| |
| |||||||
Log-Analyse und Auswertung: Standard-Icons bei den Bibliotheken wurden durch andere ersetzt (Win7)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.07.2014, 19:04
| #7 |
 |  Standard-Icons bei den Bibliotheken wurden durch andere ersetzt (Win7) Hallo, habe alles gemacht. Und hier sind die Logs! LG Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 30.07.2014 Suchlauf-Zeit: 17:24:58 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.07.30.05 Rootkit Datenbank: v2014.07.17.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Manfred Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 369416 Verstrichene Zeit: 9 Min, 57 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.301 - Bericht erstellt am 30/07/2014 um 17:55:04
# Aktualisiert 28/07/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Manfred - SLM002
# Gestartet von : C:\Users\Manfred\Downloads\adwcleaner_3.301.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\NCH Software
Ordner Gelöscht : C:\ProgramData\simplitec
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Program Files (x86)\NCH Software
Ordner Gelöscht : C:\Users\Manfred\AppData\Roaming\BupSystem
Ordner Gelöscht : C:\Users\Manfred\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Manfred\AppData\Roaming\ExpressFiles
Ordner Gelöscht : C:\Users\Manfred\AppData\Roaming\goforfiles
Ordner Gelöscht : C:\Users\Manfred\AppData\Roaming\NCH Software
Ordner Gelöscht : C:\Users\Manfred\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\Manfred\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\Manfred\AppData\Roaming\simplitec
Ordner Gelöscht : C:\Users\Manfred\AppData\Roaming\YourFileDownloader
Datei Gelöscht : C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\user.js
***** [ Tasks ] *****
Task Gelöscht : Express FilesUpdate
Task Gelöscht : Your File Updater
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\blbkdnmdcafmfhinpmnlhhddbepgkeaa
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\GoforFiles_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\GoforFiles_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pdfforgeToolbar-stub-1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pdfforgeToolbar-stub-1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\YontooDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\YontooDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\YourFile_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\YourFile_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\YourFileUpdater_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\YourFileUpdater_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\14919ea49a8f3b4aa3cf1058d9a64cec
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader19356_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader19356_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader47742_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader47742_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader68324_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader68324_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nvu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nvu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_utorrent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_utorrent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\AVG Nation toolbar
Schlüssel Gelöscht : HKCU\Software\Ciuvo
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\dt soft\daemon tools toolbar
Schlüssel Gelöscht : HKCU\Software\ExpressFiles
Schlüssel Gelöscht : HKCU\Software\GoforFiles
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\YourFileDownloader
Schlüssel Gelöscht : HKLM\Software\AVG Nation toolbar
Schlüssel Gelöscht : HKLM\Software\AVG Security Toolbar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\dt soft\daemon tools toolbar
Schlüssel Gelöscht : HKLM\Software\ExpressFiles
Schlüssel Gelöscht : HKLM\Software\GoforFiles
Schlüssel Gelöscht : HKLM\Software\Myfree Codec
Schlüssel Gelöscht : HKLM\Software\YourFileDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\daemon tools toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FLV Player
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17207
-\\ Mozilla Firefox v30.0 (de)
[ Datei : C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.helperbar.Country", "Austria");
Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
Zeile gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
Zeile gelöscht : user_pref("extensions.helperbar.UserID", "c21976ef-c91c-4723-a054-c8a94b98618e");
Zeile gelöscht : user_pref("extensions.helperbar.Visibility", false);
Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q=");
-\\ Google Chrome v
[ Datei : C:\Users\Manfred\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [8400 octets] - [30/07/2014 17:50:47]
AdwCleaner[S0].txt - [7753 octets] - [30/07/2014 17:55:04]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7813 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Manfred on 30.07.2014 at 18:14:47,05
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BE55B615-D803-4B3F-BBA4-7880F013314F}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\Users\Manfred\AppData\Roaming\getrighttogo"
Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\Manfred\appdata\local\{263127DC-7BF9-45ED-A1CC-3236363E70E7}
Successfully deleted: [Empty Folder] C:\Users\Manfred\appdata\local\{30791B99-B479-45EA-8BAB-76C3A6C92EA5}
Successfully deleted: [Empty Folder] C:\Users\Manfred\appdata\local\{504FB90D-4E49-4A1C-BF12-3B9E47A79348}
Successfully deleted: [Empty Folder] C:\Users\Manfred\appdata\local\{650A894F-D7C5-462D-B12F-1ED02F6BA3E7}
Successfully deleted: [Empty Folder] C:\Users\Manfred\appdata\local\{CF8D6DF9-12AD-4B12-8ED5-FCEB873DA0DA}
~~~ FireFox
Emptied folder: C:\Users\Manfred\AppData\Roaming\mozilla\firefox\profiles\0qlyz6hb.default\minidumps [281 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.07.2014 at 18:25:24,20
