| |
| |||||||
Log-Analyse und Auswertung: not-a-virus:AdWare.Win32.Agent.aknuWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
22.05.2014, 23:32
| #1 |
 |  not-a-virus:AdWare.Win32.Agent.aknu Hallo, Ich habe Kaspersky 2013 auf dem PC. Als ich gestern im Internet gesurft habe, öffnete sich ein Fenster mit der Meldung, ich hätte eine alte Flash Player Version auf dem Pc und müsste dieses unbedingt aktualisieren. Dieses Fenster öffnet sich ständig bei mir, wenn ich im Internet bin! Ich wollte das Fenster nur schließen, weil ich mir gedacht habe, es könnte ja ein Virus sein. Da setzte plötzlich automatisch ein Download ein. Habe dann mit Kaspersky sofort eine Säuberung durchgeführt. Der hat auch 2 Bedrohungen gefunden, aber er kann die nicht entfernen. Bei der einen Bedrohung steht: dtx Dynamic Link Library und bei der anderen steht: DTX Toolbar. Wenn ich auf die Beschreibung der Bedrohungen klicke, erscheint dies: not-a-virus:AdWare.Win32.Agent.aknu. Komisch ist, dass ich sonst keine Anzeichen für einen Virus merke aber das heisst ja nichts! Habe dann alle Schritte/Scans durchgeführt, wie in der Anleitung beschrieben. Hier die Ergebnisse: Ich hoffe sehr, ihr könnt mir weiterhelfen. DAnke im voraus!!!!! Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:57 on 22/05/2014 (Reyhan)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014
Ran by Reyhan (administrator) on REYHAN-HP on 22-05-2014 23:05:19
Running from C:\Users\Reyhan\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Koyote-Lab Inc) C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Koyote-Lab Inc) C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TorchMedia Inc.) C:\Users\Reyhan\AppData\Local\Torch\Update\TorchCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Dropbox, Inc.) C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Koyote-Lab Inc) C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\plugin-nm-server.exe
(Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\chrome.exe
(PriceMeter) C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [151552 2013-06-29] (IvoSoft)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1243656 2013-12-06] (Easybits)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [Google Update] => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-09-20] (Google Inc.)
HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Policies\system: [DisableChangePassword] 0
Startup: C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll [489992 2014-05-12] () <===== ATTENTION
HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll [664584 2014-05-12] () <===== ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.search.ask.com/?o=APN10649A&gct=hp&d=414-135&v=a12627-127&t=4
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2414} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms}
SearchScopes: HKLM - {A4FA6C37-32A9-4C43-B912-4562FAB9AA92} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2414} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms}
SearchScopes: HKLM-x32 - {A4FA6C37-32A9-4C43-B912-4562FAB9AA92} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - DefaultScope Software\Microsoft\Internet Explorer\SearchScopes URL =
SearchScopes: HKCU - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2414} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms}
SearchScopes: HKCU - {A4FA6C37-32A9-4C43-B912-4562FAB9AA92} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
BHO: Plus-HD-2.2 - {11111111-1111-1111-1111-110311301136} - C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-bho64.dll (Plus HD)
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Plus-HD-2.2 - {11111111-1111-1111-1111-110311301136} - C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-bho.dll (Plus HD)
BHO-x32: Speed Analysis 2 - {18DBB6CE-3148-4FEC-B481-103CB3290427} - C:\Program Files (x86)\Speed Analysis 2\ScriptHost.dll (SpeedAnalysis.com)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Movies Toolbar (Dist. by Koyote-Lab, Inc.) - {e5d4f4fd-a039-4670-8354-633c30a5f54e} - C:\PROGRA~2\MOVIES~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll No File
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Toolbar: HKLM-x32 - Movies Toolbar (Dist. by Koyote-Lab, Inc.) - {e5d4f4fd-a039-4670-8354-633c30a5f54e} - C:\PROGRA~2\MOVIES~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default
FF user.js: detected! => C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\user.js
FF DefaultSearchEngine: Search the web
FF SearchEngineOrder.1: Search the web
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=3 - C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll (PriceMeter)
FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=9 - C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll (PriceMeter)
FF Plugin-x32: @videolan.org/vlc,version=1.1.11 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Reyhan\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Reyhan\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\searchplugins\Ask.xml
FF SearchPlugin: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\searchplugins\delta.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Ask.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Search the web.src
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Plus-HD-2.2 - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\4fdacf00-e9c4-4ad5-b4cf-bf9800f184f6@36857116-74e0-4973-936f-860cd2a102a9.com [2014-05-19]
FF Extension: toolplugin - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\welcome@toolmin.com [2012-02-14]
FF Extension: Ask New Tabs - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38} [2014-05-19]
FF Extension: DivX Web Player - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\DivXWebPlayer@divx.com.xpi [2011-06-07]
FF Extension: Speed Analysis 2 - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\speedanalysis02@SpeedAnalysis.com.xpi [2013-11-16]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2012-12-18]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2012-12-18]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2012-12-18]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2012-12-18]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2012-12-18]
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ []
Chrome:
=======
CHR DefaultSearchKeyword: ask.com
CHR DefaultSearchProvider: Ask.com
CHR DefaultSearchURL: hxxp://dts.search.ask.com/sr?src=crb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll ()
CHR Plugin: (Java Deployment Toolkit 6.0.200.2) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\Reyhan\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-20]
CHR Extension: (Google Drive) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-20]
CHR Extension: (YouTube) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-14]
CHR Extension: (Google-Suche) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-14]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2013-09-20]
CHR Extension: (Plus-HD-2.2) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfakeonomonapccoamcmdgpoaicnpnoo [2013-11-05]
CHR Extension: (Kaspersky Protection) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpoimibckejjdjcfbdnajaicnklhfplh [2014-05-21]
CHR Extension: (DVDVideoSoft) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-09-20]
CHR Extension: (Google Wallet) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-20]
CHR Extension: (Google Mail) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-14]
CHR Extension: (Anti-Banner) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2013-09-20]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-06-24]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx [2012-10-25]
CHR HKLM-x32\...\Chrome\Extension: [dgjkhjdcljddbedokogakmmdjgnbeanf] - C:\Users\Reyhan\AppData\Roaming\SpeedAnalysis2\SpeedAnalysis.crx [2013-06-11]
CHR HKLM-x32\...\Chrome\Extension: [lpoimibckejjdjcfbdnajaicnklhfplh] - https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh [2013-06-11]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx [2012-10-25]
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO)
R2 DatamngrCoordinator; C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe [3544072 2014-05-12] (Koyote-Lab Inc)
S2 pricemeterliveUpdate; C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504 2014-05-21] (PriceMeter)
S3 pricemeterliveUpdatem; C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504 2014-05-21] (PriceMeter)
R2 TorchCrashHandler; C:\Users\Reyhan\AppData\Local\Torch\Update\TorchCrashHandler.exe [1210720 2013-09-24] (TorchMedia Inc.)
S2 Update ConstaSurf; "C:\Program Files (x86)\ConstaSurf\updateConstaSurf.exe" [X]
==================== Drivers (Whitelisted) ====================
R1 F06DEFF2-5B9C-490D-910F-35D3A9119622; C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\setmgrc1.cfg [36232 2014-05-12] (Koyote-Lab Inc)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-11] (Kaspersky Lab ZAO)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [91008 2014-05-21] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [628320 2014-05-21] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-23] (Kaspersky Lab ZAO)
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-22 23:05 - 2014-05-22 23:06 - 00029132 _____ () C:\Users\Reyhan\Desktop\FRST.txt
2014-05-22 23:04 - 2014-05-22 23:05 - 00000000 ____D () C:\FRST
2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Downloads\FRST64.exe
2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Desktop\FRST64.exe
2014-05-22 22:57 - 2014-05-22 22:57 - 00000474 _____ () C:\Users\Reyhan\Desktop\defogger_disable.log
2014-05-22 22:56 - 2014-05-22 22:56 - 00050477 _____ () C:\Users\Reyhan\Desktop\Defogger (1).exe
2014-05-22 22:52 - 2014-05-22 22:52 - 00000474 _____ () C:\Users\Reyhan\Downloads\defogger_disable.log
2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 _____ () C:\Users\Reyhan\defogger_reenable
2014-05-22 22:50 - 2014-05-22 22:50 - 00050477 _____ () C:\Users\Reyhan\Downloads\Defogger.exe
2014-05-21 23:32 - 2014-05-21 23:32 - 00000045 _____ () C:\Users\Reyhan\AppData\Roaming\WB.CFG
2014-05-21 22:32 - 2014-05-22 22:37 - 00000966 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job
2014-05-21 22:32 - 2014-05-22 22:37 - 00000962 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job
2014-05-21 22:32 - 2014-05-22 00:32 - 00000296 _____ () C:\Windows\Tasks\PriceMeterUpdater.job
2014-05-21 22:32 - 2014-05-21 22:32 - 00003962 _____ () C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA
2014-05-21 22:32 - 2014-05-21 22:32 - 00003710 _____ () C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore
2014-05-21 22:32 - 2014-05-21 22:32 - 00003300 _____ () C:\Windows\System32\Tasks\pricemeterdownloader
2014-05-21 22:32 - 2014-05-21 22:32 - 00003240 _____ () C:\Windows\System32\Tasks\PriceMeterUpdater
2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\PriceMeterUpdater
2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Users\Reyhan\AppData\Local\PriceMeterLiveUpdate
2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\ProgramData\PriceMeterLiveUpdate
2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Program Files (x86)\PriceMeterLiveUpdate
2014-05-21 22:30 - 2014-05-21 22:31 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Advanced System Protector
2014-05-21 22:29 - 2014-05-22 00:24 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Systweak
2014-05-21 22:28 - 2014-05-21 22:28 - 01069776 _____ (Solid State Networks) C:\Users\Reyhan\Downloads\install_flashplayer13x32_mssa_aaa_aih.exe
2014-05-21 22:23 - 2014-05-21 22:23 - 00942552 _____ () C:\Users\Reyhan\Downloads\setup (3).exe
2014-05-19 16:59 - 2014-05-22 23:06 - 00000000 ____D () C:\ProgramData\Datamngr
2014-05-15 23:20 - 2014-05-15 23:20 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a
2014-05-15 20:43 - 2014-05-15 20:44 - 00994176 _____ () C:\Users\Reyhan\Downloads\setup (2).exe
2014-05-14 18:08 - 2014-05-14 18:08 - 00994160 _____ () C:\Users\Reyhan\Downloads\setup (1).exe
2014-05-14 17:07 - 2014-05-14 17:08 - 00994160 _____ () C:\Users\Reyhan\Downloads\setup.exe
2014-05-12 22:02 - 2014-05-12 22:02 - 00022655 _____ () C:\Users\Reyhan\Downloads\2. Klausur EPH.odt
