| |
| |||||||
Log-Analyse und Auswertung: Windows Vista - search.fbdownloader in google chromeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
17.05.2014, 13:52
| #1 |
| |  Windows Vista - search.fbdownloader in google chrome Hallo, beim Start von Chrome öffnet immer eine zweite Registerkarte mit search.fbdownloader. defogger.disable.log defogger_disable by jpshortstuff (23.02.10.1) Log created at 11:44 on 17/05/2014 (Dirk) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- FRST.txt Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014 Ran by Dirk (administrator) on JOKER on 17-05-2014 11:49:41 Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\ehome\ehsched.exe (Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (The Eraser Project) C:\Program Files\Eraser\Eraser.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe (cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe (Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe () C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (Dominik Reichl) Y:\Live-Stick\KeePass\KeePass.exe (Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.) HKLM\...\Run: [] => [X] HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] () HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink) HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.) HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] () HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe" HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann) Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/ HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll () BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll () Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - No File DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin) Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12] FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR StartupUrls: "https://www.google.de/", "hxxp://wisersearch.com/?channel=de", "hxxp://www.google.com" CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org) CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04] CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG) R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG) S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin) R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin) R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] () R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR) S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions) S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG) S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security) R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software) R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies) R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.) R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG) R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X] S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X] S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable 2014-05-17 11:43 - 2014-05-17 11:49 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader 2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-05-17 10:45 - 2014-05-17 11:49 - 00000000 ____D () C:\FRST 2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-14 12:10 - 2014-05-17 11:23 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus 2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft 2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft 2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft 2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe 2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk 2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk 2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log ==================== One Month Modified Files and Folders ======= 2014-05-17 11:49 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader 2014-05-17 11:49 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST 2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable 2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk 2014-05-17 11:36 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job 2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat 2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001 2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 2014-05-17 11:32 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection 2014-05-17 11:32 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-17 11:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-17 11:28 - 2009-09-09 20:59 - 01077859 _____ () C:\Windows\WindowsUpdate.log 2014-05-17 11:25 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-05-17 11:23 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-05-17 11:22 - 2008-01-21 05:26 - 00302430 _____ () C:\Windows\PFRO.log 2014-05-17 11:22 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-17 11:21 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner 2014-05-17 11:21 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-05-17 11:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-17 11:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job 2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager 2014-05-17 10:26 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser 2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2014-05-14 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job 2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus 2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft 2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus 2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft 2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft 2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe 2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft 2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3 2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB 2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB 2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk 2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk 2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA 2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core 2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball 2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle 2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log 2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java Some content of TEMP: ==================== C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll C:\Users\Dirk\AppData\Local\Temp\avgnt.exe C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe C:\Users\Dirk\AppData\Local\Temp\ose00000.exe C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe C:\Users\Dirk\AppData\Local\Temp\tbWise.dll C:\Users\Dirk\AppData\Local\Temp\unwise.exe C:\Users\Dirk\AppData\Local\Temp\Update.exe C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll C:\Users\Jutta\AppData\Local\Temp\avgnt.exe C:\Users\Lisa\AppData\Local\Temp\avgnt.exe C:\Users\Nils\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-17 11:37 ==================== End Of Log ============================ Addition.txt Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014 Ran by Dirk (administrator) on JOKER on 17-05-2014 11:49:41 Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\ehome\ehsched.exe (Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (The Eraser Project) C:\Program Files\Eraser\Eraser.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe (cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe (Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe () C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (Dominik Reichl) Y:\Live-Stick\KeePass\KeePass.exe (Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.) HKLM\...\Run: [] => [X] HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] () HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink) HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.) HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] () HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe" HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom) HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann) Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/ HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll () BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll () Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - No File DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin) Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12] FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR StartupUrls: "https://www.google.de/", "hxxp://wisersearch.com/?channel=de", "hxxp://www.google.com" CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org) CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04] CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG) R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG) S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin) R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin) R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] () R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR) S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions) S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG) S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security) R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software) R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies) R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.) R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG) R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X] S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X] S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable 2014-05-17 11:43 - 2014-05-17 11:49 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader 2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-05-17 10:45 - 2014-05-17 11:49 - 00000000 ____D () C:\FRST 2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-14 12:10 - 2014-05-17 11:23 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus 2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft 2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft 2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft 2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe 2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk 2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk 2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log ==================== One Month Modified Files and Folders ======= 2014-05-17 11:49 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader 2014-05-17 11:49 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST 2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable 2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk 2014-05-17 11:36 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job 2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat 2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001 2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 2014-05-17 11:32 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection 2014-05-17 11:32 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-17 11:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-17 11:28 - 2009-09-09 20:59 - 01077859 _____ () C:\Windows\WindowsUpdate.log 2014-05-17 11:25 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-05-17 11:23 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2014-05-17 11:22 - 2008-01-21 05:26 - 00302430 _____ () C:\Windows\PFRO.log 2014-05-17 11:22 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-17 11:21 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner 2014-05-17 11:21 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-05-17 11:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-17 11:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job 2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager 2014-05-17 10:26 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser 2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2014-05-14 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job 2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus 2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft 2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus 2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft 2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft 2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe 2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft 2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3 2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB 2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB 2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk 2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk 2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA 2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core 2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball 2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle 2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log 2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java Some content of TEMP: ==================== C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll C:\Users\Dirk\AppData\Local\Temp\avgnt.exe C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe C:\Users\Dirk\AppData\Local\Temp\ose00000.exe C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe C:\Users\Dirk\AppData\Local\Temp\tbWise.dll C:\Users\Dirk\AppData\Local\Temp\unwise.exe C:\Users\Dirk\AppData\Local\Temp\Update.exe C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll C:\Users\Jutta\AppData\Local\Temp\avgnt.exe C:\Users\Lisa\AppData\Local\Temp\avgnt.exe C:\Users\Nils\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-17 11:37 ==================== End Of Log ============================ gmer.txt GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-05-17 14:23:02 Windows 6.0.6002 Service Pack 2 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST31500541AS rev.CC34 1397,27GB Running: Gmer-19357.exe; Driver: C:\Users\Dirk\AppData\Local\Temp\kgldypow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!EnableWindow 0000000074e40827 5 bytes JMP 00000001602d9ed4 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxParamA 0000000074e5081c 5 bytes JMP 0000000160429151 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamW 0000000074e52483 5 bytes JMP 00000001604291b6 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA 0000000074e54b7c 5 bytes JMP 00000001604290d8 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW 0000000074e69b0b 5 bytes JMP 000000016042905f .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000074e75fb7 5 bytes JMP 00000001602318b3 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamA 0000000074e76397 5 bytes JMP 000000016042921b .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxExA 0000000074e8d3ad 5 bytes JMP 0000000160428ffb .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxExW 0000000074e8d3d1 5 bytes JMP 0000000160428f97 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\OLEAUT32.dll!OleCreatePropertyFrameIndirect 00000000754c70a6 5 bytes JMP 00000001604293d0 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheetW 000000007458881c 5 bytes JMP 0000000160429280 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheet 0000000074588834 5 bytes JMP 0000000160429328 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\comdlg32.dll!PageSetupDlgW 00000000753aed29 5 bytes JMP 00000001604295c8 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!recv 000000007630343a 6 bytes JMP 71a60f5a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSASend 0000000076304496 6 bytes JMP 71a30f5a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!send 000000007630659b 6 bytes JMP 71a90f5a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult 0000000076308143 6 bytes JMP 71a00f5a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSARecv 0000000076308400 6 bytes JMP 71ac0f5a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_A 0000000077014572 6 bytes JMP 0000000160299805 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_W 000000007701457d 6 bytes JMP 00000001602f8082 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\kernel32.dll!CreateThread 0000000076508352 5 bytes JMP 00000001602975db .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CallNextHookEx 0000000074e37bb3 5 bytes JMP 00000001602f801f .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!GetKeyState 0000000074e38c38 5 bytes JMP 000000016027dd9b .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!GetAsyncKeyState 0000000074e3f2ca 5 bytes JMP 000000016027dec5 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000074e4010d 5 bytes JMP 000000016031ed28 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000074e403d2 5 bytes JMP 00000001602d25cc .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!EnableWindow 0000000074e40827 5 bytes JMP 00000001602d9ed4 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000074e417ea 5 bytes JMP 000000016030040f .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetKeyboardState 0000000074e4263b 5 bytes JMP 000000016042a565 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateWindowExA 0000000074e4280d 5 bytes JMP 00000001602a3627 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamW 0000000074e478d1 5 bytes JMP 0000000160429590 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!IsDialogMessageW 0000000074e4805d 5 bytes JMP 0000000160429c9e .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!EndDialog 0000000074e487af 5 bytes JMP 0000000160429f4a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamA 0000000074e4f8f3 5 bytes JMP 0000000160429558 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxParamA 0000000074e5081c 5 bytes JMP 0000000160429151 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamW 0000000074e52483 5 bytes JMP 00000001604291b6 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA 0000000074e54b7c 5 bytes JMP 00000001604290d8 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogParamA 0000000074e59b1b 5 bytes JMP 00000001604294e8 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!IsDialogMessage 0000000074e59c47 5 bytes JMP 0000000160429c76 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogParamW 0000000074e5bd5b 5 bytes JMP 0000000160429520 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW 0000000074e69b0b 5 bytes JMP 000000016042905f .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetCursorPos 0000000074e72a58 5 bytes JMP 000000016042a5e6 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000074e75fb7 5 bytes JMP 00000001602318b3 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamA 0000000074e76397 5 bytes JMP 000000016042921b .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxExA 0000000074e8d3ad 5 bytes JMP 0000000160428ffb .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxExW 0000000074e8d3d1 5 bytes JMP 0000000160428f97 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!keybd_event 0000000074e8d782 5 bytes JMP 000000016042a4ca .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SendInput 0000000074e95af6 5 bytes JMP 000000016042a50d .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\ole32.dll!OleLoadFromStream 0000000075541e80 5 bytes JMP 00000001604299a8 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!VariantClear 0000000075463df0 5 bytes JMP 0000000160429b1e .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString 0000000075463e40 5 bytes JMP 0000000160429aa0 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 000000007546462b 5 bytes JMP 0000000160429a12 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType 00000000754674bc 5 bytes JMP 0000000160429abe .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!OleCreatePropertyFrameIndirect 00000000754c70a6 5 bytes JMP 00000001604293d0 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheetW 000000007458881c 5 bytes JMP 0000000160429280 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheet 0000000074588834 5 bytes JMP 0000000160429328 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PrintDlgW 00000000753830cf 5 bytes JMP 000000016042966c .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PrintDlgA 00000000753834de 5 bytes JMP 0000000160429738 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PageSetupDlgW 00000000753aed29 5 bytes JMP 00000001604295c8 .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!recv 000000007630343a 6 bytes JMP 71a60f5a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSASend 0000000076304496 6 bytes JMP 71a30f5a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!send 000000007630659b 6 bytes JMP 71a90f5a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult 0000000076308143 6 bytes JMP 71a00f5a .text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSARecv 0000000076308400 6 bytes JMP 71ac0f5a ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamDWord] [7fef7f5741c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSet] [7fef7f55f10] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmEndSession] [7fef7f55674] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartSession] [7fef7f55e2c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartUpload] [7fef7f57f48] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppVersion] [7fef7f56a38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetMachineId] [7fef7f56ee8] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmWriteSharedMachineId] [7fef7f57b58] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmCreateNewId] [7fef7f57ea0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmReadSharedMachineId] [7fef7f578b0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmGetSession] [7fef7f54fb4] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppId] [7fef7f55d38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamString] [7fef7f57584] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification ---- Processes - GMER 2.1 ---- Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E2F02B9D-85EB-4BDD-9FE7-1DDB8D9D795A}\mpengine.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [308] (Microsoft Malware Protection Engine/Microsoft Corporation)(2014-05-17 06:59:46) 000007fefa190000 Library \\?\C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\trufos.dll (*** suspicious ***) @ C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [1020] (Trufos API/BitDefender S.R.L.)(2013-07-17 15:10:52) 000007fef5f80000 Library C:\ProgramData\Microsoft\Windows\DRM\Cache\Indiv01_64.key (*** suspicious ***) @ C:\Program Files\Windows Media Player\wmpnetwk.exe [2620] (Individualized Black Box DLL/Microsoft Corporation)(2014-02-02 16:56:14) 000000000ac00000 Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [4748] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000 Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Hardcopy\hardcopy.exe [4944] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 00000000021f0000 Process C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (*** suspicious ***) @ C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [5088] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:58) 00000000009f0000 Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [5088] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000000750000 Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Internet Explorer\iexplore.exe [3604] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000 Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Internet Explorer\iexplore.exe [4804] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000 Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe [5616] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000 ---- EOF - GMER 2.1 ---- Vielen Dank vorab für eure Hilfe |
|
17.05.2014, 14:25
| #2 |
| /// the machine /// TB-Ausbilder    | Windows Vista - search.fbdownloader in google chrome hi,
__________________ So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Addition.txt von FRST fehlt noch.
__________________ |
|
17.05.2014, 14:28
| #3 |
| | Windows Vista - search.fbdownloader in google chrome îch werde zukünftig auf das richtige Einfügen achten.
__________________Addition.txt ist aber dabei. |
|
18.05.2014, 12:25
| #4 |
| /// the machine /// TB-Ausbilder | Windows Vista - search.fbdownloader in google chrome ich schreibe das nit zum Spass. DU hast zweimal die FRST.txt gepostet anstatt der Addition.txt 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.05.2014, 16:25
| #5 |
| | Windows Vista - search.fbdownloader in google chrome defogger_disable.log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:44 on 17/05/2014 (Dirk)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
frst.txt FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Dirk (administrator) on JOKER on 17-05-2014 11:49:41
Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe
(Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
() C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Dominik Reichl) Y:\Live-Stick\KeePass\KeePass.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink)
HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.)
HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe
HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK
ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)
Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - No File
DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab
DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin)
Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://www.google.de/", "hxxp://wisersearch.com/?channel=de", "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File
CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File
CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]
CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)
S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG)
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X]
S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:43 - 2014-05-17 11:49 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-17 10:45 - 2014-05-17 11:49 - 00000000 ____D () C:\FRST
2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 12:10 - 2014-05-17 11:23 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
==================== One Month Modified Files and Folders =======
2014-05-17 11:49 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-17 11:49 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST
2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk
2014-05-17 11:36 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job
2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat
2014-05-17 11:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001
2014-05-17 11:32 - 2014-05-17 11:32 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-17 11:32 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-17 11:32 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-17 11:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-17 11:28 - 2009-09-09 20:59 - 01077859 _____ () C:\Windows\WindowsUpdate.log
2014-05-17 11:25 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-05-17 11:23 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-17 11:22 - 2008-01-21 05:26 - 00302430 _____ () C:\Windows\PFRO.log
2014-05-17 11:22 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-17 11:22 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-17 11:21 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner
2014-05-17 11:21 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-17 11:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-17 11:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job
2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager
2014-05-17 10:26 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser
2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-14 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job
2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3
2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB
2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA
2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core
2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball
2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java
Some content of TEMP:
====================
C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe
C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll
C:\Users\Dirk\AppData\Local\Temp\avgnt.exe
C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE
C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll
C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe
C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe
C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll
C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll
C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe
C:\Users\Dirk\AppData\Local\Temp\ose00000.exe
C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe
C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe
C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe
C:\Users\Dirk\AppData\Local\Temp\tbWise.dll
C:\Users\Dirk\AppData\Local\Temp\unwise.exe
C:\Users\Dirk\AppData\Local\Temp\Update.exe
C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe
C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe
C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe
C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll
C:\Users\Jutta\AppData\Local\Temp\avgnt.exe
C:\Users\Lisa\AppData\Local\Temp\avgnt.exe
C:\Users\Nils\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-17 11:37
==================== End Of Log ============================
--- --- --- addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by Dirk at 2014-05-17 11:50:09
Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
1&1 Upload-Manager (HKLM-x32\...\1&1 Upload-Manager) (Version: 2.0.676 - 1&1 Internet AG)
64 Bit HP CIO Components Installer (Version: 3.2.1 - Hewlett-Packard) Hidden
7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)
Ad-Aware Antivirus (HKLM\...\{6A16ADA5-0B30-4893-84AB-961B1340D14A}_AdAwareUpdater) (Version: 11.1.5354.0 - Lavasoft)
AdAwareInstaller (Version: 11.1.5354.0 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.1.5354.0 - Lavasoft) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0 - Adobe Systems Incorporated)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden
ALDI Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI Bestellsoftware) (Version: 4.12.2 - ORWO Net)
AntimalwareEngine (Version: 2.6.0.0 - Lavasoft) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version: - )
AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version: - )
AVM FRITZ!fax für FRITZ!Box (HKLM-x32\...\FRITZ! 2.0) (Version: - AVM Berlin)
BufferChm (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
C309a (x32 Version: 120.0.202.000 - Hewlett-Packard) Hidden
calibre 64bit (HKLM\...\{1BC00DD4-173E-4325-BDB7-48A076DFC1EF}) (Version: 1.29.0 - Kovid Goyal)
Camera Support Core Library (x32 Version: 7.2.0.4 - Canon) Hidden
Camera Window DS (x32 Version: 5.1 - Canon) Hidden
Camera Window DVC (x32 Version: 5.1 - Canon) Hidden
Camera Window MC (x32 Version: 5.1 - Canon) Hidden
Canon Camera Support Core Library (HKLM-x32\...\InstallShield_{5662C158-CA24-4228-BF6C-596FADA08682}) (Version: 7.2.0.4 - Canon)
Canon Camera WIA Driver (x32 Version: 5.6 - Canon) Hidden
Canon Camera Window DS for ZoomBrowser EX (HKLM-x32\...\InstallShield_{7B847C9D-6758-45E6-B598-3BD8F43EAE9E}) (Version: 5.1 - Canon)
Canon Camera Window DVC for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A70D14C6-FF2C-4B8E-A643-7E74EC607614}) (Version: 5.1 - Canon)
Canon Camera Window for ZoomBrowser EX (HKLM-x32\...\InstallShield_{E73534D5-CC93-4C63-9072-5A9734255C74}) (Version: 5.1 - Canon)
Canon EOS Kiss_N REBEL_XT 350D WIA-Treiber (HKLM-x32\...\InstallShield_{33CF7CDF-9805-4500-9CC7-D19D52AD63C4}) (Version: 5.6 - Canon)
Canon Internet Library for ZoomBrowser EX (HKLM-x32\...\InstallShield_{954BF446-BBC9-42CC-87A6-EBF0D55CA19A}) (Version: 1.3.4 - Canon Inc.)
Canon PhotoRecord (HKLM-x32\...\{862983D7-FA08-493E-A9ED-6B7859E069D3}) (Version: 02.02.01000 - Cisra)
Canon RAW Image Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A0F34E4E-25F0-4B68-AE8F-EF0C15CB1FED}) (Version: 2.0 - Canon)
Canon RemoteCapture Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{28291BD5-92D2-4685-82DC-CCA925C53CCA}) (Version: 1.1 - Canon)
Canon Utilities Digital Photo Professional 3.4 (HKLM-x32\...\DPP) (Version: 3.4.1.1 - )
Canon Utilities EOS Capture 1.3 (HKLM-x32\...\InstallShield_{16480125-0428-4097-9A2A-74464004D169}) (Version: 1.3 - Canon)
Canon Utilities PhotoStitch 3.1 (HKLM-x32\...\InstallShield_{218BBBE3-FE63-4BB2-81A8-7435575A84FA}) (Version: 3.1.14 - Canon)
Canon ZoomBrowser EX (HKLM-x32\...\{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}) (Version: 5.00.0000 - Canon)
CyberLink PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.3.5711.0 - CyberLink Corp.)
Destination Component (x32 Version: 110.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
devolo dLAN Cockpit (HKLM-x32\...\dlancockpit) (Version: 3.0.0.0 - devolo AG)
dLAN Cockpit (HKLM-x32\...\Cockpit.92121A72F826FA9D0BD3A830E7F04987B31AFB22.1) (Version: 3 (23.12.2010) - devolo AG)
dLAN Cockpit (x32 Version: 3.23.12 - devolo AG) Hidden
DocProc (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden
DVDFab 8.0.7.3 (29/01/2011) (HKLM-x32\...\DVDFab 8_is1) (Version: - Fengtao Software Inc.)
EASEUS Data Recovery Wizard Free Edition 5.5.1 (HKLM-x32\...\EASEUS Data Recovery Wizard Free Edition 5.5.1_is1) (Version: - EASEUS)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.20140114 - Landesfinanzdirektion Thüringen)
ElsterFormular 2007/2008 (HKLM-x32\...\{5BA43E5C-66FD-48D2-AB40-B807D457EF83}) (Version: 9.6.2.0 NE - Steuerverwaltung des Bundes und der Länder)
ElsterFormular 2008/2009 (HKLM-x32\...\{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}) (Version: 10.3.2.0 - Steuerverwaltung des Bundes und der Länder)
EOS Capture 1.3 (x32 Version: 1.3 - Canon) Hidden
Eraser 5.8.7 (HKLM\...\{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1) (Version: Eraser 5.8.7 - The Eraser Project)
fassurun 2013.11.07.203951 (HKLM\...\fassurun) (Version: 2013.11.07.203951 - fassurun) <==== ATTENTION
Fax (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
Free Download Manager 3.9.2 (HKLM-x32\...\Free Download Manager_is1) (Version: - FreeDownloadManager.ORG)
FRITZ!DSL64 (HKLM\...\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}) (Version: 2.04.03 - AVM Berlin)
Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Chrome Frame (HKLM-x32\...\{CD4ABC29-0547-388C-B8BC-EF88333E5C2E}) (Version: 65.119.72 - Google, Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hardcopy (C:\Program Files (x86)\Hardcopy) (HKLM-x32\...\Hardcopy(C__Program Files (x86)_Hardcopy)) (Version: 17.0.18 - www.hardcopy.de)
Hauppauge MCE XP/Vista Software Encoder (2.0.27022) (HKLM-x32\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.27022 - Hauppauge Computer Works, Inc.)
HP Customer Participation Program 12.0 (HKLM\...\HPExtendedCapabilities) (Version: 12.0 - HP)
HP Imaging Device Functions 12.0 (HKLM\...\HP Imaging Device Functions) (Version: 12.0 - HP)
HP Photosmart C309a All-In-One Driver Software 12.0 Rel .5 (HKLM\...\{2D250E57-9890-44a6-B08F-5C02C991EF24}) (Version: 12.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 120.0.150.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.2.0 - LIGHTNING UK!)
Internet Library (x32 Version: 1.3.4 - Canon Inc.) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)
J2SE Runtime Environment 5.0 (HKLM-x32\...\{3248F0A8-6813-11D6-A77B-00B0D0150000}) (Version: 1.5.0 - Sun Microsystems, Inc.)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
KeePass Password Safe 2.10 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: - Dominik Reichl)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
MarketResearch (x32 Version: 120.0.226.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVC80_x64 (Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86 (x32 Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSVCSetup (x32 Version: 1.00.0000 - HP) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{801189ff-e34f-423a-9f10-b423502b163f}) (Version: - Nero AG)
Nero BurnRights (x32 Version: 3.4.10.100 - Nero AG) Hidden
Nero BurnRights Help (x32 Version: 3.4.4.100 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero CoverDesigner (x32 Version: 4.4.9.202 - Nero AG) Hidden
Nero CoverDesigner Help (x32 Version: 4.4.6.100 - Nero AG) Hidden
Nero DiscSpeed (x32 Version: 5.4.10.100 - Nero AG) Hidden
Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden
Nero DriveSpeed (x32 Version: 4.4.10.100 - Nero AG) Hidden
Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden
Nero InfoTool (x32 Version: 6.4.10.100 - Nero AG) Hidden
Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden
Nero StartSmart (x32 Version: 9.4.11.201 - Nero AG) Hidden
Nero StartSmart Help (x32 Version: 9.4.1.100 - Nero AG) Hidden
Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Network64 (Version: 120.0.194.000 - Hewlett-Packard) Hidden
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9745 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.59.37 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
OCR Software by I.R.I.S. 12.0 (HKLM\...\HPOCR) (Version: 12.0 - HP)
OpenOffice.org 3.1 (HKLM-x32\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9420 - OpenOffice.org)
Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)
PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)
PDF Editor 2 (HKLM-x32\...\PDF Editor 2) (Version: - )
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)
pdfforge Toolbar v4.6 (HKLM-x32\...\{E6098043-1183-4580-89EF-423CBF807188}) (Version: 4.6 - Spigot, Inc.) <==== ATTENTION
Phase 5 HTML-Editor (HKLM-x32\...\{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}) (Version: 5.6.2 - Systemberatung Schommer)
PhotoStitch (x32 Version: 3.1.14 - Canon) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)
ProgDVB x64 (HKLM\...\ProgDVB) (Version: 6.9x - Prog)
PS_AIO_05_C309_Software_Min (x32 Version: 120.0.206.000 - Hewlett-Packard) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
RAW Image Task 2.0 (x32 Version: 2.0 - Canon) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5874 - Realtek Semiconductor Corp.)
