|
Plagegeister aller Art und deren Bekämpfung: Online Banking gesperrt wg. PhishingWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
26.05.2014, 13:10 | #1 |
| Online Banking gesperrt wg. Phishing Hallo, bei mir wurde heute das Online Banking gesperrt. Nach einem Anruf bei der Bank hieß es aufgrund von Phishingversuchen. Habe jetzt gleich mal das FTST durchlaufen lassen: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02 Ran by george west (administrator) on GEORGEWEST on 26-05-2014 14:05:47 Running from C:\Users\george west\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AMD) C:\Windows\System32\atieclxx.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (NCP engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe (NCP Engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe () C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE () C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe () C:\Users\george west\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe (ICQ) C:\Users\george west\AppData\Roaming\ICQM\icq.exe () C:\Program Files (x86)\LANCOM\Advanced VPN Client\NcpBudgetGui.exe (NCP engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPMON.exe () C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe (Mozilla Corporation) D:\Users\george west\AppData\Local\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6468712 2012-03-20] (Realtek Semiconductor) HKLM\...\Run: [Ocs_SM] => C:\Users\george west\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-05-31] (OCS) HKLM-x32\...\Run: [NcpBudgetGui] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\NcpBudgetGui.exe [968192 2009-11-05] () HKLM-x32\...\Run: [NcpPopup] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncppopup.exe [578560 2009-11-10] () HKLM-x32\...\Run: [NcpMonitor] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpmon.exe [6587904 2009-11-16] (NCP engineering GmbH) HKLM-x32\...\Run: [NcpRsuGui] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe [819712 2009-10-12] () HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.) HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3873704 2014-05-23] (AVAST Software) HKU\S-1-5-21-1259545048-3289132323-2229452691-1001\...\Run: [ICQ] => C:\Users\george west\AppData\Roaming\ICQM\icq.exe [26606072 2013-01-15] (ICQ) HKU\S-1-5-21-1259545048-3289132323-2229452691-1001\...\MountPoints2: {435fbe2c-4e6a-11e2-a281-02004e435049} - F:\Startme.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE SearchScopes: HKCU - {458EE135-7AEF-4DA1-A16A-32ACF72D7767} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {69768234-9577-4522-904D-FA321F28FC62} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {7E123647-C404-4442-8A3D-B0DCFC5A106E} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {8A5D189D-2332-4A4D-B63B-B4581985AF6A} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {A87AB137-614A-4AC2-BE79-E4EDF43E007E} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {D82BEAA4-CF55-4201-B59D-6D86BF5D7D4C} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default FF SelectedSearchEngine: Google FF Homepage: hxxp://www.t-online.de/ FF Keyword.URL: hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q= FF NetworkProxy: "backup.ftp", "" Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-05-2014 02 Ran by george west at 2014-05-26 14:07:08 Running from C:\Users\george west\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated) AMD Accelerated Video Transcoding (Version: 2.00.0002 - Advanced Micro Devices, Inc.) Hidden AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden AMD Catalyst Install Manager (HKLM\...\{46DA7FD9-8BC1-7BA8-98D1-27F46647871B}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.) AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden AMD Fuel (Version: 2012.0928.1532.26058 - Ihr Firmenname) Hidden AMD Media Foundation Decoders (Version: 1.0.70405.2224 - Advanced Micro Devices, Inc.) Hidden AMD VISION Engine Control Center (x32 Version: 2012.0928.1532.26058 - Ihr Firmenname) Hidden avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software) Bing Bar (HKLM-x32\...\{F0839DB3-FBB8-4D14-936F-1D457A088224}) (Version: 7.0.601.0 - Microsoft Corporation) Brother MFL-Pro Suite DCP-9042CDN (HKLM-x32\...\{C83FB11D-9EC6-49D7-99A7-DDDB2264883C}) (Version: 1.0.1.0 - Brother Industries, Ltd.) Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0928.1532.26058 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center InstallProxy (x32 Version: 2012.0928.1532.26058 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Localization All (x32 Version: 2012.0928.1532.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Standard (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Traditional (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Czech (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Danish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Dutch (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help English (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Finnish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help French (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help German (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Greek (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Hungarian (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Italian (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Japanese (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Korean (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Norwegian (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Polish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Portuguese (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Russian (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Spanish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Swedish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Thai (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Turkish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden ccc-utility64 (Version: 2012.0928.1532.26058 - Advanced Micro Devices, Inc.) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Desktop Icon für Amazon (HKLM\...\DesktopIconAmazon) (Version: 1.0.1 (de) - ) Dropbox (HKCU\...\Dropbox) (Version: 2.6.24 - Dropbox, Inc.) FireJump (HKLM-x32\...\{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1) (Version: 1.0.2.5 - FireJump.net) Fotobuch (HKLM-x32\...\Fotobuch_is1) (Version: - ) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.) Google Drive (HKLM-x32\...\{418BAAD1-754D-48B4-B078-46EF4F25AF42}) (Version: 1.15.6556.8063 - Google, Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden ICQ 7.8 Build #6800 Banner Remover 1.0 (HKLM-x32\...\{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1) (Version: - murb.com) ICQ 8.0 (build 5981, für aktuellen Benutzer) (HKCU\...\ICQ) (Version: 8.0.5981.0 - Mail.Ru) ICQ7M (HKLM-x32\...\{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}) (Version: 7.8 - ICQ) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden LANCOM Advanced VPN Client (HKLM-x32\...\NCP RWS/GA) (Version: 2.20 - LANCOM Systems GmbH) Logitech Vid (HKLM-x32\...\{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}) (Version: 1.10.1009 - Logitech Inc.) Logitech Webcam Software-Treiberpaket (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.) Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation) MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version: - Pavel Cvrcek) Mozilla Firefox 12.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 12.0 (x86 de)) (Version: 12.0 - Mozilla) Mozilla Firefox 29.0.1 (x86 de) (HKCU\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla) Mozilla Thunderbird 12.0.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 12.0.1 (x86 de)) (Version: 12.0.1 - Mozilla) Mozilla Thunderbird 13.0.1 (x86 de) (HKCU\...\Mozilla Thunderbird 13.0.1 (x86 de)) (Version: 13.0.1 - Mozilla) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden OpenOffice.org 3.4 (HKLM-x32\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6602 - Realtek Semiconductor Corp.) SearchAnonymizer (HKLM\...\SearchAnonymizer) (Version: 1.0.1 (de) - ) Sony Ericsson Update Engine (HKLM-x32\...\Update Engine) (Version: 2.12.15.18 - Sony Ericsson Communications AB) Sony PC Companion 2.10.115 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.115 - Sony) TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer) Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) XnView 1.98.5 (HKLM-x32\...\XnView_is1) (Version: 1.98.5 - Gougelet Pierre-e) ==================== Restore Points ========================= 12-05-2014 07:43:15 Windows-Sicherung 13-05-2014 10:11:34 Windows Update 14-05-2014 09:10:33 Windows Update 18-05-2014 17:10:47 Windows-Sicherung 21-05-2014 11:04:59 Windows Update 23-05-2014 12:37:00 avast! antivirus system restore point 23-05-2014 14:11:22 avast! antivirus system restore point 23-05-2014 14:41:24 avast! antivirus system restore point 25-05-2014 17:00:10 Windows-Sicherung ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {6D873145-03B8-40B5-A5C7-EA584E58088F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-10] (Google Inc.) Task: {8A35DC50-5912-4E4E-AF06-9AABF14F319E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-15] (Adobe Systems Incorporated) Task: {D9C59B49-8F48-4C16-BCC9-C9A0381C5AF8} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-23] (AVAST Software) Task: {E68D9419-71BC-406A-80CF-4E6492588F15} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {EB77479B-857B-48EC-991F-31860CC5B4BC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-10] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2012-05-31 19:03 - 2009-09-23 14:34 - 00146432 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\x64\ncpbudget2008.dll 2012-05-31 19:03 - 2009-10-27 09:31 - 00104960 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\x64\ncpmif32.dll 2012-05-31 19:02 - 2008-10-06 10:58 - 00032768 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpsec.exe 2012-05-31 19:03 - 2009-10-12 14:37 - 00819712 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe 2012-05-31 20:02 - 2012-05-31 20:02 - 00040960 _____ () C:\Users\george west\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe 2012-05-31 19:03 - 2009-11-05 16:25 - 00968192 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\NcpBudgetGui.exe 2012-09-28 16:43 - 2012-09-28 16:43 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll 2014-05-25 16:06 - 2014-05-25 16:06 - 02255872 _____ () C:\Program Files\AVAST Software\Avast\defs\14052500\algo.dll 2014-05-26 12:06 - 2014-05-26 12:06 - 02255872 _____ () C:\Program Files\AVAST Software\Avast\defs\14052601\algo.dll 2012-06-14 18:24 - 2009-10-27 09:26 - 00097792 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpmif32.dll 2012-05-31 19:02 - 2009-10-28 15:47 - 01572352 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpgacc.dll 2012-05-31 19:03 - 2009-10-12 14:36 - 00979968 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\rsussl.dll 2013-01-15 18:25 - 2013-01-15 18:25 - 00851456 _____ () C:\Users\george west\AppData\Roaming\ICQM\ICQ\dll\YLUSBTEL.dll 2012-05-31 19:03 - 2002-06-28 10:16 - 00151552 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpcfg.dll 2012-05-31 19:03 - 2009-10-12 13:38 - 00077824 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.dll 2012-05-31 19:03 - 2009-10-21 12:29 - 00139264 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpdlg.dll 2012-05-31 19:03 - 2002-09-04 15:27 - 00102400 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpcry.dll 2014-05-23 16:42 - 2014-05-23 16:42 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2014-05-10 18:18 - 2014-05-10 18:18 - 03839088 _____ () D:\Users\george west\AppData\Local\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== Disabled items from MSCONFIG ============== MSCONFIG\startupreg: Logitech Vid => "C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe" -bootmode MSCONFIG\startupreg: Ocs_SM => C:\Users\george west\AppData\Roaming\OCS\SM\SearchAnonymizer.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (05/26/2014 00:07:11 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/26/2014 09:22:55 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/25/2014 07:03:11 PM) (Source: Windows Backup) (EventID: 4104) (User: ) Description: Die Sicherung war nicht erfolgreich. Fehler: "Die Datei oder das Verzeichnis ist beschädigt und nicht lesbar. (0x80070570)" Error: (05/25/2014 04:08:14 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/25/2014 02:04:09 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/25/2014 10:00:12 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/24/2014 10:32:23 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/23/2014 04:41:37 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer". Details: AddLegacyDriverFiles: Unable to back up image of binary uvsnazbt. System Error: Das System kann die angegebene Datei nicht finden. . Error: (05/23/2014 04:34:13 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/23/2014 04:25:54 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (05/25/2014 07:03:05 PM) (Source: Ntfs) (EventID: 55) (User: ) Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar. Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy10" den Befehl "chkdsk" aus. Error: (05/25/2014 06:04:03 PM) (Source: Service Control Manager) (EventID: 7011) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht. Error: (05/23/2014 04:22:37 PM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: AFD aswRdr aswRvrt aswSnx aswSP aswVmm DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx Wanarpv6 WfpLwf Error: (05/23/2014 04:22:37 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Client Virtualization Handler" ist vom Dienst "Application Virtualization Client" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (05/23/2014 04:22:37 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (05/23/2014 04:22:37 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (05/23/2014 04:22:37 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "SMB 1.x-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (05/23/2014 04:22:37 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "SMB-Miniredirector-Wrapper und -Modul" ist vom Dienst "Umgeleitetes Puffersubsystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%31 Error: (05/23/2014 04:22:37 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "IP-Hilfsdienst" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (05/23/2014 04:22:37 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: Der Dienst "Arbeitsstationsdienst" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Microsoft Office Sessions: ========================= Error: (05/26/2014 00:07:11 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/26/2014 09:22:55 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/25/2014 07:03:11 PM) (Source: Windows Backup) (EventID: 4104) (User: ) Description: Die Datei oder das Verzeichnis ist beschädigt und nicht lesbar. (0x80070570) Error: (05/25/2014 04:08:14 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/25/2014 02:04:09 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/25/2014 10:00:12 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/24/2014 10:32:23 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/23/2014 04:41:37 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Details: AddLegacyDriverFiles: Unable to back up image of binary uvsnazbt. System Error: Das System kann die angegebene Datei nicht finden. Error: (05/23/2014 04:34:13 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (05/23/2014 04:25:54 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 ==================== Memory info =========================== Percentage of memory in use: 67% Total physical RAM: 1790.13 MB Available physical RAM: 584.2 MB Total Pagefile: 3580.25 MB Available Pagefile: 1738.65 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:232.88 GB) (Free:177.92 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: () (Fixed) (Total:232.88 GB) (Free:33.73 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 375CF69B) Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
26.05.2014, 13:28 | #2 |
/// the machine /// TB-Ausbilder | Online Banking gesperrt wg. Phishing hi,
__________________Scan mit Combofix
__________________ |
26.05.2014, 14:08 | #3 |
| Online Banking gesperrt wg. PhishingCode:
ATTFilter ComboFix 14-05-26.02 - george west 26.05.2014 14:49:54.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.1790.506 [GMT 2:00] ausgeführt von:: c:\users\george west\Downloads\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B} SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe D:\install.exe . . ((((((((((((((((((((((( Dateien erstellt von 2014-04-26 bis 2014-05-26 )))))))))))))))))))))))))))))) . . 2014-05-26 12:59 . 2014-05-26 12:59 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-05-26 12:05 . 2014-05-26 12:07 -------- d-----w- C:\FRST 2014-05-23 14:42 . 2014-05-23 14:42 85328 ----a-w- c:\windows\system32\drivers\aswstm.sys 2014-05-23 14:42 . 2014-05-23 14:42 208416 ----a-w- c:\windows\system32\drivers\aswVmm.sys 2014-05-23 14:42 . 2014-05-23 14:42 423240 ----a-w- c:\windows\system32\drivers\aswsp.sys 2014-05-23 14:42 . 2014-05-23 14:42 1039096 ----a-w- c:\windows\system32\drivers\aswsnx.sys 2014-05-23 14:42 . 2014-05-23 14:42 79184 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2014-05-23 14:42 . 2014-05-23 14:42 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys 2014-05-23 14:42 . 2014-05-23 14:42 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys 2014-05-23 14:42 . 2014-05-23 14:42 334648 ----a-w- c:\windows\system32\aswBoot.exe 2014-05-23 14:42 . 2014-05-23 14:42 43152 ----a-w- c:\windows\avastSS.scr 2014-05-23 14:25 . 2014-05-23 14:25 -------- d-----w- c:\programdata\AVAST Software 2014-05-23 13:32 . 2014-05-26 10:40 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2236797E-ABD0-4C98-9C4A-4D929451E3A1}\offreg.dll 2014-05-23 12:38 . 2014-05-23 14:42 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys 2014-05-23 12:02 . 2014-05-23 12:02 -------- d-----w- c:\programdata\Malwarebytes 2014-05-23 12:02 . 2014-05-23 12:02 -------- d-----w- c:\users\george west\AppData\Local\Programs 2014-05-23 11:40 . 2014-04-30 23:20 10702536 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2236797E-ABD0-4C98-9C4A-4D929451E3A1}\mpengine.dll 2014-05-14 09:14 . 2014-05-06 04:40 23544320 ----a-w- c:\windows\system32\mshtml.dll 2014-05-14 09:14 . 2014-05-06 03:00 84992 ----a-w- c:\windows\system32\mshtmled.dll 2014-05-14 09:14 . 2014-05-06 04:17 2724864 ----a-w- c:\windows\system32\mshtml.tlb 2014-05-14 09:14 . 2014-05-06 03:07 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb 2014-05-06 17:25 . 2014-05-14 16:15 -------- d-s---w- c:\windows\system32\CompatTel 2014-04-27 14:33 . 2014-04-27 14:33 -------- d-sh--w- c:\users\george west\AppData\Local\EmieUserList 2014-04-27 14:33 . 2014-04-27 14:33 -------- d-sh--w- c:\users\george west\AppData\Local\EmieSiteList . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-05-15 17:15 . 2012-05-31 15:53 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-05-15 17:15 . 2012-05-31 15:53 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-05-14 09:11 . 2012-06-07 17:41 93223848 ----a-w- c:\windows\system32\MRT.exe 2014-03-31 07:35 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe 2014-03-04 09:44 . 2014-04-10 10:48 243712 ----a-w- c:\windows\system32\wow64.dll 2014-03-04 09:44 . 2014-04-10 10:48 362496 ----a-w- c:\windows\system32\wow64win.dll 2014-03-04 09:44 . 2014-04-10 10:48 13312 ----a-w- c:\windows\system32\wow64cpu.dll 2014-03-04 09:44 . 2014-04-10 10:48 16384 ----a-w- c:\windows\system32\ntvdm64.dll 2014-03-04 09:44 . 2014-04-10 10:48 1163264 ----a-w- c:\windows\system32\kernel32.dll 2014-03-04 09:17 . 2014-04-10 10:48 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll 2014-03-04 09:17 . 2014-04-10 10:48 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2014-03-04 09:16 . 2014-04-10 10:48 25600 ----a-w- c:\windows\SysWow64\setup16.exe 2014-03-04 09:16 . 2014-04-10 10:48 5120 ----a-w- c:\windows\SysWow64\wow32.dll 2014-03-04 08:09 . 2014-04-10 10:48 7680 ----a-w- c:\windows\SysWow64\instnm.exe 2014-03-04 08:09 . 2014-04-10 10:48 2048 ----a-w- c:\windows\SysWow64\user.exe . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ICQ"="c:\users\george west\AppData\Roaming\ICQM\icq.exe" [2013-01-15 26606072] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "NcpBudgetGui"="c:\program files (x86)\LANCOM\Advanced VPN Client\NcpBudgetGui.exe" [2009-11-05 968192] "NcpPopup"="c:\program files (x86)\LANCOM\Advanced VPN Client\ncppopup.exe" [2009-11-10 578560] "NcpMonitor"="c:\program files (x86)\LANCOM\Advanced VPN Client\ncpmon.exe" [2009-11-16 6587904] "NcpRsuGui"="c:\program files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe" [2009-10-12 819712] "BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168] "ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-05-23 3873704] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 NcpSec;NcpSec;c:\program files (x86)\LANCOM\Advanced VPN Client\ncpsec.exe;c:\program files (x86)\LANCOM\Advanced VPN Client\ncpsec.exe [x] R2 rwsrsu;rwsrsu;c:\program files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe;c:\program files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe [x] R3 adp3132;adp3132;c:\windows\system32\drivers\adp3132.sys;c:\windows\SYSNATIVE\drivers\adp3132.sys [x] R3 ahcix64s;ahcix64s;c:\windows\system32\drivers\ahcix64s.sys;c:\windows\SYSNATIVE\drivers\ahcix64s.sys [x] R3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\drivers\amdhub30.sys;c:\windows\SYSNATIVE\drivers\amdhub30.sys [x] R3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\drivers\amdxhc.sys;c:\windows\SYSNATIVE\drivers\amdxhc.sys [x] R3 asahci64;asahci64;c:\windows\system32\drivers\asahci64.sys;c:\windows\SYSNATIVE\drivers\asahci64.sys [x] R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys;c:\windows\SYSNATIVE\drivers\asmthub3.sys [x] R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys;c:\windows\SYSNATIVE\drivers\asmtxhci.sys [x] R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x] R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\System32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x] R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\System32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x] R3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\drivers\FLxHCIc.sys;c:\windows\SYSNATIVE\drivers\FLxHCIc.sys [x] R3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\drivers\FLxHCIh.sys;c:\windows\SYSNATIVE\drivers\FLxHCIh.sys [x] R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x] R3 iaStorA;iaStorA;c:\windows\system32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x] R3 iaStorS;iaStorS;c:\windows\system32\drivers\iaStorS.sys;c:\windows\SYSNATIVE\drivers\iaStorS.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x] R3 ISASerial;PCIe-ISA Communication Port;c:\windows\system32\drivers\ISASerial.sys;c:\windows\SYSNATIVE\drivers\ISASerial.sys [x] R3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\drivers\iusb3hub.sys;c:\windows\SYSNATIVE\drivers\iusb3hub.sys [x] R3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\drivers\iusb3xhc.sys;c:\windows\SYSNATIVE\drivers\iusb3xhc.sys [x] R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x] R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys;c:\windows\SYSNATIVE\DRIVERS\LVPr2M64.sys [x] R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x] R3 MtsHID;TechniSat Mantis BDA HID Driver;c:\windows\system32\drivers\MtsHID.sys;c:\windows\SYSNATIVE\drivers\MtsHID.sys [x] R3 mv91cons;mv91cons;c:\windows\system32\drivers\mv91cons.sys;c:\windows\SYSNATIVE\drivers\mv91cons.sys [x] R3 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys;c:\windows\SYSNATIVE\drivers\mv91xx.sys [x] R3 ncpfilt;LANCOM Filter;c:\windows\system32\DRIVERS\ncplelhp.sys;c:\windows\SYSNATIVE\DRIVERS\ncplelhp.sys [x] R3 NmPar;MosChip PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys;c:\windows\SYSNATIVE\drivers\NmPar.sys [x] R3 nmserial;MosChip PCI Serial Port;c:\windows\system32\drivers\nmserial.sys;c:\windows\SYSNATIVE\drivers\nmserial.sys [x] R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x] R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x] R3 nvamacpi;nvamacpi;c:\windows\system32\drivers\NVAMACPI.sys;c:\windows\SYSNATIVE\drivers\NVAMACPI.sys [x] R3 PciIsaSerial;PCI-ISA Communication Port;c:\windows\system32\drivers\PciIsaSerial.sys;c:\windows\SYSNATIVE\drivers\PciIsaSerial.sys [x] R3 PciPPorts;PCI ECP Parallel Port;c:\windows\system32\drivers\PciPPorts.sys;c:\windows\SYSNATIVE\drivers\PciPPorts.sys [x] R3 PciSPorts;High-Speed PCI Serial Port;c:\windows\system32\drivers\PciSPorts.sys;c:\windows\SYSNATIVE\drivers\PciSPorts.sys [x] R3 PPorts;PCIe ECP Parallel Port;c:\windows\system32\drivers\PPorts.sys;c:\windows\SYSNATIVE\drivers\PPorts.sys [x] R3 rusb3hub;Renesas Electronics USB 3.0 Hub Driver (Version 3.0);c:\windows\system32\drivers\rusb3hub.sys;c:\windows\SYSNATIVE\drivers\rusb3hub.sys [x] R3 rusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver (Version 3.0);c:\windows\system32\drivers\rusb3xhc.sys;c:\windows\SYSNATIVE\drivers\rusb3xhc.sys [x] R3 Si3124r5;Si3124r5;c:\windows\system32\drivers\Si3124r5.sys;c:\windows\SYSNATIVE\drivers\Si3124r5.sys [x] R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x] R3 SPorts;High-Speed PCIe Serial Port;c:\windows\system32\drivers\SPorts.sys;c:\windows\SYSNATIVE\drivers\SPorts.sys [x] R3 StnPport;PCIe to Multi Mode Parallel Port;c:\windows\system32\drivers\StnPport.sys;c:\windows\SYSNATIVE\drivers\StnPport.sys [x] R3 StnSport;PCIe to High Speed Serial Port;c:\windows\system32\drivers\StnSport.sys;c:\windows\SYSNATIVE\drivers\StnSport.sys [x] R3 tihub3;TI USB3 Hub Service;c:\windows\system32\drivers\tihub3.sys;c:\windows\SYSNATIVE\drivers\tihub3.sys [x] R3 tixhci;TI XHCI Service;c:\windows\system32\drivers\tixhci.sys;c:\windows\SYSNATIVE\drivers\tixhci.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 VUSB3HUB;VIA USB 3 Root Hub Service;c:\windows\system32\drivers\ViaHub3.sys;c:\windows\SYSNATIVE\drivers\ViaHub3.sys [x] R3 xhcdrv;VIA USB eXtensible Host Controller Service;c:\windows\system32\drivers\xhcdrv.sys;c:\windows\SYSNATIVE\drivers\xhcdrv.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x] S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x] S0 amdide64;amdide64;c:\windows\system32\drivers\amdide64.sys;c:\windows\SYSNATIVE\drivers\amdide64.sys [x] S0 aswRvrt;avast! Revert; [x] S0 aswVmm;avast! VM Monitor; [x] S0 iaStorF;iaStorF;c:\windows\system32\drivers\iaStorF.sys;c:\windows\SYSNATIVE\drivers\iaStorF.sys [x] S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x] S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x] S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x] S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x] S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x] S2 ncpclcfg;ncpclcfg;c:\program files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe;c:\program files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe [x] S2 ncprwsnt;ncprwsnt;c:\program files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe;c:\program files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe [x] S2 SearchAnonymizer;SearchAnonymizer;c:\users\george west\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe;c:\users\george west\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [x] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x] S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x] S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x] S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\DRIVERS\LVUSBS64.sys;c:\windows\SYSNATIVE\DRIVERS\LVUSBS64.sys [x] S3 ncplelhp;LANCOM Secure Client NDIS6 Driver;c:\windows\system32\DRIVERS\ncplelhp.sys;c:\windows\SYSNATIVE\DRIVERS\ncplelhp.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-05-23 16:52 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe . Inhalt des "geplante Tasks" Ordners . 2014-05-26 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-31 17:15] . 2014-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-10 15:38] . 2014-05-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-10 15:38] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2014-05-23 14:42 290888 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}] 2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2014-04-25 08:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-03-20 6468712] "Ocs_SM"="c:\users\george west\AppData\Roaming\OCS\SM\SearchAnonymizer.exe" [2012-05-31 106496] . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - d:\program files (x86)\ICQ7M\ICQ.exe TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.t-online.de/ FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q= FF - ExtSQL: !HIDDEN! 2012-05-31 20:03; firejump@firejump.net; c:\users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\extensions\firejump@firejump.net FF - user.js: yahoo.homepage.dontask - yahoo.ytff.general.dontshowhpoffer . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Toolbar-Locked - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.13" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2014-05-26 15:06:17 ComboFix-quarantined-files.txt 2014-05-26 13:06 . Vor Suchlauf: 8 Verzeichnis(se), 191.437.176.832 Bytes frei Nach Suchlauf: 12 Verzeichnis(se), 193.412.640.768 Bytes frei . - - End Of File - - B202033F5A9DE08E5919291BE977DF80 A36C5E4F47E84449FF07ED3517B43A31 |
27.05.2014, 12:18 | #4 |
/// the machine /// TB-Ausbilder | Online Banking gesperrt wg. Phishing Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
31.05.2014, 17:25 | #5 |
| Online Banking gesperrt wg. Phishing MBAM Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 31.05.2014 Suchlauf-Zeit: 18:04:39 Logdatei: MBAM.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.05.31.07 Rootkit Datenbank: v2014.05.21.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: george west Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 272283 Verstrichene Zeit: 9 Min, 8 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) AdwCleader Code:
ATTFilter # AdwCleaner v3.211 - Bericht erstellt am 31/05/2014 um 18:17:40 # Aktualisiert 26/05/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : george west - GEORGEWEST # Gestartet von : F:\adwcleaner_3.211.exe # Option : Löschen ***** [ Dienste ] ***** Dienst Gelöscht : SearchAnonymizer ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\Users\george west\AppData\Roaming\DesktopIconForAmazon Ordner Gelöscht : C:\Users\george west\AppData\Roaming\OCS Ordner Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\ICQToolbarData Ordner Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\Extensions\firejump@firejump.net Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\icqplugin.xml Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\icqplugin-1.xml Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\icqplugin-2.xml Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\icqplugin-3.xml Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\icqplugin-4.xml Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\icqplugin-5.xml Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\icqplugin-6.xml Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\icqplugin-7.xml Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\icqplugin-8.xml Datei Gelöscht : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\user.js ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [firejump@firejump.net] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7} Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17041 -\\ Mozilla Firefox v12.0 (de) [ Datei : C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\prefs.js ] Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false); Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false); Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1320409904); Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options"); Zeile gelöscht : user_pref("icqtoolbar.history", "G%C3%B6tzburg-Nachtw%C3%A4sche||Dresden%20Ibis-hotel||Dresden.de||Centerparks||01...%20Dresden||Dresden||Umr%C3%BCsts%C3%A4tze%20Scheibenwischerbl%C3%A4tter||Scheibenw[...] Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49); Zeile gelöscht : user_pref("icqtoolbar.installTime", "1320409904"); Zeile gelöscht : user_pref("icqtoolbar.itbsitescount", 0); Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1"); Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0); Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "7.0.1"); Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no"); Zeile gelöscht : user_pref("icqtoolbar.suggestions", false); Zeile gelöscht : user_pref("icqtoolbar.uninstStatSent", true); Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "110893803218499710211265462657430"); Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1320409908); Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0); Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0); Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0); Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 3); Zeile gelöscht : user_pref("icqtoolbar.xmlEnableHomePageDsGuard", false); Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false); Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de"); Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="); -\\ Google Chrome v35.0.1916.114 [ Datei : C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [5175 octets] - [31/05/2014 18:16:50] AdwCleaner[S0].txt - [4920 octets] - [31/05/2014 18:17:40] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4980 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows 7 Home Premium x64 Ran by george west on 31.05.2014 at 17:54:56,35 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho.1 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{d85ffe92-bf14-4e9b-bccd-e5c16069e65f}_is1 ~~~ Files Successfully deleted: [File] C:\Windows\syswow64\sho1DB2.tmp Successfully deleted: [File] C:\Windows\syswow64\sho2C45.tmp Successfully deleted: [File] C:\Windows\syswow64\sho31BF.tmp Successfully deleted: [File] C:\Windows\syswow64\sho61E0.tmp Successfully deleted: [File] C:\Windows\syswow64\sho6B54.tmp Successfully deleted: [File] C:\Windows\syswow64\sho7C55.tmp Successfully deleted: [File] C:\Windows\syswow64\sho802.tmp Successfully deleted: [File] C:\Windows\syswow64\shoA140.tmp Successfully deleted: [File] C:\Windows\syswow64\shoDAE.tmp Successfully deleted: [File] C:\Windows\syswow64\shoE93A.tmp ~~~ Folders Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{01AE94BE-942C-422A-849F-DB752D3C8462} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{01CA58CB-CAB2-44E5-997A-F5B814A8D4BB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{020378EA-2C79-4267-A54B-0BBF5BB88AF3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{02B2844F-5BEA-43E5-8499-8292F956E1A4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{02D7D541-E377-4690-A0B6-CFADF06A872F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{02FB7BC2-E78F-4F43-A2EA-51EF255B51E0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{03749EF8-CF75-49B1-9458-9B9D1229B20A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{045E5A0C-C07E-4396-A9EA-A2BBB6543BEE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{04698917-8A50-4526-A93E-85CAAC71B28A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0489D36C-CEF2-44DB-89CC-A7A23083228A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{04BB2C95-FB3D-4D96-B528-DEF36CC93AF0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{05160706-ED51-4F48-A572-707FB939ADAD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{05FF95EC-8147-47F3-BCB7-C50E3E6B1DCA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{06B44329-C358-4D55-8C42-4749B296CEF4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{078FDCF6-E7DF-4BFE-94C9-3FCCF9D6758B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{081AB3B3-B4DC-4285-8463-C3B8F8E3759A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{082F879D-A05B-4B86-943E-FD08E17D575F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{083AD51E-4C20-415A-9495-F00879999A14} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{08E01482-7C4A-41E9-89CB-44127E41223D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{092080D9-E642-4850-AC55-7855B5109F7B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0A2A4208-6118-47DE-AC33-22183440E45C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0A7968F6-8EB5-4ABC-B849-D5FFBEDF0017} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0B164F49-C63F-402A-9AF9-C01DC0ACEF92} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0B184C95-8BA5-461A-89AD-A9F28F7219AC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0B19858F-648E-4D55-AF0D-21368187F795} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0B3199AC-8FCE-4DCE-98A9-D80F50150BED} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0C9E128B-C8B5-454B-8C04-E1A6B7EC0DC3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0D42BE62-3876-454D-97FA-0492969637D7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0E2843A3-B9A3-4CDB-AF7F-48684932DE8C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0E2F6C4D-846E-4B1C-85F8-5B728A04681F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0E7D8B2C-32B0-43C5-AFCF-42557123CDC5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0E89F1B4-2584-4AA8-A568-F2457B697DEF} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0EB9A9DF-288E-4CF8-B0BD-492124ABCB19} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0F156AA7-7416-4007-B549-C57695201C9A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{0F66DA9E-17DD-44E4-9390-99A0E639206F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{10276EF2-7D84-49A3-A5FE-6E10FFF9C322} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{10792A1D-1A9D-44CD-9C6B-AA50F57FBE9D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{10DD7074-7A6C-4156-9474-445F0121A05F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{11019D42-1B0A-4150-802B-FCFDD8818F28} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{11559A82-6107-4D76-B3CC-0E243E4A6AFB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{11746A4B-FACE-48DC-A778-913445FE1951} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{11D0EA8E-4E8D-49F8-8BBC-12B30864CAC3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{12266297-E4C3-4606-81A2-8ECF153C32D8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{12D1D53A-7247-4A3E-B0FF-3B8D1C7CC3D1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{12F665E5-DB2A-4817-9D2F-50F647A33891} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1339F7F0-4B78-4EE6-BADA-23D27BC7B457} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{13E3DBCB-4B52-495E-9A71-69E9F59401EC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{141CAB19-E936-44BB-9250-73BA3C79AC2A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{14318E53-8797-48D2-85D2-D9AB210326EE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1433AC10-2452-4CEA-A078-12FAB5B400FB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{145CCF08-B36D-4D1A-8CE8-20D029C3CD1E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{145E6D30-7CE7-4675-B1EB-34EDFE9F6C38} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{149F6840-5F91-4D31-8114-79046A4C3A0F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{14CE42CA-1E4E-4F10-87ED-986D5ED709AC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{14D55B18-32BC-4503-81F1-695AF4CD0E07} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{15A503C1-4D0B-4B11-9B59-EA5FA9EA71EE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{168B20ED-1004-437E-8259-8A0E64769CDE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{16F4141A-4D5C-4C0F-B704-5385CBAAD34B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{17863352-6045-4CB0-9875-BD73E7AAA4DB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{182A4D3B-4F03-40CE-BABB-4C6553919AAA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1839861C-43E0-4717-AE49-339D6D49B95B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1841EE6B-DEE0-48CD-80F5-E6765ED76315} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1864DA15-804F-4158-8298-347D9602E47E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{18C3647E-758F-44B3-8D77-A3C5E5A782D6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{18EBA539-9046-40E3-A414-10456D82EDF9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{18EDA610-464B-460C-9887-226FC2C6DAA4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{192AA13D-32DA-4A22-9EC7-21B9D3492CFF} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{19428C40-FF92-4967-90CC-8EAB70D4BF89} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1A4005DB-65F3-44C0-AD5F-B17C6251C5BF} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1A71E9F1-5C24-45C3-BDDE-C4B5679EC9BA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1AA3F168-49B2-46D8-A66C-4AB1A3D793C4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1AE6ABD9-B9D4-4DE4-B007-9BA8732B572D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1B04BF61-3B78-4950-A06C-12FCEE388268} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1BA29595-FAD6-4D35-AEFA-05981E8C118C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1C8401CB-D40B-4251-AE94-2261EA655B25} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1C94D5D1-9386-413E-B77A-1EBBC12B7916} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1CF26C9B-F16F-4517-9D48-EB095B17AB7A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1D8D2B94-F6D7-4634-8FCC-2C9C067D33B4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1E142A81-DCD5-43E6-A10F-9DDB742F4BCD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1E655C2C-EA9B-4835-81A4-6EA252D92BA1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{1F75B89B-3492-416F-95B5-71CB1FB9678E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2001E440-718D-4313-8D15-53B36583BEFC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{207B5B38-731A-4156-A576-D2662A9FEC9E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{20C111FF-ED74-4D4B-ABD5-10FD37891A4F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{21565930-F68D-4387-89FC-9AA351A2DC32} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2163B03E-3087-4C92-B1A3-7127A53D35E8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{21B8005D-E285-41C5-AF22-7251C5B043BE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{21B8E538-7A85-4A3F-8BA3-E4CDF881C639} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2225B65A-D0BD-4C71-93A5-EDD8E433966F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2295CCF5-8D2D-4D99-B640-8B07942E95D6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{230560CD-E758-48E4-828B-F3F9DBB0FC12} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{23100B71-DA61-48C7-A8BE-77F856D578F0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2373D342-1D98-4402-9985-B7556EE26036} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{238EB779-4B5F-4D94-BDB2-1C8209D21446} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{23C03CE0-56EF-4CFB-932F-4A1D3D9D47C8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2570A041-79CC-459F-9423-B1F4130D79FE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{25D88EC1-FB5D-4B9E-B894-9B298D4B8E5D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2611CF73-91DF-416C-B022-7E3BB1B44D06} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{264F2660-6BAD-44DD-8191-E5A59615AD2A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{283112FA-98F2-4CBC-84DE-1E02B274AF0E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{28B8F67D-CA37-4DE9-8176-BE4FAC3B707C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{28E127E6-B06E-42AA-855A-2D71A3366781} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{29E44030-7348-413C-B3B5-6370488D335C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{29F8F185-3ACF-472E-AC5F-903F9C08E4A9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2A9FBB77-11B0-413C-B2CF-04DDB22E2EA3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2B372848-FB4F-4C8C-80FE-D0B8CD28B061} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2B8B7A47-647E-4EF5-97B5-59B27B15A8FE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2C769A1B-06C3-409B-8442-1233876A0465} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2CF51800-A9FE-4061-BF0C-F02BD061664A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2D5C839E-21E4-4B8F-8351-57B9F21A55E8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2D7165AC-BCA1-43D2-B1EF-4CADF722FEBD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2D853C37-CC07-4384-8251-2000CCE1311E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2DD1D4B0-179B-435B-B663-B5C229D937F4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2DF683EC-27C0-4937-B2B4-9F4BAB92B74E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2F114E26-8BE9-4E3F-8705-98345623AF51} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{2F90E5ED-82E9-4637-899C-4AB2D0DDE127} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{30401CFC-29A1-43A7-87EA-AB8EB2F4AD37} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3077C875-DD0C-4761-B75C-59B3CD88E4C0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{30ACE662-CDB1-4A9B-8D8F-B91E545396E6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{312DDF61-546A-4F35-88A9-20DC1DFF28AC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{316C4994-C805-4312-A86E-39713A0B4253} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{31B2F6F3-E38C-492D-841B-BD91DE6BB780} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{32031A14-AE67-45C2-8F31-230BEE1F4C86} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{326C4AD4-1AF9-4083-A93C-6ADBF179B261} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{32CAD5EE-BCCD-4F6A-955F-19B45D56BAEC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3300E3C6-29B3-499C-AE6D-3DC24B149F8A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{332CB913-EE20-467B-B8E8-24AD7F3B7629} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3355F083-8425-4559-87A6-02F46AFBED02} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{337FCA7A-C18E-48F8-B55D-41EFCB3D71C4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{33ACE003-6A24-4BE3-88FA-B93385CFDD97} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3410121E-97F6-46A0-928B-8A340C718572} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{341FD0A8-AEFB-471F-8B21-207C607523AD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3494FEFE-1F3B-4B60-9860-66DAC60DFA5C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{349D49B3-B3DD-45AE-93D3-E15C00B80805} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3549EFA4-484C-4D43-9222-E43A89DFC515} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{35B1BF87-634D-4BA4-9F9E-9C7EAA04C3EC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{362388F8-4359-4A78-A942-6568C376FDC9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3720B55F-805E-4B0F-ABA7-03BDCFAB3546} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{374E967C-BDD9-4F48-9824-63A387C2199B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3779C53C-30A1-4D26-B9D5-22408F28C257} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{37B3D0F6-6EC5-4070-A666-769F04395CF8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3840C6B0-DCBE-4399-BC45-E40E681088DA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{38ACDDCB-34F1-4A95-8A21-15AB107F7AC3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{38D1E4CD-B7E7-4B1D-870A-A3BB5AA8434E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{39D60AD0-4A0B-4B82-9DBB-8E85EB059D53} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3A2D5B51-47AC-4C9F-8CA2-ECA0E8CB4F33} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3A507DC0-DB9F-4454-BFB4-319FDF7207D4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3A71F7AD-D431-4F97-8866-726B7078DEB5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3ACC4032-A986-4F54-884E-E3688716B857} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3AE54449-0BD9-4E86-93F0-662B072D9898} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3B2CF13F-517D-422D-B852-6EC649FBA11F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3B33A753-3DCF-4AB0-833A-93D39497F48E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3B9B3F7F-3C37-43A9-9D3D-E75CE4493A78} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3BF92AC7-4CB3-454B-9D68-ED63234C4141} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3D043039-C541-45F3-B3F7-3D9158128288} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3D2A235A-BF07-43A9-8E69-BD135C377175} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3F057440-349C-4893-86BF-A6E1024A1588} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3FD5ACE0-0C45-4D20-8EA9-FEF6FE273520} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{3FE94735-120D-4821-8CDA-938894B77930} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{40149ED1-2F3E-4932-9912-6828A5B249CA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{40501B60-F221-4F3B-A813-4F01C7CFA768} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{40D12699-CA24-4C67-B5DE-CE0B0F64C2BB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{40F07A4F-D083-407D-8382-EBBE2E59FF45} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{413A5DDD-D84C-4254-80AF-F871B968F078} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{41D62FFC-D91E-4DA4-B9E4-EC6BB8DEE53E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{422B3174-F15C-4A1E-9DAF-E505CB7E63F5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{42463924-B2F0-46E5-BF30-EE6C82C51104} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{42BD548B-186D-4BD3-AAE4-684BF132790A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{42E5E792-29E4-449A-96B7-DB95FE91DDD5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{444630CE-DAA0-466E-8D6C-0288E24904AE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{44A2FC60-385D-45D0-8C0E-EDCE87EDED93} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{44BE6F34-F91F-4814-BF14-6F60E0A6610F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{44CE5CEC-83D6-427A-8D92-6A5F92A929C3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{45405E88-BE6D-4ACE-A636-FA2080435CEA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{45C8B3E5-874D-4592-9E4E-F137C3CBF869} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{46DB86A3-D74D-4783-8C9D-756B706480CE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{477F58CE-D38E-4701-A1FA-A4460C20041E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{47974DE4-66F5-449B-8593-A3EA7C9AB9C4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{48605A54-605F-46C7-BE4E-4E3F872146AF} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{489DDCFA-DF69-4DB8-B6EA-A6869EA3D9D4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4995CB4D-02CC-498A-8761-B709B72094B7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4AD1CB87-1052-43B2-863B-51CEED88CD3B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4B1E48E9-40FD-408A-8444-6BCD38F73518} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4B2659DF-4A1F-4AFC-99C9-1324A3A0EA1C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4B55DF6F-9127-43C8-8C22-87D3BB477B23} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4BCA5D32-E671-4A22-BF90-730E3B4A3678} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4C2E663F-8223-448D-897D-C8462EAC96CB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4C3CA744-8E64-4564-B83C-4E867292688B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4C6D1E5A-56FB-4267-B62D-9837876B647B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4CD052FD-5ED6-4C89-BE0D-DBFB46FD3EE9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4D4F1C0B-79ED-4567-9DDC-B3F67C13C56C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4D5D27C1-2722-4044-B198-F6AB46A09CE7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4E15BBE1-4A93-4A3C-B325-E0C39C4933F5