2014-05-05 12:22 - 2014-05-05 12:22 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\DropboxMaster
==================== One Month Modified Files and Folders =======
2014-05-22 23:06 - 2014-05-22 23:05 - 00029132 _____ () C:\Users\Reyhan\Desktop\FRST.txt
2014-05-22 23:06 - 2014-05-19 16:59 - 00000000 ____D () C:\ProgramData\Datamngr
2014-05-22 23:05 - 2014-05-22 23:04 - 00000000 ____D () C:\FRST
2014-05-22 23:05 - 2012-04-05 16:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-22 23:05 - 2010-12-01 04:32 - 01093773 _____ () C:\Windows\WindowsUpdate.log
2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Downloads\FRST64.exe
2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Desktop\FRST64.exe
2014-05-22 22:57 - 2014-05-22 22:57 - 00000474 _____ () C:\Users\Reyhan\Desktop\defogger_disable.log
2014-05-22 22:56 - 2014-05-22 22:56 - 00050477 _____ () C:\Users\Reyhan\Desktop\Defogger (1).exe
2014-05-22 22:52 - 2014-05-22 22:52 - 00000474 _____ () C:\Users\Reyhan\Downloads\defogger_disable.log
2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 _____ () C:\Users\Reyhan\defogger_reenable
2014-05-22 22:52 - 2011-02-09 17:02 - 00000000 ____D () C:\Users\Reyhan
2014-05-22 22:50 - 2014-05-22 22:50 - 00050477 _____ () C:\Users\Reyhan\Downloads\Defogger.exe
2014-05-22 22:37 - 2014-05-21 22:32 - 00000966 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job
2014-05-22 22:37 - 2014-05-21 22:32 - 00000962 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job
2014-05-22 22:16 - 2013-09-20 23:36 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000UA.job
2014-05-22 22:06 - 2012-12-18 21:33 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-05-22 22:02 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-22 22:02 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-22 21:56 - 2013-02-16 17:48 - 00000000 ___RD () C:\Users\Reyhan\Dropbox
2014-05-22 21:56 - 2013-02-16 17:44 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Dropbox
2014-05-22 21:55 - 2013-11-05 16:01 - 00001298 _____ () C:\Windows\Tasks\Plus-HD-2.2-updater.job
2014-05-22 21:55 - 2013-11-05 16:01 - 00001200 _____ () C:\Windows\Tasks\Plus-HD-2.2-codedownloader.job
2014-05-22 21:55 - 2013-11-05 16:01 - 00001100 _____ () C:\Windows\Tasks\Plus-HD-2.2-enabler.job
2014-05-22 21:55 - 2013-11-05 16:00 - 00001908 _____ () C:\Windows\Tasks\Plus-HD-2.2-chromeinstaller.job
2014-05-22 21:55 - 2013-11-05 16:00 - 00001832 _____ () C:\Windows\Tasks\Plus-HD-2.2-firefoxinstaller.job
2014-05-22 21:55 - 2013-10-06 19:52 - 00000000 ____D () C:\ProgramData\TorchCrashHandler
2014-05-22 21:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-22 21:54 - 2011-02-09 15:53 - 00692738 _____ () C:\Windows\PFRO.log
2014-05-22 21:54 - 2009-07-14 06:51 - 00156030 _____ () C:\Windows\setupact.log
2014-05-22 00:59 - 2013-10-06 19:48 - 00000000 ____D () C:\ProgramData\Wincert
2014-05-22 00:32 - 2014-05-21 22:32 - 00000296 _____ () C:\Windows\Tasks\PriceMeterUpdater.job
2014-05-22 00:24 - 2014-05-21 22:29 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Systweak
2014-05-22 00:23 - 2011-02-09 17:18 - 00000000 ___RD () C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-21 23:59 - 2013-12-19 16:48 - 00262144 _____ () C:\Windows\system32\config\elam
2014-05-21 23:32 - 2014-05-21 23:32 - 00000045 _____ () C:\Users\Reyhan\AppData\Roaming\WB.CFG
2014-05-21 23:27 - 2013-09-20 23:36 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000Core.job
2014-05-21 22:49 - 2013-10-11 14:51 - 00002304 _____ () C:\Users\Reyhan\Desktop\Sicherer Zahlungsverkehr.lnk
2014-05-21 22:32 - 2014-05-21 22:32 - 00003962 _____ () C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA
2014-05-21 22:32 - 2014-05-21 22:32 - 00003710 _____ () C:\Windows\System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore
2014-05-21 22:32 - 2014-05-21 22:32 - 00003300 _____ () C:\Windows\System32\Tasks\pricemeterdownloader
2014-05-21 22:32 - 2014-05-21 22:32 - 00003240 _____ () C:\Windows\System32\Tasks\PriceMeterUpdater
2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\PriceMeterUpdater
2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Users\Reyhan\AppData\Local\PriceMeterLiveUpdate
2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\ProgramData\PriceMeterLiveUpdate
2014-05-21 22:32 - 2014-05-21 22:32 - 00000000 ____D () C:\Program Files (x86)\PriceMeterLiveUpdate
2014-05-21 22:31 - 2014-05-21 22:30 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Advanced System Protector
2014-05-21 22:28 - 2014-05-21 22:28 - 01069776 _____ (Solid State Networks) C:\Users\Reyhan\Downloads\install_flashplayer13x32_mssa_aaa_aih.exe
2014-05-21 22:23 - 2014-05-21 22:23 - 00942552 _____ () C:\Users\Reyhan\Downloads\setup (3).exe
2014-05-21 21:48 - 2013-01-03 16:14 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForReyhan
2014-05-21 21:48 - 2013-01-03 16:14 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForReyhan.job
2014-05-21 18:58 - 2012-10-25 13:42 - 00628320 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-05-21 18:58 - 2012-08-13 19:24 - 00091008 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-05-19 22:40 - 2012-04-28 11:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-19 21:14 - 2013-08-31 21:28 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\HpUpdate
2014-05-18 19:32 - 2014-03-23 18:59 - 00000000 ____D () C:\Users\Reyhan\Desktop\bewerbungen
2014-05-18 11:10 - 2012-12-12 23:49 - 00000000 ____D () C:\Users\Reyhan\Documents\Geschichte sek I
2014-05-15 23:29 - 2011-02-09 19:06 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 23:26 - 2013-08-25 22:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 23:23 - 2011-09-30 10:47 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 23:20 - 2014-05-15 23:20 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a
2014-05-15 21:48 - 2012-12-20 17:05 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-05-15 21:47 - 2013-02-16 15:18 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-05-15 20:44 - 2014-05-15 20:43 - 00994176 _____ () C:\Users\Reyhan\Downloads\setup (2).exe
2014-05-14 18:08 - 2014-05-14 18:08 - 00994160 _____ () C:\Users\Reyhan\Downloads\setup (1).exe
2014-05-14 17:08 - 2014-05-14 17:07 - 00994160 _____ () C:\Users\Reyhan\Downloads\setup.exe
2014-05-14 14:07 - 2012-04-05 16:30 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 14:07 - 2012-04-05 16:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 14:07 - 2012-02-20 13:42 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 13:54 - 2013-10-01 16:20 - 00000000 ____D () C:\Users\Reyhan\Desktop\Gutachten Ref_Sonnentiger
2014-05-14 13:41 - 2013-02-16 17:48 - 00001021 _____ () C:\Users\Reyhan\Desktop\Dropbox.lnk
2014-05-14 13:41 - 2013-02-16 17:45 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-12 22:02 - 2014-05-12 22:02 - 00022655 _____ () C:\Users\Reyhan\Downloads\2. Klausur EPH.odt
2014-05-12 22:00 - 2013-02-16 21:58 - 00000000 ____D () C:\Users\Reyhan\Documents\Geschichte sek II
2014-05-12 20:12 - 2013-02-12 17:05 - 00000000 ____D () C:\Users\Reyhan\Documents\sonstiges
2014-05-12 19:47 - 2013-02-17 13:53 - 00000000 ____D () C:\Users\Reyhan\Documents\herkenrath
2014-05-10 23:11 - 2013-09-20 23:36 - 00004096 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000UA
2014-05-10 23:11 - 2013-09-20 23:36 - 00003700 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000Core
2014-05-07 14:51 - 2014-04-13 16:48 - 00000000 ____D () C:\Users\Reyhan\Documents\Ref
2014-05-06 19:06 - 2010-07-20 23:46 - 00654400 _____ () C:\Windows\system32\perfh007.dat
2014-05-06 19:06 - 2010-07-20 23:46 - 00130240 _____ () C:\Windows\system32\perfc007.dat
2014-05-06 19:06 - 2009-07-14 07:13 - 01498742 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-05 12:22 - 2014-05-05 12:22 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\DropboxMaster
Files to move or delete:
====================
C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll
C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll
Some content of TEMP:
====================
C:\Users\Reyhan\AppData\Local\Temp\6_Offer_9.exe
C:\Users\Reyhan\AppData\Local\Temp\autorun.dll
C:\Users\Reyhan\AppData\Local\Temp\b4rrqmfd.dll
C:\Users\Reyhan\AppData\Local\Temp\BackupSetup.exe
C:\Users\Reyhan\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Reyhan\AppData\Local\Temp\Delta.exe
C:\Users\Reyhan\AppData\Local\Temp\DeltaTB.exe
C:\Users\Reyhan\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzrjnjj.dll
C:\Users\Reyhan\AppData\Local\Temp\Extract.exe
C:\Users\Reyhan\AppData\Local\Temp\f.exe
C:\Users\Reyhan\AppData\Local\Temp\glpo0rwa.dll
C:\Users\Reyhan\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Reyhan\AppData\Local\Temp\ICReinstall_PDFCreatorSetup.exe
C:\Users\Reyhan\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Reyhan\AppData\Local\Temp\propsys.dll
C:\Users\Reyhan\AppData\Local\Temp\Resource.exe
C:\Users\Reyhan\AppData\Local\Temp\SP51865.exe
C:\Users\Reyhan\AppData\Local\Temp\SP52264.exe
C:\Users\Reyhan\AppData\Local\Temp\SP54714.exe
C:\Users\Reyhan\AppData\Local\Temp\SP56215.exe
C:\Users\Reyhan\AppData\Local\Temp\SP56221.exe
C:\Users\Reyhan\AppData\Local\Temp\sp58915.exe
C:\Users\Reyhan\AppData\Local\Temp\sp64126.exe
C:\Users\Reyhan\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Reyhan\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\Reyhan\AppData\Local\Temp\WSSetup.exe
C:\Users\Reyhan\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_N360_20117.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-08 13:32
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-05-2014
Ran by Reyhan at 2014-05-22 23:07:05
Running from C:\Users\Reyhan\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Kaspersky Internet Security (Enabled - Up to date) {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
AS: Kaspersky Internet Security (Enabled - Up to date) {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
==================== Installed Programs ======================
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Acrobat 5.0 (HKLM-x32\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader 9.5.1 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.1 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\{9ECF7817-DB11-4FBA-9DF1-296A578D513A}) (Version: 11.5.7.609 - Adobe Systems, Inc)
ATI Catalyst Install Manager (HKLM\...\{1795BAA8-65EC-66D0-9DA4-D4B1FBE7700E}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0621.2137.36973 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0621.2137.36973 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0621.2137.36973 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0621.2137.36973 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help English (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help French (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help German (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0621.2136.36973 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0621.2137.36973 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0621.2137.36973 - ATI) Hidden
Classic Shell (HKLM\...\{FEA1590B-540A-41FC-A95C-664493C82A21}) (Version: 3.6.8 - IvoSoft)
CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3003 - CyberLink Corp.)
CyberLink DVD Suite (x32 Version: 7.0.3003 - CyberLink Corp.) Hidden
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.1.4217 - CyberLink Corp.)
CyberLink PowerDVD 9 (x32 Version: 9.0.1.4217 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2511 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.0.2511 - CyberLink Corp.) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{349F73CA-653A-43A6-AE77-970B07D6EDA0}) (Version: - Microsoft)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.5 - DivX, LLC)
Dropbox (HKCU\...\Dropbox) (Version: 2.6.33 - Dropbox, Inc.)
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
ffdshow v1.3.4500 [2013-01-06] (HKLM-x32\...\ffdshow_is1) (Version: 1.3.4500.0 - )
Free Video Converter V 3.2 (HKLM-x32\...\Free Video Converter_is1) (Version: 3.2.0.0 - Koyote Soft)
Free YouTube Download version 3.2.4.622 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.4.622 - DVDVideoSoft Ltd.)
Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Update Helper (x32 Version: 1.3.23.0 - PriceMeter) Hidden <==== ATTENTION
HDPlayer (HKLM-x32\...\1ClickDownload) (Version: 2.1 Build 26473 - HDPlayer) <==== ATTENTION
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.10262.3295 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{B360E24A-BF25-4353-AA79-1B54F509024A}) (Version: 1.0.0.0 - Hewlett-Packard)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet Pro 8600 Hilfe (HKLM-x32\...\{FDE820DD-CC88-4395-AD5C-801365B8F316}) (Version: 28.0.0 - Hewlett Packard)
HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard)
HP Software Framework (HKLM-x32\...\{62BD9D85-46D9-400E-95F1-A09B667CB57F}) (Version: 3.5.23.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{E342EC6B-5F25-47FE-B92C-DE616149B430}) (Version: 4.0.9.0 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation)
Java Auto Updater (x32 Version: 2.0.2.1 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 20 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Java(TM) 6 Update 20 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Kaspersky Internet Security 2013 (HKLM-x32\...\InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}) (Version: 13.0.1.4190 - Kaspersky Lab)
Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190 - Kaspersky Lab) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2907 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.2907 - CyberLink Corp.) Hidden
LightScribe System Software (HKLM-x32\...\{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}) (Version: 1.18.15.1 - LightScribe)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Movies Toolbar for Internet Explorer (Dist. by Koyote-Lab, Inc.) (HKLM-x32\...\koyotesoftmoviestoolbarhaIE) (Version: 1.6.2.0 - APN LLC) <==== ATTENTION
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MyFreeCodec (HKCU\...\MyFreeCodec) (Version: - )
Plus-HD-2.2 (HKLM-x32\...\Plus-HD-2.2) (Version: 1.29.153.3 - Plus HD) <==== ATTENTION
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3003 - CyberLink Corp.)
PowerDirector (x32 Version: 8.0.3003 - CyberLink Corp.) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6066 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30105 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.3023 - CyberLink Corp.) Hidden
RtVOsd (HKLM\...\{F3D7AC17-1FF4-41A8-BB18-3FC39C65AEB9}) (Version: 1.0.3 - Realtek Semiconductor Corp.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.16.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Speed Analysis 2 (HKLM-x32\...\Speed Analysis 2) (Version: 1.0.0.3 - SpeedAnalysis.com) <==== ATTENTION
Studie zur Verbesserung von HP Officejet Pro 8600 Produkten (HKLM\...\{B9824225-2055-4700-BCD4-64B25EC88264}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.17.0 - Synaptics Incorporated)
toolplugin (HKLM-x32\...\toolplugin) (Version: - )
Torch (HKCU\...\Torch) (Version: 29.0.0.5394 - Torch Media, Inc) <==== ATTENTION
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Updater Service (HKLM-x32\...\Updater Service) (Version: 15,9,28,27 - ) <==== ATTENTION
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN)
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 5.00 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
Zensurenrechner (HKLM-x32\...\{2D6650E5-EB74-489F-BE6B-5E5B2CAB502F}) (Version: 1.00.0000 - Marc-Oliver Stühmer)
==================== Restore Points =========================
01-04-2014 16:14:15 Windows Update
05-04-2014 10:20:23 Windows Update
10-04-2014 18:08:42 Windows Update
10-04-2014 18:26:50 Windows Update
19-04-2014 20:04:41 Windows Update
28-04-2014 10:58:59 Windows Update
02-05-2014 09:26:12 Windows Update
06-05-2014 15:33:24 Windows Update
10-05-2014 20:34:30 Windows Update
15-05-2014 17:30:17 Windows Update
15-05-2014 21:22:08 Windows Update
21-05-2014 14:30:06 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {15C3458A-BB00-4737-80C4-A18AD391CAEA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {19D28779-8B9E-4BE5-B1D1-CBDAA2B2EB23} - System32\Tasks\HP AR Program Upload - 0916bfa35d324a3b82eee0161673d2c1dbc328c3dd23418d8292c36ce43f44a5 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {1F372B15-D99E-4225-B22C-BD5546051ADF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {2AF9F8EE-E480-46A1-A48C-E8FD6142F238} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {36567CFC-253E-42CE-A9D3-B07AF22B6C96} - System32\Tasks\Plus-HD-2.2-chromeinstaller => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-chromeinstaller.exe [2013-11-05] (Plus HD) <==== ATTENTION
Task: {39BB4247-47B8-4E51-827A-8B8585E31425} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-05-21] (PriceMeter) <==== ATTENTION
Task: {4395BC09-BD88-4918-944E-F53B81E52A6A} - System32\Tasks\RecoveryCDWin7 => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] ()
Task: {4428A508-3F22-4D65-BD1D-14C5481C041A} - System32\Tasks\HPCustParticipation HP Officejet Pro 8600 => C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {46117FA1-7659-4580-81D0-A81B039B6CA8} - System32\Tasks\Plus-HD-2.2-firefoxinstaller => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-firefoxinstaller.exe [2013-11-05] (Plus HD) <==== ATTENTION
Task: {54768754-8392-4E52-9C50-101C8BA14E3E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000UA => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-20] (Google Inc.)
Task: {62BF5ACB-A6BB-4742-B804-A3EAEB56793A} - System32\Tasks\Plus-HD-2.2-codedownloader => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-codedownloader.exe [2013-11-05] (Plus HD) <==== ATTENTION
Task: {635ABB19-8A25-4825-9BA0-A577B2B99E3C} - System32\Tasks\HP AR Program Upload - 59dd25c072d24e1b9124c2395de5c0b03f6addd415d142e0817ab56c6f6e9395 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {6EC561EE-9047-43F1-88E0-A06C04E1A677} - System32\Tasks\pricemeterdownloader => C:\Users\Reyhan\AppData\Local\PriceMeter\pricemeterd.exe <==== ATTENTION
Task: {7193D61F-1C49-4AA3-8EA0-A2A2C386BD0E} - System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {76E3365D-9562-48CD-97DF-AF62F73882AE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {7A58BA56-B0F5-4789-B27B-F8219D6418A4} - System32\Tasks\PriceMeterUpdater => C:\Users\Reyhan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {88406FE4-C8F7-4167-ADBE-AD6BA20E96D5} - System32\Tasks\Plus-HD-2.2-enabler => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-enabler.exe [2013-11-05] (Plus HD) <==== ATTENTION
Task: {8E647909-B2ED-4356-BF24-8C2C9B82C9A4} - System32\Tasks\Plus-HD-2.2-updater => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-updater.exe [2013-11-05] (Plus HD) <==== ATTENTION
Task: {A15054DB-AE60-4069-AA94-F4D9C3DF5A77} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000Core => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-20] (Google Inc.)
Task: {A17C5532-BBB0-48E5-9252-B78F245F0E15} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {AAA2E062-EA50-4658-A693-35A87267FC32} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2014-05-13] (Microsoft)
Task: {B14FD8F2-2B33-4DD5-A1A1-9D5F3F57534F} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-05-21] (PriceMeter) <==== ATTENTION
Task: {D6968F80-7367-46CC-9FD4-DD8A64BBF212} - System32\Tasks\HPCeeScheduleForReyhan => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {E17FC154-EE02-4ED3-8225-6E641D66EE07} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {E1F53E64-86F6-48E8-9938-1021E4392243} - System32\Tasks\HP AR Program Upload - 5ce66c71ccfb416c9bbe4617df876fc2cc33c535579141a5ac4678af48b3d875 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {F93A880E-DBA1-4456-863B-8028F1805B51} - System32\Tasks\JavaUpdateSched => %COMMONPROGRAMFILES(x86)%\Java\Java Update\jusched.exe
Task: {FCDD8B28-012E-4F25-882B-458F0EB62C34} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000Core.job => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3704761350-3873045834-1805283501-1000UA.job => C:\Users\Reyhan\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForReyhan.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\Plus-HD-2.2-chromeinstaller.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-2.2-codedownloader.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-2.2-enabler.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-2.2-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-2.2-updater.job => C:\Program Files (x86)\Plus-HD-2.2\Plus-HD-2.2-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterUpdater.job => C:\Users\Reyhan\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2014-05-19 17:01 - 2014-05-12 15:06 - 00664584 _____ () C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll
2010-06-10 18:12 - 2010-06-10 18:12 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-06-21 22:36 - 2010-06-21 22:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2012-08-17 22:39 - 2012-12-18 21:53 - 01310136 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\kpcengine.2.2.dll
2014-05-19 17:01 - 2014-05-12 15:06 - 00489992 _____ () C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll
2014-05-19 17:01 - 2014-05-12 15:06 - 00020488 _____ () C:\Program Files (x86)\Movies Toolbar\Datamngr\mgrldr.dll
2010-05-19 11:05 - 2010-05-19 11:05 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2010-05-19 11:05 - 2010-05-19 11:05 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2010-05-19 11:05 - 2010-05-19 11:05 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2012-08-17 22:38 - 2012-08-17 22:38 - 00479160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
2014-05-22 21:55 - 2014-05-22 21:55 - 00041984 _____ () c:\users\reyhan\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzrjnjj.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\libcef.dll
2013-01-15 17:55 - 2013-01-15 17:55 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9e5dc5d1c75de12100f8c1d8c65de002\IsdiInterop.ni.dll
2010-12-01 04:35 - 2010-04-13 10:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2010-02-09 18:58 - 2010-02-09 18:58 - 00061440 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
2010-02-09 18:58 - 2010-02-09 18:58 - 00131072 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
2010-02-09 18:58 - 2010-02-09 18:58 - 00040960 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll
2010-02-09 18:58 - 2010-02-09 18:58 - 00005632 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll
2010-02-09 18:58 - 2010-02-09 18:58 - 00018944 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll
2010-02-09 18:58 - 2010-02-09 18:58 - 00036864 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll
2010-02-09 18:58 - 2010-02-09 18:58 - 00028672 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
2010-02-09 18:58 - 2010-02-09 18:58 - 00007680 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll
2014-05-15 20:20 - 2014-05-08 01:29 - 00065352 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll
2014-05-15 20:20 - 2014-05-08 01:29 - 00674632 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\libglesv2.dll
2014-05-15 20:20 - 2014-05-08 01:29 - 00093000 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\libegl.dll
2014-05-15 20:20 - 2014-05-08 01:29 - 04081480 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\pdf.dll
2014-05-15 20:20 - 2014-05-08 01:29 - 00390472 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll
2014-05-15 20:20 - 2014-05-08 01:29 - 01647432 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll
2014-05-15 20:20 - 2014-05-08 01:29 - 13695816 _____ () C:\Users\Reyhan\AppData\Local\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^Users^Reyhan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk => C:\Windows\pss\Tintenwarnungen überwachen - HP Officejet Pro 8600.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/22/2014 09:56:21 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (05/22/2014 00:23:59 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (05/22/2014 00:11:53 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (05/21/2014 10:48:13 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (05/21/2014 04:26:16 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (05/19/2014 10:42:20 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (05/19/2014 05:01:44 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (05/19/2014 04:00:15 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (05/19/2014 11:11:54 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (05/18/2014 10:50:31 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
System errors:
=============
Error: (05/22/2014 09:55:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Update ConstaSurf" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/22/2014 00:35:49 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Update ConstaSurf" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/22/2014 00:35:44 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Update ConstaSurf" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/22/2014 00:35:36 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Util ConstaSurf" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/22/2014 00:10:20 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Computer Backup (MyPC Backup)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (05/22/2014 00:10:20 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Computer Backup (MyPC Backup) erreicht.
Error: (05/22/2014 00:09:43 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 22.05.2014 um 00:08:32 unerwartet heruntergefahren.
Error: (05/22/2014 00:04:01 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (05/22/2014 00:03:24 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (05/21/2014 11:27:08 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.