RemoteCapture Task 1.1 (x32 Version: 1.1 - Canon) Hidden
Scan (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 12 - HP)
SIS-Handball 3.9 (HKLM-x32\...\SIS-Handball) (Version: 3.9 - GateCom GmbH)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
St. Louis Rams Toolbar (HKLM-x32\...\St. Louis Rams Toolbar) (Version: 1.514 - )
Status (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
Stellar Phoenix Photo Recovery (HKLM-x32\...\Stellar Phoenix Photo Recovery_is1) (Version: 4.0.0.0 - Stellar Information Systems Ltd)
SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
SystemDiagnostics (HKLM-x32\...\{80B0B731-5FAE-475D-8844-20F46373780D}) (Version: 3.02.0010 - Fujitsu Technology Solutions)
teXXas (HKLM-x32\...\{F3DCD04C-BE9C-408C-BC8C-B77AF972DBC2}) (Version: 1 - metaspinner net GmbH)
TomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Toolbox (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
WebReg (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live OneCare safety scanner (HKLM-x32\...\Windows Live OneCare safety scanner) (Version: - Microsoft Corporation)
Windows Live OneCare safety scanner (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
XP Codec Pack (HKLM-x32\...\XP Codec Pack) (Version: - )
==================== Restore Points =========================
16-03-2014 11:47:26 Installed calibre 64bit
21-03-2014 18:10:12 Installed calibre 64bit
16-04-2014 15:01:22 Windows Update
27-04-2014 09:58:17 Installed Java 7 Update 55
27-04-2014 10:05:33 Removed Java 7 Update 55
27-04-2014 10:17:56 Installed Java 7 Update 55
12-05-2014 15:12:38 Windows Update
12-05-2014 18:07:07 OpenOffice.org 3.1 wird entfernt
12-05-2014 18:13:37 AA11
14-05-2014 10:04:25 AA11
14-05-2014 11:40:48 Windows Update
14-05-2014 12:43:05 Windows Update
==================== Hosts content: ==========================
2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {01503B02-7AF4-4ED7-9E3F-97049297213F} - System32\Tasks\{B7B91C77-1E48-44BE-8E9F-FC08EE02125A} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {5E551E2D-6024-438A-B6BB-4BD2C63E230F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {600D1CE0-FC0C-464E-AC3B-FA5F135D3915} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {6A3BC972-B370-45E3-AD15-370CFD3EE8F9} - System32\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F} => C:\Program Files\V-bates\PrefHelper.exe
Task: {7A936888-6D24-4B69-9A45-EAEA6C3F1EFF} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {7BA40AA9-D6BC-4D03-A0C0-398717389FC7} - System32\Tasks\{F7A8E834-BD3C-4504-885B-1E637D64FEC7} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {8CFE1E32-B04E-456C-989C-1AA1556BE805} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)
Task: {B384F716-A243-4440-91D6-34FA3643F784} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)
Task: {BF328AF9-E972-4814-BA2B-8955BE07E803} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)
Task: {E3891FA7-79D4-4A37-A8CC-B7D9ADEDDCEC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job => C:\Program Files\V-bates\PrefHelper.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2009-11-19 19:34 - 2006-02-23 13:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll
2009-11-19 19:34 - 2006-02-22 12:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll
2014-01-23 16:09 - 2014-01-23 16:09 - 00702744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
2014-01-23 16:30 - 2014-01-23 16:30 - 00103800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_thread-vc100-mt-1_55.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00024440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_system-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00033656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_chrono-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00055680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_date_time-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00123776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_filesystem-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 03720040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareServiceKernel.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00685904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SQLite.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00158032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\pugixml.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 02595144 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\RCF.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00788856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_regex-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00602984 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareActivation.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareApplicationUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00142696 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareGamingMode.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00098648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareReset.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00120152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTime.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00268152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00198024 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdaterScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00417128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIgnoreList.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00253800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareQuarantine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00293744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiMalwareEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00212336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiRootkitEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00509808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerHistory.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00607584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScanner.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00035192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_timer-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00325488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00333688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareRealTimeProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00227688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIncompatibles.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00219488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiSpam.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00129896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiPhishing.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00599920 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareParentalControl.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 01926504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareWebProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00263536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareEmailProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00650608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareNetworkProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00490848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareInstaller.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00106824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\zlib.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00149840 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\libssh2.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00358744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwarePromo.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareFeedback.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00154464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SecurityCenter.dll
2013-07-17 17:10 - 2013-07-17 17:10 - 00777296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\BDSmartDB.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 04114264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
2014-01-23 16:29 - 2014-01-23 16:29 - 00500088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_locale-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00361824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\HtmlFramework.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00066904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\DllStorage.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00788848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTrayDefaultSkin.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00139608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\Localization.dll
2009-10-03 10:51 - 2008-12-02 14:21 - 00041984 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_ex.exe
2009-10-03 10:51 - 2009-06-10 06:19 - 00057856 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_x64.dll
2012-12-21 19:33 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2009-10-03 10:51 - 2009-09-25 16:50 - 00445440 _____ () C:\Program Files (x86)\Hardcopy\HcDllS.dll
2009-10-03 10:51 - 2009-08-19 13:20 - 00043008 _____ () C:\Program Files (x86)\Hardcopy\hardcopy_02.dll
2009-10-03 10:51 - 2009-06-10 06:19 - 00057344 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_Win32.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:A8665DF4
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^Users^Dirk^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: BDRegion => "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe"
MSCONFIG\startupreg: Google EULA Launcher => c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA
MSCONFIG\startupreg: NokiaMServer => C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
MSCONFIG\startupreg: NokiaMusic FastStart => "C:\Program Files (x86)\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart
MSCONFIG\startupreg: NokiaOviSuite2 => C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
MSCONFIG\startupreg: RemoteControl => "C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
==================== Faulty Device Manager Devices =============
Name: Photosmart C309a series
Description: Photosmart C309a series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/17/2014 11:24:13 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/17/2014 10:29:42 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (05/17/2014 11:24:13 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt
Error: (05/17/2014 11:24:13 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Util fassurun%%3
Error: (05/17/2014 10:31:34 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {7F6316B4-4D69-4765-B0A3-B2598F2FA80A}
Error: (05/17/2014 10:30:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Mobile-basierte Geräteverbindung%%1053
Error: (05/17/2014 10:30:14 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Mobile-basierte Geräteverbindung
Error: (05/17/2014 10:30:14 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053RapiMgr{ED081F25-6A77-4C89-B689-C6E15C582EC1}
Error: (05/17/2014 10:29:44 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt
Error: (05/17/2014 10:29:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Util fassurun%%3
Microsoft Office Sessions:
=========================
Error: (05/01/2014 07:39:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 36965 seconds with 180 seconds of active time. This session ended with a crash.
Error: (03/12/2014 07:08:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 58 seconds with 0 seconds of active time. This session ended with a crash.
Error: (02/03/2014 07:02:12 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2689 seconds with 600 seconds of active time. This session ended with a crash.
Error: (02/16/2013 02:55:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.
Error: (12/22/2012 09:18:07 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.
Error: (12/09/2012 10:54:19 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.
Error: (12/09/2012 10:54:02 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.
Error: (07/09/2012 00:55:39 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 28 seconds with 0 seconds of active time. This session ended with a crash.
Error: (07/06/2012 11:28:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 43 seconds with 0 seconds of active time. This session ended with a crash.
Error: (05/31/2012 08:02:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-05-12 20:15:20.405
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\i386\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-12 20:15:20.018
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\i386\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-12 20:15:19.625
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\i386\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-12 20:15:19.223
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\i386\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-12 20:15:18.794
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\amd64\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-12 20:15:18.416
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\amd64\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-12 20:15:18.049
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\amd64\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-12 20:15:17.668
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Ad-Aware Antivirus\Drivers\amd64\wlh\sbhips.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-18 13:11:06.987
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-01-18 13:11:06.648
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 49%
Total physical RAM: 4094.32 MB
Available physical RAM: 2047.72 MB
Total Pagefile: 8395.91 MB
Available Pagefile: 6076.74 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: (SYSTEM) (Fixed) (Total:164.75 GB) (Free:30.54 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (DATA) (Fixed) (Total:1220.5 GB) (Free:761.28 GB) NTFS
Drive y: (Two-Face) (Removable) (Total:14.89 GB) (Free:13.49 GB) exFAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 1397 GB) (Disk ID: FCD6DD83)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=165 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=-888516751360) - (Type=07 NTFS)
========================================================
Disk: 5 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: 98720C68)
Partition 1: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
==================== End Of Log ============================
gmer.txt Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-17 14:23:02
Windows 6.0.6002 Service Pack 2 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST31500541AS rev.CC34 1397,27GB
Running: Gmer-19357.exe; Driver: C:\Users\Dirk\AppData\Local\Temp\kgldypow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!EnableWindow 0000000074e40827 5 bytes JMP 00000001602d9ed4
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxParamA 0000000074e5081c 5 bytes JMP 0000000160429151
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamW 0000000074e52483 5 bytes JMP 00000001604291b6
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA 0000000074e54b7c 5 bytes JMP 00000001604290d8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW 0000000074e69b0b 5 bytes JMP 000000016042905f
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000074e75fb7 5 bytes JMP 00000001602318b3
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamA 0000000074e76397 5 bytes JMP 000000016042921b
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxExA 0000000074e8d3ad 5 bytes JMP 0000000160428ffb
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\USER32.dll!MessageBoxExW 0000000074e8d3d1 5 bytes JMP 0000000160428f97
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\OLEAUT32.dll!OleCreatePropertyFrameIndirect 00000000754c70a6 5 bytes JMP 00000001604293d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheetW 000000007458881c 5 bytes JMP 0000000160429280
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheet 0000000074588834 5 bytes JMP 0000000160429328
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\comdlg32.dll!PageSetupDlgW 00000000753aed29 5 bytes JMP 00000001604295c8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!recv 000000007630343a 6 bytes JMP 71a60f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSASend 0000000076304496 6 bytes JMP 71a30f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!send 000000007630659b 6 bytes JMP 71a90f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult 0000000076308143 6 bytes JMP 71a00f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[3604] C:\Windows\syswow64\WS2_32.dll!WSARecv 0000000076308400 6 bytes JMP 71ac0f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_A 0000000077014572 6 bytes JMP 0000000160299805
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\SysWOW64\ntdll.dll!NtdllDefWindowProc_W 000000007701457d 6 bytes JMP 00000001602f8082
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\kernel32.dll!CreateThread 0000000076508352 5 bytes JMP 00000001602975db
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CallNextHookEx 0000000074e37bb3 5 bytes JMP 00000001602f801f
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!GetKeyState 0000000074e38c38 5 bytes JMP 000000016027dd9b
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!GetAsyncKeyState 0000000074e3f2ca 5 bytes JMP 000000016027dec5
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000074e4010d 5 bytes JMP 000000016031ed28
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000074e403d2 5 bytes JMP 00000001602d25cc
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!EnableWindow 0000000074e40827 5 bytes JMP 00000001602d9ed4
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000074e417ea 5 bytes JMP 000000016030040f
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetKeyboardState 0000000074e4263b 5 bytes JMP 000000016042a565
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateWindowExA 0000000074e4280d 5 bytes JMP 00000001602a3627
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamW 0000000074e478d1 5 bytes JMP 0000000160429590
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!IsDialogMessageW 0000000074e4805d 5 bytes JMP 0000000160429c9e
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!EndDialog 0000000074e487af 5 bytes JMP 0000000160429f4a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamA 0000000074e4f8f3 5 bytes JMP 0000000160429558
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxParamA 0000000074e5081c 5 bytes JMP 0000000160429151
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamW 0000000074e52483 5 bytes JMP 00000001604291b6
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA 0000000074e54b7c 5 bytes JMP 00000001604290d8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogParamA 0000000074e59b1b 5 bytes JMP 00000001604294e8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!IsDialogMessage 0000000074e59c47 5 bytes JMP 0000000160429c76
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!CreateDialogParamW 0000000074e5bd5b 5 bytes JMP 0000000160429520
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW 0000000074e69b0b 5 bytes JMP 000000016042905f
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SetCursorPos 0000000074e72a58 5 bytes JMP 000000016042a5e6
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxParamW 0000000074e75fb7 5 bytes JMP 00000001602318b3
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!DialogBoxIndirectParamA 0000000074e76397 5 bytes JMP 000000016042921b
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxExA 0000000074e8d3ad 5 bytes JMP 0000000160428ffb
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!MessageBoxExW 0000000074e8d3d1 5 bytes JMP 0000000160428f97
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!keybd_event 0000000074e8d782 5 bytes JMP 000000016042a4ca
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\USER32.dll!SendInput 0000000074e95af6 5 bytes JMP 000000016042a50d
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\ole32.dll!OleLoadFromStream 0000000075541e80 5 bytes JMP 00000001604299a8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!VariantClear 0000000075463df0 5 bytes JMP 0000000160429b1e
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!SysFreeString 0000000075463e40 5 bytes JMP 0000000160429aa0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 000000007546462b 5 bytes JMP 0000000160429a12
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!VariantChangeType 00000000754674bc 5 bytes JMP 0000000160429abe