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4E8D9D55-F5E6-45FA-969F-B5E6518C01FB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4E9B6F7C-AA5D-4346-8E69-35DCEC66110F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4EC367C2-5ACF-4169-B3D5-059BD24C3333} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4EE5F4A6-1AE0-4B81-BECD-BEF5468ABE91} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{4F46B0B5-F2F8-4E9F-8AFD-5C4AF294D418} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{50A2F40A-D756-457F-9EC4-F5C780B21376} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{50B48037-52C3-44AC-B556-CCF570FDA7F4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{51283561-2269-4ECA-9059-C8FF75A3571B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5149B9B6-C42A-44E2-8E4A-613B06E975E8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5235AF4C-8812-46F7-A651-DA2ACD0ACCEE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{525C3C66-9472-4F1F-96CF-979612557897} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{53A3A4D1-0EB7-4FD3-877C-98A4A7F6BD9D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{54476E04-35E2-495E-8DE6-78846AE4DB7C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{544EF891-2725-480F-AE9E-2788ECB43388} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5456879A-FA8C-4B67-9914-786FDFC7A3E8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{549F0296-34F5-447E-9F78-A482B191B7E6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{54CA841A-817E-48A6-B473-5EC8A809E984} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5603878A-7738-46E5-8C65-7802CFA2516F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{561837BC-BCB6-4051-AA2E-2537B74FD476} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{56805875-F413-4999-A9F5-0EE2FCF7EBE0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5682A760-2683-4D5B-9493-F1F0BD54D4B8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{56E190D5-2D2F-44A6-B475-4D9A550D2E16} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{573381BE-3022-430B-B054-D11DD8BEC960} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{57A9C881-A60C-44F4-8403-13A6C0D499B8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{58540604-6A94-4D6A-9D46-C361C7736F57} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{58646CC2-A097-44D8-A395-1733D3442BC2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{596FB385-6A7B-4858-BF41-B73FC46C311A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5A477F56-2B48-4151-A8C4-A24600CCABCC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5A4D4654-F35D-43A9-B523-A207A3FF28C2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5A925313-F7EA-46D9-AD50-D9157B6C3ECC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5B135DFA-5EC9-4446-BFAB-DC4764D2C2E0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5B5F1792-2F4A-41B5-AF27-FA8240F32A91} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5C0C0ECB-254D-4708-892A-560749AAECEC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5C869309-E06B-4E41-9E9F-86622C9418B1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5CE4F371-3283-4953-9327-336CC5A8DBCE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5E240BDA-C9E3-4773-A7DC-7B3A2357EEFC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5E5DA6E1-9B83-4685-AFBD-96D0DF10C5C6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5F3387D0-4989-4777-8B3C-E5E69CA7BD03} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5F485888-38BE-4FAE-AF27-89D4F3817BDB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5F60BD9A-E5BE-4BE2-9EDF-F3BF2F764431} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5FC09C93-B506-4E57-BC1A-7E1B24935C1A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5FDC58EF-1DBD-4560-B38B-62D7268CB379} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{5FEA9C64-78D6-4E8D-BE03-CA987CBCB0B9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6012EB29-94CB-42F6-A57F-CB82046D96B3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{60A97B53-CE5D-4C30-9B88-B3D0D636D6B9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{60ABB28D-34FC-4384-91BB-3089156D51B3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{60C55D18-BC37-429B-A6FF-073C31C81D99} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{60C5E484-380E-4B2A-97D3-4F365D8D76D6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{60D0A5E6-99D1-4B74-AFEB-4D9263260D6C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{611985C0-7283-45ED-99C4-11AEBA08528F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6188BEDF-1CBB-45D2-82B4-5295A640AA3C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{61EFEF4F-EF57-4169-95A5-6AD436A61EE8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6265082D-C3D5-43F6-9829-4CB0A91E9377} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{626E3EF0-B2BD-44B9-B369-F89F362B087D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{62B8113C-F67B-4AD3-A366-5BF2BC13B70E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6307866C-348A-4248-94EC-AC354E549128} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{631AAACE-5E5D-4860-9406-48B52C942B19} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{637F3A02-E928-40E7-9EF6-136FDFD51D77} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6449535A-49FC-48DE-9A55-E40A015CE438} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{64A2D3BC-3576-4E45-B681-5BF9825A165B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{64C21086-1142-4F67-9176-5C2529219A12} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{656E920D-994A-4B53-8539-E8F37124CF77} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6669EBB1-1398-433F-B308-E288DC7F5359} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{66C41783-2F37-4D61-B0F2-99191D0C5B5A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{66F5E70C-9CA3-481D-8C9C-C8A5F75A03C1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{674307D7-B794-4AD1-A414-5ECF1811D84D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{67792CA9-C926-4D86-9D6F-9466031B20E5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{68440C39-DD2A-4268-BE1A-C26AC1802F35} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{686CAE58-23C9-43C7-8228-08F5D0884441} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{688A1453-01E0-499D-AE95-F3B89B4DDFC0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6915B756-1E32-46B6-9B63-4ABF75EF4966} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6966E56B-3CA7-455A-ACA9-0253DAD8F419} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{69F84982-9F3F-4864-BDCD-821C3EE1FFCB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6A56F4C4-9B4D-464A-A438-2CFF02454628} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6B1A8BAB-6D76-49D7-AB98-51EB1E79029D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6C580D73-AA1C-41B1-9290-32F402458F2F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6D2A7FC4-CBC0-44C7-B987-E26B543C65DC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6DCCF664-90B0-4C79-BBB2-26CD7204F689} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6ED692D8-54BE-441E-85D8-B5C9A190A1BF} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{6FEAA388-B34E-40C7-A3D2-D2599F6646B8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{700E4042-2332-4EAC-A752-BBFB7270193C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{70540165-3F77-4910-BCC3-6156D92B4E94} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{706310B3-5DA8-4826-8B1D-547EF4488BD4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7075F547-0FFA-4B15-8BD8-CCFBFCA47464} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{708224BE-1884-43BF-A37D-A05CB91B79F9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7087C199-4574-4FE3-9200-BA538239324C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{70CD8289-BFF5-4A03-B8AB-3676E479B70E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{70FA75F3-C003-446C-81DC-9634E9874558} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{71C0C53A-E718-45E1-8A6A-6ABE5FADFB85} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{71F7EEB3-45F4-47D6-B323-ADA4F2A423DD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{72C4FC0A-4240-4BEB-A40A-B5E49FB71C95} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{72D61944-118F-42CA-923D-964786CDEBF5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{735D0AE1-3C98-4932-9710-15E1F38B07E2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{73BFEBAF-3A44-42F2-BE0C-CDC56661F18B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{74145C8E-9420-4855-91BC-ED409D721BE4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{741E46B1-6454-4272-ACEF-D7BC8AD56479} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{74BC60C9-CEC6-4BF5-B2AA-19C52627E25C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{74F16E5E-435F-41BE-8EE0-2B1533EB6BCD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{752805CB-9E51-459C-BBA2-7ABE5ABDA1D7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{755D3AB8-9E88-4987-B27C-51A5C86BE2C6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7571F08E-E369-4E4C-8F6D-D307D38D6DB3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{75A745F4-A754-4E89-9E4F-A8054A9026CE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{760E1051-2CF3-4307-8D06-1AA612C010C9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7620EEF2-E62C-4AF5-AA5D-0B2D1C445038} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{762F98B3-BF61-4F6A-8309-7A0C199A830C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7649150C-7CAF-42FA-B89C-EF3C0C432933} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7657C13A-FC7D-42F0-B4F2-BFBEA5BEE093} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7668CC8C-F251-4C3D-994C-29E016A0A971} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{76780F3D-8852-49A9-ACC9-4DD55721EC9D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{768A7970-4A5E-497B-B0B1-918A05AE1907} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{76CD9BA1-A185-436D-BDF9-F23C96F1C183} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{76ED7EFE-7845-49A0-A3FE-7B27416557E3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{774F349F-737B-4341-A591-0ACDB6E3DB3A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{777CFF1A-84D6-4F0D-9B94-3A3555F6F365} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{77E20E3D-6BF4-4C32-B456-20B9226368A0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{786AEF79-D44C-469F-8317-F023597AE93F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{789C2373-5CA4-49BE-B0B5-0B29312B4E59} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{78C1E3F3-09BD-4926-949A-B83F6BE37122} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{78F18CBD-681F-41BF-B8FF-A8CBA7F73BAC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{78F246E7-1E18-4D19-8959-31217CD2953F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{79AE868C-554C-4E4A-9220-741862F474D2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7A1EF62E-AD2B-4EE2-BB6D-A612ED024C87} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7A3DE9F7-2C61-40A9-8F70-A64F61BD9DCA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7A4F01D3-133C-42CC-8006-B11060C6FF02} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7B21C410-1729-4711-AEB6-BAFDAC4F7F76} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7B613DFD-5AFB-4448-B8D7-FEE487A6862E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7B6F21A6-BF9C-4F85-84DF-A2D2A13597B5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7BB7E6EB-5D8A-4F9E-8F3C-6DE286D8C3E2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7BE2AA6F-FCEC-4020-A3CE-2A81CAB8351F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7C0815AC-7E44-46EA-926B-712AFF708AA1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7D42F076-CDF4-4316-99D3-235FD6F4DEE6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7D8A4D5D-C044-48E3-8E64-E94C28517D36} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7DDB186C-398C-4FFC-B3CC-93E56AFA9387} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7DDB85D3-35CF-4E04-87E8-52EC3CADA8DB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7E26CB8B-E0FB-4A84-97D8-8C7E10CC5870} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7E5CEEFF-32AA-4C35-BD18-D7E719FCB491} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{7EADC83B-8A59-42BC-ACA2-AEBE771BA43B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{801E19AE-6181-4FDC-84BB-76F8CD35DC7B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{803F5A6A-43F3-41DE-A81D-E3171EFC906E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{80EEC495-8EFD-4460-A6C2-007917BB546E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{81278A7D-615C-4502-9FDE-2D17465E7BCB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{82331F2D-6CED-4548-BDC4-25BE80709146} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{83438128-FE43-4FC5-8755-9B75A6F5CC14} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{839AC59A-914D-41DE-8693-E4AED023B30F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{84106600-6ED4-4A84-A260-633F29B7A875} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{84CF7A75-8ACB-4E7C-A9DB-2C8FEC08AC56} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{854FB0E7-C48D-4984-AD19-C72D7485AAB5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8590AB7D-5F7D-4580-B6B6-7DBC58EF23D7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{861874A7-0958-481C-8B3D-5DD1FC261AFD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{86498408-1552-4EF2-B16A-580A16292433} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{868DCA93-9A20-4127-ABDD-1BEBE2689C29} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{86ACEB55-1FAF-4B8E-8795-FAA0FF880567} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{87638CC9-117F-4CD5-ACE4-291758DEAEAB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8791212B-899E-4216-AB0A-5E0042748754} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{88AEE80A-5388-4327-95EE-FE5D12BF502F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{88C1398A-7A0A-4897-8B43-5CAD31DC0AC7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{88C44536-00B0-45D6-9239-896983042C0E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{88F30FC3-D62D-4950-9C3E-7BEB43F881CF} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8945D3FD-2FC3-48EC-8A0A-B0F64248894B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{897FC902-93BF-414E-BF89-6FFEB7C0A8C9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{899B6B8B-83E8-49BD-BAA9-AE8D0D49018B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8A0DC39E-C96F-4964-9A88-494C5D9EA22C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8A6F366B-AC52-49F8-BAA5-43B3164E4AC7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8AA8A99B-09D6-4E18-8F10-2D45AFFCDAE1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8AE8A9B9-D435-408E-8253-1F1F4968B4BD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8CABC986-693F-4CBB-8C40-8C9058BF49C2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8D447CBC-AD82-4FB0-8F32-1E1620253230} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8DB118B4-02CF-47ED-8E76-9AA5327DED07} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8E04F0FC-29C0-4836-AF25-6B8E61122CCC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8EAFC232-D9D6-4E1F-BACF-F498978B7FA7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8EC7547A-4EB3-4E36-ACE6-27414634F0E6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8EE65E3D-6134-44B8-BB0B-44689E51B3A0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8F2FB0F3-7CB6-405D-A495-287C44B90DB5} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8F9007C8-8677-4AF8-9D9C-65E6A8666749} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8FCDB0ED-C3EB-48A3-8CF3-695EB697E547} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{8FFAC82E-4A60-4B53-833C-FA78E7110E67} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{908268C2-1997-4322-87ED-1E2880A6BABB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9120F0EF-EE5E-4F52-97CB-94BDF1C1DC7E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{914F1CAE-41BD-461C-8140-EC834AD34046} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9165B80E-CAD2-4377-8566-ACE710BFD609} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{91A26295-C224-4C47-B190-6E3ED16DE810} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{91ABE1D3-D8BA-4ED9-81DA-5930E1D823DA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{91F40104-F831-4CCC-B27D-4CBCFD89579A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{92D3B0D0-6731-43A0-8136-9C22569B0486} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9301FFF6-CEBD-4A47-BA11-907F85052346} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{935AF33E-CAC4-458D-99A3-1B22BDA56687} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9383A8AF-5E2D-49FF-AE03-7A744B210D4C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{93BBABCD-76B0-47D0-9FC9-FD7BFC6F375E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{940ED1B8-3DA6-4AFB-83B0-6FC9B0CA9A5E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{94395D33-C8AA-40EC-BF41-3E13ED1F6603} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{94D6C302-F9E5-4356-AB25-30EF1101B2F4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9575E509-CAC0-4D2C-8971-F2A85B89DD40} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9575F726-A23D-4FF3-9B7C-C902AD75047C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9604D10