|
Log-Analyse und Auswertung: Windows 7: Werbung überall und Tabs öffnen sich von selbstWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.07.2014, 05:32 | #1 |
| Windows 7: Werbung überall und Tabs öffnen sich von selbst Hallo! Also ich habe folgendes Problem: Seit ein paar Tagen öffnen sich sowohl im Chrome-Browser als auch im Firefox-Browser ungefragt Tabs, die sich zum Einen auf das beziehen, was ich in dem Moment im Internet mache (z.B. such ich nach Musik und es kommt Werbung im neuen Tab für irgendwelche Updates von Flashplayern zum Anhören der Musik) zum Anderen immer wieder die gleiche Seite mit Werbung. Da ich oft auf Youtube bin sind dort viele Banner mit Werbung für ein neues Java-Update und ich werde ganz oft wenn ich mir ein Video anschauen will auf eine neue Seite geschickt, die mir angibt, ein neues Java-Update herunterladen zu müssen. Der Link wäre: hxxp://www.sheliminder.com/DE/?dv1=show5&dv2=&dv3=&dv4=mariRM-DE&sec_id=qWJ8vBQjIEzEzreaqZipDn7pCZO6Y3RmIaRmqldR7kOaNrCuC3i8fAvrNAs8hnoQzA8KNasK7aV%EB&marketing_fid=MTQwNDk2NjUwMi0zNjBkNTgxNzAxYjNmYjc5ZWY0YTQ5Y2E 2NGFlN2ZjZA== Habe die Log-Files sowie zwei Logs meines Viren-Scanners bereit liegen. Ich hoffe ihr könnt mir helfen ;-) Mfg T_Tech |
10.07.2014, 07:10 | #2 |
/// the machine /// TB-Ausbilder | Windows 7: Werbung überall und Tabs öffnen sich von selbst hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
10.07.2014, 07:20 | #3 |
| Windows 7: Werbung überall und Tabs öffnen sich von selbst FRST.txt
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-07-2014 Ran by Timmi (administrator) on TIM-PC on 10-07-2014 05:55:53 Running from C:\Users\Timmi\Desktop Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe (Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Hi-Rez Studios) C:\Program Files\Hi-Rez Studios\HiPatchService.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe (ClientConnect Ltd.) C:\Program Files\Tbccint\ToolbarService\ToolbarService.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (FNet Co., Ltd.) C:\Program Files\XFastUsb\XFastUsb.exe (Creative Technology Ltd) C:\Program Files\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe (Creative Technology Ltd) C:\Program Files\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe () C:\Program Files\Pando Networks\Media Booster\PMB.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Smartbar) C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.exe () C:\Users\Timmi\AppData\Roaming\InetStat\inetstat.exe () C:\Users\Timmi\AppData\Local\hccwqz.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin (Macrovision Europe Ltd.) C:\Users\Timmi\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001 (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Aztec Media Inc) C:\Program Files\Settings Manager\systemk\SystemkService.exe (Aztec Media Inc) C:\Program Files\Settings Manager\systemk\SystemkService.exe (Aztec Media Inc) C:\Program Files\Settings Manager\systemk\systemku.exe (Creative Labs) C:\Program Files\Common Files\Creative Labs Shared\Service\XMBLicensing.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (PortableApps.com) C:\Users\Timmi\Documents\Firefox Browser\FirefoxPortable.exe (Mozilla Corporation) C:\Users\Timmi\Documents\Firefox Browser\App\Firefox\firefox.exe (Mozilla Corporation) C:\Users\Timmi\Documents\Firefox Browser\App\Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9742952 2010-10-05] (Realtek Semiconductor) HKLM\...\Run: [XFastUsb] => C:\Program Files\XFastUsb\XFastUsb.exe [4942336 2012-10-03] (FNet Co., Ltd.) HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated) HKLM\...\Run: [CTSyncService] => C:\Program Files\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe [1233195 2009-07-08] (Creative Technology Ltd) HKLM\...\Run: [VolPanel] => C:\Program Files\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd) HKLM\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.) HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\AmbRunE.dll [14848 2009-02-26] (Creative Technology Ltd.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-01-26] (Advanced Micro Devices, Inc.) HKLM\...\Run: [DATAMNGR] => C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation) HKLM\...\Run: [fst_de_78] => [X] HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-03-21] (Microsoft Corporation) HKU\S-1-5-21-1715000752-643566925-54856787-1001\...\Run: [ASRockXTU] => [X] HKU\S-1-5-21-1715000752-643566925-54856787-1001\...\Run: [zASRockInstantBoot] => [X] HKU\S-1-5-21-1715000752-643566925-54856787-1001\...\Run: [Pando Media Booster] => C:\Program Files\Pando Networks\Media Booster\PMB.exe [3093624 2012-11-29] () HKU\S-1-5-21-1715000752-643566925-54856787-1001\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [17877168 2012-11-09] (Skype Technologies S.A.) HKU\S-1-5-21-1715000752-643566925-54856787-1001\...\Run: [Browser Infrastructure Helper] => C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.exe [28952 2014-06-11] (Smartbar) HKU\S-1-5-21-1715000752-643566925-54856787-1001\...\Run: [InetStat] => C:\Users\Timmi\AppData\Roaming\InetStat\inetstat.exe [1259488 2014-07-03] () HKU\S-1-5-21-1715000752-643566925-54856787-1001\...\Run: [BackgroundContainerV2] => "C:\Windows\system32\Rundll32.exe" "C:\Users\Timmi\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun HKU\S-1-5-21-1715000752-643566925-54856787-1001\...\MountPoints2: E - E:\LaunchU3.exe -a HKU\S-1-5-21-1715000752-643566925-54856787-1001\...\MountPoints2: {88779af5-1399-11e2-9dfa-0009dd50921b} - E:\LaunchU3.exe -a IFEO\bitguard.exe: [Debugger] tasklist.exe IFEO\bprotect.exe: [Debugger] tasklist.exe IFEO\bpsvc.exe: [Debugger] tasklist.exe IFEO\browserdefender.exe: [Debugger] tasklist.exe IFEO\browserprotect.exe: [Debugger] tasklist.exe IFEO\browsersafeguard.exe: [Debugger] tasklist.exe IFEO\dprotectsvc.exe: [Debugger] tasklist.exe IFEO\jumpflip: [Debugger] tasklist.exe IFEO\protectedsearch.exe: [Debugger] tasklist.exe IFEO\searchinstaller.exe: [Debugger] tasklist.exe IFEO\searchprotection.exe: [Debugger] tasklist.exe IFEO\searchprotector.exe: [Debugger] tasklist.exe IFEO\searchsettings.exe: [Debugger] tasklist.exe IFEO\searchsettings64.exe: [Debugger] tasklist.exe IFEO\snapdo.exe: [Debugger] tasklist.exe IFEO\stinst32.exe: [Debugger] tasklist.exe IFEO\stinst64.exe: [Debugger] tasklist.exe IFEO\umbrella.exe: [Debugger] tasklist.exe IFEO\utiljumpflip.exe: [Debugger] tasklist.exe IFEO\volaro: [Debugger] tasklist.exe IFEO\vonteera: [Debugger] tasklist.exe IFEO\websteroids.exe: [Debugger] tasklist.exe IFEO\websteroidsservice.exe: [Debugger] tasklist.exe Startup: C:\Users\Timmi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () Startup: C:\Users\Timmi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hccwqz.lnk ShortcutTarget: hccwqz.lnk -> C:\Users\Timmi\AppData\Local\hccwqz.exe () Startup: C:\Users\Timmi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () HKLM\...\AppCertDlls: [x64] -> c:\program files\settings manager\systemk\x64\sysapcrt.dll HKLM\...\AppCertDlls: [x86] -> c:\program files\settings manager\systemk\sysapcrt.dll [489488 2014-07-09] () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAaunXoZgE5PjtiMDHhI2DK1Lv4UT8GdCTvmBxy0AFIas9JQyB68hZ4yWRPr-xoIg_U1ETgBZIIhvF8aMzL8ig_vbGCWfo2TPC116f8G5i2L6EsH2cRGZryNJNVPb1wVi2m5CxnfrAkfJxDxtxsURfbZlfSO7a-Bv0xaoA,,&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.default-search.net?sid=476&aid=164&itype=a&ver=13337&tm=351&src=hmp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFA7FE944CDA3CD01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www2.delta-search.com/?affID=121562&tt=gc_&babsrc=HP_ss&mntrId=22C3BC5FF40F2D2A HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAaunXoZgE5PjtiMDHhI2DK1Lv4UT8GdCTvmBxy0AFIas9JQyB68hZ4yWRPr-xoIg_U1ETgBZIIhvF8aMzL8ig_vbGCWfo2TPC116f8G5i2L6EsH2cRGZryNJNVPb1wVi2m5CxnfrAkfJxDxtxsURfbZlfSO7a-Bv0xaoA,,&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1&q={searchTerms} URLSearchHook: HKLM - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Timmi\AppData\LocalLow\DVDVideoSoftTB_DE\prxtbDVD2.dll (ClientConnect Ltd.) StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1 SearchScopes: HKLM - DefaultScope {AA25CD1D-CF3E-4BB9-B107-1555D22FDE08} URL = SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=adacc75c-f70f-6b6d-6a6e-2551e9e9b9c4&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=05/02/2014&type=hp1000 SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1&q={searchTerms} SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=164&itype=a&ver=13337&tm=351&src=ds&p={searchTerms} SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1&q={searchTerms} SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAaunXoZgE5PjtiMDHhI2DK1Lv4UT8GdCTvmBxy0AFIas9JQyB68hZ4yWRPr-xoIg_U1ETgBZIIhvF8aMzL8ig_vbGCWfo2TPC116f8G5i2L6EsH2cRGZryNJNVPb1wVi2m5CxnfrAkfJxDxtxsURfbZlfSO7a-Bv0xaoA,,&q={searchTerms} SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1&q={searchTerms} SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=164&itype=a&ver=13337&tm=351&src=ds&p={searchTerms} SearchScopes: HKCU - {AA25CD1D-CF3E-4BB9-B107-1555D22FDE08} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848 SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = BHO: DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Timmi\AppData\LocalLow\DVDVideoSoftTB_DE\prxtbDVD2.dll (ClientConnect Ltd.) BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Yahoo Community Smartbar (by Linkury)Engine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\SupTab\SupTab.dll (Thinknice Co. Limited) BHO: Search-Results Toolbar - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\PROGRA~1\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll No File BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation) BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: CostMin - {95F5878C-1592-2F84-261E-9B16EB0FE0A4} - C:\Program Files\CostMin\ikjnv9Q3.dll () BHO: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files\Delta\delta\1.8.16.16\bh\delta.dll No File BHO: DataMngr - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - C:\PROGRA~1\SEARCH~1\Datamngr\BROWSE~1.DLL No File BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: FlowSurf - {E3F1CA13-EA0E-4617-8D03-3EAA6A94A7E0} - C:\Program Files\Flowsurf\FlowSurf.dll (FlowSurf Inc.) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation) Toolbar: HKLM - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Users\Timmi\AppData\LocalLow\DVDVideoSoftTB_DE\prxtbDVD2.dll (ClientConnect Ltd.) Toolbar: HKLM - Search-Results Toolbar - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\PROGRA~1\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll No File Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - DVDVideoSoftTB DE Toolbar - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - C:\Users\Timmi\AppData\LocalLow\DVDVideoSoftTB_DE\prxtbDVD2.dll (ClientConnect Ltd.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin: @java.com/DTPlugin,version=10.60.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin: @staging.google.com/globalUpdate Update;version=10 - C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate) FF Plugin: @staging.google.com/globalUpdate Update;version=4 - C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn FF Extension: Symantec IPS - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn [2012-10-03] FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2 FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2 [2014-07-10] Chrome: ======= CHR HomePage: hxxp://www.default-search.net?sid=476&aid=164&itype=a&ver=13337&tm=351&src=hmp CHR StartupUrls: "hxxp://www.google.de/" CHR DefaultSearchKeyword: default-search.net CHR DefaultSearchProvider: default-search.net CHR DefaultSearchURL: hxxp://www.default-search.net/search?sid=476&aid=164&itype=a&ver=12627&tm=351&src=ds&p={searchTerms} CHR DefaultNewTabURL: CHR Plugin: (Shockwave Flash) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - F:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll () CHR Plugin: (Wajam) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24_0\plugins/PriamNPAPI.dll No File CHR Plugin: (Adobe Acrobat) - F:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.170.4) - F:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll No File CHR Plugin: (2007 Microsoft Office system) - F:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL No File CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File CHR Plugin: (Winamp Application Detector) - F:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npdrmv2.dll No File CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npwmsdrm.dll No File CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - F:\Program Files\Windows Media Player\npdsplay.dll No File CHR Plugin: (Google Update) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (Google Earth Plugin) - F:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File CHR Plugin: (Panda ActiveScan 2.0) - F:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll No File CHR Plugin: (iTunes Application Detector) - F:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File CHR Plugin: (Ma-Config.com plugin) - F:\Program Files\ma-config.com\nphardwaredetection.dll No File CHR Plugin: (Silverlight Plug-In) - f:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Extension: (Google Wallet) - C:\Users\Timmi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-20] CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe hxxp://istart.webssearches.com/?type=sc&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1 ========================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [284672 2011-01-26] (Advanced Micro Devices, Inc.) [File not signed] R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [140224 2010-06-17] (Advanced Micro Devices) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG) S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2012-10-03] (Creative Labs) [File not signed] S3 Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2012-10-03] (Creative Labs) [File not signed] R2 CTAudSvcService; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed] S2 globalUpdate; C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2014-05-18] (globalUpdate) [File not signed] S3 globalUpdatem; C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2014-05-18] (globalUpdate) [File not signed] U2 HiPatchService; C:\Program Files\Hi-Rez Studios\HiPatchService.exe [9216 2014-01-05] (Hi-Rez Studios) [File not signed] R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [762192 2013-07-18] (Nero AG) R2 NIS; C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation) R3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2012-10-03] (Creative Labs) [File not signed] R2 SystemkService; C:\Program Files\Settings Manager\systemk\SystemkService.exe [3572240 2014-07-09] (Aztec Media Inc) R2 TBSrv; C:\Program Files\Tbccint\ToolbarService\ToolbarService.exe [350496 2014-03-26] (ClientConnect Ltd.) R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [535936 2014-07-03] (Fuyu LIMITED) ==================== Drivers (Whitelisted) ==================== R1 AsrAppCharger; C:\Windows\System32\DRIVERS\AsrAppCharger.sys [13832 2010-06-11] (Windows (R) Win 7 DDK provider) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-06-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-22] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG) R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx86.sys [692272 2010-08-09] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [371248 2010-08-13] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [102448 2010-08-13] (Symantec Corporation) R3 EtronHub3; C:\Windows\System32\Drivers\EtronHub3.sys [32384 2011-02-08] (Etron Technology Inc) R3 EtronXHCI; C:\Windows\System32\Drivers\EtronXHCI.sys [52352 2011-02-08] (Etron Technology Inc) S3 FNETTBOH_305; C:\Windows\System32\drivers\FNETTBOH_305.SYS [29248 2012-10-11] (FNet Co., Ltd.) R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [14656 2012-10-03] (FNet Co., Ltd.) R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVix86.sys [344112 2010-06-27] (Symantec Corporation) S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\NAVENG.SYS [85424 2010-08-13] (Symantec Corporation) S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100813.009\NAVEX15.SYS [1362608 2010-08-13] (Symantec Corporation) S3 SRTSP; C:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS [516216 2011-03-31] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS [50168 2011-03-31] (Symantec Corporation) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) R0 SymDS; C:\Windows\System32\drivers\NIS\1207020.003\SYMDS.SYS [340088 2011-01-27] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NIS\1207020.003\SYMEFA.SYS [744568 2011-03-15] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [126584 2012-10-04] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS [136312 2011-01-27] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS [299640 2011-04-21] (Symantec Corporation) S3 WinRing0_1_2_0; C:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys [14416 2010-11-01] (OpenLibSys.org) R1 {0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw; C:\Windows\System32\drivers\{0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw.sys [52920 2014-07-04] (StdLib) R1 F06DEFF2-5B9C-490D-910F-35D3A91196222; \??\C:\Program Files\Settings Manager\systemk\systemkmgrc1.cfg [X] S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP3a\WNt500x86\Sandra.sys [X] S3 XDva405; \??\C:\Windows\system32\XDva405.