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-07-2014 Ran by Manfred (administrator) on SLM002 on 30-07-2014 18:29:06 Running from C:\Users\Manfred\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\stacsv64.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe () C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe (devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe () C:\Windows\System32\spool\drivers\x64\3\dlecserv.exe ( ) C:\Windows\System32\dleccoms.exe (Fortinet Inc.) C:\Windows\SysWOW64\FortiSSLVPNdaemon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (O2Micro International) C:\Windows\System32\drivers\o2flash.exe (SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe () C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) C:\Windows\System32\alg.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE () C:\Program Files (x86)\Dell P713w\dlecmon.exe () C:\Program Files (x86)\Dell P713w\ezprint.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Money\System\REMINDER.EXE (Akamai Technologies, Inc.) C:\Users\Manfred\AppData\Local\Akamai\netsession_win.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe (Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Microsoft Corporation) C:\Users\Manfred\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe () C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Winsent Lab) C:\Program Files (x86)\Winsent Messenger\winsent.exe (Akamai Technologies, Inc.) C:\Users\Manfred\AppData\Local\Akamai\netsession_win.exe (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1909032 2010-01-14] (Synaptics Incorporated) HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe [4968960 2009-07-17] (Dell Inc.) HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry HKLM\...\Run: [dlecmon.exe] => C:\Program Files (x86)\Dell P713w\dlecmon.exe [770728 2011-01-23] () HKLM\...\Run: [EzPrint] => C:\Program Files (x86)\Dell P713w\ezprint.exe [139944 2011-01-23] () HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-01-20] (IDT, Inc.) HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.) HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-17] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [409744 2009-06-24] (Creative Technology Ltd) HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-05] (Creative Technology Ltd) HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.) HKLM-x32\...\Run: [CloneCDTray] => C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.) HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [498160 2009-12-15] () HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-07] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation) HKLM-x32\...\Run: [Winsent Messenger] => C:\Program Files (x86)\Winsent Messenger\winsent.exe [834048 2014-07-14] (Winsent Lab) HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] => C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe [560128 2011-09-17] (Dell) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) HKU\.DEFAULT\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.) HKU\S-1-5-21-4023297661-2550031368-3471815440-1001\...\Run: [Reminder] => C:\Program Files (x86)\Microsoft Money\System\reminder.exe [37376 1999-03-14] (Microsoft Corporation) HKU\S-1-5-21-4023297661-2550031368-3471815440-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Manfred\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.) HKU\S-1-5-21-4023297661-2550031368-3471815440-1001\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [578560 2013-07-18] (Samsung Electronics) HKU\S-1-5-21-4023297661-2550031368-3471815440-1001\...\Run: [KiesPDLR] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-02-07] (Samsung) HKU\S-1-5-21-4023297661-2550031368-3471815440-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564992 2014-02-07] (Samsung) HKU\S-1-5-21-4023297661-2550031368-3471815440-1001\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.) HKU\S-1-5-21-4023297661-2550031368-3471815440-1001\...\Run: [KiesPDLR.exe] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-02-07] (Samsung) HKU\S-1-5-21-4023297661-2550031368-3471815440-1001\...\Run: [SkyDrive] => C:\Users\Manfred\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257224 2014-05-15] (Microsoft Corporation) Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Manfred\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64\SkyDriveShell64.dll (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Manfred\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64\SkyDriveShell64.dll (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Manfred\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64\SkyDriveShell64.dll (Microsoft Corporation) ShellIconOverlayIdentifiers: AutoCAD Digital Signatures Icon Overlay Handler -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.) ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Manfred\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\SkyDriveShell.dll (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Manfred\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\SkyDriveShell.dll (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Manfred\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\SkyDriveShell.dll (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: AutoCAD Digital Signatures Icon Overlay Handler -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\SysWOW64\AcSignIcon.dll (Autodesk, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKCU - DefaultScope {D7C579EF-7EBD-4217-8DF1-8C2384DB290A} URL = hxxp://www.google.at/search?q={searchTerms} SearchScopes: HKCU - {D7C579EF-7EBD-4217-8DF1-8C2384DB290A} URL = hxxp://www.google.at/search?q={searchTerms} BHO: McAfee Phishing Filter -> {27B4851A-3207-45A2-B947-BE8AFE6163AB} -> c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL No File BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) BHO-x32: Dell Symbolleiste -> {09B71986-2AC5-482d-B6CB-42EA34F4F85B} -> C:\Program Files\Dell Printable Web\toolband.dll () BHO-x32: McAfee Phishing Filter -> {27B4851A-3207-45A2-B947-BE8AFE6163AB} -> c:\progra~1\mcafee\msk\mskapbho.dll No File BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO) Toolbar: HKLM-x32 - Dell Symbolleiste - {09B71986-2AC5-482d-B6CB-42EA34F4F85B} - C:\Program Files\Dell Printable Web\toolband.dll () DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: HKLM-x32 {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} https://support.dell.com/systemprofiler/SysProExe.CAB DPF: HKLM-x32 {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 10.0.0.138 FireFox: ======== FF ProfilePath: C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default FF NewTab: about:blank FF Homepage: hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @Skype Technologies S.A..com/Skype Web Plugin - C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin64.dll (Skype) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File FF Plugin-x32: @FortinetCacheClean - C:\Program Files (x86)\Fortinet\SslvpnClient\npccplugin.dll (Fortinet Inc.) FF Plugin-x32: @FortinetCacheCleanEx - C:\Program Files (x86)\Fortinet\SslvpnClient\npccpluginex.dll (Fortinet Inc.) FF Plugin-x32: @FortinetTunnelControl - C:\Program Files (x86)\Fortinet\SslvpnClient\nptcplugin.dll (Fortinet Inc.