B-F0B6-45B8-8EE3-36CC8C8B01A7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{97499878-6A9F-47DF-90D9-0C8F369A42E0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{97697AD7-3049-4F61-922F-4CE82D913259} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{97F62C29-DC8F-4485-9E78-318D6B0942BC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9919A0CA-DFC1-4E23-8682-E3AA540FAB75} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9953EFBC-242D-4156-B8CF-E0147B216BFD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{99D7173C-9886-409F-9B7F-EB42C84BD9D3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9AEFC928-8181-424E-AD5A-C1B9B039C7E8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9BFACF28-1E98-4FD1-8540-A900FEF78CD8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9C56D0B3-DD0F-4762-A010-D93521BC3B19} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9C783B5E-DF04-46F5-9B69-A625775E9C92} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9D1F9D43-97CB-4588-96D9-8D0C99FB0CD1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9EB48911-6ECA-477F-9D6E-E1E83D7CB918} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9ED3E8C3-714E-4331-9D8C-972A1F325896} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9F81D067-415D-491C-B1CE-428D9C05F1D7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9F985EA2-B264-43D7-B80C-4E3F09D54327} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{9FFC9FED-16BE-4C05-9799-362761975CB2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A018ED58-D250-4660-BAF9-4B7E2751293A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A0EFE431-890D-4324-96EF-25E0DF0FFE08} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A171DA47-ED5E-42FE-8D02-561D5C22723A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A17D8576-EE7F-4624-9C06-BF2FD16CE995} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A1ECD471-97CE-4CCE-8E36-27CF9CA0CA15} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A214412D-CC80-482F-A191-C5724CF0B24A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A343B2CD-E65A-476E-9CF9-98BACEF3AE61} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A396DB7C-AA3A-4EE3-932E-4EB497156907} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A3E1B119-0C0B-44D0-8197-02B71CEBDD54} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A524235D-1B62-410D-B285-8EC540ADF397} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A6080E2B-0955-47D3-B224-FD77F508D5AE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A6669283-0411-468C-A063-BF5DD8D1F466} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A67B2080-B9E6-41AE-9D65-FCD9564A4235} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A6B0FFBA-76C9-4F8D-A8D3-DE1B97A3466C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A708FE58-8706-46BF-9F8C-DCD10183B9CE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A7644474-45CC-4776-BB41-E21EADD724C7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A7F473AE-DD8C-43A2-AA0C-F90E99DF5DF4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A84163B4-A5B4-46F2-A4D5-C5DFD6E598F8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A85B3170-DD2D-4909-AE2D-5A4F3455C693} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{A88F7477-D85E-4071-823F-29A31C394805} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AA104968-7E18-4C4D-A50D-A90C991EF8B7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AA3E3465-0FAC-4941-B4D0-601891820301} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AA57D506-9FBF-41F3-8101-1FA83460096D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AA90831C-93B8-4E54-A1B7-E030111716B8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AB240069-BD0C-4F77-B02A-9FFA3709EF74} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AB56FACA-54EA-48BD-8F5D-CEA33C59D4EA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AB7331AD-A845-4D8B-8F0E-FA6FCE9CDF15} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{ABD85E1A-DC59-4278-A9CF-F1A4530DB057} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AC577337-256C-49C7-AEE0-3101379DADB2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AE360331-4590-4B08-8EDE-5E1CED729CCE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AE55272C-AAB5-44B8-B06F-B1DC38AD8C22} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AEABDABF-2C66-45DC-9E8D-4D747C145E83} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AEF41ED1-5158-4232-8FB5-F113A7C3A584} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{AFF96B91-BB04-4BE6-B811-A51F7BB25880} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B0A5851D-2B95-4841-A59F-EF426BC7E8B0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B0CC18EF-4E74-45D0-8E3B-DD46E91706CC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B1167C70-74D9-4D32-8926-F83984170502} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B1263DF0-3BEC-4002-97B2-C696B92752AA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B12972D6-E1F3-4A8E-BAC0-D1BC23580EED} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B16376A6-6D08-483F-A4DB-FD33DE5E85FE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B17E7FA0-9F17-4B71-BEE3-B83FFA46AEC2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B1B33F67-A009-4AF8-A9E7-F7D064CA30B0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B24A3A38-F0C2-40A7-AB75-09580D59188D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B394E2CB-8DB7-45FE-9834-C0C3841AC9C0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B3B098BF-A1EC-4B81-B87D-9D7541097F71} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B3D8EC4B-7DE3-46C1-8BFC-F4511253EE18} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B4658214-BDA1-4BA2-ABED-A7BD057C59B4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B494A0C2-4EE2-430F-802D-751E1204590B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B5118971-DD7C-4182-A2CD-56C3347406CE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B55D1707-4F8D-40E3-AB5C-FBED0A6573F8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B56CB464-7711-4C60-8EB9-A468BA84DC84} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B5865CAF-0EB0-4746-A4FA-B624DAB34EFA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B5BBF19F-C3F8-4E67-A77A-80DFA02F3617} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B5C6014E-B441-4825-9212-B32A577F61A4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B5FA6769-E7D9-483F-BCAF-B86A85096316} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B69D65D1-71E8-4411-8FB9-BFD3CEC07107} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B6F74DD1-3C41-4C4C-B12C-63202B2ABF85} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B74A7E66-6C10-4C1E-970E-BAFAAB755D70} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B79C2780-9DAC-48A6-ACA6-F5AA211646B0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B7C6EE77-C8DC-487E-B875-CBB14A048AF6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B7E03C3F-3E26-4EC7-9879-4E7D3038A9BC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B85FCE60-857C-4406-9636-220E2B822B38} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{B9CDC044-3AC3-4762-8525-089EA4CDF949} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BA4AB3A8-DDA1-45A5-A629-98AD2DB21409} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BB0049D5-FEFA-4104-8345-C09E2BAC96F0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BB0A163D-7894-4721-8F85-82DE69F97A9E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BB1CAAC3-A712-4C0E-9463-096A2B75F5E8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BB81AC7F-B84C-4F42-ABA7-C78B21BD6F2D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BB955A16-1915-4FBB-ADE0-3AD407146989} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BCD1236A-B4BF-45FF-8D6C-29B098C2A20A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BDD4B882-E7D9-4D97-8B65-949FE330F6F6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BE5BD8C8-B13A-4C4C-B68C-58B2E54E1E1F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BEA653ED-AFDB-4F13-B618-D7931CE89116} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BF1121AD-2AF4-456A-BF20-50876A9AE4EB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{BF24F190-CB68-428A-83A1-3B638EA26A24} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C0FC5044-80EF-431A-BFC8-1D744E28FA5F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C19ECC24-D744-4E79-9C5B-6E9F91ED8DD4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C1DC70AD-8D91-4B85-8E3F-1A91CE9EFE5F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C28D5D57-669C-4FC1-82BA-DAB14164BB1B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C2944811-E670-445C-97EA-A1052199380F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C38FE553-F03E-47AB-B720-3A57E7C6CD6B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C39B1538-A1AB-4ACE-AA6F-9A9ABCE05379} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C4206E1E-E0AE-443C-B4C7-1468E94B9316} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C44BD62E-D9F8-42F9-9DF0-D4D81B334762} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C555FA54-14C5-45BD-A665-42D1D0A214F8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C557F7CC-0439-4277-B40B-3A106F63ACE1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C58C8FE1-A235-4CF6-BC8D-AFCB3BE37AD9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C5E62205-5E1A-4B25-9325-EE7311020E4C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C5EDA190-729D-4990-8AAA-778135B5623F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C5FEDD58-D92F-4CB1-B143-A23CE488B409} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C6941C83-2A76-44A8-A9F2-C2B92BAE1072} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C7F46ED6-3197-49CC-8F2D-D9B566ACC0D0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C81685D7-A00B-4F03-8C32-AC88A4A48D1E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C8B7B082-19C3-4850-A2DE-BA2E554499AC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C90B78E0-DA13-400C-8D82-9C87B99BC701} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C95F296B-B9E8-43A0-B16D-6B4A0FD21224} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C972DC40-F84E-45DE-9759-92723CB37F15} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C9A73B4F-80C7-4736-9E2F-4CB2B1D9432C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C9D216ED-6A71-4049-A2C7-53B6A510FD6D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C9E9888C-1DB7-4A5E-8BFE-91738CCC4466} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C9F37960-FF03-4282-B66C-59CB34C99E19} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{C9FE2468-CCC9-45BC-B621-140B825BE0E2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CA14373E-1E71-4D92-AEEA-C792B7C222A4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CA6D0FA4-C73F-4AA5-936B-34B1BE364F8F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CA91E5A7-5FB6-4744-AB34-47555CCD42D3} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CAB884D6-AC7B-4732-BA76-0756C36F7648} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CB6AD3D6-B0FE-4BA2-AE9B-40D2B2CD48E2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CBCA52A1-4752-4102-A6CD-4C6986E85822} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CBE4E478-07E6-445F-BD10-AE40149F2F03} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CC0CEA84-E8C4-4099-A6EF-348E2A5D7FEC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CC3DB175-35FC-4209-9A76-9A75DA1E7943} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CC6761F0-0FD0-42C4-BCDE-8FA0BF0CA6F4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CCC2FA3D-4538-4618-821D-04D53DB89D08} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CD061E60-D009-4938-A91F-204AE68B7F7E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CD57A40A-FDBC-4D14-8122-FECFA55CA2B1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CDB990DF-3B69-4555-9A0D-2473D4B47FFE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CEBF05F7-0F92-4F96-B38F-DCA0D61E09D6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CF004445-CDCC-407D-BCCB-7DCF47385EAE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CF02C993-82CC-400C-A7EE-84D13117AEE6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{CF94227B-AA4F-446C-AD59-FBAAF3297970} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D013D6F2-F6F4-42C3-A36D-E07CAC195BDA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D052E818-52C4-4BEC-8BF6-72ACF1FD0A48} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D05E7685-CD5B-462A-B8E4-F8AC748DCC0C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D07260EF-7371-4A5D-B477-E9CC2AADCDA1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D09B9913-FD66-4498-BC0B-B828AA2EFEF4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D1400F35-CF7B-4608-AAE0-51331ECBFC07} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D14F63ED-75FA-45E4-B498-BAFDE06E83E9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D1A755D5-7D92-4678-AD41-416614E23028} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D1DB700D-396F-4813-82BE-D1D31A615EDE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D24F3B09-0137-4EF9-83B8-F2DC17A212E8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D2EC239A-A821-4070-AB87-9C16B24045AE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D3E93753-A668-407E-8F9A-C3A7591EA405} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D468AF12-9DF7-4FFB-BD16-9D67F995619B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D4B3A7C2-98B8-4581-A00E-00E65F18F69C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D4BD1D0D-CA82-468C-BD0A-D01BBAE22FBB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D5008D5A-8D74-471C-B1FB-3B51924FEE54} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D5DAEE26-DF36-4018-8012-582C8252DF1C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D5FEF0D5-0708-494A-8E58-6690A87C3397} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D71B2989-62E3-4817-BE5E-9688223E3D2B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D7354B91-FC47-409B-A550-89F10C82DD12} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D82273AB-BDD3-401C-A642-3813256A4DF6} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{D830096A-2980-4EFD-A528-62F72EEC3B98} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{DC7417F5-8B95-4A2B-BCF3-955048E2345D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{DCDFC2F4-24B6-437E-BD86-68AC1947E001} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{DDD98C20-7340-40B6-8034-9204CF1EC282} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{DE0C8A42-99DC-4627-847B-6FD996C255D7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{DF87765E-5C22-484B-87DB-51C53405F120} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{DF923544-298F-4210-B181-6685CBECA4B7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{DF981649-4085-4F80-AA35-A057ADD6F240} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{DFC14636-88AD-4EF6-8966-B109506A0627} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E00F82D5-F23A-4E0D-8D6D-A89BE5D71C3C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E0783591-3F9B-48D7-9DF4-07783F8202BE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E0C2F6ED-5FF0-4D20-8DB7-91E82D6EE1CB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E11EECAB-6352-4BAA-8A22-49868B9CA7D4} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E1D68233-F3A0-4297-9734-AB938A096710} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E28505C3-858B-488F-B159-7EDDAE353E49} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E2D08262-B716-4487-BF1C-7CB767A9DECE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E35FA718-CEF1-4423-84EF-F18FD75903B2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E4FE77DB-DED1-4FF2-A9F9-D9107002C479} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E71734E3-A383-40AD-AAB5-3135F516454E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E77E5FAA-E40C-483A-A9B3-BA90088F8462} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E7D6D179-C9E1-4D45-B948-2B4A5E0BF956} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E82E1106-C77A-444E-B810-64660243CB2F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E839B7D6-1DF9-421E-A7C3-4D366C10697F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E8627D15-6F53-4D6A-BB54-DDE3319CD657} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E903621E-1BB1-461B-A68D-69CA7CBDE72C} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E9B1AB8A-5E14-4A6A-8FCD-0E04E36F2775} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E9C6D548-C6D3-472F-AEAF-B37CEED4A805} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{E9EC288F-02A7-49AF-BA9E-50628F54DC6F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EA0F8310-DE82-4613-85EA-A3DBF7993DAA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EAF2ED4B-F8DC-4DDC-8C81-122B50928E9E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EB79A423-D4DF-41A7-B00D-CFBFA7FE19F8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EBA64CDE-BC7E-4A0C-B779-25B1D419AD1A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EBC0E82E-30ED-4F4D-B7D5-7B091023011B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EBF3CED4-FB3F-40C6-9171-BC8E85FC030B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EC4ACA8A-B889-45B3-B730-E911C5B4D51B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{ECAE38CF-B083-4835-8D1F-581B6D4DE395} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{ECFA4530-8319-4F44-8F1F-D72458DA2594} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{ED28A1A1-C200-43ED-9225-F98F6A6352E1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{ED32F148-7E47-4605-A8E0-6F901E1F55FF} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{ED96FFE3-C99C-4D8F-A9DA-E2C5F05A782F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EE7A2085-C8FA-445E-8C5B-A4AD98FD7020} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EF01DB72-1722-4493-A884-BB7148D6B54B} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EF890DCD-C017-4A93-9570-C451FB001B6E} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EF907B00-7BCB-4AA7-95A1-E9E513FDA4DB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{EFB68452-4F5D-4C49-B853-ED9CCA8F62EA} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F031FB92-6226-4667-BC54-A66489145B2D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F0DC4EDE-8525-4ED6-8923-977808366A35} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F1405B11-EFA1-49B2-A640-845404889AAC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F2314FEC-92AE-4534-815C-1FCF361995D9} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F2718EB1-C302-4493-98BD-370CAC4B8A20} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F2EBA2E5-E252-40B5-B00B-5D4ABB5A8D67} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F34DB31C-1A57-43B9-B759-123BB7DE9C29} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F409907A-4769-4183-818A-981F0547B5B0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F48F046F-D352-472F-86A3-009914CE6612} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F52D6FED-3223-43FA-8637-1C4CDA6452ED} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F56B4B72-C098-45B5-9587-D9238ADF729A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F64675B7-F8F3-4BC0-810B-B6FED0A66072} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F655EAF7-FA2A-425F-B0DC-9E86B5F0A709} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F6B1F23A-498A-491B-B19C-082E474AAA36} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F6B41374-DE15-4D23-A470-52E5B093B7B1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F77B44DA-851F-49B2-B003-B3912F192E6A} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F7D56D50-ADDE-4200-AF20-2D47BD597967} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F8325F9B-9D9D-40C3-825E-B5EB9229EF52} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F841A82A-79E0-4B66-A017-32270ED32889} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F88A11C7-6DBB-4D23-856B-2C83A6207B82} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F89C1380-0572-41BF-9273-76E5FE79F111} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F8CF2C36-3330-4368-A89E-200E72940DB7} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F90FB1ED-AA83-4FFC-A383-576DA6049ACF} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F97E3008-FA7D-43CD-BB6E-40A0B68869A1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F9D5F24A-71C3-4161-A93B-D27A7E2F3F1F} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{F9E55C52-83A7-4A34-8BBF-5FC32D8FEF02} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FA81B099-8DA4-4DF7-85C2-269328684605} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FAD3D274-88DE-4476-A10A-D327F65223F1} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FAF6C6F4-407D-4472-A7E0-7F7DFE3E57D2} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FB0B0A42-38DD-4FAC-9D3E-928A6584F9BD} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FB239F9B-43A8-4AEB-88BF-3901622B16F0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FBA0E52F-9FF3-45B4-84B9-BBB21A214280} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FBB74D60-F4DF-4355-82FF-D91519B6CBCB} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FBC2D1A0-587B-4282-95C5-CD6DA2749A40} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FC9C6448-D451-449E-A031-3F6DF1921BEE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FCE61409-47CC-4EE6-B022-2DBC50DF5930} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FD9B4D57-F440-478A-A496-860858FA72F8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FE774B60-B3BE-46CB-9E8F-D17146E11FE0} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FE9506D1-A584-446A-90DA-87FE15D830AC} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FEBD2391-A532-43EB-B86E-EF41C9E468BE} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FF345A0E-6D03-4049-9099-3234EBE85AE8} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FF609FFB-10E2-47AB-8387-5DE682E59C08} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FF99B9AE-76C4-4028-8320-C83B942C1686} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FFA9BBCE-0410-4B0E-9450-013044799C0D} Successfully deleted: [Empty Folder] C:\Users\george west\appdata\local\{FFD556B6-594C-4CC3-B499-23A67F38C791} ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 31.05.2014 at 18:07:28,97 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02 Ran by george west (administrator) on GEORGEWEST on 31-05-2014 18:20:16 Running from C:\Users\george west\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AMD) C:\Windows\System32\atieclxx.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (NCP engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe (NCP Engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe () C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe () C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (ICQ) C:\Users\george west\AppData\Roaming\ICQM\icq.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe () C:\Program Files (x86)\LANCOM\Advanced VPN Client\NcpBudgetGui.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (NCP engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPMON.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE () C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\reader_sl.exe (Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6468712 2012-03-20] (Realtek Semiconductor) HKLM\...\Run: [Ocs_SM] => C:\Users\george west\AppData\Roaming\OCS\SM\SearchAnonymizer.exe HKLM-x32\...\Run: [NcpBudgetGui] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\NcpBudgetGui.exe [968192 2009-11-05] () HKLM-x32\...\Run: [NcpPopup] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncppopup.exe [578560 2009-11-10] () HKLM-x32\...\Run: [NcpMonitor] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpmon.exe [6587904 2009-11-16] (NCP engineering GmbH) HKLM-x32\...\Run: [NcpRsuGui] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe [819712 2009-10-12] () HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.) HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3888648 2014-05-26] (AVAST Software) HKU\S-1-5-21-1259545048-3289132323-2229452691-1001\...\Run: [ICQ] => C:\Users\george west\AppData\Roaming\ICQM\icq.exe [26606072 2013-01-15] (ICQ) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKCU - {458EE135-7AEF-4DA1-A16A-32ACF72D7767} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {69768234-9577-4522-904D-FA321F28FC62} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {7E123647-C404-4442-8A3D-B0DCFC5A106E} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {8A5D189D-2332-4A4D-B63B-B4581985AF6A} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {A87AB137-614A-4AC2-BE79-E4EDF43E007E} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {D82BEAA4-CF55-4201-B59D-6D86BF5D7D4C} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) FireFox: ======== FF ProfilePath: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default FF SelectedSearchEngine: Google FF Homepage: hxxp://www.t-online.de/ FF NetworkProxy: "backup.ftp", "" FF NetworkProxy: "backup.ftp_port", 0 FF NetworkProxy: "backup.gopher", "" FF NetworkProxy: "backup.gopher_port", 0 FF NetworkProxy: "backup.socks", "" FF NetworkProxy: "backup.socks_port", 0 FF NetworkProxy: "backup.ssl", "" FF NetworkProxy: "backup.ssl_port", 0 FF NetworkProxy: "ftp", "10.3.250.6" FF NetworkProxy: "ftp_port", 3128 FF NetworkProxy: "gopher", "10.3.250.6" FF NetworkProxy: "gopher_port", 3128 FF NetworkProxy: "http", "10.3.250.6" FF NetworkProxy: "http_port", 3128 FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "socks", "10.3.250.6" FF NetworkProxy: "socks_port", 3128 FF NetworkProxy: "ssl", "10.3.250.6" FF NetworkProxy: "ssl_port", 3128 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\{67AD8DB5-2343-4FA8-8D4F-6DF843F9B2F8}.xml FF SearchPlugin: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\{7D9A242B-65E5-43BF-91DC-082CCA0A89E6}.xml FF SearchPlugin: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\{844D149C-DD72-447C-B732-B98E2C0F005A}.xml FF Extension: Microsoft .NET Framework Assistant - C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012-05-31] FF Extension: Adblock Plus Pop-up Addon - C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\Extensions\adblockpopups@jessehakanen.net.xpi [2012-06-22] FF Extension: Adblock Plus - C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-05-31] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-23] FF StartMenuInternet: FIREFOX.EXE - d:\Users\george west\AppData\Local\Mozilla Firefox\firefox.exe Chrome: ======= CHR HomePage: hxxp://www.google.com CHR StartupUrls: "hxxp://www.google.com" CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Extension: (YouTube) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-07-11] CHR Extension: (Google-Suche) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-07-11] CHR Extension: (avast! Online Security) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-10-12] CHR Extension: (Google Wallet) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07] CHR Extension: (Google Mail) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-07-11] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-05-23] ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-09-28] (Advanced Micro Devices, Inc.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-23] (AVAST Software) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 ncpclcfg; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe [86016 2008-06-30] (NCP engineering GmbH) R2 ncprwsnt; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe [1381384 2009-10-27] (NCP Engineering GmbH) R2 NcpSec; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpsec.exe [32768 2008-10-06] () R2 rwsrsu; C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe [819712 2009-10-12] () ==================== Drivers (Whitelisted) ==================== S3 adp3132; C:\Windows\system32\drivers\adp3132.sys [385072 2010-01-28] (Adaptec, Inc.) R0 amdide64; C:\Windows\System32\drivers\amdide64.sys [10632 2007-10-12] (Advanced Micro Devices) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 asahci64; C:\Windows\system32\drivers\asahci64.sys [49760 2012-01-06] (Asmedia Technology) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-23] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-23] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-23] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-23] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-23] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-23] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-23] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-23] () S3 FLxHCIh; C:\Windows\system32\drivers\FLxHCIh.sys [70912 2011-11-04] (Fresco Logic) R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [23832 2011-12-06] (Intel Corporation) S3 iaStorS; C:\Windows\system32\drivers\iaStorS.sys [636184 2011-12-06] (Intel Corporation) S3 ISASerial; C:\Windows\system32\drivers\ISASerial.sys [72192 2008-02-20] (Windows (R) Codename Longhorn DDK provider) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-05-31] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] () S3 MtsHID; C:\Windows\system32\drivers\MtsHID.sys [27664 2009-07-15] (TechniSat Provide) S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [151016 2009-10-08] (NCP Engineering GmbH) R3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [151016 2009-10-08] (NCP Engineering GmbH) S3 nvamacpi; C:\Windows\system32\drivers\NVAMACPI.sys [28192 2009-07-17] (NVIDIA Corporation) S3 nvrd64; C:\Windows\system32\drivers\nvrd64.sys [175648 2009-08-04] (NVIDIA Corporation) S3 PciIsaSerial; C:\Windows\system32\drivers\PciIsaSerial.sys [72192 2008-05-22] (Windows (R) Codename Longhorn DDK provider) S3 PciPPorts; C:\Windows\system32\drivers\PciPPorts.sys [95744 2008-05-22] () S3 PciSPorts; C:\Windows\system32\drivers\PciSPorts.sys [126464 2008-05-22] () S3 PPorts; C:\Windows\system32\drivers\PPorts.sys [95744 2008-02-20] () S3 rusb3hub; C:\Windows\system32\drivers\rusb3hub.sys [102912 2012-03-15] (Renesas Electronics Corporation) S3 rusb3xhc; C:\Windows\system32\drivers\rusb3xhc.sys [220672 2012-03-15] (Renesas Electronics Corporation) S3 Si3124r5; C:\Windows\system32\drivers\Si3124r5.sys [340008 2010-04-13] (Silicon Image, Inc) R0 SiFilter; C:\Windows\System32\drivers\SiWinAcc.sys [22568 2010-04-13] (Silicon Image, Inc.) R0 SiRemFil; C:\Windows\System32\drivers\SiRemFil.sys [16936 2010-04-13] (Silicon Image, Inc.) S3 SPorts; C:\Windows\system32\drivers\SPorts.sys [124416 2008-02-20] () S3 StnPport; C:\Windows\system32\drivers\StnPport.sys [97280 2009-12-17] () S3 StnSport; C:\Windows\system32\drivers\StnSport.sys [126464 2009-11-14] () S3 VUSB3HUB; C:\Windows\system32\drivers\ViaHub3.sys [176640 2011-05-21] (VIA Technologies, Inc.) S3 xhcdrv; C:\Windows\system32\drivers\xhcdrv.sys [230400 2011-05-21] (VIA Technologies, Inc.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 LVPr2M64; system32\DRIVERS\LVPr2M64.sys [X] S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X] S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-05-31 18:19 - 2014-05-31 18:19 - 00005068 _____ () C:\Users\george west\Desktop\AdwCleaner[S0].txt 2014-05-31 18:16 - 2014-05-31 18:16 - 00001161 _____ () C:\Users\george west\Desktop\MBAM.txt 2014-05-31 18:07 - 2014-05-31 18:07 - 00072583 _____ () C:\Users\george west\Desktop\JRT.txt 2014-05-31 17:54 - 2014-05-31 18:17 - 00000000 ____D () C:\AdwCleaner 2014-05-31 17:54 - 2014-05-31 17:54 - 00000000 ____D () C:\Windows\ERUNT 2014-05-31 17:47 - 2014-05-31 18:20 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-31 17:45 - 2014-05-31 17:45 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-31 17:45 - 2014-05-31 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-31 17:45 - 2014-05-31 17:45 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-31 17:45 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-31 17:45 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-31 17:45 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-26 15:06 - 2014-05-26 15:06 - 00026997 _____ () C:\ComboFix.txt 2014-05-26 14:47 - 2014-05-26 15:06 - 00000000 ____D () C:\Qoobox 2014-05-26 14:47 - 2014-05-26 15:04 - 00000000 ____D () C:\Windows\erdnt 2014-05-26 14:47 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-05-26 14:47 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-05-26 14:47 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-05-26 14:46 - 2014-05-26 14:47 - 05200919 ____R (Swearware) C:\Users\george west\Downloads\ComboFix.exe 2014-05-26 14:07 - 2014-05-26 14:07 - 00026629 _____ () C:\Users\george west\Downloads\Addition.txt 2014-05-26 14:05 - 2014-05-31 18:20 - 00019516 _____ () C:\Users\george west\Downloads\FRST.txt 2014-05-26 14:05 - 2014-05-31 18:20 - 00000000 ____D () C:\FRST 2014-05-26 14:03 - 2014-05-26 14:03 - 02066944 _____ (Farbar) C:\Users\george west\Downloads\FRST64.exe 2014-05-23 16:43 - 2014-05-23 16:43 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-05-23 16:43 - 2014-05-23 16:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast 2014-05-23 16:42 - 2014-05-23 16:42 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400856172777 2014-05-23 16:42 - 2014-05-23 16:42 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400856172777 2014-05-23 16:42 - 2014-05-23 16:42 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-05-23 16:42 - 2014-05-23 16:42 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-23 16:35 - 2014-05-23 16:38 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup2018.exe 2014-05-23 16:27 - 2014-05-23 16:30 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup_21514(1).exe 2014-05-23 16:25 - 2014-05-23 16:25 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-05-23 16:16 - 2014-05-23 16:16 - 00519488 _____ (AVAST Software) C:\Users\george west\Downloads\avastclear.exe 2014-05-23 16:13 - 2014-05-23 16:17 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup_21514.exe 2014-05-23 14:38 - 2014-05-23 16:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-23 14:02 - 2014-05-23 14:02 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-23 14:01 - 2014-05-23 14:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\george west\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-05-23 13:59 - 2014-05-23 14:00 - 12742760 _____ (Malwarebytes Corporation ) C:\Users\george west\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-21 13:13 - 2014-05-21 13:13 - 00274832 _____ () C:\Windows\Minidump\052114-15802-01.dmp 2014-05-14 11:14 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-14 11:14 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-14 11:14 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-14 11:14 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-14 11:14 