Microsoft Office Sessions:
=========================
Error: (05/22/2014 09:56:21 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (05/22/2014 00:23:59 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (05/22/2014 00:11:53 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (05/21/2014 10:48:13 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (05/21/2014 04:26:16 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (05/19/2014 10:42:20 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (05/19/2014 05:01:44 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (05/19/2014 04:00:15 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (05/19/2014 11:11:54 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
Error: (05/18/2014 10:50:31 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.ExeC:\Program Files (x86)\Windows Live\Photo Gallery\WLMFDS.DLL8
CodeIntegrity Errors:
===================================
Date: 2014-02-09 10:11:44.398
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-09 10:11:44.398
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-09 10:11:44.383
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-09 10:11:44.383
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-09 10:11:44.367
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-09 10:11:44.367
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-08 12:34:41.113
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-08 12:34:41.113
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-08 12:34:41.113
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-08 12:34:41.097
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 53%
Total physical RAM: 3893.86 MB
Available physical RAM: 1829.81 MB
Total Pagefile: 7785.86 MB
Available Pagefile: 4934.76 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:280.96 GB) (Free:209.6 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:16.83 GB) (Free:2.43 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 298 GB) (Disk ID: CB9E9924)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=281 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=17 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-22 23:45:40
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.12.0 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Reyhan\AppData\Local\Temp\uxdcqpow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77]
.text C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77]
.text ... * 2
.text C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe[1896] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77]
.text C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe[1896] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77]
.text ... * 2
.text C:\Users\Reyhan\AppData\Local\Torch\Update\TorchCrashHandler.exe[1292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77]
.text C:\Users\Reyhan\AppData\Local\Torch\Update\TorchCrashHandler.exe[1292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77]
.text ... * 2
.text C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe[3728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77]
.text C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe[3728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77]
.text ... * 2
.text C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe[3956] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77]
.text C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe[3956] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077271465 2 bytes [27, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000772714bb 2 bytes [27, 77]
.text ... * 2
---- Processes - GMER 2.1 ----
Library C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3956](2014-01-03 03:42:50) 0000000003cb0000
Library c:\users\reyhan\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpzrjnjj.dll (*** suspicious ***) @ C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3956](2014-05-22 19:55:57) 0000000003ba0000
Library C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3956](2013-10-18 23:55:02) 0000000069e30000
Library C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe [3956] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 0000000073970000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
23.05.2014, 06:54
| #2 |
| /// the machine /// TB-Ausbilder    | not-a-virus:AdWare.Win32.Agent.aknu hi,
__________________Adware & Co. deinstallieren
Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter: Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
24.05.2014, 13:20
| #3 |
| | not-a-virus:AdWare.Win32.Agent.aknu Hallo,
__________________Ich habe mit dem Revo Uninstaller einige "gewarnte" Programme deinstalliert, nur eins habe ich nicht gefunden. In der Addition Datei stand, dass Google Updater ne Gefahr darstellt, da habe ich dann einfach Google Chrome erst einmal komplett entfernt. Weil ich mir nicht sicher war, ob das alles so reicht, habe ich trotzdem die nachfolgenden Schritte durchgeführt. Bezüglich Malwarebytes Anti-Malware: Habe alles nach Anleitung gemacht. Der hat ewig gescannt und hunderte Bedrohungen gefunden. Als ich am Ende "Suchlauf-Protokoll" anklickte und auf Ansicht gehen wollte, ging das aber nicht. Also man kann noch nicht mal draufklicken. Man kann die Datei nur löschen, nicht aber anschauen.. Habe sie nicht gelöscht, sondern einfach so in Quaratäne gelassen. Die restlichen Schritte haben ganz normal geklappt. Hier die Ergebnisse: Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 24/05/2014 um 12:36:43
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium (64 bits)
# Benutzername : Reyhan - REYHAN-HP
# Gestartet von : C:\Users\Reyhan\Desktop\adwcleaner_3.210.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\Ask.xml
Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Ask.xml
Datei Gefunden : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Search the web.src
Datei Gefunden : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gefunden : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\speedanalysis02@SpeedAnalysis.com.xpi
Datei Gefunden : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\searchplugins\Ask.xml
Datei Gefunden : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\user.js
Datei Gefunden : C:\Windows\System32\Tasks\pricemeterdownloader
Datei Gefunden : C:\Windows\System32\Tasks\PriceMeterUpdater
Ordner Gefunden : C:\Program Files (x86)\Movies Toolbar
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\ProgramData\BitGuard
Ordner Gefunden : C:\ProgramData\Browser Manager
Ordner Gefunden : C:\ProgramData\BrowserProtect
Ordner Gefunden : C:\ProgramData\PriceMeterLiveUpdate
Ordner Gefunden : C:\ProgramData\Uniblue
Ordner Gefunden : C:\ProgramData\Uniblue\DriverScanner
Ordner Gefunden : C:\ProgramData\wincert
Ordner Gefunden : C:\Users\Reyhan\AppData\Local\PriceMeterLiveUpdate
Ordner Gefunden : C:\Users\Reyhan\AppData\Local\Temp\ConstaSurf
Ordner Gefunden : C:\Users\Reyhan\AppData\Local\Temp\Delta
Ordner Gefunden : C:\Users\Reyhan\AppData\LocalLow\DataMngr
Ordner Gefunden : C:\Users\Reyhan\AppData\LocalLow\Plus-HD-2.2
Ordner Gefunden : C:\Users\Reyhan\AppData\LocalLow\searchresultstb
Ordner Gefunden : C:\Users\Reyhan\AppData\Roaming\Advanced System Protector
Ordner Gefunden : C:\Users\Reyhan\AppData\Roaming\Babylon
Ordner Gefunden : C:\Users\Reyhan\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gefunden : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\welcome@toolmin.com
Ordner Gefunden : C:\Users\Reyhan\AppData\Roaming\PerformerSoft
Ordner Gefunden : C:\Users\Reyhan\AppData\Roaming\SpeedAnalysis2
Ordner Gefunden : C:\Users\Reyhan\AppData\Roaming\Systweak
Ordner Gefunden : C:\Users\Reyhan\AppData\Roaming\Toolplugin
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\Delta
Schlüssel Gefunden : HKCU\Software\InstallCore
Schlüssel Gefunden : HKCU\Software\installedbrowserextensions
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKCU\Software\systweak
Schlüssel Gefunden : [x64] HKCU\Software\Delta
Schlüssel Gefunden : [x64] HKCU\Software\InstallCore
Schlüssel Gefunden : [x64] HKCU\Software\installedbrowserextensions
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}
Schlüssel Gefunden : [x64] HKCU\Software\systweak
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gefunden : HKLM\Software\Delta
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\plus-hd-2_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\plus-hd-2_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rjatydimofu.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\toolplugin
Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@tools.updatepm.com/PriceMeterLiveUpdate Update;version=3
Schlüssel Gefunden : HKLM\SOFTWARE\MozillaPlugins\@tools.updatepm.com/PriceMeterLiveUpdate Update;version=9
Schlüssel Gefunden : HKLM\Software\systweak
Schlüssel Gefunden : HKLM\Software\Uniblue
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Wert Gefunden : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Wert Gefunden : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x64]
Wert Gefunden : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x86]
Wert Gefunden : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x64]
Wert Gefunden : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x86]
Wert Gefunden : HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls [x64]
Wert Gefunden : HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls [x86]
***** [ Browser ] *****
-\\ Internet Explorer v8.0.7600.17267
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.search.ask.com/?o=APN10649A&gct=hp&d=414-135&v=a12627-127&t=4
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\prefs.js ]
Zeile gefunden : user_pref("browser.search.defaultenginename", "Search the web");
Zeile gefunden : user_pref("browser.search.order.1", "Search the web");
Zeile gefunden : user_pref("extensions.delta.autoRvrt", "false");
Zeile gefunden : user_pref("extensions.delta.newTab", false);
Zeile gefunden : user_pref("extensions.delta.rvrt", "false");
Zeile gefunden : user_pref("extensions.enabledAddons", "DivXWebPlayer%40divx.com:2.0.2.039,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0");
-\\ Google Chrome v
[ Datei : C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gefunden [Search Provider] : hxxp://dts.search.ask.com/sr?src=crb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms}
*************************
AdwCleaner[R0].txt - [15548 octets] - [24/05/2014 12:36:43]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [15609 octets] ##########
Code:
ATTFilter # AdwCleaner v3.210 - Bericht erstellt am 24/05/2014 um 12:44:48
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium (64 bits)
# Benutzername : Reyhan - REYHAN-HP
# Gestartet von : C:\Users\Reyhan\Desktop\adwcleaner_3.210.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BitGuard
Ordner Gelöscht : C:\ProgramData\Browser Manager
Ordner Gelöscht : C:\ProgramData\BrowserProtect
Ordner Gelöscht : C:\ProgramData\PriceMeterLiveUpdate
Ordner Gelöscht : C:\ProgramData\Uniblue
Ordner Gelöscht : C:\ProgramData\wincert
Ordner Gelöscht : C:\Program Files (x86)\Movies Toolbar
Ordner Gelöscht : C:\Users\Reyhan\AppData\Local\PriceMeterLiveUpdate
Ordner Gelöscht : C:\Users\Reyhan\AppData\Local\Temp\ConstaSurf
Ordner Gelöscht : C:\Users\Reyhan\AppData\Local\Temp\Delta
Ordner Gelöscht : C:\Users\Reyhan\AppData\LocalLow\DataMngr
Ordner Gelöscht : C:\Users\Reyhan\AppData\LocalLow\Plus-HD-2.2
Ordner Gelöscht : C:\Users\Reyhan\AppData\LocalLow\searchresultstb
Ordner Gelöscht : C:\Users\Reyhan\AppData\Roaming\Advanced System Protector
Ordner Gelöscht : C:\Users\Reyhan\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Reyhan\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Reyhan\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\Reyhan\AppData\Roaming\SpeedAnalysis2
Ordner Gelöscht : C:\Users\Reyhan\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Reyhan\AppData\Roaming\Toolplugin
Ordner Gelöscht : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\welcome@toolmin.com