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @google.com/sewebplugin - C:\Windows\system32\npsewebplugin.dll No File FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @Skype Technologies S.A..com/Skype Web Plugin - C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin.dll (Skype) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Manfred\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( ) FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Manfred\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Manfred\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google) FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Manfred\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Manfred\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Manfred\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\Manfred\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Users\Manfred\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google) FF Plugin ProgramFiles/Appdata: C:\Users\Manfred\AppData\Roaming\mozilla\plugins\npo1d.dll (Google) FF SearchPlugin: C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\searchplugins\googleat.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Securita Scout - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\Extensions\isec@securitascout.com [2014-06-25] FF Extension: ColorZilla - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\Extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} [2012-08-01] FF Extension: DownloadHelper - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-27] FF Extension: CookieCuller - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\Extensions\{99B98C2C-7274-45a3-A640-D9DF1A1C8460}.xpi [2012-10-28] FF Extension: ImTranslator - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi [2011-05-28] FF Extension: Adblock Plus - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-14] FF Extension: Greasemonkey - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012-08-25] FF Extension: User Agent Changer - C:\Users\Manfred\AppData\Roaming\Mozilla\Firefox\Profiles\0qlyz6hb.default\Extensions\{e968fc70-8f95-4ab9-9e79-304de2a66ee1}.xpi [2013-02-15] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14] FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-01-13] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-01-13] FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-01-13] FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-01-13] FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-01-13] FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-07-25] FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK Chrome: ======= Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION CHR Extension: (No Name) - C:\Users\Manfred\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfkilfadjoneaheacgmkahfgcjchkpad [2014-06-24] CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17] CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17] CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17] CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17] CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14] CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17] CHR StartMenuInternet: Google Chrome - C:\Users\Manfred\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [79360 2011-07-17] (Autodesk) [File not signed] R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO) S3 BroadCamService; C:\Program Files (x86)\NCH Software\BroadCam\broadcam.exe [2591304 2013-06-12] (NCH Software) S3 BroadWaveService; C:\Program Files (x86)\NCH Software\BroadWave\broadwave.exe [1226312 2013-10-17] (NCH Software) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT) S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-07-10] (Creative Labs) [File not signed] S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2010-07-10] (Creative Labs) [File not signed] R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-07-05] (Creative Technology Ltd) [File not signed] R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3647992 2014-05-14] (devolo AG) R2 dlecCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\dlecserv.exe [45224 2010-05-21] () R2 dlec_device; C:\Windows\system32\dleccoms.exe [1052328 2010-05-21] ( ) R2 dlec_device; C:\Windows\SysWOW64\dleccoms.exe [598696 2010-05-21] ( ) R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2009-06-09] (Stardock Corporation) [File not signed] R2 FortiSslvpnDaemon; C:\Windows\SysWOW64\FortiSSLVPNdaemon.exe [954080 2014-01-06] (Fortinet Inc.) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 mitsijm2014; C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.) R2 MSSQL$ECSQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation) S3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2010-07-10] (Creative Labs) [File not signed] R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\STacSV64.exe [244736 2010-01-20] (IDT, Inc.) R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe [3417088 2009-07-17] (Dell Inc.) [File not signed] S2 !SASCORE; "C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116480 2012-12-28] (AVM Berlin) S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT) S3 dwVSCD; C:\Windows\System32\DRIVERS\dwvscd.sys [11904 2009-12-14] (Danware Data A/S) R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.) R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.) S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] () [File not signed] S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-07-29] () [File not signed] S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] () [File not signed] S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-07-29] () [File not signed] S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-07-18] () [File not signed] S2 Hardlock; C:\Windows\SysWOW64\drivers\hardlock.sys [676864 2004-07-14] (Aladdin Knowledge Systems) [File not signed] R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-01-13] (Kaspersky Lab ZAO) S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-03-20] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-03-20] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-02-17] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-01-13] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-30] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-09-07] (CACE Technologies) R3 pppop; C:\Windows\System32\DRIVERS\pppop64.sys [42528 2009-07-21] (Fortinet Inc.) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-07-21] (Duplex Secure Ltd.) S3 ss_bserd; C:\Windows\System32\DRIVERS\ss_bserd.sys [128000 2012-06-27] (MCCI Corporation) S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2099-07-30 19:55 - 2099-07-30 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intergraph SmartSketch 2099-07-30 19:55 - 1999-08-05 07:59 - 00695392 _____ (ProtoView Development Corp.) C:\Windows\SysWOW64\pvdt60.ocx 2099-07-30 19:55 - 1999-03-26 18:10 - 00061704 _____ () C:\Windows\system\igransbi.ttf 2099-07-30 19:55 - 1999-03-26 18:10 - 00060112 _____ () C:\Windows\system\igransi.ttf 2099-07-30 19:55 - 1999-03-26 18:10 - 00058260 _____ () C:\Windows\system\igrisobi.ttf 2099-07-30 19:55 - 1999-03-26 18:10 - 00057980 _____ () C:\Windows\system\igrisoi.ttf 2099-07-30 19:55 - 1999-03-26 18:10 - 00055812 _____ () C:\Windows\system\igransbd.ttf 2099-07-30 19:55 - 1999-03-26 18:10 - 00054992 _____ () C:\Windows\system\igrans.ttf 2099-07-30 19:55 - 1999-03-26 18:10 - 00052824 _____ () C:\Windows\system\igrisobd.ttf 2099-07-30 19:55 - 1999-03-26 18:10 - 00052276 _____ () C:\Windows\system\igriso.ttf 2099-07-30 19:55 - 1998-12-08 10:31 - 00198456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCI32.OCX 2099-07-30 19:55 - 1998-08-19 15:24 - 01124864 _____ (Home Page Software Inc. -- webster@homepagesw.com) C:\Windows\SysWOW64\WebPro32.OCX 2099-07-30 19:55 - 1997-12-23 10:23 - 00051304 _____ () C:\Windows\system\igrmeci2.ttf 2099-07-30 19:55 - 1997-12-23 10:22 - 00056896 _____ () C:\Windows\system\igrmeci1.ttf 2099-07-30 19:55 - 1997-12-23 10:22 - 00051292 _____ () C:\Windows\system\igrmeca2.ttf 2099-07-30 19:55 - 1997-12-23 10:21 - 00061428 _____ () C:\Windows\system\igrmeca1.ttf 2099-07-30 19:55 - 1997-07-19 16:00 - 00227600 _____ (Microsoft) C:\Windows\SysWOW64\MSFLXGRD.OCX 2099-07-30 19:55 - 1997-07-19 16:00 - 00155920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COMCT232.OCX 2099-07-30 19:55 - 1997-07-19 15:55 - 01347344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVBVM50.DLL 2099-07-30 19:55 - 1997-07-19 15:01 - 00192784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TABCTL32.OCX 2099-07-30 19:55 - 1996-05-21 07:02 - 00050156 _____ () C:\Windows\system\IGRFT30B.TTF 2099-07-30 19:55 - 1996-05-21 07:02 - 00050084 _____ () C:\Windows\system\IGRFT30.TTF 2099-07-30 19:55 - 1996-04-08 18:14 - 00022104 _____ () C:\Windows\system\IGRARCHB.TTF 2099-07-30 19:55 - 1996-04-08 18:14 - 00021948 _____ () C:\Windows\system\IGRARCH.TTF 2099-07-30 19:55 - 1996-01-24 00:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ven2232.olb 2099-07-30 19:54 - 2099-07-30 19:55 - 00000000 ____D () C:\Program Files (x86)\SmartSketch 2014-07-30 18:29 - 2014-07-30 18:29 - 00035044 _____ () C:\Users\Manfred\Downloads\FRST.txt 2014-07-30 18:25 - 2014-07-30 18:25 - 00001838 _____ () C:\Users\Manfred\Desktop\JRT.txt 2014-07-30 18:14 - 2014-07-30 18:14 - 01016261 _____ (Thisisu) C:\Users\Manfred\Downloads\JRT.exe 2014-07-30 18:14 - 2014-07-30 18:14 - 00000000 ____D () C:\Windows\ERUNT 2014-07-30 18:03 - 2014-07-30 18:03 - 00007905 _____ () C:\Users\Manfred\Desktop\AdwCleaner[S0].txt 2014-07-30 17:51 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-07-30 17:50 - 2014-07-30 17:55 - 00000000 ____D () C:\AdwCleaner 2014-07-30 17:49 - 2014-07-30 17:49 - 01365525 _____ () C:\Users\Manfred\Downloads\adwcleaner_3.301.exe 2014-07-30 17:46 - 2014-07-30 17:46 - 00003421 _____ () C:\Users\Manfred\Desktop\mbam.txt 2014-07-29 13:55 - 2014-07-29 13:55 - 00034703 _____ () C:\ComboFix.txt 2014-07-29 13:44 - 2014-07-29 13:56 - 00000000 ____D () C:\ComboFix 2014-07-29 13:44 - 2014-07-29 13:55 - 00000000 ____D () C:\Qoobox 2014-07-29 13:44 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-07-29 13:44 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-07-29 13:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-07-29 13:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-07-29 13:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-07-29 13:44 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-07-29 13:44 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-07-29 13:44 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-07-29 13:43 - 2014-07-29 13:54 - 00000000 ____D () C:\Windows\erdnt 2014-07-29 13:40 - 2014-07-29 13:40 - 05563986 _____ (Swearware) C:\Users\Manfred\Downloads\ComboFix.exe 2014-07-29 11:22 - 2014-07-29 11:22 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\e-Government 2014-07-28 21:01 - 2014-07-28 21:01 - 00004602 _____ () C:\Users\Manfred\Desktop\GMER.log 2014-07-28 20:59 - 2014-07-28 21:00 - 00380416 _____ () C:\Users\Manfred\Downloads\kcj83i3n.exe 2014-07-28 20:41 - 2014-07-28 20:43 - 00090521 _____ () C:\Users\Manfred\Desktop\Addition.txt 2014-07-28 20:41 - 2014-07-28 20:43 - 00074376 _____ () C:\Users\Manfred\Desktop\FRST1.txt 2014-07-28 20:40 - 2014-07-30 18:29 - 00000000 ____D () C:\FRST 2014-07-28 20:40 - 2014-07-28 20:40 - 02093568 _____ (Farbar) C:\Users\Manfred\Downloads\FRST64.exe 2014-07-28 20:30 - 2014-07-28 20:30 - 00050477 _____ () C:\Users\Manfred\Downloads\Defogger.exe 2014-07-28 20:30 - 2014-07-28 20:30 - 00000656 _____ () C:\Users\Manfred\Desktop\defogger_disable.log 2014-07-28 20:30 - 2014-07-28 20:30 - 00000188 _____ () C:\Users\Manfred\defogger_reenable 2014-07-28 19:55 - 2014-07-28 19:55 - 00003421 _____ () C:\Users\Manfred\Desktop\mbam 28-07.txt 2014-07-28 19:36 - 2014-07-30 18:00 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-07-28 19:35 - 2014-07-28 19:35 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-07-28 19:35 - 2014-07-28 19:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-07-28 19:35 - 2014-07-28 19:35 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-07-28 19:35 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-07-28 19:35 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-07-28 19:35 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-07-28 19:08 - 2014-07-28 19:08 - 00000000 ____D () C:\Program Files (x86)\DLLSuite 2014-07-28 15:47 - 2014-07-28 18:33 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\DivX 2014-07-28 15:47 - 2014-07-28 15:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Sunbird 2014-07-28 15:43 - 2014-07-28 20:07 - 00000000 ____D () C:\ProgramData\DivX 2014-07-25 