033082 _____ () C:\Windows\setupact.log
2014-03-12 07:09 - 2014-03-12 07:04 - 00000000 ____D () C:\Cakewalk Content
2014-03-11 13:55 - 2014-02-25 12:33 - 00000000 ____D () C:\Users\Christoph Engen\Documents\AUDIO Die singenden Zehen
2014-03-10 19:37 - 2013-08-14 18:53 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Angebote
2014-03-09 18:09 - 2014-03-09 18:07 - 00635504 _____ () C:\Windows\Minidump\030914-40359-01.dmp
2014-03-08 15:51 - 2014-03-08 15:51 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Sony
2014-03-08 15:42 - 2014-03-08 11:11 - 27858496 _____ (Sony Mobile Communications ) C:\Users\Christoph Engen\Downloads\Sony PC Companion_Web.exe
2014-03-08 08:27 - 2014-03-08 08:27 - 00667264 _____ ( ) C:\Users\Christoph Engen\Downloads\skype_setup(1).exe
2014-03-06 18:41 - 2013-01-12 06:18 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\CyberLink
2014-03-06 18:17 - 2014-03-06 18:17 - 00000000 ____D () C:\Users\Christoph Engen\Documents\DVD Architect Studio 5.0 Projekte
2014-03-06 12:34 - 2014-03-06 12:34 - 00000000 ____D () C:\Users\Christoph Engen\AppData\Roaming\WinRAR
2014-03-06 12:31 - 2014-03-06 12:31 - 00000000 ____D () C:\Program Files (x86)\WinRAR
2014-03-06 12:09 - 2013-07-12 13:20 - 00000000 ____D () C:\Users\Christoph Engen\Documents\Miracles are no miracle!
2014-03-05 09:26 - 2014-03-30 12:08 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-05 09:26 - 2014-03-30 12:08 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-05 09:26 - 2014-03-30 12:08 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

Some content of TEMP:
====================
C:\Users\Christoph Engen\AppData\Local\Temp\APNStub.exe
C:\Users\Christoph Engen\AppData\Local\Temp\BackupSetup.exe
C:\Users\Christoph Engen\AppData\Local\Temp\ICReinstall_skype_setup.exe
C:\Users\Christoph Engen\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Christoph Engen\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Christoph Engen\AppData\Local\Temp\ose00000.exe
C:\Users\Christoph Engen\AppData\Local\Temp\Quarantine.exe
C:\Users\Christoph Engen\AppData\Local\Temp\setup.exe
C:\Users\Christoph Engen\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_is47EF.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_is5EF.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_is824C.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_is99ED.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_isC9D1.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_isDE12.exe
C:\Users\Christoph Engen\AppData\Local\Temp\_isF203.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2012-08-03 04:22

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Jetzt alles okay?

Hi Schrauber, guten Morgen!
Sag mal, mein McAfee Trusted Advisor Framework.Exe ist nicht mehr funktionsfähig, schreibt mir grad das Windows Wartungscenter. Auch läßt sich die McAfee Firewall nicht mehr aktivieren ...
Gruß!
Gulliver

Hi Schrauber,
meinerseits ist webssearches weg. Firefox funktioniert wieder normal. Bloss meine ,Firewall (McAfee) läßt sich nicht mehr aktivieren. ???
Danke schon mal für alles Bisherige!
Gulliver

Hi,
konnte jetzt McAfee-Firewall wieder aktivieren.
Grüße!

schrauber · 04.04.2014, 11:39

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\ProgramData\Updater

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Gulliver · 04.04.2014, 16:07

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by Christoph Engen at 2014-04-04 14:02:52 Run:2
Running from C:\Users\Christoph Engen\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\ProgramData\Updater
*****************

C:\ProgramData\Updater => Moved successfully.

==== End of Fixlog ====

Lieber Schrauber,

das eben war der fixlog.txt
Defogger hatte ich nicht benutzt und combofix auch nicht.
Starte dann demnächst dieses delfix, nicht?

Herzlichen Dank für Deine ganze Hilfe!
Überweisung etc. folgt später.

Gulliver

Lieber Schrauber,

habe mir jetzt Malwarebytes besorgt und auch ansonsten läuft, glaube ich, wieder alles bestens.
Vielen herzlichen Dank für Deine Hilfe!
Wie kann ich mich denn finanziell erkenntlich zeigen?

Grüsse!

Gulliver

schrauber · 05.04.2014, 10:50

Wenn Du magst kannste was spenden, siehe Link in meiner Signatur

und Gern Geschehen

02.04.2014, 08:49	#11
schrauber /// the machine /// TB-Ausbilder	Via vorgetäuschten java-update Malware webssearches.com eingefangen Du findest im programm Revo keinen Firefox? Dann deinstalliere ihn normal und mach den Rest. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

05.04.2014, 10:50	#15
schrauber /// the machine /// TB-Ausbilder	Via vorgetäuschten java-update Malware webssearches.com eingefangen Wenn Du magst kannste was spenden, siehe Link in meiner Signatur und Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Via vorgetäuschten java-update Malware webssearches.com eingefangen

Log-Analyse und Auswertung: Via vorgetäuschten java-update Malware webssearches.com eingefangen