Datei Gelöscht : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\speedanalysis02@SpeedAnalysis.com.xpi
Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gelöscht : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\searchplugins\Ask.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Ask.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\Ask.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Search the web.src
Datei Gelöscht : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\pricemeterdownloader
Datei Gelöscht : C:\Windows\System32\Tasks\PriceMeterUpdater
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\plus-hd-2_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\plus-hd-2_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.updatepm.com/PriceMeterLiveUpdate Update;version=3
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@tools.updatepm.com/PriceMeterLiveUpdate Update;version=9
Wert Gelöscht : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x64]
Wert Gelöscht : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x86]
Wert Gelöscht : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x64]
Wert Gelöscht : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x86]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\toolplugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rjatydimofu.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe
***** [ Browser ] *****
-\\ Internet Explorer v8.0.7600.17267
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\prefs.js ]
Zeile gelöscht : user_pref("browser.search.defaultenginename", "Search the web");
Zeile gelöscht : user_pref("browser.search.order.1", "Search the web");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.enabledAddons", "DivXWebPlayer%40divx.com:2.0.2.039,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0");
-\\ Google Chrome v
[ Datei : C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Search Provider] : hxxp://dts.search.ask.com/sr?src=crb&gct=ds&appid=135&systemid=414&v=a12627-127&apn_uid=0317681494404144&apn_dtid=BND414&o=APN10649&apn_ptnrs=AGA&q={searchTerms}
*************************
AdwCleaner[R0].txt - [15734 octets] - [24/05/2014 12:36:43]
AdwCleaner[S0].txt - [12968 octets] - [24/05/2014 12:44:48]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [13029 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Reyhan on 24.05.2014 at 12:55:13,55
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Myfree Codec
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Myfree Codec
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\torchsetupfull_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\torchsetupfull_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\PRICEM~1_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\PRICEM~1_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\PRICEM~1_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\PRICEM~1_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A4FA6C37-32A9-4C43-B912-4562FAB9AA92}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{A4FA6C37-32A9-4C43-B912-4562FAB9AA92}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files (x86)\free video converter"
Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
~~~ FireFox
Emptied folder: C:\Users\Reyhan\AppData\Roaming\mozilla\firefox\profiles\1wafexqp.default\minidumps [272 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.05.2014 at 13:13:57,58
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-05-2014 Ran by Reyhan (administrator) on REYHAN-HP on 24-05-2014 13:39:54 Running from C:\Users\Reyhan\Desktop Platform: Windows 7 Home Premium (X64) OS Language: German Standard Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe (Dropbox, Inc.) C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe (Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company) HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [151552 2013-06-29] (IvoSoft) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-21] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1243656 2013-12-06] (Easybits) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-09] () HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company) HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Policies\system: [DisableChangePassword] 0 Startup: C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM - {A4FA6C37-32A9-4C43-B912-4562FAB9AA92} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=1.1.11 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Ask New Tabs - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38} [2014-05-19] FF Extension: DivX Web Player - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\DivXWebPlayer@divx.com.xpi [2011-06-07] FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2012-12-18] Chrome: ======= CHR HomePage: CHR DefaultSearchKeyword: ask.com CHR DefaultSearchProvider: Ask.com CHR DefaultNewTabURL: CHR Extension: (Google Docs) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-20] CHR Extension: (Google Drive) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-20] CHR Extension: (YouTube) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-14] CHR Extension: (Google-Suche) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-14] CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2013-09-20] CHR Extension: (Kaspersky Protection) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpoimibckejjdjcfbdnajaicnklhfplh [2014-05-21] CHR Extension: (DVDVideoSoft) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-09-20] CHR Extension: (Google Wallet) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-20] CHR Extension: (Google Mail) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-14] CHR Extension: (Anti-Banner) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2013-09-20] CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-06-24] CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx [2012-10-25] CHR HKLM-x32\...\Chrome\Extension: [lpoimibckejjdjcfbdnajaicnklhfplh] - https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh [2012-10-25] CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx [2012-10-25] ==================== Services (Whitelisted) ================= S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) ==================== Drivers (Whitelisted) ==================== R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-11] (Kaspersky Lab ZAO) U5 klflt; C:\Windows\System32\Drivers\klflt.sys [91008 2014-05-21] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [628320 2014-05-21] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-11] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-23] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-05-24] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-24 13:39 - 2014-05-24 13:39 - 00020729 _____ () C:\Users\Reyhan\Desktop\FRST.txt 2014-05-24 13:13 - 2014-05-24 13:13 - 00002008 _____ () C:\Users\Reyhan\Desktop\JRT.txt 2014-05-24 12:55 - 2014-05-24 12:55 - 00000000 ____D () C:\Windows\ERUNT 2014-05-24 12:54 - 2014-05-24 12:54 - 01016261 _____ (Thisisu) C:\Users\Reyhan\Desktop\JRT.exe 2014-05-24 12:37 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-05-24 12:36 - 2014-05-24 12:44 - 00000000 ____D () C:\AdwCleaner 2014-05-24 12:35 - 2014-05-24 12:35 - 01326389 _____ () C:\Users\Reyhan\Desktop\adwcleaner_3.210.exe 2014-05-23 21:11 - 2014-05-24 13:36 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-23 21:11 - 2014-05-23 21:11 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-23 21:11 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-23 21:11 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-23 21:11 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-23 21:09 - 2014-05-23 21:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reyhan\Desktop\mbam-setup-2.0.2.1012.exe 2014-05-23 21:08 - 2014-05-23 21:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reyhan\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-23 19:23 - 2014-05-23 19:23 - 00003266 _____ () C:\Windows\System32\Tasks\{393F5A52-D230-45DC-838E-5296AF3CF56B} 2014-05-23 19:15 - 2014-05-23 19:15 - 00001228 _____ () C:\Users\Reyhan\Desktop\Revo Uninstaller.lnk 2014-05-23 19:15 - 2014-05-23 19:15 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-23 19:14 - 2014-05-23 19:14 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Reyhan\Downloads\revosetup95.exe 2014-05-23 19:14 - 2014-05-23 19:14 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Reyhan\Desktop\revosetup95.exe 2014-05-22 23:45 - 2014-05-22 23:45 - 00006100 _____ () C:\Users\Reyhan\Desktop\Gmer.txt 2014-05-22 23:09 - 2014-05-22 23:09 - 00380416 _____ () C:\Users\Reyhan\Downloads\Gmer-19357.exe 2014-05-22 23:09 - 2014-05-22 23:09 - 00380416 _____ () C:\Users\Reyhan\Desktop\Gmer-19357.exe 2014-05-22 23:07 - 2014-05-22 23:08 - 00053817 _____ () C:\Users\Reyhan\Desktop\Addition.txt 2014-05-22 23:05 - 2014-05-22 23:08 - 00043824 _____ () C:\Users\Reyhan\Desktop\FRST_alt.txt 2014-05-22 23:04 - 2014-05-24 13:39 - 00000000 ____D () C:\FRST 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Downloads\FRST64.exe 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Desktop\FRST64.exe 2014-05-22 22:57 - 2014-05-22 22:57 - 00000474 _____ () C:\Users\Reyhan\Desktop\defogger_disable.log 2014-05-22 22:56 - 2014-05-22 22:56 - 00050477 _____ () C:\Users\Reyhan\Desktop\Defogger (1).exe 2014-05-22 22:52 - 2014-05-22 22:52 - 00000474 _____ () C:\Users\Reyhan\Downloads\defogger_disable.log 2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 _____ () C:\Users\Reyhan\defogger_reenable 2014-05-22 22:50 - 2014-05-22 22:50 - 00050477 _____ () C:\Users\Reyhan\Downloads\Defogger.exe 2014-05-21 23:32 - 2014-05-21 23:32 - 00000045 _____ () C:\Users\Reyhan\AppData\Roaming\WB.CFG 2014-05-21 22:28 - 2014-05-21 22:28 - 01069776 _____ (Solid State Networks) C:\Users\Reyhan\Downloads\install_flashplayer13x32_mssa_aaa_aih.exe 2014-05-15 23:20 - 2014-05-15 23:20 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a 2014-05-12 22:02 - 2014-05-12 22:02 - 00022655 _____ () C:\Users\Reyhan\Downloads\2. Klausur EPH.odt 2014-05-05 12:22 - 2014-05-05 12:22 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\DropboxMaster ==================== One Month Modified Files and Folders ======= 2014-05-24 13:40 - 2014-05-24 13:39 - 00020729 _____ () C:\Users\Reyhan\Desktop\FRST.txt 2014-05-24 13:39 - 2014-05-22 23:04 - 00000000 ____D () C:\FRST 2014-05-24 13:36 - 2014-05-23 21:11 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-24 13:13 - 2014-05-24 13:13 - 00002008 _____ () C:\Users\Reyhan\Desktop\JRT.txt 2014-05-24 13:05 - 2012-04-05 16:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-24 12:55 - 2014-05-24 12:55 - 00000000 ____D () C:\Windows\ERUNT 2014-05-24 12:54 - 2014-05-24 12:54 - 01016261 _____ (Thisisu) C:\Users\Reyhan\Desktop\JRT.exe 2014-05-24 12:54 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-24 12:54 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-24 12:52 - 2010-12-01 04:32 - 01182738 _____ () C:\Windows\WindowsUpdate.log 2014-05-24 12:49 - 2012-12-18 21:33 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2014-05-24 12:48 - 2013-02-16 17:48 - 00000000 ___RD () C:\Users\Reyhan\Dropbox 2014-05-24 12:48 - 2013-02-16 17:44 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Dropbox 2014-05-24 12:46 - 2011-02-09 15:53 - 00757778 _____ () C:\Windows\PFRO.log 2014-05-24 12:46 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-24 12:46 - 2009-07-14 06:51 - 00156310 _____ () C:\Windows\setupact.log 2014-05-24 12:44 - 2014-05-24 12:36 - 00000000 ____D () C:\AdwCleaner 2014-05-24 12:35 - 2014-05-24 12:35 - 01326389 _____ () C:\Users\Reyhan\Desktop\adwcleaner_3.210.exe 2014-05-24 12:18 - 2011-05-19 16:18 - 00000000 ____D () C:\Windows\Minidump 2014-05-24 12:16 - 2012-02-14 21:47 - 00000000 ____D () C:\Users\Reyhan\AppData\Local\Google 2014-05-23 21:11 - 2014-05-23 21:11 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-23 21:09 - 2014-05-23 21:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reyhan\Desktop\mbam-setup-2.0.2.1012.exe 2014-05-23 21:09 - 2014-05-23 21:08 