19:27 - 2014-07-25 19:27 - 00000000 ____D () C:\Users\Manfred\AppData\Local\Logishrd 2014-07-25 19:26 - 2014-07-28 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech 2014-07-25 19:26 - 2014-07-28 18:31 - 00000000 ____D () C:\ProgramData\Logishrd 2014-07-25 19:25 - 2014-07-28 18:31 - 00000000 ____D () C:\Program Files\Common Files\Logishrd 2014-07-22 19:05 - 2014-07-28 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winsent Messenger 2014-07-22 19:05 - 2014-07-28 18:33 - 00000000 ____D () C:\Program Files (x86)\Winsent Messenger 2014-07-22 19:05 - 2014-07-22 19:17 - 00000000 ____D () C:\ProgramData\Winsent Messenger 2014-07-22 19:05 - 2014-07-22 19:05 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\WinSent Messenger 2014-07-21 16:46 - 2014-07-28 18:33 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-07-21 16:43 - 2014-07-28 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Storm Entertainment 2014-07-21 16:43 - 2014-07-21 16:43 - 00001976 _____ () C:\Users\Public\Desktop\Ghost Recon.lnk 2014-07-21 16:40 - 2014-07-28 18:31 - 00000000 ____D () C:\Program Files (x86)\Red Storm Entertainment 2014-07-19 19:45 - 2014-07-19 19:45 - 00004623 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-19 19:45 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-19 19:45 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-19 19:45 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-19 19:45 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-19 13:30 - 2014-06-30 14:00 - 00001184 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BroadWave Audio Streaming Server.lnk 2014-07-19 13:11 - 2014-07-19 13:11 - 00000000 ____D () C:\ProgramData\NCH Swift Sound 2014-07-19 13:03 - 2014-07-19 19:09 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\uTorrent 2014-07-16 20:43 - 2014-07-11 19:53 - 00001172 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BroadCam Video Streaming Server.lnk 2014-07-11 19:53 - 2014-07-28 18:34 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite 2014-07-11 19:53 - 2014-07-11 19:53 - 00001160 _____ () C:\Users\Public\Desktop\BroadCam Video Streaming Server.lnk 2014-07-10 18:20 - 2014-06-20 21:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-07-10 18:20 - 2014-06-20 20:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-07-10 18:20 - 2014-06-19 02:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-07-10 18:20 - 2014-06-19 02:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-07-10 18:20 - 2014-06-19 02:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-07-10 18:20 - 2014-06-19 01:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-07-10 18:20 - 2014-06-19 01:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-07-10 18:20 - 2014-06-19 01:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-07-10 18:20 - 2014-06-19 01:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-07-10 18:20 - 2014-06-19 01:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-07-10 18:20 - 2014-06-19 01:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-07-10 18:20 - 2014-06-19 01:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-07-10 18:20 - 2014-06-19 01:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-07-10 18:20 - 2014-06-19 01:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-07-10 18:20 - 2014-06-19 01:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-07-10 18:20 - 2014-06-19 01:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-07-10 18:20 - 2014-06-19 01:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-07-10 18:20 - 2014-06-19 01:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-07-10 18:20 - 2014-06-19 01:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-07-10 18:20 - 2014-06-19 00:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-07-10 18:20 - 2014-06-19 00:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-07-10 18:20 - 2014-06-19 00:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-07-10 18:20 - 2014-06-19 00:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-07-10 18:20 - 2014-06-19 00:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-07-10 18:20 - 2014-06-19 00:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-07-10 18:20 - 2014-06-19 00:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-07-10 18:20 - 2014-06-19 00:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-07-10 18:20 - 2014-06-19 00:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-07-10 18:20 - 2014-06-19 00:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-07-10 18:20 - 2014-06-19 00:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-07-10 18:20 - 2014-06-19 00:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-07-10 18:20 - 2014-06-19 00:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-07-10 18:20 - 2014-06-19 00:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-07-10 18:20 - 2014-06-19 00:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-07-10 18:20 - 2014-06-19 00:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-07-10 18:20 - 2014-06-19 00:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-07-10 18:20 - 2014-06-19 00:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-07-10 18:20 - 2014-06-19 00:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-07-10 18:20 - 2014-06-19 00:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-07-10 18:20 - 2014-06-19 00:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-07-10 18:20 - 2014-06-19 00:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-07-10 18:20 - 2014-06-19 00:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-07-10 18:20 - 2014-06-18 23:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-07-10 18:20 - 2014-06-18 23:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-07-10 18:20 - 2014-06-18 23:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-07-10 18:20 - 2014-06-18 23:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-07-10 18:20 - 2014-06-18 23:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-07-10 18:20 - 2014-06-18 23:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-07-10 18:20 - 2014-06-18 23:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-07-10 18:20 - 2014-06-18 23:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-07-10 18:20 - 2014-06-18 23:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-07-10 18:20 - 2014-06-18 23:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-07-10 18:20 - 2014-06-18 23:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-07-10 18:20 - 2014-06-18 23:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-07-10 18:20 - 2014-06-18 23:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-07-10 18:20 - 2014-06-18 23:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-07-10 18:20 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe 2014-07-10 18:20 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe 2014-07-10 18:20 - 2014-06-18 02:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-07-10 18:20 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-07-10 18:20 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-07-10 18:20 - 2014-05-30 09:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-07-10 18:20 - 2014-05-30 09:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-07-10 18:20 - 2014-05-30 09:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-07-10 18:20 - 2014-05-30 09:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-07-10 18:20 - 2014-05-30 09:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-07-10 18:20 - 2014-05-30 09:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-07-10 18:20 - 2014-05-30 09:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-07-10 18:20 - 2014-05-30 08:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-07-10 18:20 - 2014-05-30 08:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-07-10 18:20 - 2014-05-30 08:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-07-10 18:20 - 2014-05-30 08:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-07-10 18:20 - 2014-05-30 08:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-07-10 18:20 - 2014-05-30 08:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-07-10 18:20 - 2014-05-30 08:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-07-10 18:20 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2014-07-10 18:18 - 2014-06-05 15:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-07-10 18:18 - 2014-06-05 15:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-07-10 18:18 - 2014-06-05 15:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-07-08 18:01 - 2014-07-28 18:33 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No-IP DUC 2014-06-30 18:48 - 2014-06-30 18:48 - 00001545 _____ () C:\Users\Manfred\Desktop\UltraVNC.lnk 2014-06-30 18:34 - 2014-06-30 18:34 - 00000000 ____D () C:\Program Files\uvnc bvba 2014-06-30 14:00 - 2014-07-28 18:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite 2014-06-30 14:00 - 2014-07-19 19:09 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software 2014-06-30 14:00 - 2014-07-19 19:09 - 00000000 ____D () C:\ProgramData\NCH Software 2014-06-30 14:00 - 2014-07-19 19:09 - 00000000 ____D () C:\Program Files (x86)\NCH Software 2014-06-30 14:00 - 2014-06-30 14:00 - 00001172 _____ () C:\Users\Public\Desktop\BroadWave Audio Streaming Server.lnk 2014-06-30 12:45 - 2014-06-30 12:46 - 00000000 ____D () C:\Users\Manfred\.yawcam 2014-06-30 12:45 - 2014-06-30 12:45 - 00001869 _____ () C:\Users\Manfred\Desktop\Yawcam.lnk 2014-06-30 12:45 - 2014-06-30 12:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yawcam 2014-06-30 12:45 - 2014-06-30 12:45 - 00000000 ____D () C:\Program Files (x86)\Yawcam 2014-06-30 12:16 - 2014-07-28 18:41 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\AbelCam 2014-06-30 12:15 - 2014-06-30 12:15 - 00000000 ____D () C:\Users\Manfred\AppData\Local\IsolatedStorage 2014-06-30 12:13 - 2014-06-30 12:20 - 00000000 ____D () C:\ProgramData\Seiz System Engineering 2014-06-30 12:01 - 2014-06-30 12:01 - 00000000 ____D () C:\ProgramData\webcamXP 5 2014-06-30 11:28 - 2014-06-30 11:29 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\TightVNC 2014-06-30 11:28 - 2014-06-30 11:28 - 00000000 ____D () C:\Users\Manfred\showmypc ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2099-07-30 19:55 - 2099-07-30 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intergraph SmartSketch 2099-07-30 19:55 - 2099-07-30 19:54 - 00000000 ____D () C:\Program Files (x86)\SmartSketch 2099-07-30 19:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system 2014-07-30 18:29 - 2014-07-30 18:29 - 00035044 _____ () C:\Users\Manfred\Downloads\FRST.txt 2014-07-30 18:29 - 2014-07-28 20:40 - 00000000 ____D () C:\FRST 2014-07-30 18:28 - 2011-07-29 21:50 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\NetSpeedMonitor 2014-07-30 18:25 - 2014-07-30 18:25 - 00001838 _____ () C:\Users\Manfred\Desktop\JRT.txt 2014-07-30 18:25 - 2012-04-09 09:53 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-07-30 18:25 - 2012-03-25 14:20 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-30 18:19 - 2011-02-04 18:30 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4023297661-2550031368-3471815440-1001UA.job 2014-07-30 18:14 - 2014-07-30 18:14 - 01016261 _____ (Thisisu) C:\Users\Manfred\Downloads\JRT.exe 2014-07-30 18:14 - 2014-07-30 18:14 - 00000000 ____D () C:\Windows\ERUNT 2014-07-30 18:06 - 2009-07-14 05:45 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-07-30 18:06 - 2009-07-14 05:45 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-07-30 18:03 - 2014-07-30 18:03 - 00007905 _____ () C:\Users\Manfred\Desktop\AdwCleaner[S0].txt 2014-07-30 18:00 - 2014-07-28 19:36 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-07-30 18:00 - 2014-02-23 10:40 - 00000000 ___RD () C:\Users\Manfred\OneDrive 2014-07-30 18:00 - 2010-07-21 13:25 - 00284588 _____ () C:\ProgramData\dlecscan.log 2014-07-30 17:59 - 2014-02-02 14:24 - 00000434 _____ () C:\Windows\system32\Drivers\etc\hosts.ics 2014-07-30 17:59 - 2014-01-13 18:32 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2014-07-30 17:59 - 2010-07-10 08:32 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks 2014-07-30 17:59 - 2010-07-10 08:32 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks 2014-07-30 17:59 - 2010-07-10 08:09 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup 2014-07-30 17:58 - 2012-03-25 14:20 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-30 17:58 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-07-30 17:57 - 2009-07-14 05:51 - 00133992 _____ () C:\Windows\setupact.log 2014-07-30 17:56 - 2010-07-10 00:53 - 00404390 _____ () C:\Windows\PFRO.log 2014-07-30 17:55 - 2014-07-30 17:50 - 00000000 ____D () C:\AdwCleaner 2014-07-30 17:55 - 2009-07-14 06:10 - 01225739 _____ () C:\Windows\WindowsUpdate.log 2014-07-30 17:49 - 2014-07-30 17:49 - 01365525 _____ () C:\Users\Manfred\Downloads\adwcleaner_3.301.exe 2014-07-30 17:46 - 2014-07-30 17:46 - 00003421 _____ () C:\Users\Manfred\Desktop\mbam.txt 2014-07-30 17:02 - 