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-14 11:14 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-14 11:02 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-14 11:02 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-14 11:02 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-14 11:02 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-14 11:02 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-14 11:02 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-14 11:02 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-14 11:02 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-14 11:02 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-14 11:02 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-14 11:02 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-14 11:02 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-14 11:02 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-14 11:02 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-14 11:02 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-14 11:02 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-14 11:02 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-14 11:02 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-14 11:02 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-14 11:02 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-06 19:25 - 2014-05-14 18:15 - 00000000 ___SD () C:\Windows\system32\CompatTel ==================== One Month Modified Files and Folders ======= 2014-05-31 18:20 - 2014-05-31 17:47 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-31 18:20 - 2014-05-26 14:05 - 00019516 _____ () C:\Users\george west\Downloads\FRST.txt 2014-05-31 18:20 - 2014-05-26 14:05 - 00000000 ____D () C:\FRST 2014-05-31 18:19 - 2014-05-31 18:19 - 00005068 _____ () C:\Users\george west\Desktop\AdwCleaner[S0].txt 2014-05-31 18:18 - 2012-07-10 17:38 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-05-31 18:18 - 2012-05-31 17:52 - 01230800 _____ () C:\Windows\WindowsUpdate.log 2014-05-31 18:18 - 2010-11-21 05:47 - 00624178 _____ () C:\Windows\PFRO.log 2014-05-31 18:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-31 18:18 - 2009-07-14 06:51 - 00119699 _____ () C:\Windows\setupact.log 2014-05-31 18:17 - 2014-05-31 17:54 - 00000000 ____D () C:\AdwCleaner 2014-05-31 18:16 - 2014-05-31 18:16 - 00001161 _____ () C:\Users\george west\Desktop\MBAM.txt 2014-05-31 18:15 - 2012-05-31 17:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-05-31 18:07 - 2014-05-31 18:07 - 00072583 _____ () C:\Users\george west\Desktop\JRT.txt 2014-05-31 18:00 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-05-31 18:00 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-05-31 17:54 - 2014-05-31 17:54 - 00000000 ____D () C:\Windows\ERUNT 2014-05-31 17:52 - 2012-07-10 17:38 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-05-31 17:46 - 2010-11-21 08:50 - 00699884 _____ () C:\Windows\system32\perfh007.dat 2014-05-31 17:46 - 2010-11-21 08:50 - 00149766 _____ () C:\Windows\system32\perfc007.dat 2014-05-31 17:46 - 2009-07-14 07:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-05-31 17:45 - 2014-05-31 17:45 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-31 17:45 - 2014-05-31 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-31 17:45 - 2014-05-31 17:45 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-31 17:44 - 2013-12-08 13:42 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-05-26 15:06 - 2014-05-26 15:06 - 00026997 _____ () C:\ComboFix.txt 2014-05-26 15:06 - 2014-05-26 14:47 - 00000000 ____D () C:\Qoobox 2014-05-26 15:06 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-05-26 15:04 - 2014-05-26 14:47 - 00000000 ____D () C:\Windows\erdnt 2014-05-26 15:04 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-05-26 14:47 - 2014-05-26 14:46 - 05200919 ____R (Swearware) C:\Users\george west\Downloads\ComboFix.exe 2014-05-26 14:07 - 2014-05-26 14:07 - 00026629 _____ () C:\Users\george west\Downloads\Addition.txt 2014-05-26 14:03 - 2014-05-26 14:03 - 02066944 _____ (Farbar) C:\Users\george west\Downloads\FRST64.exe 2014-05-26 13:10 - 2012-06-01 14:24 - 00000432 _____ () C:\Windows\BRWMARK.INI 2014-05-26 12:11 - 2012-05-31 19:02 - 00000400 _____ () C:\Users\george west\Desktop\PV Anlage.website 2014-05-23 18:52 - 2012-07-10 17:42 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-23 16:43 - 2014-05-23 16:43 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-05-23 16:43 - 2014-05-23 16:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast 2014-05-23 16:43 - 2013-12-08 13:24 - 00000000 ____D () C:\Users\george west\AppData\Roaming\AVAST Software 2014-05-23 16:42 - 2014-05-23 16:42 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400856172777 2014-05-23 16:42 - 2014-05-23 16:42 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400856172777 2014-05-23 16:42 - 2014-05-23 16:42 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-05-23 16:42 - 2014-05-23 16:42 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-23 16:42 - 2014-05-23 14:38 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-23 16:41 - 2013-12-08 13:36 - 00000000 ____D () C:\Program Files\AVAST Software 2014-05-23 16:38 - 2014-05-23 16:35 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup2018.exe 2014-05-23 16:30 - 2014-05-23 16:27 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup_21514(1).exe 2014-05-23 16:25 - 2014-05-23 16:25 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-05-23 16:23 - 2012-05-31 18:11 - 00000000 _____ () C:\Windows\SysWOW64\config.nt 2014-05-23 16:17 - 2014-05-23 16:13 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup_21514.exe 2014-05-23 16:16 - 2014-05-23 16:16 - 00519488 _____ (AVAST Software) C:\Users\george west\Downloads\avastclear.exe 2014-05-23 14:02 - 2014-05-23 14:02 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-23 14:01 - 2014-05-23 14:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\george west\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-05-23 14:00 - 2014-05-23 13:59 - 12742760 _____ (Malwarebytes Corporation ) C:\Users\george west\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-23 13:36 - 2012-05-31 19:02 - 00000505 _____ () C:\Users\george west\Desktop\Solar-Log(TM) WEB Classic 2 (c)2011 Willkommen.website 2014-05-21 13:13 - 2014-05-21 13:13 - 00274832 _____ () C:\Windows\Minidump\052114-15802-01.dmp 2014-05-21 13:13 - 2012-09-08 11:17 - 372408529 _____ () C:\Windows\MEMORY.DMP 2014-05-21 13:13 - 2012-09-08 11:17 - 00000000 ____D () C:\Windows\Minidump 2014-05-17 10:32 - 2014-04-13 17:50 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-05-16 09:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-05-15 19:15 - 2012-05-31 17:53 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-15 19:15 - 2012-05-31 17:53 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-15 19:15 - 2012-05-31 17:53 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 18:17 - 2012-05-31 17:57 - 00000000 ___RD () C:\Users\george west\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-14 18:17 - 2012-05-31 17:57 - 00000000 ___RD () C:\Users\george west\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-14 18:15 - 2014-05-06 19:25 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-14 11:13 - 2013-08-15 12:07 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-14 11:11 - 2012-06-07 19:41 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-12 07:26 - 2014-05-31 17:45 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:26 - 2014-05-31 17:45 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-05-31 17:45 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-09 17:52 - 2013-06-02 13:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2014-05-09 17:45 - 2012-07-10 17:38 - 00004116 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-09 17:45 - 2012-07-10 17:38 - 00003864 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-09 08:14 - 2014-05-14 11:02 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-14 11:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-06 06:40 - 2014-05-14 11:14 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 06:17 - 2014-05-14 11:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 05:25 - 2014-05-14 11:14 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 05:07 - 2014-05-14 11:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 05:00 - 2014-05-14 11:14 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 04:10 - 2014-05-14 11:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll Some content of TEMP: ==================== C:\Users\george west\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-31 17:44 ==================== End Of Log ============================ |
01.06.2014, 14:13 | #6 |
/// the machine /// TB-Ausbilder | Online Banking gesperrt wg. PhishingESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Online Banking gesperrt wg. Phishing |
01.06.2014, 16:25 | #7 |
| Online Banking gesperrt wg. PhishingCode:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7587 # api_version=3.0.2 # EOSSerial=ce7eed0b9ebc0f41a5f900c2401de2c7 # engine=18501 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2014-06-01 03:11:16 # local_time=2014-06-01 05:11:16 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='avast! Antivirus' # compatibility_mode=783 16777213 100 95 4109 779410 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 3618 153265326 0 0 # scanned=173709 # found=1 # cleaned=0 # scan_time=2757 sh=AC97E1EBF0F4C16EC08325D449F23E8F2673C0DA ft=1 fh=77b67014033c3aa0 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\george west\Downloads\ICQ 7.8 Build #6800 Banner Remover 1.0 Setup.exe" Code:
ATTFilter Results of screen317's Security Check version 0.99.83 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus out of date! `````````Anti-malware/Other Utilities Check:````````` Adobe Flash Player 13.0.0.214 Adobe Reader XI Mozilla Firefox 12.0 Firefox out of Date! Mozilla Thunderbird 12.0.1 Thunderbird out of Date! Google Chrome 34.0.1847.137 Google Chrome 35.0.1916.114 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe ESET ESET Online Scanner OnlineScannerApp.exe ESET ESET Online Scanner OnlineCmdLineScanner.exe Malwarebytes Anti-Malware mbamscheduler.exe AVAST Software Avast AvastSvc.exe AVAST Software Avast avastui.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-06-2014 01 Ran by george west (administrator) on GEORGEWEST on 01-06-2014 17:24:22 Running from C:\Users\george west\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AMD) C:\Windows\System32\atieclxx.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (NCP engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe (NCP Engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe () C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE () C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (ICQ) C:\Users\george west\AppData\Roaming\ICQM\icq.exe () C:\Program Files (x86)\LANCOM\Advanced VPN Client\NcpBudgetGui.exe (NCP engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPMON.exe () C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Mozilla Corporation) D:\Users\george west\AppData\Local\Mozilla Firefox\firefox.exe () C:\Users\george west\Downloads\SecurityCheck.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6468712 2012-03-20] (Realtek Semiconductor) HKLM\...\Run: [Ocs_SM] => C:\Users\george west\AppData\Roaming\OCS\SM\SearchAnonymizer.exe HKLM-x32\...\Run: [NcpBudgetGui] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\NcpBudgetGui.exe [968192 2009-11-05] () HKLM-x32\...\Run: [NcpPopup] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncppopup.exe [578560 2009-11-10] () HKLM-x32\...\Run: [NcpMonitor] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpmon.exe [6587904 2009-11-16] (NCP engineering GmbH) HKLM-x32\...\Run: [NcpRsuGui] => C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe [819712 2009-10-12] () HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.) HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3888648 2014-05-26] (AVAST Software) HKU\S-1-5-21-1259545048-3289132323-2229452691-1001\...\Run: [ICQ] => C:\Users\george west\AppData\Roaming\ICQM\icq.exe [26606072 2013-01-15] (ICQ) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKCU - {458EE135-7AEF-4DA1-A16A-32ACF72D7767} URL = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {69768234-9577-4522-904D-FA321F28FC62} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {7E123647-C404-4442-8A3D-B0DCFC5A106E} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {8A5D189D-2332-4A4D-B63B-B4581985AF6A} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {A87AB137-614A-4AC2-BE79-E4EDF43E007E} URL = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 SearchScopes: HKCU - {D82BEAA4-CF55-4201-B59D-6D86BF5D7D4C} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=4496ff3a-0fec-4559-a71e-7f57fcac1181&pid=murb&mode=bounce&k=0 BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Tcpip\Parameters: [DhcpNameServer] 10.3.250.251 FireFox: ======== FF ProfilePath: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default FF SelectedSearchEngine: Google FF Homepage: hxxp://www.t-online.de/ FF NetworkProxy: "backup.ftp", "" FF NetworkProxy: "backup.ftp_port", 0 FF NetworkProxy: "backup.gopher", "" FF NetworkProxy: "backup.gopher_port", 0 FF NetworkProxy: "backup.socks", "" FF NetworkProxy: "backup.socks_port", 0 FF NetworkProxy: "backup.ssl", "" FF NetworkProxy: "backup.ssl_port", 0 FF NetworkProxy: "ftp", "10.3.250.6" FF NetworkProxy: "ftp_port", 3128 FF NetworkProxy: "gopher", "10.3.250.6" FF NetworkProxy: "gopher_port", 3128 FF NetworkProxy: "http", "10.3.250.6" FF NetworkProxy: "http_port", 3128 FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "socks", "10.3.250.6" FF NetworkProxy: "socks_port", 3128 FF NetworkProxy: "ssl", "10.3.250.6" FF NetworkProxy: "ssl_port", 3128 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\{67AD8DB5-2343-4FA8-8D4F-6DF843F9B2F8}.xml FF SearchPlugin: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\{7D9A242B-65E5-43BF-91DC-082CCA0A89E6}.xml FF SearchPlugin: C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\searchplugins\{844D149C-DD72-447C-B732-B98E2C0F005A}.xml FF Extension: No Name - C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\Extensions\staged [2014-06-01] FF Extension: Microsoft .NET Framework Assistant - C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012-05-31] FF Extension: Adblock Plus Pop-up Addon - C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\Extensions\adblockpopups@jessehakanen.net.xpi [2012-06-22] FF Extension: Adblock Plus - C:\Users\george west\AppData\Roaming\Mozilla\Firefox\Profiles\0bx817nw.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-05-31] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-23] FF StartMenuInternet: FIREFOX.EXE - d:\Users\george west\AppData\Local\Mozilla Firefox\firefox.exe Chrome: ======= CHR HomePage: hxxp://www.google.com CHR StartupUrls: "hxxp://www.google.com" CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Extension: (YouTube) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-07-11] CHR Extension: (Google-Suche) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-07-11] CHR Extension: (avast! Online Security) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-10-12] CHR Extension: (Google Wallet) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07] CHR Extension: (Google Mail) - C:\Users\george west\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-07-11] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-05-23] ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-09-28] (Advanced Micro Devices, Inc.