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reyhan\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-23 19:23 - 2014-05-23 19:23 - 00003266 _____ () C:\Windows\System32\Tasks\{393F5A52-D230-45DC-838E-5296AF3CF56B} 2014-05-23 19:15 - 2014-05-23 19:15 - 00001228 _____ () C:\Users\Reyhan\Desktop\Revo Uninstaller.lnk 2014-05-23 19:15 - 2014-05-23 19:15 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-23 19:14 - 2014-05-23 19:14 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Reyhan\Downloads\revosetup95.exe 2014-05-23 19:14 - 2014-05-23 19:14 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Reyhan\Desktop\revosetup95.exe 2014-05-23 18:39 - 2013-01-03 16:14 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForReyhan.job 2014-05-22 23:56 - 2013-02-16 15:18 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-05-22 23:56 - 2013-01-03 16:14 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForReyhan 2014-05-22 23:56 - 2012-12-20 17:05 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-05-22 23:45 - 2014-05-22 23:45 - 00006100 _____ () C:\Users\Reyhan\Desktop\Gmer.txt 2014-05-22 23:09 - 2014-05-22 23:09 - 00380416 _____ () C:\Users\Reyhan\Downloads\Gmer-19357.exe 2014-05-22 23:09 - 2014-05-22 23:09 - 00380416 _____ () C:\Users\Reyhan\Desktop\Gmer-19357.exe 2014-05-22 23:08 - 2014-05-22 23:07 - 00053817 _____ () C:\Users\Reyhan\Desktop\Addition.txt 2014-05-22 23:08 - 2014-05-22 23:05 - 00043824 _____ () C:\Users\Reyhan\Desktop\FRST_alt.txt 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Downloads\FRST64.exe 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Desktop\FRST64.exe 2014-05-22 22:57 - 2014-05-22 22:57 - 00000474 _____ () C:\Users\Reyhan\Desktop\defogger_disable.log 2014-05-22 22:56 - 2014-05-22 22:56 - 00050477 _____ () C:\Users\Reyhan\Desktop\Defogger (1).exe 2014-05-22 22:52 - 2014-05-22 22:52 - 00000474 _____ () C:\Users\Reyhan\Downloads\defogger_disable.log 2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 _____ () C:\Users\Reyhan\defogger_reenable 2014-05-22 22:52 - 2011-02-09 17:02 - 00000000 ____D () C:\Users\Reyhan 2014-05-22 22:50 - 2014-05-22 22:50 - 00050477 _____ () C:\Users\Reyhan\Downloads\Defogger.exe 2014-05-22 00:23 - 2011-02-09 17:18 - 00000000 ___RD () C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-21 23:59 - 2013-12-19 16:48 - 00262144 _____ () C:\Windows\system32\config\elam 2014-05-21 23:32 - 2014-05-21 23:32 - 00000045 _____ () C:\Users\Reyhan\AppData\Roaming\WB.CFG 2014-05-21 22:49 - 2013-10-11 14:51 - 00002304 _____ () C:\Users\Reyhan\Desktop\Sicherer Zahlungsverkehr.lnk 2014-05-21 22:28 - 2014-05-21 22:28 - 01069776 _____ (Solid State Networks) C:\Users\Reyhan\Downloads\install_flashplayer13x32_mssa_aaa_aih.exe 2014-05-21 18:58 - 2012-10-25 13:42 - 00628320 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys 2014-05-21 18:58 - 2012-08-13 19:24 - 00091008 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys 2014-05-19 22:40 - 2012-04-28 11:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-05-19 21:14 - 2013-08-31 21:28 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\HpUpdate 2014-05-18 19:32 - 2014-03-23 18:59 - 00000000 ____D () C:\Users\Reyhan\Desktop\bewerbungen 2014-05-18 11:10 - 2012-12-12 23:49 - 00000000 ____D () C:\Users\Reyhan\Documents\Geschichte sek I 2014-05-15 23:29 - 2011-02-09 19:06 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-15 23:26 - 2013-08-25 22:52 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-15 23:23 - 2011-09-30 10:47 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-15 23:20 - 2014-05-15 23:20 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a 2014-05-14 14:07 - 2012-04-05 16:30 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-14 14:07 - 2012-04-05 16:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 14:07 - 2012-02-20 13:42 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-14 13:54 - 2013-10-01 16:20 - 00000000 ____D () C:\Users\Reyhan\Desktop\Gutachten Ref_Sonnentiger 2014-05-14 13:41 - 2013-02-16 17:48 - 00001021 _____ () C:\Users\Reyhan\Desktop\Dropbox.lnk 2014-05-14 13:41 - 2013-02-16 17:45 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-05-12 22:02 - 2014-05-12 22:02 - 00022655 _____ () C:\Users\Reyhan\Downloads\2. Klausur EPH.odt 2014-05-12 22:00 - 2013-02-16 21:58 - 00000000 ____D () C:\Users\Reyhan\Documents\Geschichte sek II 2014-05-12 20:12 - 2013-02-12 17:05 - 00000000 ____D () C:\Users\Reyhan\Documents\sonstiges 2014-05-12 19:47 - 2013-02-17 13:53 - 00000000 ____D () C:\Users\Reyhan\Documents\herkenrath 2014-05-12 07:26 - 2014-05-23 21:11 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:26 - 2014-05-23 21:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-05-23 21:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-07 14:51 - 2014-04-13 16:48 - 00000000 ____D () C:\Users\Reyhan\Documents\Ref 2014-05-06 19:06 - 2010-07-20 23:46 - 00654400 _____ () C:\Windows\system32\perfh007.dat 2014-05-06 19:06 - 2010-07-20 23:46 - 00130240 _____ () C:\Windows\system32\perfc007.dat 2014-05-06 19:06 - 2009-07-14 07:13 - 01498742 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-05-05 12:22 - 2014-05-05 12:22 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\DropboxMaster Some content of TEMP: ==================== C:\Users\Reyhan\AppData\Local\Temp\6_Offer_9.exe C:\Users\Reyhan\AppData\Local\Temp\autorun.dll C:\Users\Reyhan\AppData\Local\Temp\b4rrqmfd.dll C:\Users\Reyhan\AppData\Local\Temp\BackupSetup.exe C:\Users\Reyhan\AppData\Local\Temp\BundleSweetIMSetup.exe C:\Users\Reyhan\AppData\Local\Temp\Delta.exe C:\Users\Reyhan\AppData\Local\Temp\DeltaTB.exe C:\Users\Reyhan\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpj4tp8l.dll C:\Users\Reyhan\AppData\Local\Temp\Extract.exe C:\Users\Reyhan\AppData\Local\Temp\f.exe C:\Users\Reyhan\AppData\Local\Temp\glpo0rwa.dll C:\Users\Reyhan\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Reyhan\AppData\Local\Temp\ICReinstall_PDFCreatorSetup.exe C:\Users\Reyhan\AppData\Local\Temp\MybabylonTB.exe C:\Users\Reyhan\AppData\Local\Temp\propsys.dll C:\Users\Reyhan\AppData\Local\Temp\Quarantine.exe C:\Users\Reyhan\AppData\Local\Temp\Resource.exe C:\Users\Reyhan\AppData\Local\Temp\SP51865.exe C:\Users\Reyhan\AppData\Local\Temp\SP52264.exe C:\Users\Reyhan\AppData\Local\Temp\SP54714.exe C:\Users\Reyhan\AppData\Local\Temp\SP56215.exe C:\Users\Reyhan\AppData\Local\Temp\SP56221.exe C:\Users\Reyhan\AppData\Local\Temp\sp58915.exe C:\Users\Reyhan\AppData\Local\Temp\sp64126.exe C:\Users\Reyhan\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Reyhan\AppData\Local\Temp\UninstallHPTCA.exe C:\Users\Reyhan\AppData\Local\Temp\WSSetup.exe C:\Users\Reyhan\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_N360_20117.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-08 13:32 ==================== End Of Log ============================ --- --- --- |
|
25.05.2014, 06:52
| #4 |
| /// the machine /// TB-Ausbilder | not-a-virus:AdWare.Win32.Agent.aknuESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.05.2014, 13:57
| #5 |
| | not-a-virus:AdWare.Win32.Agent.aknu Hi, Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=8788362ce0569e4d8d9c1325a45d2f36
# engine=18408
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-26 12:26:13
# local_time=2014-05-26 02:26:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode=1286 16777214 100 99 84037 55873495 0 0
# compatibility_mode=5893 16776573 100 94 177365 152737023 0 0
# scanned=266043
# found=57
# cleaned=0
# scan_time=60924
sh=71A76FBD54A7B8AF6D0A6F2F18741DDFDEE65ECC ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-3704761350-3873045834-1805283501-1000\$R4RWR1S.2\33036.crx"
sh=7970532D35E4BD7EC7ABF2615AC585E8479D2784 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-3704761350-3873045834-1805283501-1000\$R4RWR1S.2\33036.xpi"
sh=4895CA1F5BADF11347680E960E0AF32B5EAA9CC3 ft=1 fh=812b793a72793e5b vn="möglicherweise Variante von Win64/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-3704761350-3873045834-1805283501-1000\$R4RWR1S.2\Plus-HD-2.2-buttonutil64.dll"
sh=5E877F079FC2912CE8FB7CD6977B74B84827FD7E ft=1 fh=481830f7804beb9f vn="Variante von Win32/DealPly.R evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\10L1W02Y\PriceMeter[1].exe"
sh=44ED55CB1079D34027CB77CD62248064FF5A0A09 ft=1 fh=3916453e74289c7d vn="Win32/VOPackage.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XZAX6GXD\VuuPC-Installer[1].exe"
sh=65069039FF215442E62A73673030AB04629F8DB4 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Mozilla\Firefox\Profiles\1wafexqp.default\Cache\0\92\D1991d01"
sh=82FC98475AA3CE263569334FA32F32201404BBA7 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Mozilla\Firefox\Profiles\1wafexqp.default\Cache\3\09\87207d01"
sh=EBD7A4063D5314A8FAB43896D8431F25167F8D1A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Mozilla\Firefox\Profiles\1wafexqp.default\Cache\6\D3\22994d01"
sh=1CDD5DB563E5F4C663E5C7B65DA5D68D82067C69 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Mozilla\Firefox\Profiles\1wafexqp.default\Cache\B\C8\02CB9d01"
sh=AB0A82F0C59DAEBDEB0D094EDB0709708093DF2B ft=1 fh=1983d4e99174a8ef vn="Variante von Win32/OutBrowse.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\f.exe"
sh=170A552B2827306CC405C3251B0CFCA833A4BC69 ft=1 fh=4b71f71c6d7bf5db vn="Variante von Win32/InstallCore.BB evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\ICReinstall_PDFCreatorSetup.exe"
sh=6511B37C7ACE73216D35C2AA7AF2034E1780EB56 ft=1 fh=c71c0011fd19b3c0 vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\BA0637A0-BAB0-7891-B103-D6BE5A9434D0\BExternal.dll"
sh=F2FB5115B7D03E90F6E9D4B1F6E882385AA00F5F ft=1 fh=f2472f77ed228eaa vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\BA0637A0-BAB0-7891-B103-D6BE5A9434D0\IEHelper.dll"
sh=9F2FBFE260C9111F88E8EDC6DFC068D08C1491C5 ft=1 fh=73baccadb4ce839e vn="Variante von Win32/Toolbar.Babylon.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\BA0637A0-BAB0-7891-B103-D6BE5A9434D0\Setup.exe"
sh=E0814D0F17EE1122F6D3507DC676030F8E1CC133 ft=1 fh=0e0f46db8e6ee8c4 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\BA0637A0-BAB0-7891-B103-D6BE5A9434D0\Latest\BabMaint.exe"
sh=6511B37C7ACE73216D35C2AA7AF2034E1780EB56 ft=1 fh=c71c0011fd19b3c0 vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\BA0637A0-BAB0-7891-B103-D6BE5A9434D0\Latest\BExternal.dll"
sh=E2BA5F8A7BD2BAF32FF31730BAD873C8E7957030 ft=1 fh=6e8622963c31f56a vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\BA0637A0-BAB0-7891-B103-D6BE5A9434D0\Latest\BUSolution.dll"
sh=F2FB5115B7D03E90F6E9D4B1F6E882385AA00F5F ft=1 fh=f2472f77ed228eaa vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\BA0637A0-BAB0-7891-B103-D6BE5A9434D0\Latest\IEHelper.dll"
sh=B7BCAF66B2BB0CA2EE89D16A94A4D4C4BB1CE025 ft=1 fh=9dabbe262182f2d2 vn="Variante von Win32/Toolbar.Babylon.V evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\BA0637A0-BAB0-7891-B103-D6BE5A9434D0\Latest\MntrDLLInstall.dll"
sh=F741A93A71FC9FBDAB27C1607851782DB25DCA7C ft=1 fh=d991a1e4eaf165d5 vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nsc915.tmp\Helper.dll"
sh=D4BF0DA9E7F964E2D86102D7B404E037DB090ED9 ft=1 fh=0a4a631baf057822 vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nse57D1.tmp\Helper.dll"
sh=10865E388F36174297EC4ECDAFD6265B331BFDCD ft=1 fh=c71442a0f17f9a09 vn="Win32/Toolbar.Montiera.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nsj7C1A.tmp\mt.dll"
sh=CE08CF00826F1C171223F5DC91B71B9D2BDAF115 ft=1 fh=8a2a024b94b2481f vn="Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nspA92C.tmp\Helper.dll"
sh=48209C23C5CEC53ADEEE22901EB3CB96E4B134BC ft=1 fh=4c60f800711c36d7 vn="Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nspA92C.tmp\Starter.exe"
sh=CC7EBD4BA7795FD75313069A1DC445B27F3914CE ft=1 fh=f16081f84df83856 vn="Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nspA92C.tmp\~nsmE532.tmp"
sh=0383CBA52B980571DE38EDFE81DDDDEDF0D8CF96 ft=1 fh=8eb091f431e727f8 vn="Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nss2292.tmp\Helper.dll"
sh=83100F9A03DC203001A7EE828DEE7CE7AEDD2BFE ft=1 fh=3a6d2c7b4b004612 vn="Variante von Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nss2292.tmp\Starter.exe"