2012-04-08 21:05 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{35D87AED-7CD7-4FF8-B08C-1716353DE11E} 2014-07-30 10:44 - 2010-07-26 09:59 - 00000000 ____D () C:\Users\Manfred\AppData\Local\Apps\2.0 2014-07-30 10:41 - 2014-05-12 18:53 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask 2014-07-30 10:22 - 2014-06-18 19:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-07-30 07:05 - 2011-07-24 18:12 - 00000936 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4023297661-2550031368-3471815440-1001UA.job 2014-07-29 21:38 - 2012-04-27 20:18 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Skype 2014-07-29 19:19 - 2011-02-04 18:30 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4023297661-2550031368-3471815440-1001Core.job 2014-07-29 16:05 - 2011-07-24 18:12 - 00000914 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4023297661-2550031368-3471815440-1001Core.job 2014-07-29 13:56 - 2014-07-29 13:44 - 00000000 ____D () C:\ComboFix 2014-07-29 13:55 - 2014-07-29 13:55 - 00034703 _____ () C:\ComboFix.txt 2014-07-29 13:55 - 2014-07-29 13:44 - 00000000 ____D () C:\Qoobox 2014-07-29 13:55 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-07-29 13:54 - 2014-07-29 13:43 - 00000000 ____D () C:\Windows\erdnt 2014-07-29 13:53 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2014-07-29 13:52 - 2010-07-21 17:04 - 00000000 ____D () C:\Users\Manfred\AppData\Local\Adobe 2014-07-29 13:40 - 2014-07-29 13:40 - 05563986 _____ (Swearware) C:\Users\Manfred\Downloads\ComboFix.exe 2014-07-29 11:22 - 2014-07-29 11:22 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\e-Government 2014-07-29 11:22 - 2012-11-02 11:18 - 00002253 _____ () C:\Users\Manfred\Desktop\MOCCA Webstart.lnk 2014-07-29 10:21 - 2010-07-21 19:01 - 00002360 ____H () C:\Users\Manfred\Documents\Default.rdp 2014-07-28 21:01 - 2014-07-28 21:01 - 00004602 _____ () C:\Users\Manfred\Desktop\GMER.log 2014-07-28 21:00 - 2014-07-28 20:59 - 00380416 _____ () C:\Users\Manfred\Downloads\kcj83i3n.exe 2014-07-28 20:43 - 2014-07-28 20:41 - 00090521 _____ () C:\Users\Manfred\Desktop\Addition.txt 2014-07-28 20:43 - 2014-07-28 20:41 - 00074376 _____ () C:\Users\Manfred\Desktop\FRST1.txt 2014-07-28 20:40 - 2014-07-28 20:40 - 02093568 _____ (Farbar) C:\Users\Manfred\Downloads\FRST64.exe 2014-07-28 20:30 - 2014-07-28 20:30 - 00050477 _____ () C:\Users\Manfred\Downloads\Defogger.exe 2014-07-28 20:30 - 2014-07-28 20:30 - 00000656 _____ () C:\Users\Manfred\Desktop\defogger_disable.log 2014-07-28 20:30 - 2014-07-28 20:30 - 00000188 _____ () C:\Users\Manfred\defogger_reenable 2014-07-28 20:30 - 2010-07-21 13:05 - 00000000 ____D () C:\Users\Manfred 2014-07-28 20:16 - 2010-12-12 11:50 - 00000000 ____D () C:\Program Files (x86)\UltraVNC 2014-07-28 20:14 - 2011-07-18 14:02 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared 2014-07-28 20:14 - 2011-07-18 14:02 - 00000000 ____D () C:\Program Files\Autodesk 2014-07-28 20:14 - 2011-07-18 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk 2014-07-28 20:14 - 2011-07-17 10:53 - 00000000 ____D () C:\ProgramData\Autodesk 2014-07-28 20:07 - 2014-07-28 15:43 - 00000000 ____D () C:\ProgramData\DivX 2014-07-28 19:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Help 2014-07-28 19:55 - 2014-07-28 19:55 - 00003421 _____ () C:\Users\Manfred\Desktop\mbam 28-07.txt 2014-07-28 19:35 - 2014-07-28 19:35 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-07-28 19:35 - 2014-07-28 19:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-07-28 19:35 - 2014-07-28 19:35 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-07-28 19:35 - 2012-10-10 18:17 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-07-28 19:08 - 2014-07-28 19:08 - 00000000 ____D () C:\Program Files (x86)\DLLSuite 2014-07-28 18:41 - 2014-06-30 12:16 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\AbelCam 2014-07-28 18:34 - 2014-07-11 19:53 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite 2014-07-28 18:34 - 2014-06-30 14:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite 2014-07-28 18:33 - 2014-07-28 15:47 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\DivX 2014-07-28 18:33 - 2014-07-25 19:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech 2014-07-28 18:33 - 2014-07-22 19:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winsent Messenger 2014-07-28 18:33 - 2014-07-22 19:05 - 00000000 ____D () C:\Program Files (x86)\Winsent Messenger 2014-07-28 18:33 - 2014-07-21 16:46 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-07-28 18:33 - 2014-07-21 16:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Storm Entertainment 2014-07-28 18:33 - 2014-07-08 18:01 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No-IP DUC 2014-07-28 18:33 - 2013-07-28 18:12 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\GHISLER 2014-07-28 18:33 - 2013-03-13 22:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-07-28 18:33 - 2013-03-13 22:17 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-07-28 18:33 - 2013-03-13 22:17 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-07-28 18:33 - 2012-03-16 17:41 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-07-28 18:33 - 2011-11-10 18:20 - 00000000 ____D () C:\Users\Manfred\AppData\Local\Akamai 2014-07-28 18:33 - 2011-07-17 12:05 - 00000000 ____D () C:\Users\Administrator 2014-07-28 18:33 - 2010-11-17 19:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client 2014-07-28 18:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-07-28 18:32 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration 2014-07-28 18:31 - 2014-07-25 19:26 - 00000000 ____D () C:\ProgramData\Logishrd 2014-07-28 18:31 - 2014-07-25 19:25 - 00000000 ____D () C:\Program Files\Common Files\Logishrd 2014-07-28 18:31 - 2014-07-21 16:40 - 00000000 ____D () C:\Program Files (x86)\Red Storm Entertainment 2014-07-28 18:31 - 2012-01-05 10:28 - 00000000 ____D () C:\Program Files\Logitech 2014-07-28 18:31 - 2010-07-10 08:11 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-07-28 18:30 - 2010-07-10 08:05 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-07-28 18:18 - 2011-11-25 16:34 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\Logishrd 2014-07-28 18:17 - 2012-01-05 10:28 - 00000000 ____D () C:\ProgramData\Logitech 2014-07-28 15:47 - 2014-07-28 15:47 - 00000000 ____D () C:\Program Files (x86)\Mozilla Sunbird 2014-07-28 15:47 - 2014-02-05 21:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2014-07-27 21:30 - 2011-02-13 16:08 - 00152879 _____ () C:\Users\Manfred\Documents\backup.log 