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-10 05:55 - 2014-07-10 05:56 - 00027726 _____ () C:\Users\Timmi\Desktop\FRST.txt 2014-07-10 05:54 - 2014-07-10 05:55 - 00000000 ____D () C:\FRST 2014-07-10 05:52 - 2014-07-10 05:52 - 00000472 _____ () C:\Users\Timmi\Desktop\defogger_disable.log 2014-07-10 05:52 - 2014-07-10 05:52 - 00000000 _____ () C:\Users\Timmi\defogger_reenable 2014-07-10 05:49 - 2014-07-10 05:50 - 00380416 _____ () C:\Users\Timmi\Desktop\Gmer-19357.exe 2014-07-10 05:49 - 2014-07-10 05:49 - 00050477 _____ () C:\Users\Timmi\Desktop\Defogger.exe 2014-07-10 05:42 - 2014-07-10 05:55 - 00000000 ____D () C:\ProgramData\systemk 2014-07-09 17:10 - 2014-07-09 17:10 - 01074688 _____ (Farbar) C:\Users\Timmi\Desktop\FRST.exe 2014-07-09 17:01 - 2014-07-09 17:01 - 00000000 ____D () C:\ProgramData\2308189059 2014-07-09 17:00 - 2014-07-09 17:00 - 00000000 ____D () C:\Program Files\predm 2014-07-09 13:47 - 2014-07-09 13:47 - 00070676 _____ () C:\Users\Timmi\Desktop\AVSCAN-20140709-111817-C956C9DD.LOG 2014-07-09 11:14 - 2014-07-09 11:14 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-07-09 11:13 - 2014-07-09 11:13 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-07-09 11:13 - 2014-07-09 11:13 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-07-09 11:13 - 2014-07-09 11:13 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-07-09 11:13 - 2014-07-09 11:13 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-07-09 11:13 - 2014-07-09 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit 2014-07-09 11:13 - 2014-07-09 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-08 14:10 - 2014-07-08 14:10 - 00000254 _____ () C:\Windows\system32\InstallUtil.InstallLog 2014-07-07 15:35 - 2014-07-04 14:15 - 00052920 _____ (StdLib) C:\Windows\system32\Drivers\{0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw.sys 2014-07-07 14:35 - 2014-07-08 14:11 - 00000000 ____D () C:\Program Files\IminentToolbar 2014-07-07 14:35 - 2014-07-07 14:35 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\IminentToolbar 2014-07-07 14:35 - 2014-07-07 14:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-07-07 14:34 - 2014-07-09 07:19 - 00000000 ____D () C:\Program Files\Iminent 2014-07-07 14:33 - 2014-07-07 14:34 - 00000000 ____D () C:\Users\Timmi\AppData\Local\mcpatcher 2014-07-07 14:32 - 2014-07-07 14:32 - 00245024 _____ () C:\Users\Timmi\Downloads\MCPatcher.exe 2014-07-07 11:32 - 2014-07-09 18:01 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\.minecraft 2014-07-07 11:27 - 2014-07-07 11:27 - 00695296 _____ (AnjoCaido) C:\Users\Timmi\Desktop\MinecraftSP.exe 2014-07-07 07:44 - 2014-07-10 05:56 - 01042031 _____ () C:\Users\Timmi\AppData\Local\hccwqz.gss 2014-07-07 07:44 - 2014-07-09 23:22 - 00074752 _____ () C:\Users\Timmi\AppData\Local\hccwqz.gdb 2014-07-07 07:44 - 2014-07-07 07:44 - 02625536 _____ () C:\Users\Timmi\AppData\Local\hccwqz.exe 2014-07-05 00:59 - 2014-07-05 01:00 - 02350021 _____ () C:\Users\Timmi\Downloads\mcpatcher-4.3.2_03.exe 2014-07-05 00:34 - 2014-07-05 00:47 - 00000000 ____D () C:\Users\Timmi\Desktop\MC TPs 2014-07-05 00:34 - 2014-07-05 00:35 - 26839900 _____ () C:\Users\Timmi\Downloads\Soartex_Fanver.zip 2014-07-05 00:34 - 2014-07-05 00:34 - 68640726 _____ () C:\Users\Timmi\Downloads\ChromaHills-64x1.7_1.0.8.zip 2014-07-05 00:33 - 2014-07-05 00:34 - 09610626 _____ () C:\Users\Timmi\Downloads\willpack3.zip 2014-07-05 00:29 - 2014-07-05 00:45 - 49462275 _____ () C:\Users\Timmi\Downloads\MicRaPr6.rar 2014-07-03 18:35 - 2014-07-03 18:35 - 01543979 _____ () C:\Users\Timmi\Desktop\Neuer Ordner.rar 2014-07-03 18:33 - 2014-07-03 18:35 - 00000000 ____D () C:\Users\Timmi\Desktop\Neuer Ordner 2014-07-03 14:51 - 2014-07-03 14:55 - 00016947 _____ () C:\Users\Timmi\Desktop\Bewerbung Aushilfe.odt 2014-07-03 14:29 - 2014-07-03 14:29 - 00015026 _____ () C:\Users\Timmi\Downloads\Unbenannt 1.odt 2014-07-03 12:14 - 2014-07-03 12:14 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft 2014-07-03 12:14 - 2014-07-03 12:14 - 00000000 ____D () C:\Program Files\Minecraft 2014-07-03 12:13 - 2014-07-03 12:13 - 00000000 ____D () C:\Program Files\Tbccint 2014-07-03 12:12 - 2014-07-03 12:12 - 00000000 __SHD () C:\Users\Timmi\AppData\Local\EmieUserList 2014-07-03 12:12 - 2014-07-03 12:12 - 00000000 __SHD () C:\Users\Timmi\AppData\Local\EmieSiteList 2014-07-03 12:10 - 2014-07-03 12:10 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\InetStat 2014-07-03 12:09 - 2014-07-07 20:19 - 00000000 ____D () C:\Users\Timmi\AppData\Local\Genesis_07031009 2014-07-03 12:09 - 2014-07-03 12:09 - 00000000 ____D () C:\ProgramData\CostMin 2014-07-03 12:09 - 2014-07-03 12:09 - 00000000 ____D () C:\ProgramData\bdcd2bfe41197639 2014-07-03 12:08 - 2014-07-03 12:09 - 00000000 ____D () C:\Program Files\SupTab 2014-07-03 12:08 - 2014-07-03 12:09 - 00000000 ____D () C:\Program Files\CostMin 2014-07-03 12:08 - 2014-07-03 12:08 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect 2014-07-03 12:04 - 2014-07-10 05:42 - 00000342 _____ () C:\Windows\Tasks\AmiUpdXp.job 2014-07-03 12:04 - 2014-07-04 09:33 - 00000000 ____D () C:\Program Files\Flowsurf 2014-07-03 12:04 - 2014-07-03 12:04 - 00000000 ____D () C:\Users\Timmi\AppData\Local\9312 2014-07-03 12:02 - 2014-07-03 12:02 - 03675075 _____ () C:\Users\Timmi\Downloads\skaiacraft_launcher.zip 2014-07-03 11:22 - 2014-07-03 23:42 - 00000454 _____ () C:\Users\Timmi\Desktop\kurztext.txt 2014-06-22 15:16 - 2014-06-22 15:16 - 00025849 _____ () C:\Users\Timmi\Downloads\start zerti (1).odt 2014-06-22 15:15 - 2014-06-22 15:15 - 00025849 _____ () C:\Users\Timmi\Downloads\start zerti.odt 2014-06-19 17:54 - 2014-06-19 17:55 - 00000796 _____ () C:\Users\Timmi\Desktop\tracert.txt 2014-06-13 08:56 - 2014-06-13 08:56 - 00000000 ____D () C:\Users\Timmi\AppData\Local\LPT 2014-06-11 19:40 - 2014-06-11 19:40 - 00000641 _____ () C:\Users\Timmi\Desktop\lol.txt ==================== One Month Modified Files and Folders ======= 2014-07-10 05:56 - 2014-07-10 05:55 - 00027726 _____ () C:\Users\Timmi\Desktop\FRST.txt 2014-07-10 05:56 - 2014-07-07 07:44 - 01042031 _____ () C:\Users\Timmi\AppData\Local\hccwqz.gss 2014-07-10 05:56 - 2012-11-29 22:58 - 00000000 ____D () C:\Users\Timmi\AppData\Local\PMB Files 2014-07-10 05:55 - 2014-07-10 05:54 - 00000000 ____D () C:\FRST 2014-07-10 05:55 - 2014-07-10 05:42 - 00000000 ____D () C:\ProgramData\systemk 2014-07-10 05:52 - 2014-07-10 05:52 - 00000472 _____ () C:\Users\Timmi\Desktop\defogger_disable.log 2014-07-10 05:52 - 2014-07-10 05:52 - 00000000 _____ () C:\Users\Timmi\defogger_reenable 2014-07-10 05:52 - 2012-10-03 19:06 - 00000000 ____D () C:\Users\Timmi 2014-07-10 05:51 - 2009-07-14 06:34 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-07-10 05:51 - 2009-07-14 06:34 - 00014608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-07-10 05:50 - 2014-07-10 05:49 - 00380416 _____ () C:\Users\Timmi\Desktop\Gmer-19357.exe 2014-07-10 05:49 - 2014-07-10 05:49 - 00050477 _____ () C:\Users\Timmi\Desktop\Defogger.exe 2014-07-10 05:47 - 2012-10-03 18:41 - 01406145 _____ () C:\Windows\WindowsUpdate.log 2014-07-10 05:46 - 2012-12-05 16:32 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\Mozilla 2014-07-10 05:45 - 2012-12-09 13:02 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\Skype 2014-07-10 05:42 - 2014-07-03 12:04 - 00000342 _____ () C:\Windows\Tasks\AmiUpdXp.job 2014-07-10 05:42 - 2014-05-18 08:04 - 00000898 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job 2014-07-10 05:42 - 2013-12-20 23:55 - 00001092 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-10 05:41 - 2012-11-18 23:22 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-07-10 05:41 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-07-10 05:41 - 2009-07-14 06:39 - 00159718 _____ () C:\Windows\setupact.log 2014-07-09 23:22 - 2014-07-07 07:44 - 00074752 _____ () C:\Users\Timmi\AppData\Local\hccwqz.gdb 2014-07-09 23:18 - 2013-04-17 23:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-07-09 23:16 - 2013-12-20 23:55 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-09 21:52 - 2014-01-28 15:47 - 00000000 ____D () C:\Users\Timmi\AppData\Local\Battle.net 2014-07-09 21:12 - 2012-10-03 21:43 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\TS3Client 2014-07-09 20:09 - 2014-05-18 08:04 - 00000902 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job 2014-07-09 18:01 - 2014-07-07 11:32 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\.minecraft 2014-07-09 17:37 - 2012-11-29 22:57 - 00000000 ____D () C:\ProgramData\PMB Files 2014-07-09 17:29 - 2012-10-03 19:47 - 00327698 _____ () C:\Windows\PFRO.log 2014-07-09 17:18 - 2012-10-03 21:33 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-07-09 17:18 - 2012-10-03 21:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-07-09 17:10 - 2014-07-09 17:10 - 01074688 _____ (Farbar) C:\Users\Timmi\Desktop\FRST.exe 2014-07-09 17:05 - 2012-10-03 20:00 - 00000000 ____D () C:\ProgramData\DeviceVM 2014-07-09 17:04 - 2012-10-03 19:56 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\DeviceVm 2014-07-09 17:04 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-07-09 17:01 - 2014-07-09 17:01 - 00000000 ____D () C:\ProgramData\2308189059 2014-07-09 17:00 - 2014-07-09 17:00 - 00000000 ____D () C:\Program Files\predm 2014-07-09 13:47 - 2014-07-09 13:47 - 00070676 _____ () C:\Users\Timmi\Desktop\AVSCAN-20140709-111817-C956C9DD.LOG 2014-07-09 11:14 - 2014-07-09 11:14 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-07-09 11:13 - 2014-07-09 11:13 