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\OLEAUT32.dll!OleCreatePropertyFrameIndirect 00000000754c70a6 5 bytes JMP 00000001604293d0
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheetW 000000007458881c 5 bytes JMP 0000000160429280
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll!PropertySheet 0000000074588834 5 bytes JMP 0000000160429328
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PrintDlgW 00000000753830cf 5 bytes JMP 000000016042966c
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PrintDlgA 00000000753834de 5 bytes JMP 0000000160429738
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\comdlg32.dll!PageSetupDlgW 00000000753aed29 5 bytes JMP 00000001604295c8
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!recv 000000007630343a 6 bytes JMP 71a60f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSASend 0000000076304496 6 bytes JMP 71a30f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!send 000000007630659b 6 bytes JMP 71a90f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult 0000000076308143 6 bytes JMP 71a00f5a
.text C:\Program Files (x86)\Internet Explorer\iexplore.exe[4804] C:\Windows\syswow64\WS2_32.dll!WSARecv 0000000076308400 6 bytes JMP 71ac0f5a
---- User IAT/EAT - GMER 2.1 ----
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamDWord] [7fef7f5741c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSet] [7fef7f55f10] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmEndSession] [7fef7f55674] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartSession] [7fef7f55e2c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartUpload] [7fef7f57f48] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppVersion] [7fef7f56a38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetMachineId] [7fef7f56ee8] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmWriteSharedMachineId] [7fef7f57b58] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmCreateNewId] [7fef7f57ea0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmReadSharedMachineId] [7fef7f578b0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmGetSession] [7fef7f54fb4] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppId] [7fef7f55d38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2500] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamString] [7fef7f57584] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E2F02B9D-85EB-4BDD-9FE7-1DDB8D9D795A}\mpengine.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [308] (Microsoft Malware Protection Engine/Microsoft Corporation)(2014-05-17 06:59:46) 000007fefa190000
Library \\?\C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\trufos.dll (*** suspicious ***) @ C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [1020] (Trufos API/BitDefender S.R.L.)(2013-07-17 15:10:52) 000007fef5f80000
Library C:\ProgramData\Microsoft\Windows\DRM\Cache\Indiv01_64.key (*** suspicious ***) @ C:\Program Files\Windows Media Player\wmpnetwk.exe [2620] (Individualized Black Box DLL/Microsoft Corporation)(2014-02-02 16:56:14) 000000000ac00000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [4748] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Hardcopy\hardcopy.exe [4944] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 00000000021f0000
Process C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (*** suspicious ***) @ C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [5088] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:58) 00000000009f0000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [5088] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000000750000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Internet Explorer\iexplore.exe [3604] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Program Files (x86)\Internet Explorer\iexplore.exe [4804] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000
Library C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.dll (*** suspicious ***) @ C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe [5616] (Ad-Aware Browsing Protection and Anti-Phishing/Lavasoft)(2013-01-31 15:11:52) 0000000010000000
---- EOF - GMER 2.1 ----
|
|
20.05.2014, 11:31
| #6 |
| /// the machine /// TB-Ausbilder | Windows Vista - search.fbdownloader in google chrome Adware & Co. deinstallieren
Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter: Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Windows Vista - search.fbdownloader in google chrome |
|
22.05.2014, 20:38
| #7 |
| | Windows Vista - search.fbdownloader in google chrome Hallo, hier die logs: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 22.05.2014 Suchlauf-Zeit: 19:41:48 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.05.22.08 Rootkit Datenbank: v2014.05.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x64 Dateisystem: NTFS Benutzer: Dirk Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 391051 Verstrichene Zeit: 32 Min, 8 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 6 PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709], PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709], PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709], PUP.Optional.FreeCauseTB.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\FREECAUSE\Toolbars, Keine Aktion durch Benutzer, [e18f59fb6615082eb6f65347c43e15eb], PUP.Optional.FreeCauseTB.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\FREECAUSE\Toolbars, Keine Aktion durch Benutzer, [afc1a1b343383ff7a3090f8b17ebfb05], PUP.Optional.FreeCauseTB.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\FREECAUSE\Toolbars, Keine Aktion durch Benutzer, [f17fafa53249b2846448831722e0c040], Registrierungswerte: 6 PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{043C5167-00BB-4324-AF7E-62013FAEDACF}, å?§Ð¼Â»ä?¤çº¯Å¢ê¸¿ì¿?, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709] PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{043C5167-00BB-4324-AF7E-62013FAEDACF}, å?§Ð¼Â»ä?¤çº¯Å¢ê¸¿ì¿?, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709] PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{043C5167-00BB-4324-AF7E-62013FAEDACF}, å?§Ð¼Â»ä?¤çº¯Å¢ê¸¿ì¿?, Keine Aktion durch Benutzer, [0b659eb6b7c4f244f7be8f9a38caf709] PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [7ef284d0e4975ed8fcb9c7628a78fa06], PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [5818fe563b40b4825d58ec3d6e945ba5], PUP.Optional.VShare.A, HKU\S-1-5-21-3839580519-3571548420-1780697189-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{043C5167-00BB-4324-AF7E-62013FAEDACF}, Keine Aktion durch Benutzer, [7cf497bdadce171fcbea0b1e30d2da26], Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 22/05/2014 um 20:57:48
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# Benutzername : Dirk - JOKER
# Gestartet von : C:\Users\Dirk\Desktop\Beseitigung von FBDownloader\adwcleaner_3.210.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16545
-\\ Google Chrome v
[ Datei : C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Search Provider] : hxxp://wisersearch.com/search.php?channel=de&q={searchTerms}
Gelöscht [Search Provider] : hxxp://lavasoft.blekko.com/ws/?source=f439e2c0&tbp=rbox&toolbarid=adawaretb&u=F573A8927EB76E2851AE0D511F4E36C0&q={searchTerms}
Gelöscht [Startup_urls] : hxxp://wisersearch.com/?channel=de
*************************
AdwCleaner[R0].txt - [11152 octets] - [11/01/2014 11:32:14]
AdwCleaner[R1].txt - [1310 octets] - [11/01/2014 13:42:46]
AdwCleaner[R2].txt - [1162 octets] - [11/01/2014 16:11:01]
AdwCleaner[R3].txt - [1243 octets] - [11/01/2014 22:58:08]
AdwCleaner[R4].txt - [1363 octets] - [12/01/2014 12:14:55]
AdwCleaner[R5].txt - [1334 octets] - [12/01/2014 13:10:52]
AdwCleaner[R6].txt - [2196 octets] - [18/01/2014 11:11:17]
AdwCleaner[R7].txt - [1575 octets] - [18/01/2014 16:08:38]
AdwCleaner[R8].txt - [2805 octets] - [17/05/2014 11:04:35]
AdwCleaner[R9].txt - [2160 octets] - [22/05/2014 20:42:54]
AdwCleaner[S0].txt - [10522 octets] - [11/01/2014 11:34:43]
AdwCleaner[S1].txt - [1371 octets] - [11/01/2014 13:46:58]
AdwCleaner[S2].txt - [1224 octets] - [11/01/2014 16:12:43]
AdwCleaner[S3].txt - [1305 octets] - [11/01/2014 22:59:59]
AdwCleaner[S4].txt - [1396 octets] - [12/01/2014 13:13:10]
AdwCleaner[S5].txt - [2267 octets] - [18/01/2014 11:14:00]
AdwCleaner[S6].txt - [3118 octets] - [17/05/2014 11:21:10]
AdwCleaner[S7].txt - [2081 octets] - [22/05/2014 20:57:48]
########## EOF - C:\AdwCleaner\AdwCleaner[S7].txt - [2141 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows (TM) Vista Home Premium x64
Ran by Dirk on 22.05.2014 at 21:13:50,06
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\adawarebp
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.05.2014 at 21:24:50,85
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Dirk (administrator) on JOKER on 22-05-2014 21:27:17
Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe
(Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
() C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink)
HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.)
HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe
HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK
ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)
Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - No File
DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab
DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin)
Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://www.google.de/",
"hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File
CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File
CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]
CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)
S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG)
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X]
S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-22 21:24 - 2014-05-22 21:24 - 00000730 _____ () C:\Users\Dirk\Desktop\JRT.txt
2014-05-22 21:01 - 2014-05-22 21:01 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-22 19:40 - 2014-05-22 20:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-22 19:39 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-22 19:39 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-22 19:22 - 2014-05-22 19:22 - 00001105 _____ () C:\Users\Dirk\Desktop\Revo Uninstaller.lnk
2014-05-22 19:22 - 2014-05-22 19:22 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-17 14:40 - 2014-05-17 14:40 - 00291320 _____ () C:\Windows\Minidump\Mini051714-01.dmp
2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:43 - 2014-05-22 21:27 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-17 10:45 - 2014-05-22 21:27 - 00000000 ____D () C:\FRST
2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 12:10 - 2014-05-22 20:59 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
==================== One Month Modified Files and Folders =======
2014-05-22 21:27 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-22 21:27 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST
2014-05-22 21:24 - 2014-05-22 21:24 - 00000730 _____ () C:\Users\Dirk\Desktop\JRT.txt
2014-05-22 21:09 - 2009-09-09 20:59 - 01154858 _____ () C:\Windows\WindowsUpdate.log
2014-05-22 21:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-22 21:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job
2014-05-22 21:06 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job
2014-05-22 21:02 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-05-22 21:01 - 2014-05-22 21:01 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-22 21:01 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-22 21:01 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-22 21:01 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat
2014-05-22 21:01 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001
2014-05-22 20:59 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-22 20:59 - 2008-01-21 05:26 - 00302744 _____ () C:\Windows\PFRO.log
2014-05-22 20:59 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-22 20:59 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-22 20:59 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-22 20:58 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-22 20:57 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner
2014-05-22 20:38 - 2014-05-22 19:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-22 20:32 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser
2014-05-22 20:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-22 19:39 - 2014-01-12 12:23 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Malwarebytes
2014-05-22 19:39 - 2014-01-12 12:22 - 00000947 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-22 19:39 - 2014-01-12 12:22 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-22 19:22 - 2014-05-22 19:22 - 00001105 _____ () C:\Users\Dirk\Desktop\Revo Uninstaller.lnk
2014-05-22 19:22 - 2014-05-22 19:22 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-19 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job
2014-05-17 14:40 - 2014-05-17 14:40 - 00291320 _____ () C:\Windows\Minidump\Mini051714-01.dmp
2014-05-17 14:40 - 2013-04-17 19:55 - 00000000 ____D () C:\Windows\Minidump
2014-05-17 14:40 - 2013-04-17 19:54 - 636590701 _____ () C:\Windows\MEMORY.DMP
2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk
2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager
2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3
2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB
2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA
2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core
2014-05-12 07:26 - 2014-05-22 19:39 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-05-22 19:39 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-01-12 12:22 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball
2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java
Some content of TEMP:
====================
C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe
C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll
C:\Users\Dirk\AppData\Local\Temp\avgnt.exe
C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE
C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll
C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe
C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe
C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll
C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll
C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe
C:\Users\Dirk\AppData\Local\Temp\ose00000.exe
C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe
C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe
C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe
C:\Users\Dirk\AppData\Local\Temp\tbWise.dll
C:\Users\Dirk\AppData\Local\Temp\unwise.exe
C:\Users\Dirk\AppData\Local\Temp\Update.exe
C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe
C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe
C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe
C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll
C:\Users\Jutta\AppData\Local\Temp\avgnt.exe
C:\Users\Lisa\AppData\Local\Temp\avgnt.exe
C:\Users\Nils\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-22 21:07
==================== End Of Log ============================
--- --- --- Hab das Addition log auch noch mal dabei Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by Dirk at 2014-05-22 21:27:55
Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
1&1 Upload-Manager (HKLM-x32\...\1&1 Upload-Manager) (Version: 2.0.676 - 1&1 Internet AG)
64 Bit HP CIO Components Installer (Version: 3.2.1 - Hewlett-Packard) Hidden
7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)
Ad-Aware Antivirus (HKLM\...\{6A16ADA5-0B30-4893-84AB-961B1340D14A}_AdAwareUpdater) (Version: 11.1.5354.0 - Lavasoft)
AdAwareInstaller (Version: 11.1.5354.0 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.1.5354.0 - Lavasoft) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0 - Adobe Systems Incorporated)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden
ALDI Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI Bestellsoftware) (Version: 4.12.2 - ORWO Net)
AntimalwareEngine (Version: 2.6.0.0 - Lavasoft) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version: - )
AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version: - )
AVM FRITZ!fax für FRITZ!Box (HKLM-x32\...\FRITZ! 2.0) (Version: - AVM Berlin)
BufferChm (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
C309a (x32 Version: 120.0.202.000 - Hewlett-Packard) Hidden
calibre 64bit (HKLM\...\{1BC00DD4-173E-4325-BDB7-48A076DFC1EF}) (Version: 1.29.0 - Kovid Goyal)
Camera Support Core Library (x32 Version: 7.2.0.4 - Canon) Hidden
Camera Window DS (x32 Version: 5.1 - Canon) Hidden
Camera Window DVC (x32 Version: 5.1 - Canon) Hidden
Camera Window MC (x32 Version: 5.1 - Canon) Hidden
Canon Camera Support Core Library (HKLM-x32\...\InstallShield_{5662C158-CA24-4228-BF6C-596FADA08682}) (Version: 7.2.0.4 - Canon)
Canon Camera WIA Driver (x32 Version: 5.6 - Canon) Hidden
Canon Camera Window DS for ZoomBrowser EX (HKLM-x32\...\InstallShield_{7B847C9D-6758-45E6-B598-3BD8F43EAE9E}) (Version: 5.1 - Canon)
Canon Camera Window DVC for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A70D14C6-FF2C-4B8E-A643-7E74EC607614}) (Version: 5.1 - Canon)
Canon Camera Window for ZoomBrowser EX (HKLM-x32\...\InstallShield_{E73534D5-CC93-4C63-9072-5A9734255C74}) (Version: 5.1 - Canon)
Canon EOS Kiss_N REBEL_XT 350D WIA-Treiber (HKLM-x32\...\InstallShield_{33CF7CDF-9805-4500-9CC7-D19D52AD63C4}) (Version: 5.6 - Canon)
Canon Internet Library for ZoomBrowser EX (HKLM-x32\...\InstallShield_{954BF446-BBC9-42CC-87A6-EBF0D55CA19A}) (Version: 1.3.4 - Canon Inc.)
Canon PhotoRecord (HKLM-x32\...\{862983D7-FA08-493E-A9ED-6B7859E069D3}) (Version: 02.02.01000 - Cisra)
Canon RAW Image Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A0F34E4E-25F0-4B68-AE8F-EF0C15CB1FED}) (Version: 2.0 - Canon)
Canon RemoteCapture Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{28291BD5-92D2-4685-82DC-CCA925C53CCA}) (Version: 1.1 - Canon)
Canon Utilities Digital Photo Professional 3.4 (HKLM-x32\...\DPP) (Version: 3.4.1.1 - )
Canon Utilities EOS Capture 1.3 (HKLM-x32\...\InstallShield_{16480125-0428-4097-9A2A-74464004D169}) (Version: 1.3 - Canon)
Canon Utilities PhotoStitch 3.1 (HKLM-x32\...\InstallShield_{218BBBE3-FE63-4BB2-81A8-7435575A84FA}) (Version: 3.1.14 - Canon)
Canon ZoomBrowser EX (HKLM-x32\...\{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}) (Version: 5.00.0000 - Canon)
CyberLink PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.3.5711.0 - CyberLink Corp.)
Destination Component (x32 Version: 110.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
devolo dLAN Cockpit (HKLM-x32\...\dlancockpit) (Version: 3.0.0.0 - devolo AG)
dLAN Cockpit (HKLM-x32\...\Cockpit.92121A72F826FA9D0BD3A830E7F04987B31AFB22.1) (Version: 3 (23.12.2010) - devolo AG)
dLAN Cockpit (x32 Version: 3.23.12 - devolo AG) Hidden
DocProc (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden
DVDFab 8.0.7.3 (29/01/2011) (HKLM-x32\...\DVDFab 8_is1) (Version: - Fengtao Software Inc.)
EASEUS Data Recovery Wizard Free Edition 5.5.1 (HKLM-x32\...\EASEUS Data Recovery Wizard Free Edition 5.5.1_is1) (Version: - EASEUS)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.20140114 - Landesfinanzdirektion Thüringen)
ElsterFormular 2007/2008 (HKLM-x32\...\{5BA43E5C-66FD-48D2-AB40-B807D457EF83}) (Version: 9.6.2.0 NE - Steuerverwaltung des Bundes und der Länder)
ElsterFormular 2008/2009 (HKLM-x32\...\{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}) (Version: 10.3.2.0 - Steuerverwaltung des Bundes und der Länder)
EOS Capture 1.3 (x32 Version: 1.3 - Canon) Hidden
Eraser 5.8.7 (HKLM\...\{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1) (Version: Eraser 5.8.7 - The Eraser Project)
fassurun 2013.11.07.203951 (HKLM\...\fassurun) (Version: 2013.11.07.203951 - fassurun) <==== ATTENTION
Fax (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
Free Download Manager 3.9.2 (HKLM-x32\...\Free Download Manager_is1) (Version: - FreeDownloadManager.ORG)
FRITZ!DSL64 (HKLM\...\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}) (Version: 2.04.03 - AVM Berlin)
Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Chrome Frame (HKLM-x32\...\{CD4ABC29-0547-388C-B8BC-EF88333E5C2E}) (Version: 65.119.72 - Google, Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hardcopy (C:\Program Files (x86)\Hardcopy) (HKLM-x32\...\Hardcopy(C__Program Files (x86)_Hardcopy)) (Version: 17.0.18 - www.hardcopy.de)
Hauppauge MCE XP/Vista Software Encoder (2.0.27022) (HKLM-x32\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.27022 - Hauppauge Computer Works, Inc.)