sh=4A077D1F5225C3C471121A789B53284C54B9BF13 ft=1 fh=f83bed8e1453805f vn="Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nsvC63E.tmp\Helper.dll"
sh=7710F9B0E99D686C1BC7FCC09D175B4431E6FA4F ft=1 fh=82d4b1631f9c5714 vn="Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nsvC63E.tmp\Starter.exe"
sh=CC7EBD4BA7795FD75313069A1DC445B27F3914CE ft=1 fh=f16081f84df83856 vn="Win32/Toolbar.SearchSuite.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Local\Temp\nsvC63E.tmp\~nsm1BCF.tmp"
sh=684659DE819C6971D3FFB8543676430F3788F161 ft=1 fh=688352214b21e2fc vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF10.dll"
sh=BE495ADD8621F7D5375236E9B3BE406D50ED4DCC ft=1 fh=98e4815f9eec0653 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF11.dll"
sh=AA62007E530AE4B59D9B06E610FFAD784B20BF0C ft=1 fh=27ea507024c0b535 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF12.dll"
sh=C0C0925018B8FB048ECB3ACA724D4BE8A5D7A61D ft=1 fh=cba7b209ae432309 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF13.dll"
sh=444946A80C8ED759A507DB0B52AA9F9A08518530 ft=1 fh=1d45c62094e22350 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF14.dll"
sh=C8D8DA3FCBC9DD1C8DDFFB25880645CAAEB6AD98 ft=1 fh=94333259c30da11b vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF15.dll"
sh=894C107650F0860170DF4B1E96EADDE3C9F89416 ft=1 fh=18fd5e720a7792b8 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF16.dll"
sh=CB1AB7184222C287462205E7FBB17CBF71ECFBA4 ft=1 fh=64be3a3eef4df71b vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF17.dll"
sh=C23097F6EFDE34F01BA856DF343C7794F153C9F2 ft=1 fh=2e1bdcc1ac0ef47d vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF18.dll"
sh=52D78FE2A4DDE87EC46D2725AAD7E63C1A917C74 ft=1 fh=0c5ecc30fdb69e2e vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF19.dll"
sh=FA1F25860DE71CBC4D1CDDA674BAFFE5AE91D860 ft=1 fh=48f666780c8864c1 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF2.dll"
sh=0260186D028EE5F3CA72641F3A75FD518F9770C7 ft=1 fh=6556c0c289904cef vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF20.dll"
sh=02A8E5B0457F08AD0E28D633C763362C0DD909F3 ft=1 fh=c0b358c44962bc27 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF21.dll"
sh=1AA39119314DB552765C3951758ACD7FAC8DBA33 ft=1 fh=c603d8992f2083b3 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF22.dll"
sh=C8D9FE97D411FF83625D8CA918D39FADD8B07EFB ft=1 fh=65fe8a506a54c2e9 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF23.dll"
sh=18533E208644CA917335568B0F43E35A618FEAEC ft=1 fh=d0588c5f3182161d vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF24.dll"
sh=365A86A2BD04DB4D751831B71C2B94E0593B6DA6 ft=1 fh=25f8a92abc100940 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF25.dll"
sh=01C72FF71C9C104D7A8143B375EA2CE3C684A558 ft=1 fh=5d04555623cbbac9 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF26.dll"
sh=2A521DDAC9D2AC26631F6E8881FFC063130EBCB2 ft=1 fh=91f1fea085b7520c vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF27.dll"
sh=4517187B7DE6EB03DA3D85E5947877A10BB059A7 ft=1 fh=faefa3d72246b60b vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF28.dll"
sh=85696DF198FDF9644CF00C4A3127A9E0227EDB6E ft=1 fh=540060d56d7ebad3 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF29.dll"
sh=0F79C2CF5F0C0B116A68599D7B53FAC5F4808F6B ft=1 fh=e3d4e7c50cd6cc0d vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF4.dll"
sh=517F0CC849190DA4AFE47A5BC0E0CCE6A56E107A ft=1 fh=0f4e8a1678276615 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF5.dll"
sh=F060FF66A771C73B7A4E8267BFE2D903A4ECD904 ft=1 fh=c447cef5040258fa vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF6.dll"
sh=DEE63D74636D5F0ECC3C5C891C5362D0EF824A8A ft=1 fh=0ca01f3f5dac52e6 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF7.dll"
sh=F2C24E966DDD9F0675B2A4B8D22AFBA9EE3EDD27 ft=1 fh=4c4faaefbadea355 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF8.dll"
sh=5116F79E8EF905A40B7450FC3C077A87378339EE ft=1 fh=3683efa413388987 vn="möglicherweise Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38}\components\DatamngrHlpFF9.dll"
Code:
ATTFilter Results of screen317's Security Check version 0.99.83 Windows 7 x64 (UAC is enabled) Out of date service pack!! ``````````````Antivirus/Firewall Check:`````````````` Kaspersky Internet Security Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Java(TM) 6 Update 20 Java version out of Date! Adobe Flash Player 13.0.0.214 Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (26.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02 Ran by Reyhan (administrator) on REYHAN-HP on 26-05-2014 14:49:00 Running from C:\Users\Reyhan\Desktop Platform: Windows 7 Home Premium (X64) OS Language: German Standard Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Dropbox, Inc.) C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe (Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6234144 2010-03-13] (Realtek Semiconductor) HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company) HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [151552 2013-06-29] (IvoSoft) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-21] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1243656 2013-12-06] (Easybits) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [HPAdvisorDock] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe [1712184 2010-02-09] () HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company) HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-3704761350-3873045834-1805283501-1000\...\Policies\system: [DisableChangePassword] 0 Startup: C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Reyhan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM - {A4FA6C37-32A9-4C43-B912-4562FAB9AA92} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {551A30C5-E2B0-4A9E-ACA3-5AB2DC0A7B4D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=1.1.11 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Ask New Tabs - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\{B08F8994-AC71-AB07-5E09-CB39FD50DF38} [2014-05-19] FF Extension: DivX Web Player - C:\Users\Reyhan\AppData\Roaming\Mozilla\Firefox\Profiles\1wafexqp.default\Extensions\DivXWebPlayer@divx.com.xpi [2011-06-07] FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2012-12-18] FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2012-12-18] Chrome: ======= CHR HomePage: CHR DefaultSearchKeyword: ask.com CHR DefaultSearchProvider: Ask.com CHR DefaultNewTabURL: CHR Extension: (Google Docs) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-20] CHR Extension: (Google Drive) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-20] CHR Extension: (YouTube) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-14] CHR Extension: (Google-Suche) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-14] CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2013-09-20] CHR Extension: (Kaspersky Protection) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpoimibckejjdjcfbdnajaicnklhfplh [2014-05-21] CHR Extension: (DVDVideoSoft) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-09-20] CHR Extension: (Google Wallet) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-20] CHR Extension: (Google Mail) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-14] CHR Extension: (Anti-Banner) - C:\Users\Reyhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2013-09-20] CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-06-24] CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx [2012-10-25] CHR HKLM-x32\...\Chrome\Extension: [lpoimibckejjdjcfbdnajaicnklhfplh] - https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh [2012-10-25] CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx [2012-10-25] ==================== Services (Whitelisted) ================= R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-10-10] (Kaspersky Lab ZAO) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) ==================== Drivers (Whitelisted) ==================== R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-11] (Kaspersky Lab ZAO) U5 klflt; C:\Windows\System32\Drivers\klflt.sys [91008 2014-05-21] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [628320 2014-05-21] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-11] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-10] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-19] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-23] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-05-26] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-26 14:49 - 2014-05-26 14:49 - 00020998 _____ () C:\Users\Reyhan\Desktop\FRST.txt 2014-05-26 14:48 - 2014-05-26 14:48 - 00000000 ____D () C:\Users\Reyhan\Desktop\FRST-OlderVersion 2014-05-25 20:34 - 2014-05-25 20:34 - 00854367 _____ () C:\Users\Reyhan\Desktop\SecurityCheck.exe 2014-05-25 20:32 - 2014-05-25 20:32 - 02347384 _____ (ESET) C:\Users\Reyhan\Desktop\esetsmartinstaller_deu.exe 2014-05-25 15:40 - 2014-05-25 15:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\38D20C41.sys 2014-05-24 13:39 - 2014-05-24 13:52 - 00035839 _____ () C:\Users\Reyhan\Desktop\FRST_alt 2.txt 2014-05-24 13:13 - 2014-05-24 13:13 - 00002008 _____ () C:\Users\Reyhan\Desktop\JRT.txt 2014-05-24 12:55 - 2014-05-24 12:55 - 00000000 ____D () C:\Windows\ERUNT 2014-05-24 12:54 - 2014-05-24 12:54 - 01016261 _____ (Thisisu) C:\Users\Reyhan\Desktop\JRT.exe 2014-05-24 12:37 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-05-24 12:36 - 2014-05-24 12:44 - 00000000 ____D () C:\AdwCleaner 2014-05-24 12:35 - 2014-05-24 12:35 - 01326389 _____ () C:\Users\Reyhan\Desktop\adwcleaner_3.210.exe 2014-05-23 21:11 - 2014-05-26 12:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-23 21:11 - 2014-05-23 21:11 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-23 21:11 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-23 21:11 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-23 21:11 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-23 21:09 - 2014-05-23 21:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reyhan\Desktop\mbam-setup-2.0.2.1012.exe 2014-05-23 21:08 - 2014-05-23 21:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reyhan\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-23 19:23 - 2014-05-23 19:23 - 00003266 _____ () C:\Windows\System32\Tasks\{393F5A52-D230-45DC-838E-5296AF3CF56B} 2014-05-23 19:15 - 2014-05-23 19:15 - 00001228 _____ () C:\Users\Reyhan\Desktop\Revo Uninstaller.lnk 2014-05-23 19:15 - 2014-05-23 19:15 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-23 19:14 - 2014-05-23 19:14 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Reyhan\Downloads\revosetup95.exe 2014-05-23 19:14 - 2014-05-23 19:14 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Reyhan\Desktop\revosetup95.exe 2014-05-22 23:45 - 2014-05-22 23:45 - 00006100 _____ () C:\Users\Reyhan\Desktop\Gmer.txt 2014-05-22 23:09 - 2014-05-22 23:09 - 00380416 _____ () C:\Users\Reyhan\Downloads\Gmer-19357.exe 2014-05-22 23:09 - 2014-05-22 23:09 - 00380416 _____ () C:\Users\Reyhan\Desktop\Gmer-19357.exe 2014-05-22 23:07 - 2014-05-22 23:08 - 00053817 _____ () C:\Users\Reyhan\Desktop\Addition_alt.txt 2014-05-22 23:05 - 2014-05-22 23:08 - 00043824 _____ () C:\Users\Reyhan\Desktop\FRST_alt.txt 2014-05-22 23:04 - 2014-05-26 14:49 - 00000000 ____D () C:\FRST 2014-05-22 23:02 - 2014-05-26 14:48 - 02066944 _____ (Farbar) C:\Users\Reyhan\Desktop\FRST64.exe 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Downloads\FRST64.exe 2014-05-22 22:57 - 2014-05-22 22:57 - 00000474 _____ () C:\Users\Reyhan\Desktop\defogger_disable.log 2014-05-22 22:56 - 2014-05-22 22:56 - 00050477 _____ () C:\Users\Reyhan\Desktop\Defogger (1).exe 2014-05-22 22:52 - 2014-05-22 22:52 - 00000474 _____ () C:\Users\Reyhan\Downloads\defogger_disable.log 2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 _____ () C:\Users\Reyhan\defogger_reenable 2014-05-22 22:50 - 2014-05-22 22:50 - 00050477 _____ () C:\Users\Reyhan\Downloads\Defogger.exe 2014-05-21 23:32 - 2014-05-21 23:32 - 00000045 _____ () C:\Users\Reyhan\AppData\Roaming\WB.CFG 2014-05-21 22:28 - 2014-05-21 22:28 - 01069776 _____ (Solid State Networks) C:\Users\Reyhan\Downloads\install_flashplayer13x32_mssa_aaa_aih.exe 2014-05-15 23:20 - 2014-05-15 23:20 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a 2014-05-12 22:02 - 2014-05-12 22:02 - 00022655 _____ () C:\Users\Reyhan\Downloads\2. Klausur EPH.odt 2014-05-05 12:22 - 2014-05-05 12:22 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\DropboxMaster ==================== One Month Modified Files and Folders ======= 2014-05-26 14:49 - 2014-05-26 14:49 - 00020998 _____ () C:\Users\Reyhan\Desktop\FRST.txt 2014-05-26 14:49 - 2014-05-22 23:04 - 00000000 ____D () C:\FRST 2014-05-26 14:48 - 2014-05-26 14:48 - 00000000 ____D () C:\Users\Reyhan\Desktop\FRST-OlderVersion 2014-05-26 14:48 - 2014-05-22 23:02 - 02066944 _____ (Farbar) C:\Users\Reyhan\Desktop\FRST64.exe 2014-05-26 14:43 - 2012-12-18 21:33 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2014-05-26 14:35 - 2011-10-10 22:43 - 00000000 ____D () C:\Users\Reyhan\AppData\Local\CrashDumps 2014-05-26 14:05 - 2012-04-05 16:30 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-26 14:00 - 2010-12-01 04:32 - 01225712 _____ () C:\Windows\WindowsUpdate.log 2014-05-26 12:27 - 2014-05-23 21:11 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-25 20:34 - 2014-05-25 20:34 - 00854367 _____ () C:\Users\Reyhan\Desktop\SecurityCheck.exe 2014-05-25 20:32 - 2014-05-25 20:32 - 02347384 _____ (ESET) C:\Users\Reyhan\Desktop\esetsmartinstaller_deu.exe 2014-05-25 20:13 - 2010-07-20 23:46 - 00654400 _____ () C:\Windows\system32\perfh007.dat 2014-05-25 20:13 - 2010-07-20 23:46 - 00130240 _____ () C:\Windows\system32\perfc007.dat 2014-05-25 20:13 - 2009-07-14 07:13 - 01498742 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-05-25 15:40 - 2014-05-25 15:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\38D20C41.sys 2014-05-25 15:13 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-25 15:13 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-25 15:07 - 2013-02-16 17:48 - 00000000 ___RD () C:\Users\Reyhan\Dropbox 2014-05-25 15:07 - 2013-02-16 17:44 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Dropbox 2014-05-25 15:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-25 15:05 - 2009-07-14 06:51 - 00156366 _____ () C:\Windows\setupact.log 2014-05-24 13:52 - 2014-05-24 13:39 - 00035839 _____ () C:\Users\Reyhan\Desktop\FRST_alt 2.txt 2014-05-24 13:13 - 2014-05-24 13:13 - 00002008 _____ () C:\Users\Reyhan\Desktop\JRT.txt 2014-05-24 12:55 - 2014-05-24 12:55 - 00000000 ____D () C:\Windows\ERUNT 2014-05-24 12:54 - 2014-05-24 12:54 - 01016261 _____ (Thisisu) C:\Users\Reyhan\Desktop\JRT.exe 2014-05-24 12:46 - 2011-02-09 15:53 - 00757778 _____ () C:\Windows\PFRO.log 2014-05-24 12:44 - 2014-05-24 12:36 - 00000000 ____D () C:\AdwCleaner 2014-05-24 12:35 - 2014-05-24 12:35 - 01326389 _____ () C:\Users\Reyhan\Desktop\adwcleaner_3.210.exe 2014-05-24 12:19 - 2011-05-19 16:18 - 00000000 ____D () C:\Windows\Minidump 2014-05-24 12:16 - 2012-02-14 21:47 - 00000000 ____D () C:\Users\Reyhan\AppData\Local\Google 2014-05-23 21:11 - 2014-05-23 21:11 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-23 21:11 - 2014-05-23 21:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-23 21:09 - 2014-05-23 21:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reyhan\Desktop\mbam-setup-2.0.2.1012.exe 2014-05-23 21:09 - 2014-05-23 21:08 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Reyhan\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-23 19:23 - 2014-05-23 19:23 - 00003266 _____ () C:\Windows\System32\Tasks\{393F5A52-D230-45DC-838E-5296AF3CF56B} 2014-05-23 19:15 - 2014-05-23 19:15 - 00001228 _____ () C:\Users\Reyhan\Desktop\Revo Uninstaller.lnk 2014-05-23 19:15 - 2014-05-23 19:15 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-05-23 19:14 - 2014-05-23 19:14 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Reyhan\Downloads\revosetup95.exe 2014-05-23 19:14 - 2014-05-23 19:14 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Reyhan\Desktop\revosetup95.exe 2014-05-23 18:39 - 2013-01-03 16:14 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForReyhan.job 2014-05-22 23:56 - 2013-02-16 15:18 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-05-22 23:56 - 2013-01-03 16:14 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForReyhan 2014-05-22 23:56 - 2012-12-20 17:05 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-05-22 23:45 - 2014-05-22 23:45 - 00006100 _____ () C:\Users\Reyhan\Desktop\Gmer.txt 2014-05-22 23:09 - 2014-05-22 23:09 - 00380416 _____ () C:\Users\Reyhan\Downloads\Gmer-19357.exe 2014-05-22 23:09 - 2014-05-22 23:09 - 00380416 _____ () C:\Users\Reyhan\Desktop\Gmer-19357.exe 2014-05-22 23:08 - 2014-05-22 23:07 - 00053817 _____ () C:\Users\Reyhan\Desktop\Addition_alt.txt 2014-05-22 23:08 - 2014-05-22 23:05 - 00043824 _____ () C:\Users\Reyhan\Desktop\FRST_alt.txt 2014-05-22 23:02 - 2014-05-22 23:02 - 02067456 _____ (Farbar) C:\Users\Reyhan\Downloads\FRST64.exe 2014-05-22 22:57 - 2014-05-22 22:57 - 00000474 _____ () C:\Users\Reyhan\Desktop\defogger_disable.log 2014-05-22 22:56 - 2014-05-22 22:56 - 00050477 _____ () C:\Users\Reyhan\Desktop\Defogger (1).exe 2014-05-22 22:52 - 2014-05-22 22:52 - 00000474 _____ () C:\Users\Reyhan\Downloads\defogger_disable.log 2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 _____ () C:\Users\Reyhan\defogger_reenable 2014-05-22 22:52 - 2011-02-09 17:02 - 00000000 ____D () C:\Users\Reyhan 2014-05-22 22:50 - 2014-05-22 22:50 - 00050477 _____ () C:\Users\Reyhan\Downloads\Defogger.exe 2014-05-22 00:23 - 2011-02-09 17:18 - 00000000 ___RD () C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-21 23:59 - 2013-12-19 16:48 - 00262144 _____ () C:\Windows\system32\config\elam 2014-05-21 23:32 - 2014-05-21 23:32 - 00000045 _____ () C:\Users\Reyhan\AppData\Roaming\WB.CFG 2014-05-21 22:49 - 2013-10-11 14:51 - 00002304 _____ () C:\Users\Reyhan\Desktop\Sicherer Zahlungsverkehr.lnk 2014-05-21 22:28 - 2014-05-21 22:28 - 01069776 _____ (Solid State Networks) C:\Users\Reyhan\Downloads\install_flashplayer13x32_mssa_aaa_aih.exe 2014-05-21 18:58 - 2012-10-25 13:42 - 00628320 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys 2014-05-21 18:58 - 2012-08-13 19:24 - 00091008 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys 2014-05-19 22:40 - 2012-04-28 11:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-05-19 21:14 - 2013-08-31 21:28 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\HpUpdate 2014-05-18 19:32 - 2014-03-23 18:59 - 00000000 ____D () C:\Users\Reyhan\Documents\bewerbungen 2014-05-18 11:10 - 2012-12-12 23:49 - 00000000 ____D () C:\Users\Reyhan\Documents\Geschichte sek I 2014-05-15 23:29 - 2011-02-09 19:06 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-15 23:26 - 2013-08-25 22:52 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-15 23:23 - 2011-09-30 10:47 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-15 23:20 - 2014-05-15 23:20 - 00003548 _____ () C:\Windows\System32\Tasks\HP AR Program Upload - af23c583e91b4bc1b3fc6942caeb15bed4368923f9ca44a48443a20709a49e5a 2014-05-14 14:07 - 2012-04-05 16:30 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-14 14:07 - 2012-04-05 16:30 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 14:07 - 2012-02-20 13:42 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-14 13:54 - 2013-10-01 16:20 - 00000000 ____D () C:\Users\Reyhan\Documents\Gutachten Ref_Sonnentiger 2014-05-14 13:41 - 2013-02-16 17:48 - 00001021 _____ () C:\Users\Reyhan\Desktop\Dropbox.lnk 2014-05-14 13:41 - 2013-02-16 17:45 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-05-12 22:02 - 2014-05-12 22:02 - 00022655 _____ () C:\Users\Reyhan\Downloads\2. Klausur EPH.odt 2014-05-12 22:00 - 2013-02-16 21:58 - 00000000 ____D () C:\Users\Reyhan\Documents\Geschichte sek II 2014-05-12 20:12 - 2013-02-12 17:05 - 00000000 ____D () C:\Users\Reyhan\Documents\sonstiges 2014-05-12 19:47 - 2013-02-17 13:53 - 00000000 ____D () C:\Users\Reyhan\Documents\herkenrath 2014-05-12 07:26 - 2014-05-23 21:11 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:26 - 2014-05-23 21:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-05-23 21:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-07 14:51 - 2014-04-13 16:48 - 00000000 ____D () C:\Users\Reyhan\Documents\Ref 2014-05-05 12:22 - 2014-05-05 12:22 - 00000000 ____D () C:\Users\Reyhan\AppData\Roaming\DropboxMaster Some content of TEMP: ==================== C:\Users\Reyhan\AppData\Local\Temp\6_Offer_9.exe C:\Users\Reyhan\AppData\Local\Temp\autorun.dll C:\Users\Reyhan\AppData\Local\Temp\b4rrqmfd.dll C:\Users\Reyhan\AppData\Local\Temp\BackupSetup.exe C:\Users\Reyhan\AppData\Local\Temp\BundleSweetIMSetup.exe C:\Users\Reyhan\AppData\Local\Temp\Delta.exe C:\Users\Reyhan\AppData\Local\Temp\DeltaTB.exe C:\Users\Reyhan\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppnvid9.dll C:\Users\Reyhan\AppData\Local\Temp\Extract.exe C:\Users\Reyhan\AppData\Local\Temp\f.exe C:\Users\Reyhan\AppData\Local\Temp\glpo0rwa.dll C:\Users\Reyhan\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Reyhan\AppData\Local\Temp\ICReinstall_PDFCreatorSetup.exe C:\Users\Reyhan\AppData\Local\Temp\MybabylonTB.exe C:\Users\Reyhan\AppData\Local\Temp\propsys.dll C:\Users\Reyhan\AppData\Local\Temp\Quarantine.exe C:\Users\Reyhan\AppData\Local\Temp\Resource.exe C:\Users\Reyhan\AppData\Local\Temp\SP51865.exe C:\Users\Reyhan\AppData\Local\Temp\SP52264.exe C:\Users\Reyhan\AppData\Local\Temp\SP54714.exe C:\Users\Reyhan\AppData\Local\Temp\SP56215.exe C:\Users\Reyhan\AppData\Local\Temp\SP56221.exe C:\Users\Reyhan\AppData\Local\Temp\sp58915.exe C:\Users\Reyhan\AppData\Local\Temp\sp64126.exe C:\Users\Reyhan\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Reyhan\AppData\Local\Temp\UninstallHPTCA.exe C:\Users\Reyhan\AppData\Local\Temp\WSSetup.exe C:\Users\Reyhan\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_N360_20117.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-08 13:32 ==================== End Of Log ============================ --- --- --- --- --- --- Es gab nur Probleme beim ESET Scan: Das erste Mal ist mitten im Scan ein Problem aufgetreten. Habe es dann nochmal durchführen lassen. Hatte wieder Ewigkeiten (einen ganzen Tag) gedauert und es waren einige Dateien infiziert. Vielen Dank! |
|
27.05.2014, 12:16
| #6 |
| /// the machine /// TB-Ausbilder | not-a-virus:AdWare.Win32.Agent.aknu Java und Adobe updaten. Papierkorb leeren. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ --> not-a-virus:AdWare.Win32.Agent.aknu |
|
29.05.2014, 15:36
| #7 |
| | not-a-virus:AdWare.Win32.Agent.aknu Hallo, Die Bereinigung hat super geklappt!! Auch die nun neueste Version von Kaspersky zeigt keine Bedrohungen mehr an. In Zukunft hoffe ich, dass sowas nicht mehr vorkommt, daher habe ich mir auf deinen Vorschlag hin einige der aufgelisteten Programme heruntergeladen. Ein, zwei Fragen hätte ich aber noch: 1. Ich habe Firefox nicht wieder neu installiert, sondern Chrome. Habe irgendwoher gehört, dass Chrome am besten sein soll und da ich das jetzt auch etwas besser kenne... Ist Chrome denn nicht so sicher? Wurde jetzt in deiner Liste nicht aufgeführt, daher frage ich. 2. Ich habe dieses Secunia heruntergeladen, um alle meine Programme aktuell zu halten, aber beim Starten kam eine Fehlermeldung. Irgendwas mit "Skript muss geschlossen werden, weil sonst der PC nicht richtig funktionieren kann???" Sowas in der Art... Vielen vielen Dank noch einmal und einen schönen Tag noch! |
|
30.05.2014, 15:29
| #8 |
| /// the machine /// TB-Ausbilder | not-a-virus:AdWare.Win32.Agent.aknu Chrome und Firefox geben sich nix Deinstalliere Secunia und teste mal den FileHippo UpdateChecker.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.05.2014, 14:35
| #9 |
| | not-a-virus:AdWare.Win32.Agent.aknu Hi, Also der Update Checker funktioniert wenigstens. Danke für deine hilfreichen Tipps! Habe dann keine Fragen mehr mfG |
|
01.06.2014, 14:07
| #10 |
| /// the machine /// TB-Ausbilder | not-a-virus:AdWare.Win32.Agent.aknu Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Revo Uninstaller herunter.
dann auf 
und dann auf 
.
Linear-Darstellung