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-07-09 11:13 - 2014-07-09 11:13 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-07-09 11:13 - 2014-07-09 11:13 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-07-09 11:13 - 2014-07-09 11:13 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-07-09 11:13 - 2014-07-09 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit 2014-07-09 11:13 - 2014-07-09 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-09 11:13 - 2012-10-11 14:03 - 00000000 ____D () C:\Program Files\Java 2014-07-09 07:19 - 2014-07-07 14:34 - 00000000 ____D () C:\Program Files\Iminent 2014-07-09 00:12 - 2009-07-14 04:04 - 00000505 _____ () C:\Windows\win.ini 2014-07-08 17:50 - 2012-10-04 14:46 - 00000000 ____D () C:\Users\Timmi\AppData\Local\CrashDumps 2014-07-08 14:11 - 2014-07-07 14:35 - 00000000 ____D () C:\Program Files\IminentToolbar 2014-07-08 14:10 - 2014-07-08 14:10 - 00000254 _____ () C:\Windows\system32\InstallUtil.InstallLog 2014-07-07 20:19 - 2014-07-03 12:09 - 00000000 ____D () C:\Users\Timmi\AppData\Local\Genesis_07031009 2014-07-07 14:35 - 2014-07-07 14:35 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\IminentToolbar 2014-07-07 14:35 - 2014-07-07 14:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-07-07 14:34 - 2014-07-07 14:33 - 00000000 ____D () C:\Users\Timmi\AppData\Local\mcpatcher 2014-07-07 14:32 - 2014-07-07 14:32 - 00245024 _____ () C:\Users\Timmi\Downloads\MCPatcher.exe 2014-07-07 11:27 - 2014-07-07 11:27 - 00695296 _____ (AnjoCaido) C:\Users\Timmi\Desktop\MinecraftSP.exe 2014-07-07 07:44 - 2014-07-07 07:44 - 02625536 _____ () C:\Users\Timmi\AppData\Local\hccwqz.exe 2014-07-05 01:00 - 2014-07-05 00:59 - 02350021 _____ () C:\Users\Timmi\Downloads\mcpatcher-4.3.2_03.exe 2014-07-05 00:47 - 2014-07-05 00:34 - 00000000 ____D () C:\Users\Timmi\Desktop\MC TPs 2014-07-05 00:45 - 2014-07-05 00:29 - 49462275 _____ () C:\Users\Timmi\Downloads\MicRaPr6.rar 2014-07-05 00:35 - 2014-07-05 00:34 - 26839900 _____ () C:\Users\Timmi\Downloads\Soartex_Fanver.zip 2014-07-05 00:34 - 2014-07-05 00:34 - 68640726 _____ () C:\Users\Timmi\Downloads\ChromaHills-64x1.7_1.0.8.zip 2014-07-05 00:34 - 2014-07-05 00:33 - 09610626 _____ () C:\Users\Timmi\Downloads\willpack3.zip 2014-07-04 14:15 - 2014-07-07 15:35 - 00052920 _____ (StdLib) C:\Windows\system32\Drivers\{0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw.sys 2014-07-04 09:33 - 2014-07-03 12:04 - 00000000 ____D () C:\Program Files\Flowsurf 2014-07-04 09:33 - 2012-10-09 06:44 - 00000002 _____ () C:\END 2014-07-03 23:42 - 2014-07-03 11:22 - 00000454 _____ () C:\Users\Timmi\Desktop\kurztext.txt 2014-07-03 18:35 - 2014-07-03 18:35 - 01543979 _____ () C:\Users\Timmi\Desktop\Neuer Ordner.rar 2014-07-03 18:35 - 2014-07-03 18:33 - 00000000 ____D () C:\Users\Timmi\Desktop\Neuer Ordner 2014-07-03 14:55 - 2014-07-03 14:51 - 00016947 _____ () C:\Users\Timmi\Desktop\Bewerbung Aushilfe.odt 2014-07-03 14:29 - 2014-07-03 14:29 - 00015026 _____ () C:\Users\Timmi\Downloads\Unbenannt 1.odt 2014-07-03 12:14 - 2014-07-03 12:14 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft 2014-07-03 12:14 - 2014-07-03 12:14 - 00000000 ____D () C:\Program Files\Minecraft 2014-07-03 12:13 - 2014-07-03 12:13 - 00000000 ____D () C:\Program Files\Tbccint 2014-07-03 12:13 - 2012-10-09 06:44 - 00000000 ____D () C:\Users\Timmi\AppData\Local\Conduit 2014-07-03 12:13 - 2012-10-09 06:44 - 00000000 ____D () C:\Program Files\DVDVideoSoftTB_DE 2014-07-03 12:12 - 2014-07-03 12:12 - 00000000 __SHD () C:\Users\Timmi\AppData\Local\EmieUserList 2014-07-03 12:12 - 2014-07-03 12:12 - 00000000 __SHD () C:\Users\Timmi\AppData\Local\EmieSiteList 2014-07-03 12:10 - 2014-07-03 12:10 - 00000000 ____D () C:\Users\Timmi\AppData\Roaming\InetStat 2014-07-03 12:10 - 2012-10-03 18:58 - 01647984 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-07-03 12:09 - 2014-07-03 12:09 - 00000000 ____D () C:\ProgramData\CostMin 2014-07-03 12:09 - 2014-07-03 12:09 - 00000000 ____D () C:\ProgramData\bdcd2bfe41197639 2014-07-03 12:09 - 2014-07-03 12:08 - 00000000 ____D () C:\Program Files\SupTab 2014-07-03 12:09 - 2014-07-03 12:08 - 00000000 ____D () C:\Program Files\CostMin 2014-07-03 12:08 - 2014-07-03 12:08 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect 2014-07-03 12:08 - 2013-12-20 23:56 - 00002321 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-07-03 12:08 - 2012-10-03 19:06 - 00001605 _____ () C:\Users\Timmi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-03 12:04 - 2014-07-03 12:04 - 00000000 ____D () C:\Users\Timmi\AppData\Local\9312 2014-07-03 12:02 - 2014-07-03 12:02 - 03675075 _____ () C:\Users\Timmi\Downloads\skaiacraft_launcher.zip 2014-07-03 08:15 - 2013-01-27 00:17 - 00000000 ____D () C:\Users\Timmi\AppData\Local\Deployment 2014-07-01 17:49 - 2014-01-28 15:48 - 00000000 ____D () C:\Program Files\Hearthstone 2014-06-26 17:07 - 2014-01-28 15:47 - 00000000 ____D () C:\Program Files\Battle.net 2014-06-24 13:56 - 2012-10-03 20:43 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-06-22 15:16 - 2014-06-22 15:16 - 00025849 _____ () C:\Users\Timmi\Downloads\start zerti (1).odt 2014-06-22 15:15 - 2014-06-22 15:15 - 00025849 _____ () C:\Users\Timmi\Downloads\start zerti.odt 2014-06-19 17:55 - 2014-06-19 17:54 - 00000796 _____ () C:\Users\Timmi\Desktop\tracert.txt 2014-06-18 09:13 - 2014-05-07 00:15 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-06-17 13:28 - 2012-10-11 16:45 - 00000000 ____D () C:\Program Files\World of Warcraft 2014-06-13 08:56 - 2014-06-13 08:56 - 00000000 ____D () C:\Users\Timmi\AppData\Local\LPT 2014-06-13 08:56 - 2014-02-05 08:19 - 00000000 ____D () C:\Users\Timmi\AppData\Local\Smartbar 2014-06-11 19:40 - 2014-06-11 19:40 - 00000641 _____ () C:\Users\Timmi\Desktop\lol.txt Files to move or delete: ==================== C:\Users\Timmi\jagex_cl_runescape_LIVE.dat C:\Users\Timmi\random.dat Some content of TEMP: ==================== C:\Users\Timmi\AppData\Local\Temp\AskSLib.dll C:\Users\Timmi\AppData\Local\Temp\avgnt.exe C:\Users\Timmi\AppData\Local\Temp\BundleSweetIMSetup.exe C:\Users\Timmi\AppData\Local\Temp\i4jdel0.exe C:\Users\Timmi\AppData\Local\Temp\i4jdel1.exe C:\Users\Timmi\AppData\Local\Temp\installhelper.dll C:\Users\Timmi\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe C:\Users\Timmi\AppData\Local\Temp\MybabylonTB.exe C:\Users\Timmi\AppData\Local\Temp\nvSCPAPI.dll C:\Users\Timmi\AppData\Local\Temp\nvSCPAPISvr.exe C:\Users\Timmi\AppData\Local\Temp\nvStereoApiI.dll C:\Users\Timmi\AppData\Local\Temp\nvStInst.exe C:\Users\Timmi\AppData\Local\Temp\OptimizerPro.exe C:\Users\Timmi\AppData\Local\Temp\optprosetup.exe C:\Users\Timmi\AppData\Local\Temp\plus-hd-9-6-1205.exe C:\Users\Timmi\AppData\Local\Temp\propsys.dll C:\Users\Timmi\AppData\Local\Temp\SettingsManagerSetup.exe C:\Users\Timmi\AppData\Local\Temp\speedupmypc.exe C:\Users\Timmi\AppData\Local\Temp\SRAssetsHelper.dll C:\Users\Timmi\AppData\Local\Temp\swt-win32-3740.dll C:\Users\Timmi\AppData\Local\Temp\TB_A4FF.exe C:\Users\Timmi\AppData\Local\Temp\trolatuntSetup.exe C:\Users\Timmi\AppData\Local\Temp\wajam_download_new.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-08 21:29 ==================== End Of Log ============================ --- --- --- Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:09-07-2014 Ran by Timmi at 2014-07-10 05:56:37 Running from C:\Users\Timmi\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF} AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Norton Internet Security (Disabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} ==================== Installed Programs ====================== Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated) Acrobat.com (Version: 0.0.0 - Adobe Systems Incorporated) Hidden Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.) Adobe AIR (Version: 1.0.8.4990 - Adobe Systems Inc.) Hidden Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated) AMD Fuel (Version: 2011.0126.1749.31909 - Ihr Firmenname) Hidden AMD USB Filter Driver (Version: 1.0.15.94 - Advanced Micro Devices, Inc.) Hidden ASRock App Charger v1.0.4 (HKLM\...\ASRock App Charger_is1) (Version: - ASRock Inc.) ASRock eXtreme Tuner v0.1.66 (HKLM\...\ASRock eXtreme Tuner_is1) (Version: - ) ASRock InstantBoot v1.26 (HKLM\...\ASRock InstantBoot_is1) (Version: - ) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.35 - Atheros Communications Inc.) ATI Catalyst Install Manager (HKLM\...\{D95A0957-F389-C180-9660-B48E41FD83D4}) (Version: 3.0.812.0 - ATI Technologies, Inc.) Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.5.450 - Avira) Battle.net (HKLM\...