HP Customer Participation Program 12.0 (HKLM\...\HPExtendedCapabilities) (Version: 12.0 - HP)
HP Imaging Device Functions 12.0 (HKLM\...\HP Imaging Device Functions) (Version: 12.0 - HP)
HP Photosmart C309a All-In-One Driver Software 12.0 Rel .5 (HKLM\...\{2D250E57-9890-44a6-B08F-5C02C991EF24}) (Version: 12.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 120.0.150.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.2.0 - LIGHTNING UK!)
Internet Library (x32 Version: 1.3.4 - Canon Inc.) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)
J2SE Runtime Environment 5.0 (HKLM-x32\...\{3248F0A8-6813-11D6-A77B-00B0D0150000}) (Version: 1.5.0 - Sun Microsystems, Inc.)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
KeePass Password Safe 2.10 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: - Dominik Reichl)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (x32 Version: 120.0.226.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVC80_x64 (Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86 (x32 Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSVCSetup (x32 Version: 1.00.0000 - HP) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{801189ff-e34f-423a-9f10-b423502b163f}) (Version: - Nero AG)
Nero BurnRights (x32 Version: 3.4.10.100 - Nero AG) Hidden
Nero BurnRights Help (x32 Version: 3.4.4.100 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero CoverDesigner (x32 Version: 4.4.9.202 - Nero AG) Hidden
Nero CoverDesigner Help (x32 Version: 4.4.6.100 - Nero AG) Hidden
Nero DiscSpeed (x32 Version: 5.4.10.100 - Nero AG) Hidden
Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden
Nero DriveSpeed (x32 Version: 4.4.10.100 - Nero AG) Hidden
Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden
Nero InfoTool (x32 Version: 6.4.10.100 - Nero AG) Hidden
Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden
Nero StartSmart (x32 Version: 9.4.11.201 - Nero AG) Hidden
Nero StartSmart Help (x32 Version: 9.4.1.100 - Nero AG) Hidden
Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Network64 (Version: 120.0.194.000 - Hewlett-Packard) Hidden
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9745 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.59.37 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
OCR Software by I.R.I.S. 12.0 (HKLM\...\HPOCR) (Version: 12.0 - HP)
OpenOffice.org 3.1 (HKLM-x32\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9420 - OpenOffice.org)
Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)
PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)
PDF Editor 2 (HKLM-x32\...\PDF Editor 2) (Version: - )
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)
Phase 5 HTML-Editor (HKLM-x32\...\{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}) (Version: 5.6.2 - Systemberatung Schommer)
PhotoStitch (x32 Version: 3.1.14 - Canon) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)
ProgDVB x64 (HKLM\...\ProgDVB) (Version: 6.9x - Prog)
PS_AIO_05_C309_Software_Min (x32 Version: 120.0.206.000 - Hewlett-Packard) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
RAW Image Task 2.0 (x32 Version: 2.0 - Canon) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5874 - Realtek Semiconductor Corp.)
RemoteCapture Task 1.1 (x32 Version: 1.1 - Canon) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Scan (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 12 - HP)
SIS-Handball 3.9 (HKLM-x32\...\SIS-Handball) (Version: 3.9 - GateCom GmbH)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
St. Louis Rams Toolbar (HKLM-x32\...\St. Louis Rams Toolbar) (Version: 1.514 - )
Status (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
Stellar Phoenix Photo Recovery (HKLM-x32\...\Stellar Phoenix Photo Recovery_is1) (Version: 4.0.0.0 - Stellar Information Systems Ltd)
SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
SystemDiagnostics (HKLM-x32\...\{80B0B731-5FAE-475D-8844-20F46373780D}) (Version: 3.02.0010 - Fujitsu Technology Solutions)
teXXas (HKLM-x32\...\{F3DCD04C-BE9C-408C-BC8C-B77AF972DBC2}) (Version: 1 - metaspinner net GmbH)
TomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Toolbox (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
WebReg (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live OneCare safety scanner (HKLM-x32\...\Windows Live OneCare safety scanner) (Version: - Microsoft Corporation)
Windows Live OneCare safety scanner (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
XP Codec Pack (HKLM-x32\...\XP Codec Pack) (Version: - )
==================== Restore Points =========================
16-04-2014 15:01:22 Windows Update
27-04-2014 09:58:17 Installed Java 7 Update 55
27-04-2014 10:05:33 Removed Java 7 Update 55
27-04-2014 10:17:56 Installed Java 7 Update 55
12-05-2014 15:12:38 Windows Update
12-05-2014 18:07:07 OpenOffice.org 3.1 wird entfernt
12-05-2014 18:13:37 AA11
14-05-2014 10:04:25 AA11
14-05-2014 11:40:48 Windows Update
14-05-2014 12:43:05 Windows Update
20-05-2014 20:37:28 Windows Update
22-05-2014 17:30:17 Revo Uninstaller's restore point - pdfforge Toolbar v4.6
22-05-2014 17:31:06 Removed pdfforge Toolbar v4.6.
==================== Hosts content: ==========================
2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {01503B02-7AF4-4ED7-9E3F-97049297213F} - System32\Tasks\{B7B91C77-1E48-44BE-8E9F-FC08EE02125A} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {5E551E2D-6024-438A-B6BB-4BD2C63E230F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {6A3BC972-B370-45E3-AD15-370CFD3EE8F9} - System32\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F} => C:\Program Files\V-bates\PrefHelper.exe
Task: {7A936888-6D24-4B69-9A45-EAEA6C3F1EFF} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {7BA40AA9-D6BC-4D03-A0C0-398717389FC7} - System32\Tasks\{F7A8E834-BD3C-4504-885B-1E637D64FEC7} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {8CFE1E32-B04E-456C-989C-1AA1556BE805} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)
Task: {B384F716-A243-4440-91D6-34FA3643F784} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)
Task: {BF328AF9-E972-4814-BA2B-8955BE07E803} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)
Task: {E3891FA7-79D4-4A37-A8CC-B7D9ADEDDCEC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job => C:\Program Files\V-bates\PrefHelper.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2009-11-19 19:34 - 2006-02-23 13:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll
2009-11-19 19:34 - 2006-02-22 12:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll
2014-01-23 16:09 - 2014-01-23 16:09 - 00702744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
2014-01-23 16:30 - 2014-01-23 16:30 - 00103800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_thread-vc100-mt-1_55.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00024440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_system-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00033656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_chrono-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00055680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_date_time-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00123776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_filesystem-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 03720040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareServiceKernel.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00685904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SQLite.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00158032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\pugixml.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 02595144 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\RCF.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00788856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_regex-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00602984 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareActivation.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareApplicationUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00142696 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareGamingMode.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00098648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareReset.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00120152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTime.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00268152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00198024 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdaterScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00417128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIgnoreList.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00253800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareQuarantine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00293744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiMalwareEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00212336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiRootkitEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00509808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerHistory.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00607584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScanner.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00035192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_timer-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00325488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00333688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareRealTimeProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00227688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIncompatibles.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00219488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiSpam.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00129896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiPhishing.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00599920 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareParentalControl.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 01926504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareWebProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00263536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareEmailProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00650608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareNetworkProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00490848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareInstaller.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00106824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\zlib.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00149840 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\libssh2.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00358744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwarePromo.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareFeedback.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00154464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SecurityCenter.dll
2013-07-17 17:10 - 2013-07-17 17:10 - 00777296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\BDSmartDB.dll
2009-10-03 10:51 - 2008-12-02 14:21 - 00041984 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_ex.exe
2009-10-03 10:51 - 2009-06-10 06:19 - 00057856 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_x64.dll
2012-12-21 19:33 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2009-10-03 10:51 - 2009-09-25 16:50 - 00445440 _____ () C:\Program Files (x86)\Hardcopy\HcDllS.dll
2009-10-03 10:51 - 2009-08-19 13:20 - 00043008 _____ () C:\Program Files (x86)\Hardcopy\hardcopy_02.dll
2009-10-03 10:51 - 2009-06-10 06:19 - 00057344 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_Win32.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:A8665DF4
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^Users^Dirk^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: BDRegion => "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe"
MSCONFIG\startupreg: Google EULA Launcher => c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA
MSCONFIG\startupreg: NokiaMServer => C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
MSCONFIG\startupreg: NokiaMusic FastStart => "C:\Program Files (x86)\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart
MSCONFIG\startupreg: NokiaOviSuite2 => C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
MSCONFIG\startupreg: RemoteControl => "C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
==================== Faulty Device Manager Devices =============
Name: NVIDIA nForce 10/100/1000 Mbps Ethernet
Description: NVIDIA nForce 10/100/1000 Mbps Ethernet
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: NVIDIA
Service: NVENETFD
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Photosmart C309a series
Description: Photosmart C309a series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (05/01/2014 07:39:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 36965 seconds with 180 seconds of active time. This session ended with a crash.
Error: (03/12/2014 07:08:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 58 seconds with 0 seconds of active time. This session ended with a crash.
Error: (02/03/2014 07:02:12 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2689 seconds with 600 seconds of active time. This session ended with a crash.
Error: (02/16/2013 02:55:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.
Error: (12/22/2012 09:18:07 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.
Error: (12/09/2012 10:54:19 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.
Error: (12/09/2012 10:54:02 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.
Error: (07/09/2012 00:55:39 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 28 seconds with 0 seconds of active time. This session ended with a crash.
Error: (07/06/2012 11:28:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 43 seconds with 0 seconds of active time. This session ended with a crash.
Error: (05/31/2012 08:02:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-05-22 21:27:48.128
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 21:27:47.715
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 21:27:47.311
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 21:27:46.895
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 21:27:46.486
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 21:27:46.075
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 21:27:45.663
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 21:27:45.250
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 21:27:44.725
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-22 21:27:44.317
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 43%
Total physical RAM: 4094.32 MB
Available physical RAM: 2305.5 MB
Total Pagefile: 8399.91 MB
Available Pagefile: 6332.27 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: (SYSTEM) (Fixed) (Total:164.75 GB) (Free:34.43 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (DATA) (Fixed) (Total:1220.5 GB) (Free:761.28 GB) NTFS
Drive y: (Two-Face) (Removable) (Total:14.89 GB) (Free:13.49 GB) exFAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 1397 GB) (Disk ID: FCD6DD83)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=165 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=-888516751360) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: 98720C68)
Partition 1: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Gruß Dirk |
|
23.05.2014, 16:23
| #8 |
| /// the machine /// TB-Ausbilder | Windows Vista - search.fbdownloader in google chrome den entfernen wir gleich. ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.05.2014, 21:34
| #9 |
| | Windows Vista - search.fbdownloader in google chromeCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=bed5156fbeb1874eb627723532df5211
# engine=18384
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-23 07:29:57
# local_time=2014-05-23 09:29:57 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 96 13797 266296687 6543 0
# compatibility_mode=5892 16776637 100 100 13285 238397303 0 0
# scanned=355098
# found=35
# cleaned=0
# scan_time=12444
sh=14C1DC5CB0CF73A42866AEA0A07B0A754C84F6B9 ft=1 fh=7b8fdf4e16867ebd vn="Variante von Win32/Toolbar.Visicom.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\adawaretb\adawareDx.dll.vir"
sh=632FB41B95FBFF1B14048B2DC0512520DD794583 ft=1 fh=7b1f3132515a2652 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\adawaretb\adawaretb.dll.vir"
sh=6E6B9D9B42A510193E815990C05C757BBC9DE99E ft=1 fh=601943b04511081d vn="Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\adawaretb\dtUser.exe.vir"
sh=DF68D276645E6BD84FA1D5CA6F40301F4F74722A ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\hjeglkhenpckoocpnajnnmcehdkcemnm.crx.vir"
sh=C785BFADB201A3E9648BC85FDCD939C959525611 ft=1 fh=eb223665b336f871 vn="Variante von Win32/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\updatefassurun.exe.vir"
sh=C785BFADB201A3E9648BC85FDCD939C959525611 ft=1 fh=eb223665b336f871 vn="Variante von Win32/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\bin\utilfassurun.exe.vir"
sh=161262BB820AFE2533C600A7D62616F259B89560 ft=1 fh=0714f9176f7719c4 vn="Variante von MSIL/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\bin\plugins\fassurun.FFUpdate.dll.vir"
sh=8014B8407EF69A368F9403F2D31FA9D66EC0107E ft=1 fh=e315604a317ff947 vn="Variante von MSIL/BrowseFox.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\bin\plugins\fassurun.GCUpdate.dll.vir"
sh=AC59A8E3441B140B4EDA699DEECD781130A704BA ft=1 fh=4bab001eeadbadbc vn="Variante von MSIL/BrowseFox.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fassurun\bin\plugins\fassurun.IEUpdate.dll.vir"
sh=4D6BE2A62DD529B6AED8BFC52283C19C0BA71CC1 ft=0 fh=0000000000000000 vn="Win32/PriceGong.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceGong\2.6.8\PriceGong.crx.vir"
sh=AC628759BA6C1F21190629C83CD034BA8BD0285F ft=1 fh=07dc08932a0af165 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceGong\2.6.8\PriceGongIE.dll.vir"
sh=51215C0B894CD4C471AAF522A22EBC00EFB4EBB2 ft=1 fh=0b9d3f2ed4c32b46 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PriceGong\2.6.8\FF\plugins\npPriceGong_FF.dll.vir"
sh=EA29B6E13129E7213242887BA3D3D81288340303 ft=0 fh=0000000000000000 vn="Win32/PriceGong.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.8_0\pg_background.html.vir"
sh=A1A811D016B52FD3004279CA2EAD58C72B21810A ft=0 fh=0000000000000000 vn="Win32/PriceGong.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.8_0\options\pg_options.html.vir"
sh=48375BB73C670D53620DB2B71E20A6587513D0F3 ft=1 fh=ae8125eb1faea8b5 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.6.8_0\plugins\npPriceGong_CH.dll.vir"
sh=52BA0F358C884C3D69A9258112DB6FFB1BB3AB18 ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjeglkhenpckoocpnajnnmcehdkcemnm\1.0.0_0\background.js.vir"
sh=83DD0B158F6E6EB53E7824856C671496666FB85C ft=0 fh=0000000000000000 vn="Win32/BrowseFox.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjeglkhenpckoocpnajnnmcehdkcemnm\1.0.0_0\content.js.vir"
sh=B5DCA84A35051ABF54282C7CDD058C5B536235D2 ft=1 fh=8d61cd15590d757b vn="Variante von Win32/Toolbar.SearchSuite.L evtl. unerwünschte Anwendung" ac=I fn="C:\Downloads\Software\iMeshSetup-r1482-w-bc.exe"
sh=BCF43267B4416C6DDEFAAD5AE0A63E3F682C5BB0 ft=1 fh=905be375e5c80006 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Downloads\Software\PDFCreator-1_6_2_setup.exe"
sh=77C41FE9D15ADB18C5C91F95FB68F2FB5D80D9B5 ft=1 fh=1dd1b49013d59105 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe"
sh=8CA209A796CAB152BC9907BCEF283C221AC5F058 ft=1 fh=16efebacbcd5a9c9 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dirk\AppData\Local\Temp\tbWise.dll"
sh=48FD60E5A677BD39B13E0188075E83137005259E ft=1 fh=ff79543ffacc5f95 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dirk\Downloads\PDFCreator-1_2_1_setup.exe"
sh=6CF8A9F031B45F70BE3E66E7ACC7449CDA15FA34 ft=1 fh=2de4b6f517306153 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Dirk\Downloads\PDFCreator-1_2_3_setup.exe"
sh=A23519E8073FDB68C377074CFC41DEF71AD03D44 ft=1 fh=ca61199ae536065a vn="Win32/StartPage.OPH Trojaner" ac=I fn="C:\Users\Dirk\Downloads\vlc-2.0.4-win32.exe"
sh=27803401390A1E8A1B467DA4397B3F8720B9C875 ft=1 fh=9507ca016fcdd5db vn="Win32/StartPage.OPH Trojaner" ac=I fn="C:\Users\Dirk\Downloads\vlc-2.0.4-win64.exe"
sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY1OD2PE\update[1]"
sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY1OD2PE\update[2]"
sh=72FDBB6E315D5BB25A04EB687095914D484B2EC7 ft=1 fh=625b5f97bb9bcd48 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TSQ5CJ66\update[1]"
sh=72FDBB6E315D5BB25A04EB687095914D484B2EC7 ft=1 fh=625b5f97bb9bcd48 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TSQ5CJ66\update[2]"
sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY1OD2PE\update[1]"
sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY1OD2PE\update[2]"
sh=72FDBB6E315D5BB25A04EB687095914D484B2EC7 ft=1 fh=625b5f97bb9bcd48 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TSQ5CJ66\update[1]"
sh=72FDBB6E315D5BB25A04EB687095914D484B2EC7 ft=1 fh=625b5f97bb9bcd48 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TSQ5CJ66\update[2]"
sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Temp\INJ003\ExtensionUpdate.exe"
sh=F4BBB551315DBE49911663D85F079AFE8B5F8F51 ft=1 fh=96414ff33da39282 vn="Variante von Win32/Toolbar.BitCocktail.B evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Temp\INJ004\ExtensionUpdate.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.83
Windows Vista Service Pack 2 x64 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Ad-Aware Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 55
Adobe Flash Player 13.0.0.214
Adobe Reader 9 Adobe Reader out of Date!