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-23] (AVAST Software) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 ncpclcfg; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe [86016 2008-06-30] (NCP engineering GmbH) R2 ncprwsnt; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe [1381384 2009-10-27] (NCP Engineering GmbH) R2 NcpSec; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpsec.exe [32768 2008-10-06] () R2 rwsrsu; C:\Program Files (x86)\LANCOM\Advanced VPN Client\rwsrsu.exe [819712 2009-10-12] () ==================== Drivers (Whitelisted) ==================== S3 adp3132; C:\Windows\system32\drivers\adp3132.sys [385072 2010-01-28] (Adaptec, Inc.) R0 amdide64; C:\Windows\System32\drivers\amdide64.sys [10632 2007-10-12] (Advanced Micro Devices) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 asahci64; C:\Windows\system32\drivers\asahci64.sys [49760 2012-01-06] (Asmedia Technology) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-23] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-23] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-23] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-23] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-23] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-23] (AVAST Software) S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-23] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-23] () S3 FLxHCIh; C:\Windows\system32\drivers\FLxHCIh.sys [70912 2011-11-04] (Fresco Logic) R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [23832 2011-12-06] (Intel Corporation) S3 iaStorS; C:\Windows\system32\drivers\iaStorS.sys [636184 2011-12-06] (Intel Corporation) S3 ISASerial; C:\Windows\system32\drivers\ISASerial.sys [72192 2008-02-20] (Windows (R) Codename Longhorn DDK provider) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-01] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] () S3 MtsHID; C:\Windows\system32\drivers\MtsHID.sys [27664 2009-07-15] (TechniSat Provide) S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [151016 2009-10-08] (NCP Engineering GmbH) R3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [151016 2009-10-08] (NCP Engineering GmbH) S3 nvamacpi; C:\Windows\system32\drivers\NVAMACPI.sys [28192 2009-07-17] (NVIDIA Corporation) S3 nvrd64; C:\Windows\system32\drivers\nvrd64.sys [175648 2009-08-04] (NVIDIA Corporation) S3 PciIsaSerial; C:\Windows\system32\drivers\PciIsaSerial.sys [72192 2008-05-22] (Windows (R) Codename Longhorn DDK provider) S3 PciPPorts; C:\Windows\system32\drivers\PciPPorts.sys [95744 2008-05-22] () S3 PciSPorts; C:\Windows\system32\drivers\PciSPorts.sys [126464 2008-05-22] () S3 PPorts; C:\Windows\system32\drivers\PPorts.sys [95744 2008-02-20] () S3 rusb3hub; C:\Windows\system32\drivers\rusb3hub.sys [102912 2012-03-15] (Renesas Electronics Corporation) S3 rusb3xhc; C:\Windows\system32\drivers\rusb3xhc.sys [220672 2012-03-15] (Renesas Electronics Corporation) S3 Si3124r5; C:\Windows\system32\drivers\Si3124r5.sys [340008 2010-04-13] (Silicon Image, Inc) R0 SiFilter; C:\Windows\System32\drivers\SiWinAcc.sys [22568 2010-04-13] (Silicon Image, Inc.) R0 SiRemFil; C:\Windows\System32\drivers\SiRemFil.sys [16936 2010-04-13] (Silicon Image, Inc.) S3 SPorts; C:\Windows\system32\drivers\SPorts.sys [124416 2008-02-20] () S3 StnPport; C:\Windows\system32\drivers\StnPport.sys [97280 2009-12-17] () S3 StnSport; C:\Windows\system32\drivers\StnSport.sys [126464 2009-11-14] () S3 VUSB3HUB; C:\Windows\system32\drivers\ViaHub3.sys [176640 2011-05-21] (VIA Technologies, Inc.) S3 xhcdrv; C:\Windows\system32\drivers\xhcdrv.sys [230400 2011-05-21] (VIA Technologies, Inc.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 LVPr2M64; system32\DRIVERS\LVPr2M64.sys [X] S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X] S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-01 17:24 - 2014-06-01 17:24 - 00000000 ____D () C:\Users\george west\Downloads\FRST-OlderVersion 2014-06-01 17:18 - 2014-06-01 17:18 - 00854367 _____ () C:\Users\george west\Downloads\SecurityCheck.exe 2014-06-01 16:06 - 2014-06-01 16:06 - 02347384 _____ (ESET) C:\Users\george west\Downloads\esetsmartinstaller_deu.exe 2014-05-31 18:19 - 2014-05-31 18:19 - 00005068 _____ () C:\Users\george west\Desktop\AdwCleaner[S0].txt 2014-05-31 18:16 - 2014-05-31 18:16 - 00001161 _____ () C:\Users\george west\Desktop\MBAM.txt 2014-05-31 18:07 - 2014-05-31 18:07 - 00072583 _____ () C:\Users\george west\Desktop\JRT.txt 2014-05-31 17:54 - 2014-05-31 18:17 - 00000000 ____D () C:\AdwCleaner 2014-05-31 17:54 - 2014-05-31 17:54 - 00000000 ____D () C:\Windows\ERUNT 2014-05-31 17:47 - 2014-06-01 16:38 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-31 17:45 - 2014-05-31 17:45 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-31 17:45 - 2014-05-31 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-31 17:45 - 2014-05-31 17:45 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-31 17:45 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-31 17:45 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-31 17:45 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-26 15:06 - 2014-05-26 15:06 - 00026997 _____ () C:\ComboFix.txt 2014-05-26 15:06 - 2014-05-26 15:06 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-05-26 15:06 - 2014-05-26 15:06 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-05-26 15:06 - 2014-05-26 15:06 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-05-26 14:47 - 2014-05-26 15:06 - 00000000 ____D () C:\Qoobox 2014-05-26 14:47 - 2014-05-26 15:04 - 00000000 ____D () C:\Windows\erdnt 2014-05-26 14:47 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-05-26 14:47 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-05-26 14:47 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-05-26 14:47 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-05-26 14:46 - 2014-05-26 14:47 - 05200919 ____R (Swearware) C:\Users\george west\Downloads\ComboFix.exe 2014-05-26 14:07 - 2014-05-26 14:07 - 00026629 _____ () C:\Users\george west\Downloads\Addition.txt 2014-05-26 14:05 - 2014-06-01 17:24 - 00019794 _____ () C:\Users\george west\Downloads\FRST.txt 2014-05-26 14:05 - 2014-06-01 17:24 - 00000000 ____D () C:\FRST 2014-05-26 14:03 - 2014-06-01 17:24 - 02067456 _____ (Farbar) C:\Users\george west\Downloads\FRST64.exe 2014-05-23 16:43 - 2014-05-23 16:43 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-05-23 16:43 - 2014-05-23 16:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast 2014-05-23 16:42 - 2014-05-23 16:42 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400856172777 2014-05-23 16:42 - 2014-05-23 16:42 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400856172777 2014-05-23 16:42 - 2014-05-23 16:42 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-05-23 16:42 - 2014-05-23 16:42 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-23 16:35 - 2014-05-23 16:38 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup2018.exe 2014-05-23 16:27 - 2014-05-23 16:30 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup_21514(1).exe 2014-05-23 16:25 - 2014-05-23 16:25 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-05-23 16:16 - 2014-05-23 16:16 - 00519488 _____ (AVAST Software) C:\Users\george west\Downloads\avastclear.exe 2014-05-23 16:13 - 2014-05-23 16:17 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup_21514.exe 2014-05-23 14:38 - 2014-05-23 16:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-23 14:02 - 2014-05-23 14:02 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-23 14:01 - 2014-05-23 14:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\george west\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-05-23 13:59 - 2014-05-23 14:00 - 12742760 _____ (Malwarebytes Corporation ) C:\Users\george west\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-21 13:13 - 2014-05-21 13:13 - 00274832 _____ () C:\Windows\Minidump\052114-15802-01.dmp 2014-05-14 11:14 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-14 11:14 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-14 11:14 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-14 11:14 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-14 11:14 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-14 11:14 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-14 11:02 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-14 11:02 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-14 11:02 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-14 11:02 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-14 11:02 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-14 11:02 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-14 11:02 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-14 11:02 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-14 11:02 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-14 11:02 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-14 11:02 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-14 11:02 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-14 11:02 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-14 11:02 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-14 11:02 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-14 11:02 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-14 11:02 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-14 11:02 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-14 11:02 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-14 11:02 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-14 11:02 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-14 11:02 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-14 11:02 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-06 19:25 - 2014-05-14 18:15 - 00000000 ___SD () C:\Windows\system32\CompatTel ==================== One Month Modified Files and Folders ======= 2014-06-01 17:24 - 2014-06-01 17:24 - 00000000 ____D () C:\Users\george west\Downloads\FRST-OlderVersion 2014-06-01 17:24 - 2014-05-26 14:05 - 00019794 _____ () C:\Users\george west\Downloads\FRST.txt 2014-06-01 17:24 - 2014-05-26 14:05 - 00000000 ____D () C:\FRST 2014-06-01 17:24 - 2014-05-26 14:03 - 02067456 _____ (Farbar) C:\Users\george west\Downloads\FRST64.exe 2014-06-01 17:24 - 2012-05-31 17:55 - 00000000 ____D () C:\Users\george west\AppData\Local\Temp 2014-06-01 17:18 - 2014-06-01 17:18 - 00854367 _____ () C:\Users\george west\Downloads\SecurityCheck.exe 2014-06-01 17:15 - 2012-05-31 17:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-01 16:50 - 2012-07-10 17:38 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-01 16:38 - 2014-05-31 17:47 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-01 16:12 - 2012-05-31 17:52 - 01266908 _____ () C:\Windows\WindowsUpdate.log 2014-06-01 16:11 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-01 16:11 - 2009-07-14 06:45 - 00021664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-01 16:06 - 2014-06-01 16:06 - 02347384 _____ (ESET) C:\Users\george west\Downloads\esetsmartinstaller_deu.exe 2014-06-01 16:03 - 2013-12-08 13:42 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-06-01 16:03 - 2012-07-10 17:38 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-01 16:02 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-01 16:02 - 2009-07-14 06:51 - 00119755 _____ () C:\Windows\setupact.log 2014-05-31 18:19 - 2014-05-31 18:19 - 00005068 _____ () C:\Users\george west\Desktop\AdwCleaner[S0].txt 2014-05-31 18:18 - 2010-11-21 05:47 - 00624178 _____ () C:\Windows\PFRO.log 2014-05-31 18:17 - 2014-05-31 17:54 - 00000000 ____D () C:\AdwCleaner 2014-05-31 18:16 - 2014-05-31 18:16 - 00001161 _____ () C:\Users\george west\Desktop\MBAM.txt 2014-05-31 18:07 - 2014-05-31 18:07 - 00072583 _____ () C:\Users\george west\Desktop\JRT.txt 2014-05-31 17:54 - 2014-05-31 17:54 - 00000000 ____D () C:\Windows\ERUNT 2014-05-31 17:46 - 2010-11-21 08:50 - 00699884 _____ () C:\Windows\system32\perfh007.dat 2014-05-31 17:46 - 2010-11-21 08:50 - 00149766 _____ () C:\Windows\system32\perfc007.dat 2014-05-31 17:46 - 2009-07-14 07:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-05-31 17:45 - 2014-05-31 17:45 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-31 17:45 - 2014-05-31 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-31 17:45 - 2014-05-31 17:45 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-26 15:06 - 2014-05-26 15:06 - 00026997 _____ () C:\ComboFix.txt 2014-05-26 15:06 - 2014-05-26 15:06 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-05-26 15:06 - 2014-05-26 15:06 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-05-26 15:06 - 2014-05-26 15:06 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-05-26 15:06 - 2014-05-26 14:47 - 00000000 ____D () C:\Qoobox 2014-05-26 15:06 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-05-26 15:04 - 2014-05-26 14:47 - 00000000 ____D () C:\Windows\erdnt 2014-05-26 15:04 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-05-26 14:47 - 2014-05-26 14:46 - 05200919 ____R (Swearware) C:\Users\george west\Downloads\ComboFix.exe 2014-05-26 14:07 - 2014-05-26 14:07 - 00026629 _____ () C:\Users\george west\Downloads\Addition.txt 2014-05-26 13:10 - 2012-06-01 14:24 - 00000432 _____ () C:\Windows\BRWMARK.INI 2014-05-26 12:11 - 2012-05-31 19:02 - 00000400 _____ () C:\Users\george west\Desktop\PV Anlage.website 2014-05-23 18:52 - 2012-07-10 17:42 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-05-23 16:43 - 2014-05-23 16:43 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-05-23 16:43 - 2014-05-23 16:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast 2014-05-23 16:43 - 2013-12-08 13:24 - 00000000 ____D () C:\Users\george west\AppData\Roaming\AVAST Software 2014-05-23 16:42 - 2014-05-23 16:42 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400856172777 2014-05-23 16:42 - 2014-05-23 16:42 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400856172777 2014-05-23 16:42 - 2014-05-23 16:42 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-05-23 16:42 - 2014-05-23 16:42 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-05-23 16:42 - 2014-05-23 16:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-05-23 16:42 - 2014-05-23 14:38 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-05-23 16:41 - 2013-12-08 13:36 - 00000000 ____D () C:\Program Files\AVAST Software 2014-05-23 16:38 - 2014-05-23 16:35 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup2018.exe 2014-05-23 16:30 - 2014-05-23 16:27 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup_21514(1).exe 2014-05-23 16:25 - 2014-05-23 16:25 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-05-23 16:23 - 2012-05-31 18:11 - 00000000 _____ () C:\Windows\SysWOW64\config.nt 2014-05-23 16:17 - 2014-05-23 16:13 - 94714880 _____ (AVAST Software) C:\Users\george west\Downloads\avast_free_antivirus_setup_21514.exe 2014-05-23 16:16 - 2014-05-23 16:16 - 00519488 _____ (AVAST Software) C:\Users\george west\Downloads\avastclear.exe 2014-05-23 14:02 - 2014-05-23 14:02 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-23 14:01 - 2014-05-23 14:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\george west\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-05-23 14:00 - 2014-05-23 13:59 - 12742760 _____ (Malwarebytes Corporation ) C:\Users\george west\Downloads\mbam-setup-2.0.2.1012.exe 2014-05-23 13:36 - 2012-05-31 19:02 - 00000505 _____ () C:\Users\george west\Desktop\Solar-Log(TM) WEB Classic 2 (c)2011 Willkommen.website 2014-05-21 13:13 - 2014-05-21 13:13 - 00274832 _____ () C:\Windows\Minidump\052114-15802-01.dmp 2014-05-21 13:13 - 2012-09-08 11:17 - 372408529 _____ () C:\Windows\MEMORY.DMP 2014-05-21 13:13 - 2012-09-08 11:17 - 00000000 ____D () C:\Windows\Minidump 2014-05-17 10:32 - 2014-04-13 17:50 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-05-16 09:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-05-15 19:15 - 2012-05-31 17:53 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-15 19:15 - 2012-05-31 17:53 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-15 19:15 - 2012-05-31 17:53 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-14 18:17 - 2012-05-31 17:57 - 00000000 ___RD () C:\Users\george west\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-14 18:17 - 2012-05-31 17:57 - 00000000 ___RD () C:\Users\george west\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-14 18:15 - 2014-05-06 19:25 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-14 11:13 - 2013-08-15 12:07 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-14 11:11 - 2012-06-07 19:41 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-12 07:26 - 2014-05-31 17:45 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:26 - 2014-05-31 17:45 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-05-31 17:45 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-09 17:52 - 2013-06-02 13:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2014-05-09 17:45 - 2012-07-10 17:38 - 00004116 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-05-09 17:45 - 2012-07-10 17:38 - 00003864 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-05-09 08:14 - 2014-05-14 11:02 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-14 11:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-06 06:40 - 2014-05-14 11:14 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 06:17 - 2014-05-14 11:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 05:25 - 2014-05-14 11:14 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 05:07 - 2014-05-14 11:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 05:00 - 2014-05-14 11:14 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 04:10 - 2014-05-14 11:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll Some content of TEMP: ==================== C:\Users\george west\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-31 17:44 ==================== End Of Log ============================ |
02.06.2014, 12:22 | #8 |
/// the machine /// TB-Ausbilder | Online Banking gesperrt wg. Phishing Firefox und Thunderbird updaten. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
04.06.2014, 09:38 | #9 |
| Online Banking gesperrt wg. Phishing Hi, vielen Dank für die Hilfe. Aber warum im Scan von SecurityCheck den Firefox out of date anzeigt, verstehe ich nicht, denn es ist die Version 29.0.1 installiert. Avast leuchtet mir noch ein, da ich den Virenscanner für die Aktion deaktiviert habe. Thunderbird wird nicht mehr genutzt, daher auch nicht up to date, logisch. Gruß |
05.06.2014, 09:07 | #10 |
/// the machine /// TB-Ausbilder | Online Banking gesperrt wg. Phishing Fehlanzeige von Securitycheck
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Online Banking gesperrt wg. Phishing |
.dll, administrator, adobe, antivirus, association, avast, bingbar, branding, defender, error, explorer, fehler, firefox, flash player, gesperrt, google, home, homepage, ip-hilfsdienst, mozilla, phishing, realtek, registry, rundll, scan, security, software, system, windows |