\Battle.net) (Version: - Blizzard Entertainment) Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden Catalyst Control Center Graphics Previews Common (Version: 2011.0126.1749.31909 - ATI) Hidden Catalyst Control Center InstallProxy (Version: 2011.0126.1749.31909 - ATI Technologies, Inc.) Hidden Catalyst Control Center Localization All (Version: 2011.0126.1749.31909 - ATI) Hidden CCC Help Chinese Standard (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Chinese Traditional (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Czech (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Danish (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Dutch (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help English (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Finnish (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help French (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help German (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Greek (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Hungarian (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Italian (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Japanese (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Korean (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Norwegian (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Polish (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Portuguese (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Russian (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Spanish (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Swedish (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Thai (Version: 2011.0126.1748.31909 - ATI) Hidden CCC Help Turkish (Version: 2011.0126.1748.31909 - ATI) Hidden ccc-core-static (Version: 2011.0126.1749.31909 - Ihr Firmenname) Hidden ccc-utility (Version: 2011.0126.1749.31909 - ATI) Hidden CostMin (HKLM\...\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}) (Version: 4.3.0.1667 - CostMin) Diablo III (HKLM\...\Diablo III) (Version: - Blizzard Entertainment) Dota 2 (HKLM\...\Steam App 570) (Version: - Valve) DVDVideoSoftTB DE Toolbar (HKLM\...\DVDVideoSoftTB_DE Toolbar) (Version: 6.9.0.16 - DVDVideoSoftTB DE) Etron USB3.0 Host Controller (HKLM\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.96 - Etron Technology) Etron USB3.0 Host Controller (Version: 0.96 - Etron Technology) Hidden Firefox Browser (remove only) (HKLM\...\Firefox Browser) (Version: - ) Free YouTube Download version 3.2.2.430 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.2.430 - DVDVideoSoft Ltd.) Free YouTube to MP3 Converter version 3.12.20.1230 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.20.1230 - DVDVideoSoft Ltd.) Game Booster 3 (HKLM\...\Game Booster_is1) (Version: 3.4 - IObit) Genesis (HKCU\...\hccwqz) (Version: - ) <==== ATTENTION GIMP 2.6.11 (HKLM\...\WinGimp-2.0_is1) (Version: 2.6.11 - The GIMP Team) Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.) Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden Hearthstone (HKLM\...\Hearthstone) (Version: - Blizzard Entertainment) Hi-Rez Studios Authenticate and Update Service (HKLM\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios) HydraVision (Version: 4.2.184.0 - ATI Technologies Inc.) Hidden InetStat (HKCU\...\InetStat) (Version: 0.4 - InetStat) Java 7 Update 60 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle) Java Auto Updater (Version: 2.1.60.19 - Oracle, Inc.) Hidden Java SE Development Kit 7 Update 7 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0170070}) (Version: 1.7.0.70 - Oracle) Java-Editor 11.17, 2012.08.26 (HKLM\...\{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1) (Version: - Gerhard Röhner) LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - ) LastChaosGER (HKLM\...\{A86A50FC-7C22-478B-BAEF-82393328825F}) (Version: 1.00.000 - Barunsongames CO., LTD.) League of Legends (HKLM\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games) Little Fighter 2 1.9c (HKLM\...\Little Fighter 2) (Version: 1.9c - ) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Nero ControlCenter (Version: 11.0.16700 - Nero AG) Hidden Nero ControlCenter Help (CHM) (Version: 15.0.00015 - Nero AG) Hidden Nero Core Components (Version: 11.0.23200 - Nero AG) Hidden Nero Update (Version: 11.0.13300.42.0 - Nero AG) Hidden Nero WaveEditor (HKLM\...\{8F7F40B4-8C55-4B92-8C89-16501DAC697F}) (Version: 12.5.00800 - Nero AG) Nero WaveEditor (Version: 12.0.12000 - Nero AG) Hidden Nero WaveEditor Help (CHM) (Version: 12.0.7000 - Nero AG) Hidden Norton Internet Security (HKLM\...\NIS) (Version: 18.7.2.3 - Symantec Corporation) Norton Internet Security (Version: 18.1.0.37 - Symantec Corporation) Hidden NVIDIA 3D Vision Controller-Treiber 314.07 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 314.07 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 314.07 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 314.07 - NVIDIA Corporation) NVIDIA Grafiktreiber 314.07 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 314.07 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.3.23.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.23.1 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.109.706 - NVIDIA Corporation) Hidden NVIDIA PhysX (Version: 9.12.1031 - NVIDIA Corporation) Hidden NVIDIA PhysX-Systemsoftware 9.12.1031 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.1031 - NVIDIA Corporation) NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1407 - NVIDIA Corporation) Hidden NVIDIA Systemsteuerung 314.07 (Version: 314.07 - NVIDIA Corporation) Hidden NVIDIA Update 1.12.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.12.12 - NVIDIA Corporation) NVIDIA Update Components (Version: 1.12.12 - NVIDIA Corporation) Hidden OpenOffice.org 3.4.1 (HKLM\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation) Pando Media Booster (HKLM\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.) PlanetSide 2 (HKCU\...\SOE-PlanetSide 2 PSG) (Version: 1.0.3.183 - Sony Online Entertainment) Plus-HD-9.6 (HKLM\...\Plus-HD-9.6) (Version: 1.34.5.4 - Plus HD) <==== ATTENTION Prerequisite installer (Version: 12.0.0003 - Nero AG) Hidden Quake Live (HKLM\...\Quake Live) (Version: - id Software) Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6215 - Realtek Semiconductor Corp.) Search-Results Toolbar (HKLM\...\ilividtoolbargaw) (Version: 1.2.0.0 - APN LLC) <==== ATTENTION Settings Manager (HKLM\...\Settings Manager) (Version: 5.0.0.12349 - Aztec Media Inc) <==== ATTENTION Skype™ 6.0 (HKLM\...\{EA17F4FC-FDBF-4CF8-A529-2D983132D053}) (Version: 6.0.126 - Skype Technologies S.A.) Software Version Updater (HKLM\...\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}) (Version: 1.1.3.8 - ) <==== ATTENTION Sound Blaster X-Fi MB (HKLM\...\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}) (Version: 1.0 - Creative Technology Limited) StarCraft II (HKLM\...\StarCraft II) (Version: - Blizzard Entertainment) Steam (HKLM\...\Steam) (Version: - Valve Corporation) TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.13.1 - TeamSpeak Systems GmbH) Tribes Ascend (HKLM\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}) (Version: 1.0.1268.1 - Hi-Rez Studios) webssearches uninstall (HKLM\...\webssearches uninstall) (Version: - webssearches) <==== ATTENTION WindowsMangerProtect20.0.0.502 (HKLM\...\WindowsMangerProtect) (Version: 20.0.0.502 - WindowsProtect LIMITED) WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) World of Warcraft (HKLM\...\World of Warcraft) (Version: - Blizzard Entertainment) XFastUsb (HKLM\...\XFastUsb) (Version: - ) XMedia Recode Version 3.1.3.7 (HKLM\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.3.7 - XMedia Recode) Yahoo Community Smartbar (HKLM\...\{D62304BE-D5D3-4CCF-8973-123909491ADB}) (Version: 11.62.66.17712 - Linkury Inc.) <==== ATTENTION Yahoo Community Smartbar Engine (HKCU\...\{189d00e6-1f58-45e1-af5a-feb5b28ea7da}) (Version: 10.201.66.14591 - Linkury Inc.) <==== ATTENTION ==================== Restore Points ========================= 28-06-2014 16:28:46 Geplanter Prüfpunkt 03-07-2014 10:10:58 Uniblue SpeedUpMyPC installation 09-07-2014 09:11:29 Installed Java 7 Update 60 09-07-2014 15:03:01 Removed SmartView for IE. 09-07-2014 15:04:30 Removed SmartView Software Updater. ==================== Hosts content: ========================== 2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {0EFBBA42-58ED-413C-BE01-7457F7FCE730} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-12-20] (Google Inc.) Task: {212DCA0C-3062-45A7-BB10-573EDBE5F168} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [2014-05-18] (globalUpdate) <==== ATTENTION Task: {331AAD3E-B5BE-4D33-BDD3-09C636E800D8} - System32\Tasks\Symantec\Norton Error Analyzer 18.7.2.3 => C:\Program Files\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation) Task: {3610CBC7-09C2-4455-A189-DC641652A178} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [2014-05-18] (globalUpdate) <==== ATTENTION Task: {5A21DD78-54DD-4CC1-827C-CA960C0DC97D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated) Task: {5BC865F4-7777-4B7D-B676-A471F044521D} - System32\Tasks\AmiUpdXp => C:\Users\Timmi\AppData\Local\9312\a13867.exe [2014-07-03] () <==== ATTENTION Task: {6B05B210-38E5-4D55-9AB5-8DA8E7AB9493} - System32\Tasks\{F2AAA375-3EE9-4C36-8337-5EF7041BF1B7} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.1.0.129.272/de/abandoninstall?page=tsProgressBar Task: {A71F1CD2-3B34-4FB4-9575-49C109E18332} - System32\Tasks\Symantec\Norton Error Processor 18.7.2.3 => C:\Program Files\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation) Task: {C4DED83C-D0AD-48D9-9C23-E003317F5733} - System32\Tasks\fsupdate => C:\Program Files\Flowsurf\fsupd.exe [2014-04-15] () Task: {CFD9EA53-3BBF-48F5-B012-20764D67D4E9} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files\IObit\Game Booster 3\AutoUpdate.exe [2013-06-09] () <==== ATTENTION Task: {E41AB5D7-967B-4A5B-BA96-55325A409D2A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-12-20] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\Timmi\AppData\Local\9312\a13867.exe <==== ATTENTION Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files\globalUpdate\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files\globalUpdate\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-07-10 05:43 - 2014-07-09 17:04 - 00489488 _____ () C:\Program Files\Settings Manager\systemk\sysapcrt.dll 2012-11-18 23:22 - 2013-02-10 02:35 - 00078624 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll 2011-01-26 17:59 - 2011-01-26 17:59 - 00072192 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Services.dll 2008-06-12 00:10 - 2008-06-12 00:10 - 00016768 _____ () C:\Program Files\Adobe\Reader 9.0\Reader\viewerps.dll 2014-07-10 05:43 - 2014-07-10 05:43 - 00697884 _____ () C:\Users\Timmi\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001.dir.0316\~df394b.tmp 2014-07-10 05:44 - 2014-07-10 05:44 - 00592896 _____ () C:\Users\Timmi\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001.dir.0316\~de6248.tmp 2012-10-03 19:46 - 2009-02-06 18:52 - 00073728 _____ () C:\Windows\SYSTEM32\CmdRtr.DLL 2012-10-03 19:46 - 2009-04-20 11:55 - 00148480 _____ () C:\Windows\SYSTEM32\APOMngr.DLL 2014-07-10 05:43 - 2014-07-09 17:04 - 00489488 _____ () c:\program files\settings manager\systemk\sysapcrt.dll 2012-11-29 22:57 - 2012-11-29 22:57 - 03093624 _____ () C:\Program Files\Pando Networks\Media Booster\PMB.exe 2014-06-11 14:12 - 2014-06-11 14:12 - 00045848 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00070936 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\srau.dll 2014-06-11 14:12 - 2014-06-11 14:12 - 00166680 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll 2014-06-11 14:12 - 2014-06-11 14:12 - 02337048 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00067864 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\spbl.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00156440 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll 2014-06-11 14:12 - 2014-06-11 14:12 - 00015128 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\siem.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00066840 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\sppsm.dll 2014-06-11 14:12 - 2014-06-11 14:12 - 00697624 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll 2014-06-11 14:12 - 2014-06-11 14:12 - 00015640 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll 2014-06-11 14:12 - 2014-06-11 14:12 - 00079640 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll 2014-06-11 14:12 - 2014-06-11 14:12 - 00027928 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00060184 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\srut.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00030488 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\srsbs.dll 2014-06-11 14:12 - 2014-06-11 14:12 - 00066328 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00150296 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\smti.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00032024 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\srom.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00031512 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\smtu.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00039704 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\smta.dll 2014-06-11 14:12 - 2014-06-11 14:12 - 00024856 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\sgml.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00062744 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00046872 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\srbu.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00025880 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\srpdm.dll 2014-06-11 14:11 - 2014-06-11 14:11 - 00044312 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\MACTrackBarLib.dll 2014-06-11 14:03 - 2014-06-11 14:03 - 00025880 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00036120 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll 2014-06-11 14:13 - 2014-06-11 14:13 - 00256280 _____ () C:\Users\Timmi\AppData\Local\Smartbar\Application\srns.dll 2014-07-03 12:10 - 2014-07-03 12:04 - 01259488 _____ () C:\Users\Timmi\AppData\Roaming\InetStat\inetstat.exe 2014-07-07 07:44 - 2014-07-07 07:44 - 02625536 _____ () C:\Users\Timmi\AppData\Local\hccwqz.exe 2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll 2014-07-10 05:43 - 2014-07-09 17:04 - 00019472 _____ () c:\program files\settings manager\systemk\smdmfldr.dll 2014-07-10 05:46 - 2014-07-10 05:46 - 00029696 _____ () C:\Users\Timmi\AppData\Local\Temp\nscE706.tmp\registry.dll 2014-07-10 05:46 - 2014-07-10 05:46 - 00008704 _____ () C:\Users\Timmi\AppData\Local\Temp\nscE706.tmp\newadvsplash.dll 2014-07-10 05:46 - 2014-07-10 05:46 - 00011264 _____ () C:\Users\Timmi\AppData\Local\Temp\nscE706.tmp\System.dll 2013-04-01 15:32 - 2013-04-01 15:32 - 03069848 _____ () C:\Users\Timmi\Documents\Firefox Browser\App\firefox\mozjs.dll 2014-07-09 17:18 - 2014-07-09 17:18 - 17029808 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== MSCONFIG/TASK MANAGER disabled items ========= ==================== Faulty Device Manager Devices ============= Name: Teredo Tunneling Pseudo-Interface Description: Microsoft-Teredo-Tunneling-Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (07/10/2014 05:44:47 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: SettingsManagerSetup.exe, Version: 5.0.0.0, Zeitstempel: 0x51a70926 Name des fehlerhaften Moduls: Helper.DLL, Version: 0.0.0.0, Zeitstempel: 0x53bd59a7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000141d7 ID des fehlerhaften Prozesses: 0xb5c Startzeit der fehlerhaften Anwendung: 0xSettingsManagerSetup.exe0 Pfad der fehlerhaften Anwendung: SettingsManagerSetup.exe1 Pfad des fehlerhaften Moduls: SettingsManagerSetup.exe2 Berichtskennung: SettingsManagerSetup.exe3 Error: (07/09/2014 09:34:49 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1". Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (07/09/2014 09:34:02 PM) (Source: SideBySide) (EventID: 63) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error: (07/08/2014 09:30:09 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1". Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (07/08/2014 09:29:38 PM) (Source: SideBySide) (EventID: 63) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error: (07/08/2014 05:50:51 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 35.0.1916.153, Zeitstempel: 0x538fb354 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c Ausnahmecode: 0xc0000374 Fehleroffset: 0x000c3873 ID des fehlerhaften Prozesses: 0x159c Startzeit der fehlerhaften Anwendung: 0xchrome.exe0 Pfad der fehlerhaften Anwendung: chrome.exe1 Pfad des fehlerhaften Moduls: chrome.exe2 Berichtskennung: chrome.exe3 Error: (07/08/2014 05:25:13 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 35.0.1916.153, Zeitstempel: 0x538fb354 Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0000abb3 ID des fehlerhaften Prozesses: 0x1e18 Startzeit der fehlerhaften Anwendung: 0xchrome.exe0 Pfad der fehlerhaften Anwendung: chrome.exe1 Pfad des fehlerhaften Moduls: chrome.exe2 Berichtskennung: chrome.exe3 Error: (07/08/2014 05:24:51 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 35.0.1916.153, Zeitstempel: 0x538fb354 Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeaf722 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00009b60 ID des fehlerhaften Prozesses: 0xb38 Startzeit der fehlerhaften Anwendung: 0xchrome.exe0 Pfad der fehlerhaften Anwendung: chrome.exe1 Pfad des fehlerhaften Moduls: chrome.exe2 Berichtskennung: chrome.exe3 Error: (07/06/2014 08:32:55 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1". Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (07/06/2014 08:32:05 PM) (Source: SideBySide) (EventID: 63) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. System errors: ============= Error: (07/10/2014 05:46:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (07/10/2014 05:46:18 AM) (Source: Service Control Manager) (EventID: 7038) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (07/09/2014 05:34:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (07/09/2014 05:34:29 PM) (Source: Service Control Manager) (EventID: 7038) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (07/09/2014 05:34:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht. Error: (07/09/2014 05:30:19 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 09.07.2014 um 17:21:03 unerwartet heruntergefahren. Error: (07/09/2014 05:02:46 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Update trolatunt" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts. Error: (07/09/2014 05:02:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Util trolatunt" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts. Error: (07/09/2014 07:22:41 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (07/09/2014 07:22:41 AM) (Source: Service Control Manager) (EventID: 7038) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Microsoft Office Sessions: ========================= Error: (07/10/2014 05:44:47 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: SettingsManagerSetup.exe5.0.0.051a70926Helper.DLL0.0.0.053bd59a7c0000005000141d7b5c01cf9bf0e98b2626C:\Windows\TEMP\8e40227d\SettingsManagerSetup.exeC:\Windows\TEMP\nsv9974.tmp\Helper.DLL89893056-07e4-11e4-b877-bc5ff40f2d2a Error: (07/09/2014 09:34:49 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Etron Technology\USB 3.0 Host Controller\Drivers\x64\ETSetup64.exe Error: (07/09/2014 09:34:02 PM) (Source: SideBySide) (EventID: 63) (User: ) Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3 Error: (07/08/2014 09:30:09 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Etron Technology\USB 3.0 Host Controller\Drivers\x64\ETSetup64.exe Error: (07/08/2014 09:29:38 PM) (Source: SideBySide) (EventID: 63) (User: ) Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3 Error: (07/08/2014 05:50:51 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: chrome.exe35.0.1916.153538fb354ntdll.dll6.1.7601.18247521ea91cc0000374000c3873159c01cf9ac31dd71f0fC:\Program Files\Google\Chrome\Application\chrome.exeC:\Windows\SYSTEM32\ntdll.dlla2cf79f2-06b7-11e4-9522-bc5ff40f2d2a Error: (07/08/2014 05:25:13 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: chrome.exe35.0.1916.153538fb354msvcrt.dll7.0.7601.177444eeaf722c00000050000abb31e1801cf9ac0c764d8c1C:\Program Files\Google\Chrome\Application\chrome.exeC:\Windows\system32\msvcrt.dll0e0cedc6-06b4-11e4-9522-bc5ff40f2d2a Error: (07/08/2014 05:24:51 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: chrome.exe35.0.1916.153538fb354msvcrt.dll7.0.7601.177444eeaf722c000000500009b60b3801cf9aa9394755f3C:\Program Files\Google\Chrome\Application\chrome.exeC:\Windows\system32\msvcrt.dll00cc1878-06b4-11e4-9522-bc5ff40f2d2a Error: (07/06/2014 08:32:55 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Etron Technology\USB 3.0 Host Controller\Drivers\x64\ETSetup64.exe Error: (07/06/2014 08:32:05 PM) (Source: SideBySide) (EventID: 63) (User: ) Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3 ==================== Memory info =========================== Percentage of memory in use: 36% Total physical RAM: 3579.64 MB Available physical RAM: 2273.49 MB Total Pagefile: 7157.58 MB Available Pagefile: 5544.61 MB Total Virtual: 2047.88 MB Available Virtual: 1892.36 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:465.76 GB) (Free:272.2 GB) NTFS ==>[Drive with boot components (obtained from BCD)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 1907EF76) Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
10.07.2014, 17:56 | #4 |
/// the machine /// TB-Ausbilder | Windows 7: Werbung überall und Tabs öffnen sich von selbst Adware & Co. deinstallieren
Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter: Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
11.07.2014, 06:38 | #5 |
| Windows 7: Werbung überall und Tabs öffnen sich von selbst Vielen Dank für die Hilfe bisher! Habe leider noch ein Problem: Entweder bin ich zu blöd oder einfach nur blind. Ich finde leider keine Stelle an der steht "Additional scan result of Farbar Recovery Scan Tool ===================== Installed Programms ======================= <========== Attention" Oder irgendwas in der Richtung. Kannst du mir da nochmal helfen? PS: Hab dir noch nen Screenshot gemacht ;-) Grüße - T_Tech |
11.07.2014, 13:53 | #6 |
/// the machine /// TB-Ausbilder | Windows 7: Werbung überall und Tabs öffnen sich von selbst Schau doch mal in die Addition.txt von FRST
__________________ --> Windows 7: Werbung überall und Tabs öffnen sich von selbst |
24.07.2014, 07:22 | #7 |
| Windows 7: Werbung überall und Tabs öffnen sich von selbst Ok, vielen Dank :-) Sorry, dass ich erst jetzt antworten konnte. Ich bin am 12.07. umgezogen und hatte noch einiges in der neuen Wohnung zu tun. Ich hab jetzt alles deinstallieren können ;-) Vielen Dank nochmal! |
24.07.2014, 19:12 | #8 |
/// the machine /// TB-Ausbilder | Windows 7: Werbung überall und Tabs öffnen sich von selbst dann jetzt bitte Combofix wie oben beschrieben.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
25.07.2014, 07:40 | #9 |
| Windows 7: Werbung überall und Tabs öffnen sich von selbstCode:
ATTFilter ComboFix 14-07-24.01 - Timmi 25.07.2014 8:21.1.4 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3580.2297 [GMT 2:00] ausgeführt von:: c:\users\Timmi\Downloads\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859} AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4} SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\CostMin c:\program files\CostMin\ikjnv9Q3.dat c:\program files\CostMin\ikjnv9Q3.dll c:\program files\CostMin\ikjnv9Q3.tlb c:\program files\CostMin\ikjnv9Q3.x64.dll c:\program files\Flowsurf\FlOWsurf.dll c:\programdata\2308189059 c:\programdata\2308189059\BIT6F71.tmp c:\programdata\CostMin c:\programdata\CostMin\rnCZCQPFD.dat c:\programdata\CostMin\rnCZCQPFD.exe c:\users\Timmi\AppData\Local\._LiveCode_ c:\users\Timmi\AppData\Local\hccwqz.exe c:\users\Timmi\AppData\Local\Microsoft\Windows\Temporary Internet Files\trolatunt_iels c:\users\Timmi\AppData\LocalLow\{95F5878C-1592-2F84-261E-9B16EB0FE0A4} c:\users\Timmi\AppData\LocalLow\{95F5878C-1592-2F84-261E-9B16EB0FE0A4}\CostMin.2.9.dat c:\windows\system32\tmpF0F3.tmp c:\windows\system32\tmpF0F4.tmp . . ((((((((((((((((((((((((((((((((((((((( Treiber/Dienste ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_globalUpdate . . ((((((((((((((((((((((( Dateien erstellt von 2014-06-25 bis 2014-07-25 )))))))))))))))))))))))))))))) . . 2014-07-25 06:29 . 2014-07-25 06:29 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp 2014-07-25 06:29 . 2014-07-25 06:29 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-07-22 19:37 . 2014-07-22 19:37 -------- d-----w- c:\programdata\Riot Games 2014-07-11 05:23 . 2014-07-11 05:23 -------- d-----w- c:\program files\VS Revo Group 2014-07-10 03:54 . 2014-07-10 03:57 -------- d-----w- C:\FRST 2014-07-10 03:42 . 2014-07-25 06:35 -------- d-----w- c:\programdata\systemk 2014-07-09 15:00 . 2014-07-09 15:00 -------- d-----w- c:\program files\predm 2014-07-09 09:14 . 2014-07-09 09:14 -------- d-----w- c:\program files\Common Files\Java 2014-07-09 09:13 . 2014-07-09 09:13 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2014-07-07 13:35 . 2014-07-04 12:15 52920 ----a-w- c:\windows\system32\drivers\{0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw.sys 2014-07-07 12:35 . 2014-07-07 12:35 -------- d-----w- c:\users\Timmi\AppData\Roaming\IminentToolbar 2014-07-07 12:34 . 2014-07-09 05:19 -------- d-----w- c:\program files\Iminent 2014-07-07 12:33 . 2014-07-07 12:34 -------- d-----w- c:\users\Timmi\AppData\Local\mcpatcher 2014-07-07 09:32 . 2014-07-11 07:03 -------- d-----w- c:\users\Timmi\AppData\Roaming\.minecraft 2014-07-03 10:14 . 2014-07-03 10:14 -------- d-----w- c:\program files\Minecraft 2014-07-03 10:13 . 2014-07-03 10:13 -------- d-----w- c:\program files\Tbccint 2014-07-03 10:12 . 2014-07-03 10:12 -------- d-sh--w- c:\users\Timmi\AppData\Local\EmieUserList 2014-07-03 10:12 . 2014-07-03 10:12 -------- d-sh--w- c:\users\Timmi\AppData\Local\EmieSiteList 2014-07-03 10:10 . 2014-07-03 10:10 -------- d-----w- c:\users\Timmi\AppData\Roaming\InetStat 2014-07-03 10:09 . 2014-07-07 18:19 -------- d-----w- c:\users\Timmi\AppData\Local\Genesis_07031009 2014-07-03 10:09 . 2014-07-03 10:09 -------- d-----w- c:\programdata\bdcd2bfe41197639 2014-07-03 10:08 . 2014-07-03 10:09 -------- d-----w- c:\program files\SupTab 2014-07-03 10:08 . 2014-07-03 10:08 -------- d-----w- c:\programdata\WindowsMangerProtect 2014-07-03 10:04 . 2014-07-25 06:29 -------- d-----w- c:\program files\Flowsurf . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-07-10 09:47 . 2013-05-02 08:54 35848 ----a-w- c:\windows\system32\drivers\avnetflt.sys 2014-07-09 15:18 . 2012-10-03 19:33 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2014-07-09 15:18 . 2012-10-03 19:33 699056 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2014-06-24 11:56 . 2012-10-03 18:43 97648 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2014-05-22 09:54 . 2012-10-03 18:43 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys 2014-05-09 07:06 . 2014-05-14 20:47 369664 ----a-w- c:\windows\system32\aepdu.dll 2014-05-09 07:04 . 2014-05-14 20:47 302592 ----a-w- c:\windows\system32\aeinv.dll 2014-05-06 03:07 . 2014-05-14 21:53 2724864 ----a-w- c:\windows\system32\mshtml.tlb 2012-08-13 09:09 . 