Adobe Reader 10.1.10 Adobe Reader out of Date!
Google Chrome 34.0.1847.131
Google Chrome 34.0.1847.137
Google Chrome Plugins...
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSASCui.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Lavasoft Ad-Aware Antivirus Ad-Aware Antivirus 11.1.5354.0\AdAwareService.exe
Lavasoft Ad-Aware Antivirus Ad-Aware Antivirus 11.1.5354.0\AdAwareTray.exe
Windows Defender MSASCui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Dirk (administrator) on JOKER on 23-05-2014 22:27:40
Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(1&1 Internet AG) C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE
(sw4you, Siegfried Weckmann) C:\Program Files (x86)\Hardcopy\hardcopy.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared Files\brs.exe
(Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
() C:\Program Files (x86)\Hardcopy\hcdll2_ex.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Microsoft Corporation) C:\Windows\ehome\mcGlidHost.exe
(Dominik Reichl) Y:\Live-Stick\KeePass\KeePass.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [225792 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AdAwareTray] => C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-09-04] (cyberlink)
HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [87336 2009-04-16] (Cyberlink Corp.)
HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [62760 2009-04-16] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [542632 2013-01-31] (Lavasoft)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe
HKU\.DEFAULT\...\Run: [fts-reg] => c:\fts-reg\ftsreg.exe
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [462736 2009-06-10] (The Eraser Project)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Google Update] => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-23] (Google Inc.)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Dirk\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [1&1_1&1 Upload-Manager] => C:\Program Files (x86)\1&1\1&1 Upload-Manager\DAVSRV.EXE [989264 2011-11-21] (1&1 Internet AG)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
HKU\S-1-5-21-3839580519-3571548420-1780697189-1000\...\MountPoints2: {b200d1a6-f4e6-11e0-831a-002421deb67d} - G:\Windows\CHECK\DriveNavigator.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Hardcopy.LNK
ShortcutTarget: Hardcopy.LNK -> C:\Program Files (x86)\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann)
Startup: C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x889B8BC05814CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Freecause Toolbar BHO - {9F185768-D42D-4F10-9829-11265F1A5326} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - St. Louis Rams Toolbar - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - C:\Program Files (x86)\St. Louis Rams Toolbar\Toolbar.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {59EDDB9B-5506-42A2-A73A-1364EDB1CB38} - No File
DPF: HKLM-x32 {3860DD98-0549-4D50-AA72-5D17D200EE10} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/de-de/wlscctrl2.cab
DPF: HKLM-x32 {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: HKLM-x32 {EF0D1A14-1033-41A2-A589-240C01EDC078} hxxp://download.pplive.com/config/pplite/pluginsetup.cab
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files (x86)\FRITZ!DSL\\sarah.dll [28472] (AVM Berlin)
Winsock: Catalog5-x64 05 %ProgramFiles%\FRITZ!DSL\\sarah.dll [34104] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @veetle.com/vbp;version=0.9.17 - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Dirk\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: bebomedia.com/OfferMosquitoIEHelper - C:\Users\Dirk\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2011-02-12]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-15]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-01-20]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://www.google.de/", "hxxp://wisersearch.com/?channel=de", "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\PepperFlash\11.6.602.167\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Free Download Manager Click Catcher Plug-In for Netscape, Opera, Mozilla) - C:\Users\Dirk\AppData\Local\Google\Chrome\Application\plugins\npfdm.dll (FreeDownloadManager.org)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U39) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Veetle TV Player) - C:\Program Files (x86)\Veetle\Player\npvlc.dll No File
CHR Plugin: (Veetle Broadcaster Plugin) - C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File
CHR Plugin: (Veetle TV Core) - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll No File
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.390.4) - C:\Windows\SysWOW64\npdeployJava1.dll No File
CHR Extension: (Google Wallet) - C:\Users\Dirk\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-04]
CHR HKLM-x32\...\Chrome\Extension: [lfffjahnfbocnaooecgijfnbpcfekoik] - C:\ProgramData\adawaretb\shortcuts\chrome\adawaretb.crx [2013-09-04]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-21] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3304768 2010-12-23] (devolo AG)
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)
S2 Util fassurun; "C:\Program Files (x86)\fassurun\bin\utilfassurun.exe" [X]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-02-16] (GFI Software)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
R1 ui11rdr; C:\Windows\System32\DRIVERS\ui11rdr.sys [199752 2011-11-21] (1&1 Internet AG)
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl [146928 2009-09-04] (CyberLink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcdnsucx64; system32\drivers\nmwcdnsucx64.sys [X]
S3 nmwcdnsux64; system32\drivers\nmwcdnsux64.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-23 17:33 - 2014-05-23 17:33 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-22 21:24 - 2014-05-22 21:24 - 00000730 _____ () C:\Users\Dirk\Desktop\JRT.txt
2014-05-22 19:40 - 2014-05-22 20:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-22 19:39 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-22 19:39 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-22 19:22 - 2014-05-22 19:22 - 00001105 _____ () C:\Users\Dirk\Desktop\Revo Uninstaller.lnk
2014-05-22 19:22 - 2014-05-22 19:22 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-17 14:40 - 2014-05-17 14:40 - 00291320 _____ () C:\Windows\Minidump\Mini051714-01.dmp
2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:43 - 2014-05-23 22:27 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-17 11:05 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-17 10:45 - 2014-05-23 22:27 - 00000000 ____D () C:\FRST
2014-05-14 13:41 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 13:41 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 13:41 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-14 13:41 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-14 13:41 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 13:39 - 2014-03-25 18:30 - 12900864 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 13:39 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 12:10 - 2014-05-23 17:32 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:03 - 2014-05-12 20:13 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-04-27 12:20 - 2014-04-27 12:19 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:20 - 2014-04-27 12:19 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 11:59 - 2014-04-27 12:01 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
==================== One Month Modified Files and Folders =======
2014-05-23 22:28 - 2012-11-05 19:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-23 22:27 - 2014-05-17 11:43 - 00000000 ____D () C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
2014-05-23 22:27 - 2014-05-17 10:45 - 00000000 ____D () C:\FRST
2014-05-23 22:08 - 2012-03-07 20:30 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-23 22:08 - 2011-10-23 17:07 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job
2014-05-23 22:07 - 2014-01-14 19:07 - 00000284 _____ () C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job
2014-05-23 21:30 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-23 21:30 - 2006-11-02 17:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-23 19:16 - 2009-09-09 20:59 - 01181924 _____ () C:\Windows\WindowsUpdate.log
2014-05-23 17:57 - 2008-01-21 13:10 - 01576088 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-23 17:57 - 2008-01-21 13:09 - 00677534 _____ () C:\Windows\system32\perfh007.dat
2014-05-23 17:57 - 2008-01-21 13:09 - 00147046 _____ () C:\Windows\system32\perfc007.dat
2014-05-23 17:35 - 2006-11-02 17:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-05-23 17:33 - 2014-05-23 17:33 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2014-05-23 17:33 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-05-23 17:33 - 2012-03-07 20:30 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-23 17:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.dat
2014-05-23 17:33 - 2009-08-12 12:45 - 00203605 _____ () C:\ProgramData\nvModes.001
2014-05-23 17:32 - 2014-05-14 12:10 - 00002210 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-05-23 17:32 - 2006-11-02 17:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-22 21:47 - 2009-09-09 23:53 - 00000000 ____D () C:\Users\Dirk\AppData\Local\Eraser
2014-05-22 21:47 - 2006-11-02 17:42 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-22 21:24 - 2014-05-22 21:24 - 00000730 _____ () C:\Users\Dirk\Desktop\JRT.txt
2014-05-22 20:59 - 2008-01-21 05:26 - 00302744 _____ () C:\Windows\PFRO.log
2014-05-22 20:57 - 2014-01-11 11:31 - 00000000 ____D () C:\AdwCleaner
2014-05-22 20:38 - 2014-05-22 19:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-22 19:39 - 2014-05-22 19:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-22 19:39 - 2014-01-12 12:23 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Malwarebytes
2014-05-22 19:39 - 2014-01-12 12:22 - 00000947 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-22 19:39 - 2014-01-12 12:22 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-22 19:22 - 2014-05-22 19:22 - 00001105 _____ () C:\Users\Dirk\Desktop\Revo Uninstaller.lnk
2014-05-22 19:22 - 2014-05-22 19:22 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-19 17:08 - 2011-10-23 17:07 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job
2014-05-17 14:40 - 2014-05-17 14:40 - 00291320 _____ () C:\Windows\Minidump\Mini051714-01.dmp
2014-05-17 14:40 - 2013-04-17 19:55 - 00000000 ____D () C:\Windows\Minidump
2014-05-17 14:40 - 2013-04-17 19:54 - 636590701 _____ () C:\Windows\MEMORY.DMP
2014-05-17 11:44 - 2014-05-17 11:44 - 00000000 _____ () C:\Users\Dirk\defogger_reenable
2014-05-17 11:44 - 2009-09-09 21:16 - 00000000 ____D () C:\Users\Dirk
2014-05-17 11:06 - 2013-02-14 08:04 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Free Download Manager
2014-05-17 08:59 - 2011-06-19 17:12 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-14 13:51 - 2009-12-14 20:55 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-14 13:49 - 2013-07-13 12:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 13:45 - 2006-11-02 14:35 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-14 13:28 - 2012-11-05 19:35 - 00003736 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 13:28 - 2012-03-29 06:20 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 13:28 - 2011-05-17 13:24 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 12:10 - 2014-05-14 12:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
2014-05-14 12:09 - 2014-05-14 12:09 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-12 20:17 - 2013-02-16 11:15 - 00000000 ____D () C:\Program Files (x86)\Ad-Aware Antivirus
2014-05-12 20:15 - 2014-05-12 20:15 - 00000000 ____D () C:\Users\Dirk\AppData\Roaming\Lavasoft
2014-05-12 20:14 - 2014-05-12 20:14 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-05-12 20:13 - 2014-05-12 20:03 - 104010008 _____ (Microsoft Corporation) C:\Users\Dirk\Downloads\msert.exe
2014-05-12 20:12 - 2013-02-16 11:15 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-05-12 20:08 - 2009-09-12 10:42 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 3
2014-05-12 20:06 - 2013-03-29 15:56 - 00000000 ____D () C:\Program Files\ProgDVB
2014-05-12 20:06 - 2013-03-29 15:55 - 00000000 ____D () C:\ProgramData\ProgDVB
2014-05-12 17:05 - 2014-05-12 17:05 - 00001858 _____ () C:\Users\Dirk\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-12 17:05 - 2014-05-12 17:05 - 00001802 _____ () C:\Users\Dirk\Desktop\Avira EU-Cleaner.lnk