2014-07-27 21:28 - 2009-07-14 18:58 - 00749350 _____ () C:\Windows\system32\perfh007.dat 2014-07-27 21:28 - 2009-07-14 18:58 - 00169014 _____ () C:\Windows\system32\perfc007.dat 2014-07-27 21:28 - 2009-07-14 06:13 - 01756482 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-07-27 13:07 - 2014-06-07 11:54 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\TS3Client 2014-07-25 19:27 - 2014-07-25 19:27 - 00000000 ____D () C:\Users\Manfred\AppData\Local\Logishrd 2014-07-25 19:27 - 2011-11-25 16:41 - 00000474 _____ () C:\Windows\LkmdfCoInst.log 2014-07-25 19:27 - 2011-11-25 16:40 - 00034744 _____ () C:\Windows\LDPINST.LOG 2014-07-25 19:26 - 2011-11-25 16:41 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys 2014-07-24 18:07 - 2010-07-21 19:45 - 00124416 ___SH () C:\Users\Manfred\Thumbs.db 2014-07-23 22:56 - 2011-01-26 20:14 - 00000000 ____D () C:\Temp 2014-07-23 13:17 - 2011-06-09 20:38 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\UltraVNC 2014-07-22 19:17 - 2014-07-22 19:05 - 00000000 ____D () C:\ProgramData\Winsent Messenger 2014-07-22 19:05 - 2014-07-22 19:05 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\WinSent Messenger 2014-07-22 11:40 - 2011-07-17 12:32 - 00001726 _____ () C:\Users\Manfred\Desktop\CDBurnerXP.lnk 2014-07-21 16:43 - 2014-07-21 16:43 - 00001976 _____ () C:\Users\Public\Desktop\Ghost Recon.lnk 2014-07-20 14:22 - 2012-03-16 17:41 - 00002334 _____ () C:\Users\Manfred\Desktop\Google Chrome.lnk 2014-07-19 19:48 - 2014-02-17 20:59 - 00001578 _____ () C:\Windows\system32\TeamViewer9_Hooks.log 2014-07-19 19:48 - 2013-12-22 20:35 - 00001104 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk 2014-07-19 19:48 - 2013-12-22 20:35 - 00001092 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk 2014-07-19 19:46 - 2013-10-19 19:04 - 00000000 ____D () C:\ProgramData\Oracle 2014-07-19 19:45 - 2014-07-19 19:45 - 00004623 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-19 19:45 - 2010-07-10 08:02 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-19 19:09 - 2014-07-19 13:03 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\uTorrent 2014-07-19 19:09 - 2014-06-30 14:00 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software 2014-07-19 19:09 - 2014-06-30 14:00 - 00000000 ____D () C:\ProgramData\NCH Software 2014-07-19 19:09 - 2014-06-30 14:00 - 00000000 ____D () C:\Program Files (x86)\NCH Software 2014-07-19 19:09 - 2012-09-09 16:46 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client 2014-07-19 19:09 - 2010-07-21 21:38 - 00000000 ____D () C:\ProgramData\FLEXnet 2014-07-19 13:11 - 2014-07-19 13:11 - 00000000 ____D () C:\ProgramData\NCH Swift Sound 2014-07-19 12:59 - 2010-07-22 11:24 - 00000600 _____ () C:\Users\Manfred\PUTTY.RND 2014-07-16 20:47 - 2010-11-17 19:15 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\FileZilla 2014-07-16 20:32 - 2012-10-20 09:21 - 00000000 ____D () C:\_OTL 2014-07-16 19:22 - 2010-11-20 20:40 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\PCDr 2014-07-11 19:53 - 2014-07-16 20:43 - 00001172 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BroadCam Video Streaming Server.lnk 2014-07-11 19:53 - 2014-07-11 19:53 - 00001160 _____ () C:\Users\Public\Desktop\BroadCam Video Streaming Server.lnk 2014-07-11 18:48 - 2009-07-14 05:45 - 00552456 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-07-11 03:02 - 2014-07-19 19:45 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-11 02:56 - 2014-07-19 19:45 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-11 02:56 - 2014-07-19 19:45 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-11 02:55 - 2014-07-19 19:45 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-10 20:56 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-10 20:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2014-07-10 20:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism 2014-07-10 18:26 - 2013-07-21 19:24 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-10 18:25 - 2012-04-09 09:53 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-10 18:25 - 2012-04-09 09:53 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-10 18:25 - 2011-05-19 18:15 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-10 18:23 - 2010-07-24 09:19 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-07-08 18:01 - 2013-10-02 17:55 - 00000000 ____D () C:\Program Files (x86)\No-IP 2014-07-05 19:28 - 2013-11-01 22:37 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\vlc 2014-06-30 18:48 - 2014-06-30 18:48 - 00001545 _____ () C:\Users\Manfred\Desktop\UltraVNC.lnk 2014-06-30 18:34 - 2014-06-30 18:34 - 00000000 ____D () C:\Program Files\uvnc bvba 2014-06-30 14:00 - 2014-07-19 13:30 - 00001184 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BroadWave Audio Streaming Server.lnk 2014-06-30 14:00 - 2014-06-30 14:00 - 00001172 _____ () C:\Users\Public\Desktop\BroadWave Audio Streaming Server.lnk 2014-06-30 12:46 - 2014-06-30 12:45 - 00000000 ____D () C:\Users\Manfred\.yawcam 2014-06-30 12:45 - 2014-06-30 12:45 - 00001869 _____ () C:\Users\Manfred\Desktop\Yawcam.lnk 2014-06-30 12:45 - 2014-06-30 12:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yawcam 2014-06-30 12:45 - 2014-06-30 12:45 - 00000000 ____D () C:\Program Files (x86)\Yawcam 2014-06-30 12:20 - 2014-06-30 12:13 - 00000000 ____D () C:\ProgramData\Seiz System Engineering 2014-06-30 12:15 - 2014-06-30 12:15 - 00000000 ____D () C:\Users\Manfred\AppData\Local\IsolatedStorage 2014-06-30 12:01 - 2014-06-30 12:01 - 00000000 ____D () C:\ProgramData\webcamXP 5 2014-06-30 11:29 - 2014-06-30 11:28 - 00000000 ____D () C:\Users\Manfred\AppData\Roaming\TightVNC 2014-06-30 11:28 - 2014-06-30 11:28 - 00000000 ____D () C:\Users\Manfred\showmypc Some content of TEMP: ==================== C:\Users\Manfred\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-19 11:55 ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- |
| Themen zu Standard-Icons bei den Bibliotheken wurden durch andere ersetzt (Win7) |
| ebanking, newtab, pup.optional.dealply.a, pup.optional.expressfiles.a, pup.optional.quickshare.a, pup.optional.smartbar.a, pup.optional.sweetim, pup.optional.sweetim.a, pup.optional.sweetpacks.a, pup.optional.trolotunt.a, required, trojan.fakealert, trojan.fakealert.sa, win32/adware.yontoo.b, win32/bundled.toolbar.ask, win32/bundled.toolbar.google.c, win32/complitly.a, win32/downloadsponsor.a, win32/hiddenstart.a, win32/remoteadmin.remoteexec.aa, win32/sweetim.l, win32/toolbar.conduit, win32/toolbar.linkury.g |
Baum-Darstellung