2012-08-13 09:09 473600 ----a-w- c:\program files\setup.exe 2012-08-13 09:09 . 2012-08-13 09:09 3166208 ----a-w- c:\program files\openofficeorg341.msi . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}] 2014-03-26 14:19 424224 ----a-w- c:\users\Timmi\AppData\LocalLow\DVDVideoSoftTB_DE\prxtbDVD2.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"= "c:\users\Timmi\AppData\LocalLow\DVDVideoSoftTB_DE\prxtbDVD2.dll" [2014-03-26 424224] . [HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}] . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}"= "c:\users\Timmi\AppData\LocalLow\DVDVideoSoftTB_DE\prxtbDVD2.dll" [2014-03-26 424224] . [HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2012-11-29 3093624] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-11-09 17877168] "Browser Infrastructure Helper"="c:\users\Timmi\AppData\Local\Smartbar\Application\Smartbar.exe" [2014-06-11 28952] "InetStat"="c:\users\Timmi\AppData\Roaming\InetStat\inetstat.exe" [2014-07-03 1259488] "BackgroundContainerV2"="c:\users\Timmi\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll" [2014-03-26 325920] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-10-05 9742952] "XFastUsb"="c:\program files\XFastUsb\XFastUsb.exe" [2012-10-03 4942336] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "CTSyncService"="c:\program files\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe" [2009-07-08 1233195] "VolPanel"="c:\program files\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" [2009-05-04 241789] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112] "RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 14848] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-06-24 750160] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-05-07 256896] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-03-21 280576] . c:\users\Timmi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CurseClientStartup.ccip [2013-1-27 0] OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R1 F06DEFF2-5B9C-490D-910F-35D3A91196222;F06DEFF2-5B9C-490D-910F-35D3A91196222;c:\program files\Settings Manager\systemk\systemkmgrc1.cfg [x] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-11-09 160944] R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2012-10-03 79360] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2012-10-03 79360] R3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [2012-10-11 29248] R3 globalUpdatem;globalUpdate Update Service (globalUpdatem);c:\program files\globalUpdate\Update\GoogleUpdate.exe [2014-05-18 68608] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-06 108032] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [2010-11-01 14416] R3 XDva405;XDva405;c:\windows\system32\XDva405.sys [x] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1207020.003\SYMDS.SYS [2011-01-27 340088] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1207020.003\SYMEFA.SYS [2011-03-15 744568] S1 {0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw;{0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw;c:\windows\system32\drivers\{0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw.sys [2014-07-04 52920] S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2010-06-11 13832] S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-11-25 37352] S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx86.sys [2010-08-09 692272] S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [2012-10-03 14656] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVix86.sys [2010-06-27 344112] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1207020.003\Ironx86.SYS [2011-01-27 136312] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS [2011-04-21 299640] S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 284672] S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 140224] S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-06-24 430160] S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2013-07-18 762192] S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [2011-04-17 130008] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-02-09 383264] S2 SystemkService;Systemk Service;c:\program files\Settings Manager\systemk\SystemkService.exe [2014-07-09 3572240] S2 TBSrv;Toolbar Service;c:\program files\Tbccint\ToolbarService\ToolbarService.exe [2014-03-26 350496] S2 WindowsMangerProtect;WindowsMangerProtect Service;c:\programdata\WindowsMangerProtect\ProtectWindowsManager.exe [2014-07-03 535936] S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-08-13 102448] S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys [2011-02-08 32384] S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys [2011-02-08 52352] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-08-24 68208] S3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [2012-10-03 79360] S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 30392] . . --- Andere Dienste/Treiber im Speicher --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-07-22 16:17 1104200 ----a-w- c:\program files\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe . Inhalt des "geplante Tasks" Ordners . 2014-07-25 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-03 15:18] . 2014-07-25 c:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job - c:\program files\globalUpdate\Update\GoogleUpdate.exe [2014-05-18 06:04] . 2014-07-25 c:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job - c:\program files\globalUpdate\Update\GoogleUpdate.exe [2014-05-18 06:04] . 2014-07-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-12-20 21:55] . 2014-07-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2013-12-20 21:55] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.default-search.net?sid=476&aid=164&itype=a&ver=13337&tm=351&src=hmp mStart Page = hxxp://istart.webssearches.com/?type=hp&ts=1404381910&from=amt&uid=ST3500321CS_9TV0A2S1XXXX9TV0A2S1 uSearchAssistant = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAaunXoZgE5PjtiMDHhI2DK1Lv4UT8GdCTvmBxy0AFIas9JQyB68hZ4yWRPr-xoIg_U1ETgBZIIhvF8aMzL8ig_vbGCWfo2TPC116f8G5i2L6EsH2cRGZryNJNVPb1wVi2m5CxnfrAkfJxDxtxsURfbZlfSO7a-Bv0xaoA,,&q={searchTerms} IE: Free YouTube to MP3 Converter - c:\users\Timmi\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com TCP: DhcpNameServer = 192.168.1.1 . - - - - Entfernte verwaiste Registrierungseinträge - - - - . BHO-{95F5878C-1592-2F84-261E-9B16EB0FE0A4} - c:\program files\CostMin\ikjnv9Q3.dll Toolbar-10 - (no file) HKCU-Run-ASRockXTU - (no file) HKCU-Run-zASRockInstantBoot - (no file) HKLM-Run-DATAMNGR - c:\progra~1\SEARCH~1\Datamngr\DATAMN~1.EXE HKLM-Run-fst_de_78 - (no file) AddRemove-Little Fighter 2 - c:\program files\lf2\LF2_v1.9c\uninst.exe AddRemove-{2F5F003B-C71B-72E3-42B4-DE51AB079EB2} - c:\programdata\CostMin\rnCZCQPFD.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS] "ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.7.2.3\diMaster.dll\" /prefetch:1" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\F06DEFF2-5B9C-490D-910F-35D3A91196222] "ImagePath"="\??\c:\program files\Settings Manager\systemk\systemkmgrc1.cfg" . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Weitere laufende Prozesse ------------------------ . c:\windows\system32\nvvsvc.exe c:\program files\Creative\Shared Files\CTAudSvc.exe c:\program files\NVIDIA Corporation\Display\nvxdsync.exe c:\windows\system32\nvvsvc.exe c:\windows\system32\taskhost.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Hi-Rez Studios\HiPatchService.exe c:\program files\Settings Manager\systemk\systemku.exe c:\program files\Avira\AntiVir Desktop\avshadow.exe c:\program files\NVIDIA Corporation\Display\nvtray.exe c:\windows\system32\conhost.exe c:\windows\System32\rundll32.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\users\Timmi\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001 c:\windows\System32\rundll32.exe c:\program files\OpenOffice.org 3\program\soffice.exe c:\program files\OpenOffice.org 3\program\soffice.bin c:\program files\Realtek\Audio\HDA\RtHDVBg.exe c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\windows\system32\sppsvc.exe . ************************************************************************** . Zeit der Fertigstellung: 2014-07-25 08:38:43 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2014-07-25 06:38 . Vor Suchlauf: 17 Verzeichnis(se), 285.333.475.328 Bytes frei Nach Suchlauf: 22 Verzeichnis(se), 286.360.735.744 Bytes frei . - - End Of File - - 4EDAB4F475897E6FCD751F6E80EEC943 A36C5E4F47E84449FF07ED3517B43A31 |
25.07.2014, 17:44 | #10 |
/// the machine /// TB-Ausbilder | Windows 7: Werbung überall und Tabs öffnen sich von selbst Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Windows 7: Werbung überall und Tabs öffnen sich von selbst |
anderen, anschauen, banner, bereit, blue, browser, folge, folgendes, hören, interne, internet, java-update, link, musik, neue, neue seite, neuen, neues, problem, seite, tabs öffnen, ungefragt, update, updates, video, werbung, windows, windows 7, überall, youtube, öffnen |