2014-05-12 17:03 - 2012-03-07 20:30 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-12 17:03 - 2012-03-07 20:30 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-12 17:03 - 2011-10-23 17:07 - 00003998 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA
2014-05-12 17:03 - 2011-10-23 17:07 - 00003602 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core
2014-05-12 07:26 - 2014-05-22 19:39 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-05-22 19:39 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-01-12 12:22 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-06 02:46 - 2014-05-14 13:41 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 02:21 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 02:21 - 2014-05-14 13:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 01:32 - 2014-05-14 13:41 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 01:14 - 2014-05-14 13:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 01:14 - 2014-05-14 13:41 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-04-27 13:02 - 2009-09-12 10:21 - 00000000 ____D () C:\sishandball
2014-04-27 12:21 - 2013-10-20 18:09 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-27 12:19 - 2014-04-27 12:20 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-27 12:19 - 2014-04-27 12:20 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-27 12:01 - 2014-04-27 11:59 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-27 12:01 - 2009-09-13 20:53 - 00000000 ____D () C:\Program Files (x86)\Java
Some content of TEMP:
====================
C:\Users\Dirk\AppData\Local\Temp\a3607d95-b990-4d1e-8803-df92eb266678.exe
C:\Users\Dirk\AppData\Local\Temp\AskSLib.dll
C:\Users\Dirk\AppData\Local\Temp\avgnt.exe
C:\Users\Dirk\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\Dirk\AppData\Local\Temp\COMAP.EXE
C:\Users\Dirk\AppData\Local\Temp\d6fc660a-da85-4b24-b2b7-5507a3192a17.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Dirk\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Dirk\AppData\Local\Temp\gcapi_dll.dll
C:\Users\Dirk\AppData\Local\Temp\giftboxplus_update.exe
C:\Users\Dirk\AppData\Local\Temp\install_flashplayer11x32axau_mssa_aih.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Dirk\AppData\Local\Temp\KUNZ.exe
C:\Users\Dirk\AppData\Local\Temp\MgxVistaTools.dll
C:\Users\Dirk\AppData\Local\Temp\NEventMessages.dll
C:\Users\Dirk\AppData\Local\Temp\Nokia_Ovi_Suite_PCS_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Nokia_PC_Suite_7_1_40_1_ger.exe
C:\Users\Dirk\AppData\Local\Temp\ose00000.exe
C:\Users\Dirk\AppData\Local\Temp\outlooksocialconnector-x86-de-de.exe
C:\Users\Dirk\AppData\Local\Temp\PPLite_Update.exe
C:\Users\Dirk\AppData\Local\Temp\Quarantine.exe
C:\Users\Dirk\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Dirk\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Dirk\AppData\Local\Temp\SystemDiagnostics.exe
C:\Users\Dirk\AppData\Local\Temp\tbWise.dll
C:\Users\Dirk\AppData\Local\Temp\unwise.exe
C:\Users\Dirk\AppData\Local\Temp\Update.exe
C:\Users\Dirk\AppData\Local\Temp\UpdatePack.exe
C:\Users\Dirk\AppData\Local\Temp\vlc-2.0.5-win32.exe
C:\Users\Dirk\AppData\Local\Temp\WUVLMZMMQTF.exe
C:\Users\Jutta\AppData\Local\Temp\AskSLib.dll
C:\Users\Jutta\AppData\Local\Temp\avgnt.exe
C:\Users\Lisa\AppData\Local\Temp\avgnt.exe
C:\Users\Nils\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-23 17:48
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by Dirk at 2014-05-23 22:28:42
Running from C:\Users\Dirk\Desktop\Beseitigung von FBDownloader
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Ad-Aware Antivirus (Disabled - Out of date) {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AS: Ad-Aware Antivirus (Disabled - Out of date) {631A84A5-349B-D564-3A83-A0F22C2DF32B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Ad-Aware Firewall (Disabled) {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
1&1 Upload-Manager (HKLM-x32\...\1&1 Upload-Manager) (Version: 2.0.676 - 1&1 Internet AG)
64 Bit HP CIO Components Installer (Version: 3.2.1 - Hewlett-Packard) Hidden
7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)
Ad-Aware Antivirus (HKLM\...\{6A16ADA5-0B30-4893-84AB-961B1340D14A}_AdAwareUpdater) (Version: 11.1.5354.0 - Lavasoft)
AdAwareInstaller (Version: 11.1.5354.0 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.1.5354.0 - Lavasoft) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.2.0.2070 - Adobe Systems Incorporated) Hidden
Adobe Digital Editions 3.0 (HKLM-x32\...\Adobe Digital Editions 3.0) (Version: 3.0 - Adobe Systems Incorporated)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.1 - Nero AG) Hidden
ALDI Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI Bestellsoftware) (Version: 4.12.2 - ORWO Net)
AntimalwareEngine (Version: 2.6.0.0 - Lavasoft) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
AVM FRITZ!Box Dokumentation (HKLM-x32\...\AVMFBox) (Version: - )
AVM FRITZ!Box Druckeranschluss (HKLM-x32\...\AVMFBoxPrinter) (Version: - )
AVM FRITZ!fax für FRITZ!Box (HKLM-x32\...\FRITZ! 2.0) (Version: - AVM Berlin)
BufferChm (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
C309a (x32 Version: 120.0.202.000 - Hewlett-Packard) Hidden
calibre 64bit (HKLM\...\{1BC00DD4-173E-4325-BDB7-48A076DFC1EF}) (Version: 1.29.0 - Kovid Goyal)
Camera Support Core Library (x32 Version: 7.2.0.4 - Canon) Hidden
Camera Window DS (x32 Version: 5.1 - Canon) Hidden
Camera Window DVC (x32 Version: 5.1 - Canon) Hidden
Camera Window MC (x32 Version: 5.1 - Canon) Hidden
Canon Camera Support Core Library (HKLM-x32\...\InstallShield_{5662C158-CA24-4228-BF6C-596FADA08682}) (Version: 7.2.0.4 - Canon)
Canon Camera WIA Driver (x32 Version: 5.6 - Canon) Hidden
Canon Camera Window DS for ZoomBrowser EX (HKLM-x32\...\InstallShield_{7B847C9D-6758-45E6-B598-3BD8F43EAE9E}) (Version: 5.1 - Canon)
Canon Camera Window DVC for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A70D14C6-FF2C-4B8E-A643-7E74EC607614}) (Version: 5.1 - Canon)
Canon Camera Window for ZoomBrowser EX (HKLM-x32\...\InstallShield_{E73534D5-CC93-4C63-9072-5A9734255C74}) (Version: 5.1 - Canon)
Canon EOS Kiss_N REBEL_XT 350D WIA-Treiber (HKLM-x32\...\InstallShield_{33CF7CDF-9805-4500-9CC7-D19D52AD63C4}) (Version: 5.6 - Canon)
Canon Internet Library for ZoomBrowser EX (HKLM-x32\...\InstallShield_{954BF446-BBC9-42CC-87A6-EBF0D55CA19A}) (Version: 1.3.4 - Canon Inc.)
Canon PhotoRecord (HKLM-x32\...\{862983D7-FA08-493E-A9ED-6B7859E069D3}) (Version: 02.02.01000 - Cisra)
Canon RAW Image Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{A0F34E4E-25F0-4B68-AE8F-EF0C15CB1FED}) (Version: 2.0 - Canon)
Canon RemoteCapture Task for ZoomBrowser EX (HKLM-x32\...\InstallShield_{28291BD5-92D2-4685-82DC-CCA925C53CCA}) (Version: 1.1 - Canon)
Canon Utilities Digital Photo Professional 3.4 (HKLM-x32\...\DPP) (Version: 3.4.1.1 - )
Canon Utilities EOS Capture 1.3 (HKLM-x32\...\InstallShield_{16480125-0428-4097-9A2A-74464004D169}) (Version: 1.3 - Canon)
Canon Utilities PhotoStitch 3.1 (HKLM-x32\...\InstallShield_{218BBBE3-FE63-4BB2-81A8-7435575A84FA}) (Version: 3.1.14 - Canon)
Canon ZoomBrowser EX (HKLM-x32\...\{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}) (Version: 5.00.0000 - Canon)
CyberLink PowerDVD (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.3.5711.0 - CyberLink Corp.)
Destination Component (x32 Version: 110.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
devolo dLAN Cockpit (HKLM-x32\...\dlancockpit) (Version: 3.0.0.0 - devolo AG)
dLAN Cockpit (HKLM-x32\...\Cockpit.92121A72F826FA9D0BD3A830E7F04987B31AFB22.1) (Version: 3 (23.12.2010) - devolo AG)
dLAN Cockpit (x32 Version: 3.23.12 - devolo AG) Hidden
DocProc (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden
DVDFab 8.0.7.3 (29/01/2011) (HKLM-x32\...\DVDFab 8_is1) (Version: - Fengtao Software Inc.)
EASEUS Data Recovery Wizard Free Edition 5.5.1 (HKLM-x32\...\EASEUS Data Recovery Wizard Free Edition 5.5.1_is1) (Version: - EASEUS)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.20140114 - Landesfinanzdirektion Thüringen)
ElsterFormular 2007/2008 (HKLM-x32\...\{5BA43E5C-66FD-48D2-AB40-B807D457EF83}) (Version: 9.6.2.0 NE - Steuerverwaltung des Bundes und der Länder)
ElsterFormular 2008/2009 (HKLM-x32\...\{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}) (Version: 10.3.2.0 - Steuerverwaltung des Bundes und der Länder)
EOS Capture 1.3 (x32 Version: 1.3 - Canon) Hidden
Eraser 5.8.7 (HKLM\...\{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1) (Version: Eraser 5.8.7 - The Eraser Project)
fassurun 2013.11.07.203951 (HKLM\...\fassurun) (Version: 2013.11.07.203951 - fassurun) <==== ATTENTION
Fax (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
Free Download Manager 3.9.2 (HKLM-x32\...\Free Download Manager_is1) (Version: - FreeDownloadManager.ORG)
FRITZ!DSL64 (HKLM\...\{2D5D9603-22CF-4B99-83F6-0CD20330F62E}) (Version: 2.04.03 - AVM Berlin)
Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Chrome Frame (HKLM-x32\...\{CD4ABC29-0547-388C-B8BC-EF88333E5C2E}) (Version: 65.119.72 - Google, Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hardcopy (C:\Program Files (x86)\Hardcopy) (HKLM-x32\...\Hardcopy(C__Program Files (x86)_Hardcopy)) (Version: 17.0.18 - www.hardcopy.de)
Hauppauge MCE XP/Vista Software Encoder (2.0.27022) (HKLM-x32\...\Hauppauge MCE2005 Software Encoder) (Version: 2.0.27022 - Hauppauge Computer Works, Inc.)
HP Customer Participation Program 12.0 (HKLM\...\HPExtendedCapabilities) (Version: 12.0 - HP)
HP Imaging Device Functions 12.0 (HKLM\...\HP Imaging Device Functions) (Version: 12.0 - HP)
HP Photosmart C309a All-In-One Driver Software 12.0 Rel .5 (HKLM\...\{2D250E57-9890-44a6-B08F-5C02C991EF24}) (Version: 12.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}) (Version: 5.002.007.004 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 120.0.150.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.2.0 - LIGHTNING UK!)
Internet Library (x32 Version: 1.3.4 - Canon Inc.) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)
J2SE Runtime Environment 5.0 (HKLM-x32\...\{3248F0A8-6813-11D6-A77B-00B0D0150000}) (Version: 1.5.0 - Sun Microsystems, Inc.)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
KeePass Password Safe 2.10 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: - Dominik Reichl)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (x32 Version: 120.0.226.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVC80_x64 (Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86 (x32 Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSVCSetup (x32 Version: 1.00.0000 - HP) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{801189ff-e34f-423a-9f10-b423502b163f}) (Version: - Nero AG)
Nero BurnRights (x32 Version: 3.4.10.100 - Nero AG) Hidden
Nero BurnRights Help (x32 Version: 3.4.4.100 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero CoverDesigner (x32 Version: 4.4.9.202 - Nero AG) Hidden
Nero CoverDesigner Help (x32 Version: 4.4.6.100 - Nero AG) Hidden
Nero DiscSpeed (x32 Version: 5.4.10.100 - Nero AG) Hidden
Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden
Nero DriveSpeed (x32 Version: 4.4.10.100 - Nero AG) Hidden
Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden
Nero InfoTool (x32 Version: 6.4.10.100 - Nero AG) Hidden
Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.8.1 - Nero AG) Hidden
Nero StartSmart (x32 Version: 9.4.11.201 - Nero AG) Hidden
Nero StartSmart Help (x32 Version: 9.4.1.100 - Nero AG) Hidden
Nero StartSmart OEM (x32 Version: 9.4.10.100 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Network64 (Version: 120.0.194.000 - Hewlett-Packard) Hidden
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9745 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.59.37 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
OCR Software by I.R.I.S. 12.0 (HKLM\...\HPOCR) (Version: 12.0 - HP)
OpenOffice.org 3.1 (HKLM-x32\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9420 - OpenOffice.org)
Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)
PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge)
PDF Editor 2 (HKLM-x32\...\PDF Editor 2) (Version: - )
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.2 - pdfforge)
Phase 5 HTML-Editor (HKLM-x32\...\{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}) (Version: 5.6.2 - Systemberatung Schommer)
PhotoStitch (x32 Version: 3.1.14 - Canon) Hidden
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)
ProgDVB x64 (HKLM\...\ProgDVB) (Version: 6.9x - Prog)
PS_AIO_05_C309_Software_Min (x32 Version: 120.0.206.000 - Hewlett-Packard) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
RAW Image Task 2.0 (x32 Version: 2.0 - Canon) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5874 - Realtek Semiconductor Corp.)
RemoteCapture Task 1.1 (x32 Version: 1.1 - Canon) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Scan (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 12 - HP)
SIS-Handball 3.9 (HKLM-x32\...\SIS-Handball) (Version: 3.9 - GateCom GmbH)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
St. Louis Rams Toolbar (HKLM-x32\...\St. Louis Rams Toolbar) (Version: 1.514 - )
Status (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
Stellar Phoenix Photo Recovery (HKLM-x32\...\Stellar Phoenix Photo Recovery_is1) (Version: 4.0.0.0 - Stellar Information Systems Ltd)
SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
SystemDiagnostics (HKLM-x32\...\{80B0B731-5FAE-475D-8844-20F46373780D}) (Version: 3.02.0010 - Fujitsu Technology Solutions)
teXXas (HKLM-x32\...\{F3DCD04C-BE9C-408C-BC8C-B77AF972DBC2}) (Version: 1 - metaspinner net GmbH)
TomTom HOME (HKLM-x32\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Toolbox (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM-x32\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
WebReg (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live ID-Anmelde-Assistent (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live OneCare safety scanner (HKLM-x32\...\Windows Live OneCare safety scanner) (Version: - Microsoft Corporation)
Windows Live OneCare safety scanner (x32 Version: 1.0.0.0 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
XP Codec Pack (HKLM-x32\...\XP Codec Pack) (Version: - )
==================== Restore Points =========================
16-04-2014 15:01:22 Windows Update
27-04-2014 09:58:17 Installed Java 7 Update 55
27-04-2014 10:05:33 Removed Java 7 Update 55
27-04-2014 10:17:56 Installed Java 7 Update 55
12-05-2014 15:12:38 Windows Update
12-05-2014 18:07:07 OpenOffice.org 3.1 wird entfernt
12-05-2014 18:13:37 AA11
14-05-2014 10:04:25 AA11
14-05-2014 11:40:48 Windows Update
14-05-2014 12:43:05 Windows Update
20-05-2014 20:37:28 Windows Update
22-05-2014 17:30:17 Revo Uninstaller's restore point - pdfforge Toolbar v4.6
22-05-2014 17:31:06 Removed pdfforge Toolbar v4.6.
==================== Hosts content: ==========================
2006-11-02 14:34 - 2006-09-18 23:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {01503B02-7AF4-4ED7-9E3F-97049297213F} - System32\Tasks\{B7B91C77-1E48-44BE-8E9F-FC08EE02125A} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {2AADFD7A-5B44-4E29-BEB4-46715EFFAD16} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {5E551E2D-6024-438A-B6BB-4BD2C63E230F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {6A3BC972-B370-45E3-AD15-370CFD3EE8F9} - System32\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F} => C:\Program Files\V-bates\PrefHelper.exe
Task: {7A936888-6D24-4B69-9A45-EAEA6C3F1EFF} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {7BA40AA9-D6BC-4D03-A0C0-398717389FC7} - System32\Tasks\{F7A8E834-BD3C-4504-885B-1E637D64FEC7} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {8CFE1E32-B04E-456C-989C-1AA1556BE805} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)
Task: {B384F716-A243-4440-91D6-34FA3643F784} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)
Task: {BF328AF9-E972-4814-BA2B-8955BE07E803} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07] (Google Inc.)
Task: {E3891FA7-79D4-4A37-A8CC-B7D9ADEDDCEC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-23] (Google Inc.)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FF Watcher {DC4BE196-01E2-4BF8-88C1-6734E875056F}.job => C:\Program Files\V-bates\PrefHelper.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000Core.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839580519-3571548420-1780697189-1000UA.job => C:\Users\Dirk\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2009-11-19 19:34 - 2006-02-23 13:35 - 00020480 _____ () C:\Windows\System32\FritzColorPort64.dll
2009-11-19 19:34 - 2006-02-22 12:39 - 00020480 _____ () C:\Windows\System32\FritzPort64.dll
2014-01-23 16:09 - 2014-01-23 16:09 - 00702744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
2014-01-23 16:30 - 2014-01-23 16:30 - 00103800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_thread-vc100-mt-1_55.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00024440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_system-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00033656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_chrono-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00055680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_date_time-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00123776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_filesystem-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 03720040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareServiceKernel.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00685904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SQLite.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00158032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\pugixml.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 02595144 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\RCF.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00788856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_regex-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00602984 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareActivation.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareApplicationUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00142696 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareGamingMode.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00098648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareReset.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00120152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTime.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00268152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00198024 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdaterScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00417128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIgnoreList.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00253800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareQuarantine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00293744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiMalwareEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00212336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiRootkitEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00509808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerHistory.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00607584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScanner.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00035192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_timer-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00325488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00333688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareRealTimeProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00227688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIncompatibles.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00219488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiSpam.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00129896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiPhishing.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00599920 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareParentalControl.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 01926504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareWebProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00263536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareEmailProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00650608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareNetworkProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00490848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareInstaller.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00106824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\zlib.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00149840 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\libssh2.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00358744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwarePromo.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareFeedback.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00154464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SecurityCenter.dll
2013-07-17 17:10 - 2013-07-17 17:10 - 00777296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\BDSmartDB.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 02141040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareShellExtension.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 04114264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
2014-01-23 16:29 - 2014-01-23 16:29 - 00500088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_locale-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00361824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\HtmlFramework.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00066904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\DllStorage.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00788848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTrayDefaultSkin.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00139608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\Localization.dll
2009-10-03 10:51 - 2008-12-02 14:21 - 00041984 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_ex.exe
2009-10-03 10:51 - 2009-06-10 06:19 - 00057856 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_x64.dll
2012-12-21 19:33 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2009-10-03 10:51 - 2009-09-25 16:50 - 00445440 _____ () C:\Program Files (x86)\Hardcopy\HcDllS.dll
2009-10-03 10:51 - 2009-08-19 13:20 - 00043008 _____ () C:\Program Files (x86)\Hardcopy\hardcopy_02.dll
2009-10-03 10:51 - 2009-06-10 06:19 - 00057344 _____ () C:\Program Files (x86)\Hardcopy\HcDLL2_29_Win32.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:A8665DF4
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^Users^Dirk^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: BDRegion => "C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe"
MSCONFIG\startupreg: Google EULA Launcher => c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe IE PA
MSCONFIG\startupreg: NokiaMServer => C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
MSCONFIG\startupreg: NokiaMusic FastStart => "C:\Program Files (x86)\Nokia\Ovi Player\NokiaOviPlayer.exe" /command:faststart
MSCONFIG\startupreg: NokiaOviSuite2 => C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
MSCONFIG\startupreg: RemoteControl => "C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
==================== Faulty Device Manager Devices =============
Name: Photosmart C309a series
Description: Photosmart C309a series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/23/2014 10:16:24 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Error: (05/23/2014 05:58:56 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Error: (05/23/2014 05:58:50 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Error: (05/23/2014 05:58:49 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Error: (05/23/2014 05:58:46 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen bereits aktiven Komponentenversion.
Die widersprüchlichen Komponenten sind:
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Error: (05/23/2014 05:34:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (05/23/2014 05:35:13 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {7F6316B4-4D69-4765-B0A3-B2598F2FA80A}
Error: (05/23/2014 05:34:09 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt
Error: (05/23/2014 05:34:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Util fassurun%%3
Microsoft Office Sessions:
=========================
Error: (05/01/2014 07:39:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 36965 seconds with 180 seconds of active time. This session ended with a crash.
Error: (03/12/2014 07:08:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 58 seconds with 0 seconds of active time. This session ended with a crash.
Error: (02/03/2014 07:02:12 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2689 seconds with 600 seconds of active time. This session ended with a crash.
Error: (02/16/2013 02:55:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.
Error: (12/22/2012 09:18:07 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.
Error: (12/09/2012 10:54:19 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.
Error: (12/09/2012 10:54:02 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.
Error: (07/09/2012 00:55:39 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 28 seconds with 0 seconds of active time. This session ended with a crash.
Error: (07/06/2012 11:28:16 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 43 seconds with 0 seconds of active time. This session ended with a crash.
Error: (05/31/2012 08:02:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9 seconds with 0 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-05-23 22:28:32.102
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-23 22:28:31.722
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-23 22:28:31.206
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-23 22:28:30.832
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-23 22:28:30.449
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-23 22:28:30.082
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-23 22:28:29.697
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-23 22:28:29.339
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-23 22:28:28.727
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-05-23 22:28:28.372
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 65%
Total physical RAM: 4094.32 MB
Available physical RAM: 1393.09 MB
Total Pagefile: 8403.91 MB
Available Pagefile: 5684.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: (SYSTEM) (Fixed) (Total:164.75 GB) (Free:33.81 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (DATA) (Fixed) (Total:1220.5 GB) (Free:761.28 GB) NTFS
Drive f: (Fiona) (Fixed) (Total:114.44 GB) (Free:43.34 GB) NTFS
Drive y: (Two-Face) (Removable) (Total:14.89 GB) (Free:13.49 GB) exFAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 1397 GB) (Disk ID: FCD6DD83)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=165 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=-888516751360) - (Type=07 NTFS)
========================================================
Disk: 5 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: 98720C68)
Partition 1: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
========================================================
Disk: 6 (Size: 114 GB) (Disk ID: 8B4E8E83)
Partition 1: (Not Active) - (Size=114 GB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=55 MB) - (Type=83)
==================== End Of Log ============================
Fassurun ist noch im Addition Log, fbdownloader noch in Chrome ... |
|
24.05.2014, 18:20
| #10 |
| /// the machine /// TB-Ausbilder | Windows Vista - search.fbdownloader in google chrome Adobe updaten. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop. SystemLook (64 bit)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.05.2014, 21:37
| #11 |
| | Windows Vista - search.fbdownloader in google chrome Adobe Reader ist aktuell Hab Chrome de- und wiederinstalliert, nach Anmeldung an Google Konto war fbdownloader wieder da. Nach Browser zurück setzen ist er jetzt weg. Hierfür schon mal vielen Dank. Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 22:32 on 24/05/2014 by Dirk
Administrator - Elevation successful
========== regfind ==========
Searching for "fassurun"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\fassurun]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]
@="IfassurunBHO"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]
@="fassurunIEClientLib"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\0\win32]
@="C:\Program Files (x86)\fassurun\fassurunbho.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\HELPDIR]
@="C:\Program Files (x86)\fassurun"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]
@="IfassurunBHO"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]
@="fassurunIEClientLib"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\0\win32]
@="C:\Program Files (x86)\fassurun\fassurunbho.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\HELPDIR]
@="C:\Program Files (x86)\fassurun"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
"DisplayName"="fassurun 2013.11.07.203951"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
"UninstallString"="C:\Program Files (x86)\fassurun\fassurununinstall.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
"QuietUninstallString"="C:\Program Files (x86)\fassurun\fassurununinstall.exe /S"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
"InstallLocation"="C:\Program Files (x86)\fassurun"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
"DisplayIcon"="C:\Program Files (x86)\fassurun\fassurun.ico"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
"Publisher"="fassurun"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
"HelpLink"="mailto:support@fassurun.co"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
"URLUpdateInfo"="hxxp://fassurun.co"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
"URLInfoAbout"="hxxp://fassurun.co/support"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]
@="IfassurunBHO"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]
@="fassurunIEClientLib"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\0\win32]
@="C:\Program Files (x86)\fassurun\fassurunbho.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0\HELPDIR]
@="C:\Program Files (x86)\fassurun"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Update fassurun]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Util fassurun]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Util fassurun]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Util fassurun]
"ImagePath"=""C:\Program Files (x86)\fassurun\bin\utilfassurun.exe""
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Util fassurun]
"DisplayName"="Util fassurun"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Update fassurun]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Util fassurun]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Util fassurun]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Util fassurun]
"ImagePath"=""C:\Program Files (x86)\fassurun\bin\utilfassurun.exe""
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Util fassurun]
"DisplayName"="Util fassurun"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Update fassurun]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Util fassurun]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util fassurun]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util fassurun]
"ImagePath"=""C:\Program Files (x86)\fassurun\bin\utilfassurun.exe""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util fassurun]
"DisplayName"="Util fassurun"
[HKEY_USERS\S-1-5-21-3839580519-3571548420-1780697189-1000\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\fassurun]
-= EOF =-
|
|
25.05.2014, 18:33
| #12 |
| /// the machine /// TB-Ausbilder | Windows Vista - search.fbdownloader in google chrome Kopiere den Text in der Codebox in deinen Editor (z.B. Notepad) und speichere es unter dem Namen regfix.reg (bei Dateityp bitte "alle Dateien" wählen) Code:
ATTFilter Windows Registry Editor Version 5.00
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\fassurun]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fassurun]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{D5B61C4D-7FC9-452A-B5C1-32625AC3B850}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2EB0829-CC71-4622-9E69-48C5E01361F0}\1.0]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Update fassurun]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Util fassurun]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Util fassurun]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Update fassurun]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Util fassurun]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Util fassurun]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Update fassurun]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Util fassurun]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util fassurun]
[-HKEY_USERS\S-1-5-21-3839580519-3571548420-1780697189-1000\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\fassurun]
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.05.2014, 09:47
| #13 |
| | Windows Vista - search.fbdownloader in google chrome Hallo, Probleme sind gelöst. Herzlichen Dank für deine Zeit. Viele Grüße und nen schönen Vatertag, Dirk |
|
30.05.2014, 09:39
| #14 |
| /// the machine /// TB-Ausbilder | Windows Vista - search.fbdownloader in google chrome Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.05.2014, 14:32
| #15 |
| | Windows Vista - search.fbdownloader in google chrome Hallo, noch mal vielen Dank. Gruß Dirk |
|
Revo Uninstaller herunter.
dann auf 
und dann auf 
.
Linear-Darstellung
